search

πŸ“ŽStapler

Average beginner/intermediate VM, only a few twists

hashtag
1. Reconnaissance

Scanning the network to find vulnerable machine's IP

sudo arp-scan -l
Interface: enp0s3, type: EN10MB, MAC: 08:00:27:9c:9d:c8, IPv4: 192.168.10.25
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1	52:54:00:12:35:00	QEMU
192.168.10.2	52:54:00:12:35:00	QEMU
192.168.10.3	08:00:27:da:3d:d3	PCS Systemtechnik GmbH
192.168.10.42	08:00:27:8a:e0:f7	PCS Systemtechnik GmbH

  • We find the IP of the vulnerable machine to be 192.168.10.42

hashtag
2. Scanning

hashtag
2.1 Nmap

  • Using nmap to find the open ports and their services

nmsudo nmap -Pn -p- -sV -O 192.168.10.42
Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-25 18:57 IST
Nmap scan report for 192.168.10.42
Host is up (0.0011s latency).
Not shown: 65523 filtered tcp ports (no-response)
PORT      STATE  SERVICE     VERSION
20/tcp    closed ftp-data
21/tcp    open   ftp         vsftpd 2.0.8 or later
22/tcp    open   ssh         OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
53/tcp    open   domain      dnsmasq 2.75
80/tcp    open   http        PHP cli server 5.5 or later
123/tcp   closed ntp
137/tcp   closed netbios-ns
138/tcp   closed netbios-dgm
139/tcp   open   netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
666/tcp   open   doom?
3306/tcp  open   mysql       MySQL 5.7.12-0ubuntu1
12380/tcp open   http        Apache httpd 2.4.18 ((Ubuntu))
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port666-TCP:V=7.92%I=7%D=6/25%Time=62B70DB3%P=x86_64-pc-linux-gnu%r(NUL
SF:L,2D58,PK\x03\x04\x14\0\x02\0\x08\0d\x80\xc3Hp\xdf\x15\x81\xaa,\0\0\x1
SF:52\0\0\x0c\0\x1c\0message2\.jpgUT\t\0\x03\+\x9cQWJ\x9cQWux\x0b\0\x01\x0
SF:4\xf5\x01\0\0\x04\x14\0\0\0\xadz\x0bT\x13\xe7\xbe\xefP\x94\x88\x88A@\xa
SF:2\x20\x19\xabUT\xc4T\x11\xa9\x102>\x8a\xd4RDK\x15\x85Jj\xa9\"DL\[E\xa2\
SF:x0c\x19\x140<\xc4\xb4\xb5\xca\xaen\x89\x8a\x8aV\x11\x91W\xc5H\x20\x0f\x
SF:b2\xf7\xb6\x88\n\x82@%\x99d\xb7\xc8#;3\[\r_\xcddr\x87\xbd\xcf9\xf7\xaeu
SF:\xeeY\xeb\xdc\xb3oX\xacY\xf92\xf3e\xfe\xdf\xff\xff\xff=2\x9f\xf3\x99\xd
SF:3\x08y}\xb8a\xe3\x06\xc8\xc5\x05\x82>\xfe\x20\xa7\x05:\xb4y\xaf\xf8\xa
SF:0\xf8\xc0\^\xf1\x97sC\x97\xbd\x0b\xbd\xb7nc\xdc\xa4I\xd0\xc4\+j\xce\[\x
SF:87\xa0\xe5\x1b\xf7\xcc=,\xce\x9a\xbb\xeb\xeb\xdds\xbf\xde\xbd\xeb\x8b\x
SF:f4\xfdis\x0f\xeeM\?\xb0\xf4\x1f\xa3\xcceY\xfb\xbe\x98\x9b\xb6\xfb\xe0\x
SF:dc\]sS\xc5bQ\xfa\xee\xb7\xe7\xbc\x05AoA\x93\xfe9\xd3\x82\x7f\xcc\xe4\xd
SF:5\x1dx\xa2O\x0e\xdd\x994\x9c\xe7\xfe\x871\xb0N\xea\x1c\x80\xd63w\xf1\xa
SF:f\xbd&&q\xf9\x97i\x85fL\x81\xe2\\\xf6\xb9\xba\xcc\x80\xde\x9a\xe1\xe2:
SF:\xc3\xc5\xa9\x85\x08r\x99\xfc\xcf\x13\xa0\x7f{\xb9\xbc\xe5:i\xb2\x1bk\
SF:x8a\xfbT\x0f\xe6\x84\x06/\xe8-\x17W\xd7\xb7&\xb9N\x9e<\xb1\\\.\xb9\xcc\
SF:xe7\xd0\xa4\x19\x93\xbd\xdf\^\xbe\xd6\xcdg\xcb\.\xd6\xbc\xaf\|W\x1c\xfd
SF:\xf6\xe2\x94\xf9\xebj\xdbf~\xfc\x98x\xf4\xf3\xaf\x8f\xb9O\xf5\xe3\xcc\
SF:x9a\xed\xbfa\xd0\xa2\xc5KV\x86\xad\n\x7fou\xc4\xfa\xf7\xa37\xc4\|\xb0\
SF:xf1\xc3\x84O\xb6nK\xdc\xbe#\)\xf5\x8b\xdd{\xd2\xf6\xa6g\x1c8\x98u\(\[r\
SF:xf8H~A\xe1qYQq\xc9w\xa7\xbe\?}\xa6\xfc\x0f\?\x9c\xbdTy\xf9\xca\xd5\xaak
SF:\xd7\x7f\xbcSW\xdf\xd0\xd8\xf4\xd3\xddf\xb5F\xabk\xd7\xff\xe9\xcf\x7fy\
SF:xd2\xd5\xfd\xb4\xa7\xf7Y_\?n2\xff\xf5\xd7\xdf\x86\^\x0c\x8f\x90\x7f\x7f
SF:\xf9\xea\xb5m\x1c\xfc\xfef\"\.\x17\xc8\xf5\?B\xff\xbf\xc6\xc5,\x82\xcb\
SF:[\x93&\xb9NbM\xc4\xe5\xf2V\xf6\xc4\t3&M~{\xb9\x9b\xf7\xda-\xac\]_\xf9\x
SF:cc\[qt\x8a\xef\xbao/\xd6\xb6\xb9\xcf\x0f\xfd\x98\x98\xf9\xf9\xd7\x8f\xa
SF:7\xfa\xbd\xb3\x12_@N\x84\xf6\x8f\xc8\xfe{\x81\x1d\xfb\x1fE\xf6\x1f\x81\
SF:xfd\xef\xb8\xfa\xa1i\xae\.L\xf2\\g@\x08D\xbb\xbfp\xb5\xd4\xf4Ym\x0bI\x9
SF:6\x1e\xcb\x879-a\)T\x02\xc8\$\x14k\x08\xae\xfcZ\x90\xe6E\xcb<C\xcap\x8f
SF:\xd0\x8f\x9fu\x01\x8dvT\xf0\x9b\xe4ST%\x9f5\x95\xab\rSWb\xecN\xfb&\xf4
SF:\xed\xe3v\x13O\xb73A\xf0,\xd5\xc2\^\xe8\xfc\xc0\xa7\xaf\xab4\xcfC\xcd\
SF:x88\x8e}\xac\x15\xf6~\xc4R\x8ewT\x96\xa8KT\x1cam\xdb\x99f\xfb\n\xbc\xb
SF:cL}AJ\xe5H\x912\x88\(O\0k\xc9\xa9\x1a\x93\xb8\x84\x8fdN\xbf\x17\xf5\xf0
SF:\.npy\.9\x04\xcf\x14\x1d\x89Rr9\xe4\xd2\xae\x91#\xfbOg\xed\xf6\x15\x04\
SF:xf6~\xf1\]V\xdcBGu\xeb\xaa=\x8e\xef\xa4HU\x1e\x8f\x9f\x9bI\xf4\xb6GTQ\x
SF:f3\xe9\xe5\x8e\x0b\x14L\xb2\xda\x92\x12\xf3\x95\xa2\x1c\xb3\x13\*P\x11\
SF:?\xfb\xf3\xda\xcaDfv\x89\xa9\xe4k\xc4S\x0e\xd6P0);
MAC Address: 08:00:27:8A:E0:F7 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Host: RED; OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 119.53 seconds

  • We get open ports 21, 22, 53, 80, 139, 3306, 12380 with ftp with anonymous login, ssh, dns, http server, netbios, mysql and another http server running respectively.

hashtag
2.2 FTP

  • Since FTP has anonymous login, we can check it out first.

  • We get a file note.txt and a potential username, Harry

  • We can download the note to our local machine

  • Reading the note, we get two more potential usernames Elly and John. Could be useful for later.

hashtag
2.2 Http

  • Port 80 is a dead end. There is no useful information and directories there

  • Port 12380, however has a webpage

hashtag
2.3 Nikto

  • We can scan this webpage using nikto for any potential vulnerabilities or misconfigurations

  • We find a few interesting things here :

    • There is an SSL certificate, which means that there is a secure verion of the webpage

    • There is a robots.txt file which contains two directory entrie /admin112233 and /blogblog

    • There is also a /phpmyadmin directory.Make sense since there is an sql database running

  • Going over to /admin112233 via https, we find that we are redirected to xss-payloads.com

  • Going over to /blogblog, we find an internal blog

  • Scrolling down, we can see that it is a wordpress site

hashtag
2.4 WPScan

  • We can use WPScan to enumerate for potentialvulnerabilitiess as well as credentials to login to WordPress admin page.We can use the switch --disable-tls-checks to bypass the certificate check

  • We get a number of vulnerable plugins as well as a list of usernames

  • We can try brute forcing the passwords of any user for the login page starting with the first user, John

    This might take some time to brute force, so another way of solving the box is to exploit the LFI vulnerability in the WP plugin advanced-video-embed-embed-videos-or-playlists which can be found by running wpscan --url https://192.168.10.42:12380/blogblog -e ap --plugins-detection aggressive --disable-tls-checks

  • We get a login credential

john : incorrect

hashtag
3. Gaining Access

hashtag
3.1 PHP Reverse Shell

  • We can log in to https://192.168.10.42:12380/blogblog/wp-admin with the above credentials

  • We are greeted with an old version of WP admin panel

  • We can get a php reverse shell from pentestmonkeyarrow-up-right(Make sure to change the IP address to your local machine) and save it as rev.php

  • We can upload it from Plugins > Upload Plugin

  • Click on install now to upload it.

  • We can provide localhost as the hostname and anonymous as FTP login credentials

  • Start a netcat session to capture the reverse shell on port 1234

  • Navigate to https://192.168.10.42:12380/blogblog/wp-content/uploads/ and click on the uploaded rev.php to run the reverse shell

  • We get a shell

  • Stabilizing the shell

hashtag
4. Privilege escalation

hashtag
4.1 Linux exploit suggester

hashtag
4.2 Double-fdput exploit

  • There are a lot of exploit suggestions offered, but we are going to use [CVE-2016-4557] double-fdput(). There is the exploit link also provided with it, so we can directly download it to the system.

  • It is a zip file, unzipping it we get

  • The exploit is in exploit.tar, extracting it

  • Now we need to run compile.sh to compile doubleput.c

  • We get some errors, but after compilation, we get a file doubleput. Executing it will give us root

  • Reading the flag

PreviousSolid StateNextCTFs

Last updated