Tenten is an medium-rated Linux machine from HackTheBox created by Iokori. In the current post, my IP is 10.10.14.76, and the target’s IP is 10.129.102.140
The machine is a good review of concepts, the recognition step is standard and involves fuzzing to find new attack vectors, but it is necessary to have a reliable tool to detect the target's technologies, like Wappalyzer.
Once the correct vector is found, you have to exploit an explicit XXE to extract relevant files and log in as roosa. By the other hand, Privilege Escalation is patience, searching for information from a git project and other important files to extract the public key.
Recon
Local Terminal
> ping -c 1 10.129.102.140
PING 10.129.102.140 (10.129.102.140) 56(84) bytes of data.
64 bytes from 10.129.102.140: icmp_seq=1 ttl=63 time=273 ms
--- 10.129.102.140 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 273.347/273.347/273.347/0.000 ms
The machine is alive, and by the TTL (close but no more than 64), it is possible to think that the target is a Linux Machine.
Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-13 16:24 -03
Warning: 10.129.102.140 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.102.140
Host is up (0.27s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
22/tcp open ssh
5000/tcp open upnp
Local Terminal
nmap -sCV -p 22,5000 10.129.102.140 -oN Target
Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-13 16:26 -03
Nmap scan report for 10.129.102.140
Host is up (0.26s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 42:90:e3:35:31:8d:8b:86:17:2a:fb:38:90:da:c4:95 (RSA)
| 256 b7:b6:dc:c4:4c:87:9b:75:2a:00:89:83:ed:b2:80:31 (ECDSA)
|_ 256 d5:2f:19:53:b2:8e:3a:4b:b3:dd:3c:1f:c0:37:0d:00 (ED25519)
5000/tcp open http Gunicorn 19.7.1
|_http-server-header: gunicorn/19.7.1
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
There are two open ports. First the port 22 with ssh, if you search about "OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 launchpad", we can see that the target is an "Ubuntu Xenial".
From here we got a lot of information. First, the output is visible, this means that is possible to execute an XXE, and second, there is an user called "roosa" at the system.
Exploitation
Let's see if the exploits works, creating a file with vi exploit_proof.xml, then upload it.
In many machines, this exploits fails, an alternative to these situation, because the target use php, is the use of wrappers, like "php://filter/convert.base64-encode/resource=/var/www/html/index.php" after SYSTEM.
roosa@devoops:~$ id
uid=1002(roosa) gid=1002(roosa) groups=1002(roosa),4(adm),27(sudo)
# group (adm), you can see the system's log with > ls -l /var/log
roosa@devoops:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial #Nice
roosa@devoops:~$ ls -la
total 156
<...>
drwx------ 3 root root 4096 Mar 26 2021 .dbus
drwxrwxr-x 4 roosa roosa 4096 Mar 26 2021 deploy
drwxr-xr-x 2 roosa roosa 4096 Mar 26 2021 Desktop
-rw-r--r-- 1 roosa roosa 25 Mar 21 2018 .dmrc
<...>
drwxr-xr-x 2 roosa roosa 4096 Mar 26 2021 Templates
-r-------- 1 roosa roosa 33 Sep 13 15:04 user.txt
drwxr-xr-x 2 roosa roosa 4096 Mar 26 2021 Videos
drwxrwxr-x 3 roosa roosa 4096 Mar 26 2021 work
<...>
A lot of files, but there are two curious folder, deploy and work. Let's check work.
Target Terminal [roosa]
roosa@devoops:~$ cd work
roosa@devoops:~/work$ ls -la
total 12
drwxrwxr-x 3 roosa roosa 4096 Mar 26 2021 .
drwxr-xr-x 22 roosa roosa 4096 Sep 23 2022 ..
drwxrwx--- 5 roosa roosa 4096 Mar 26 2021 blogfeed
roosa@devoops:~/work$ cd blogfeed
roosa@devoops:~/work/blogfeed$ ls -la
total 28
drwxrwx--- 5 roosa roosa 4096 Mar 26 2021 .
drwxrwxr-x 3 roosa roosa 4096 Mar 26 2021 ..
drwxrwx--- 8 roosa roosa 4096 Mar 26 2021 .git
-rw-rw---- 1 roosa roosa 104 Mar 19 2018 README.md
drwxrwx--- 3 roosa roosa 4096 Mar 26 2021 resources
-rwxrw-r-- 1 roosa roosa 180 Mar 21 2018 run-gunicorn.sh
drwxrwx--- 2 roosa roosa 4096 Mar 26 2021 src
Good, there is git, in those cases is always a good practice to see the commits for old relevant information... ALWAYS! But first, let's see if there is another hidden file here.
Many user to test the id_rsa, if is not the correct one, we should check the past-commits for mistakes.
Copy the authcredentials.keys as id_rsa to the tmp folder, then connect through ssh.
Target Terminal [roosa]
roosa@devoops:/home$ cd /tmp
roosa@devoops:/tmp$ cp /home/roosa/work/blogfeed/resources/integration/authcredentials.key /tmp/id_rsa
roosa@devoops:/tmp$ chmod 600 id_rsa
roosa@devoops:/tmp$ ssh -i id_rsa root@localhost
# It requires password with every user, forget about it.
Return to the blogfeed folder with cd /home/roosa/work/blogfeed
Target Terminal [roosa]
roosa@devoops:~/work/blogfeed$ git log
"reverted accidental commit with proper key" looks like an interesting mistake, copy the commit code.
