search

Aragog

#Linux #Web #Wordpress #XXE

Tenten is an medium-rated Linux machine from HackTheBoxarrow-up-right created by egre55. In the current post, my IP is 10.10.14.76, and the target’s IP is 10.129.102.78

hashtag
Recon

Local Terminal
> ping -c 1 10.129.102.78

PING 10.129.102.78 (10.129.102.78) 56(84) bytes of data.
64 bytes from 10.129.102.78: icmp_seq=1 ttl=63 time=260 ms

--- 10.129.102.78 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 260.032/260.032/260.032/0.000 ms

The machine is alive, and by the TTL (close but no more than 64), it is possible to think that the target is a Linux Machine.

Local Terminal
nmap -p- --open -sS --min-rate 5000 -Pn -n -vvv 10.129.102.78 -oN AllPorts
Nmap scan report for 10.129.102.78
Host is up, received user-set (0.26s latency).
Scanned at 2023-09-14 11:22:03 -03 for 21s
Not shown: 65487 closed ports, 45 filtered ports
Reason: 65487 resets and 45 no-responses
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON
21/tcp open  ftp     syn-ack ttl 62
22/tcp open  ssh     syn-ack ttl 62
80/tcp open  http    syn-ack ttl 62

There are two open ports. First the port 22 with ssh, if you search about "OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 launchpad", we can see that the target is an "Ubuntu Xenial". And about the port 80, the web page, if you search "Apache httpd 2.4.18 launchpad", it confirms that is an Ubuntu Xenial.

Both are the same, so there is a significant reduced chance to find a Docker Container here.

The port 80 have a redirect, add the IP to the /etc/hosts and launch another nmap scan.

hashtag
Port 21 - FTP

Looks like an XML file with custom labels.

hashtag
Port 80

Nothing from whatweb, but now we know that has an Ubuntu Default Page

Yes... Ubuntu Default Page
From Wappalyzer, the site uses PHP

Stuck, there is nothing to do, so let's try a fuzzing process with html and php.

It's fixed, maybe it's related to the other file found, test.txt. There is a way to send files with POST, of course.

It reacts, let's see if we can see the output from an XXE.

And it works!! Additionally from the /etc/passwd we make a successful user enumeration, by searching who has /bin/bash available.

[+] root + florian + cliff

Or you can use:

hashtag
Exploitation

First, let's see the code of the current php file.

hashtag
Reverse Shell

It works!

hashtag
Privileges Escalation

There is nothing around here, let's try with pspy or with procmon at /tmp.

A

It e.

It

This place says XXE everywhere

First, upload an empty file to see how it reacts, with vi test.xml, the create the proper XML, with vi exploit.xml

Fails with test.xml
Works with exploit.xml

From here we got a lot of information. First, the output is visible, this means that is possible to execute an XXE, and second, there is an user called "roosa" at the system.

hashtag
Exploitation

Let's see if the exploits works, creating a file with vi exploit_proof.xml, then upload it.

Target's /etc/passwd

Perfect, it works, remember that with Ctrl+U (view:source) you can see in a better format the targeted file.

Now, time to exploit, upload exploit_exec.xml.

Unencrypted id_rsa

In many machines, this exploits fails, an alternative to these situation, because the target use php, is the use of wrappers, like "php://filter/convert.base64-encode/resource=/var/www/html/index.php" after SYSTEM.

hashtag
Reverse Shell - roosa

Perfect, we can read the id_rsa.

See the content of the "Cross-Site Scripting" exploit, it's the version 4.1.0, it should be that.

hashtag
Privileges Escalation

A lot of files, but there are two curious folder, deploy and work. Let's check work.

Good, there is git, in those cases is always a good practice to see the commits for old relevant information... ALWAYS! But first, let's see if there is another hidden file here.

A file with credentials?

Another id_rsa, go to home to check for more users.

Another way to see the user list with bash, is by reading the /etc/passwd file and check who has the "bash" available.

Many user to test the id_rsa, if is not the correct one, we should check the past-commits for mistakes.

Copy the authcredentials.keys as id_rsa to the tmp folder, then connect through ssh.

Return to the blogfeed folder with cd /home/roosa/work/blogfeed

"reverted accidental commit with proper key" looks like an interesting mistake, copy the commit code.

It shows a deleted id_rsa, copy the red one at /tmp and try to use it.

Color Sample

And it works, the machine is done.

PreviousMedium MachineNextBitlab

Last updated