β™ŸοΈPWNLAB

Welcome to "PwnLab: init", a Boot2Root virtual machine. . The purpose of this CTF is to get root and read the flag.

1. Reconnaissance

  • Scanning the network to find vulnerable machine's IP

arp-scan -l 

Interface: enp0s3, type: EN10MB, MAC: 08:00:27:02:ad:e6, IPv4: 192.168.10.22
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1	52:54:00:12:35:00	QEMU
192.168.10.2	52:54:00:12:35:00	QEMU
192.168.10.3	08:00:27:ba:30:20	PCS Systemtechnik GmbH
192.168.10.14	08:00:27:94:3a:a6	PCS Systemtechnik GmbH

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 2.432 seconds (105.26 hosts/sec). 4 responded

  • We find the IP of the vulnerable machine to be 192.168.10.14

2. Scanning

2.1 Nmap

  • Using nmap to find the open ports and their services

  • We find open ports 22, 80, 111, 3306, 45450 with services ssh, rpcbind, mysql, and a virtual box running respectively.

2.2 Directory enumeration

  • Enumerating the web directories using gobuster

  • We find an interesting directory /upload

2.3 Vulnerability scanning

  • Enumerating vulnerable services using niko

  • We get a mention of /config.php file which could contain the database IDs and passwords

3. Initial Foothold

3.1 Local File Inclusion

  • Accessing the webpage, we see that there are three links that can be accessed : Home, Login, and Upload

  • As we access each of them we see that the url gets appended with /?page=name For eg: If we go to Login page, we see the url change from http://192.168.10.14 to http://192.168.10.14/?page=login and similarly for upload

  • This is a misconfiguration know as Local File Inclusion (LFI) and it allows an attacker to manipulate the target’s web server by including malicious files remotely or even access sensitive files present onto that server. You can read more about LFI here

  • When trying to access config.php directly by appending it to the url(http://192.168.10.14/?page=config) and also by adding a null byte (http://192.168.10.14/?page=config%00), does not yield any results

  • Then we try base64 encoding using a php wrapper: http://192.168.10.14/?page=php://filter/read=convert.base64-encode/resource=config, which gives us the base64 encode config.php page

  • Decoding it, we get the login credentials for the mysq database

3.2 Dumping credentials

  • Dumping the database using the credentials root : H4u%QJ_H99 obtained from the config.php file for possible usernames and/or password

  • We get 3 users kent, mike and kane and their base64 encode passwords

  • Decoding them, we get possible credentials for login in to the webpage and/or the box

    kent : JWzXuBJJNy mike : SIfdsTEn6I kane : iSv5Ym2GRo

  • Using any of the credentials, we can login to the web portal which will take you to the Upload page.

3.3 Reverse shell

  • Trying to upload a php-reverse-shell.php reverse shell from pentestmonkey (Make sure to change the IP and port)

  • We find that there are certain restricting in uploading files. It accept only images files

  • We can now rename .php extension of the reverse shell to .gif ; php-reverse-shell.gif

  • Also add the header GIF 98 at the start of the file to edit the magic byte (the first byte that identified the type of the file) to make it seem like a .gif file , from a text editor

  • Uploading the modified reverse shell, it goes through

  • we can find the uploaded file by going to /upload directory

  • Navigating to our uploaded GIF file, produces an error

  • There seems to be more filters in place

3.4 Filter Bypass

  • In order to find out how files are processed, we need the source code.

  • Getting index.php source from http://192.168.10.14/?page=php://filter/read=convert.base64-encode/resource=index and base64 decoding it

  • Here we see that, there is an attribute lang which, when passed to the cookie, can be used for multilingual support. As this function is not yet implemented, we need to set any other language manually through the cookie

  • There is an include() function, so there might be another possible LFI. It takes in a parameter of lang=anypath in the cookie value.

  • Capturing the upload file in burpsuit and modifying the cookie value to include the path of our uploaded reverse shell.

    • Cookie: lang=../upload/3208fd203ca8fdfa13bc98a4832c1396.gif

  • Burp Request :

  • Starting nc in the attacker system to capture the shell and forwarding the modified request in burp.

  • Stabilizing the shell

  • We are logged in as www-data

4. Privilege Escalation

4.1 SUID

  • We can try to switch users with the credentials obtained from the database.

  • We are able to switch to user kane with the credentials kane : iSv5Ym2GRo

  • sudo -l does not give any results as sudo is disabled in the box.

  • Using SUID bit to switch to other user. -> A file with SUID always executes as the user who owns the file, regardless of the user passing the command

  • find / -perm -04000 -type f -ls 2>/dev/null shows us the files with SUID bit set for the current user.

  • Files at /usr/bin and /usr/lib might not help us in privesc via SUID. There is another interesting file msgmike at /home/kane

  • Checking the file type using file

  • The file is an executable file.

  • Executing the file gives us an error

4.2 PATH Variable.

  • From the error shown above, we see that the executable is trying to read a file called msg.txt using the cat command.

    • In order to execute any Linux command, it checks the PATH variable for paths of the command. If the command is not found in the first location, it moves on to the next and so on. Read more about it here

  • Checking the PATH variable as well as the location of the cat command

  • We can see that the cat command is in the third location (/bin) of the PATH variable.

  • It checks the first two locations and moves on as it does not find the cat command there.

  • In order to exploit the PATH variable, we need to provide a pseudo cat command which can spawn a shell when called. And its path should be before the original path of the cat command in the PATH variable for it to get executed first.

  • Creating an executable file named cat in the current directory, which will spawn a bash shell.

  • Exporting the current directory path to the beginning of the PATH variable.

  • Now there is a cat command at the first location of the PATH variable, so it will get executed first when the command is called, and thus we get a shell as user mike.

  • We became the user mike because the owner of the file msgmike with SUID set was mike

4.3 Command Injection

  • We find another vulnerable executable at mike's home folder called msg2root with SUID set and owner root

  • Executing msg2root

  • It asks for some user input

  • Running strings on msg2root

  • We find that any command the user inputs is passed to the /bin/echo command and eventually, appended to that messages.txt.Here command injection is possible.

  • We can directly pass in the command ;/bin/sh to execute and spawn a shell as root we use ; to break out of the echo command.

  • We are ROOT

  • Viewing flag.txt

PreviousNodeNextSolid State

Last updated