Aratus TryHackMe Writeup

Scanning

We run nmap on all ports with scripts and software versions.

Enumeration

We list in the HTTP and HTTPS service the default page of Apache CentOS.

We continue reviewing the services, we continue with the FTP service, we see that it is possible to access with the "anonymous" credentials, we find a resource but there is nothing useful.

We continue reviewing the SMB service, we find a resource that catches our attention "temporary share", we try to see the permissions, but we cannot enumerate it with the "smbmap" tool.

But you should not be satisfied with what a tool can tell you, you have to check with other tools or manually. As you can see, the "enum4linux" tool tells us that we have read permissions on the Samba resource.

Exploitation

We connect with the "smbclient" tool and see the root path of a user, but we only have access to the "message-to-simeon.txt" file and the "chapter" folder listing.

We download and read the file "message-to-simeon.txt", we see that the user Theodore (looks like an administrator) is complaining that Simeon uses bad passwords and is a bit dirty with the files...

Coincidentally, enum4linux listed me 3 system users, so a third one called "automation" comes in.

It is time to examine the files in the "chapters" directories, it seems that all the files have the same size, this makes it a little difficult to enumerate different files... Or not? We can make use of the "find" command and list the last modified files, this works and only one comes out.

find . -printf "%T@ %Tc %p\n" | sort -n

We read the file "/chapter7/paragraph7.1/text2.txt" and find an encrypted SSH private key inside the file.

NOTE: To work more comfortably, I set up the SMB resource on my machine.

We use the tool "ssh2john" to obtain the hash of the password used, then we crack the hash with "john" and the dictionary "rockyou".

We access through the SSH service and with the private key, but we still do not have access to the "user.txt" file, so we will have to escalate to the "theodore" user.

For a moment I saw "the light", but it turned out to be a rabbit hole, so the password used in the ".htpasswd" file is not functional.

We launch the tool "linpeas.sh", it lists that we have permissions by "capabilities" of the tcpdump binary, so we would have the ability to sniff the network traffic.

We run "ip add", we see that we have two network interfaces "lo and eth0".

We ran tcpdump on "eth0", but found nothing, so I tried it on "lo" and we will run Wireshark on our computer.

Found credentials

We decode the trace to base64 and find the correct credentials of the user "theodore".

We use the credentials to authenticate as "theodore" and read the "user.txt" file.

Privilege Escalation

We execute "sudo -l", we see that we have permissions as the user "automation" to execute a script in Bash.

The script appears to run a series of "Yaml" files with the "ansible" binary.

Reviewing directories and files that follow the script, except for one file, it seems that the rest we do not have write permissions to insert malicious code and make a privilege escalation.

But watch out! There is a "+" in the permissions of the file "configure-RedHat.yml".

Indeed! We can edit the file! Reading a bit about privilege escalations in "ansible", it seems that it is simple, adding a line like "shell: command..." we can execute commands as the user that is predefined (in this case, as root).

We put a netcat listening on our attacker's machine and run the script with SUDO.

We wait for the remote connection, run our command list and read the flag from the "root.txt" file.

---

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Read More

Empline TryHackMe Writeup

Scanning

We run nmap on all ports with scripts and software versions.

Enumeration

We access website and review all zones of site.

We list a subdomain that appears to lead to an employee area.

We found deployed an Opencats with version 0.9.4.

We launch "dirsearch", we list a directory where it shows us a panel that we can access without authentication.

Deficient control panel to authorization control

Exploitation

We search exploits and found this notice: https://www.opencats.org/news/2019/july/

Create with python docx_

#!/usr/bin/env python
from docx import Document
document = Document()
paragraph = document.add_paragraph('m3n0sd0n4ld')
document.save('m3n0s.docx')

Create m3n0s.docx

Unzip the file and edit the "document.xml".

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<!DOCTYPE payload [<!ENTITY payload SYSTEM "/etc/passwd"> ]>

We insert the following line (in orange color) and modify the text to "&payload".

We see that the proof of concept works: .

So now we read the "config.php" file where the database credentials are stored (remember that we have access to the service on port 3306).

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<!DOCTYPE payload [<!ENTITY payload SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"> ]>
<data>&payload;</data>

We will get the content of the file in base64, so we decode and we will have the credentials in plain text.

Connect to the database

We select the table "users" and we will obtain the encrypted password of the user "george" (this one has a system user ;))

We use the "hashes.com" website to obtain the flat password through its hash.

Read user.txt flag

With the password in plain text, we connect through the SSH service and read the "user.txt" file.

Privilege Escalation

After an enumeration, "linpeas.sh" shows us that we have permissions with the "ruby" binary to modify the binary user due to a deficiency in capabilities.

We create a ruby file that we will use to modify the user of the file so we can edit it with our user.

file = File.new("/etc/passwd", "r")
file.chown(1002, 1002)

Edit the file "/etc/passwd" and create the user "m3n0sd0n4ld", add the password hash and give it the root suid and save the file.

We authenticate with the user "m3n0sd0n4ld", we see that we are root and we read the root.txt flag.

---

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Read More