Lightweight

Tags: #Linux #Enumeration #LDAP #Wireshark #Pivoting

Explore is an medium-rated Linux machine from HackTheBox created by 0xEA31. In the current post, my IP is 10.10.14.32, and the target IP is 10.129.95.236.

I liked this machine a lot, more than just researching to find a specific CVE or something like that. In the beginning, the machine is open; you can get in without effort and then use various techniques to pivot between many users. It's a good LDAP practice.

Recon

First, we are going to start with checking if the machine is alive, then do the classic reconnaissance to get some general information about the target.

Local Terminal
$ ping -c 1 10.129.95.236

Pinging 10.129.95.236 with 32 bytes of data:
Reply from 10.129.95.236: bytes=32 time=144ms TTL=63
Reply from 10.129.95.236: bytes=32 time=148ms TTL=63
Reply from 10.129.95.236: bytes=32 time=142ms TTL=63
Reply from 10.129.95.236: bytes=32 time=142ms TTL=63

Ping statistics for 10.129.95.236:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 142ms, Maximum = 148ms, Average = 144ms

By the TTL, we assume that is a Linux Machine (value around 64)

  • -p- --open to scan all open port

  • -T5 Scan at max speed, a little bit noisy

  • -v verbose, return more information while scanning

  • -n Scan don’t apply DNS resolution, more speed.

  • -sC Basic Nmap scripts.

  • -sV Return versions of the services.

Important information: {Domain : lightweight.htb}, modify your host file to add that domain to the target IP.

  • Browser: http://10.129.95.236

Website index

So, we will be blocked if we try brute force, this apply to dictionary attacks too. At this point, we have to explore the website through view:source (CTRL+U).

At the source code, there is a js/index.js, is always a good idea to check with the browser, in case of Directory Listing.

Nothing relevant.

  • Browser: http://10.129.95.236/js

It has the capability of Directory Listing, but there is nothing else… Ok, let's explore the website

Nothing relevant, just a warning.

  • Browser: http://10.129.95.236/user.php

That is an interesting statement, we can login using SSH with our IP address as username and password.

By hovering, we can find that there is a new url, http://10.129.95.236/reset.php, it says that is just for reset our username and password, so nothing to worry about.

But first, LDAP Enumeration

LDAP Enumeration

If we use at the terminal locate .nse we will enumerate every nmap script, but here the goal it's to execute every LDAP related script, we can add a filter by using locate .nse | grep ldap

There is a lot of information, but the password are not decryptable.

User Pivot

SSH by using IP

Before the website told us that it is possible to login by using your IP as username and password.

And… we are in, and we even have a new directory…

There are more users? And by seeing the permission (drwx------), we are not able to do anything here… We need to go further.

Yes, those are users, perfect targets for User Pivoting.

It is necessary to get more information about the target.

List of SUID privileges, there is nothing critical. And we are not able to modify one of these files or execute them as temporal root

Network Capture

by checking capabilities, we found TCPdump, and that is interesting to play with specially because we can execute an account reset at reset.php to trigger an interaction with us.

  • -i any Any Interface

  • -w Save the output as:

  • -v Verbose

It was just a test, now the best option is to open a new local terminal or Wireshark to scan a TCPDump sent by the target.

Now play at the website, navigate everywhere, press all the buttons, and the most important thing, execute the reset.php command.

You have to download the capture.cap file and explore the content with Wireshark

Open the capture.cap file with Wireshark and search for Protocol LDAP. Then right click over the packet > Follow > TCP Sequence

We have new information, {username: ldapuser2 @ password : 8bc8251332abe1d7f105d3e53ad39ac2}, now return to the Target Terminal.

Privileges Escalation

User Pivot II

Look what we found, a backup file… take it by using the TargetSSH terminal and a LocalTerminal... Copy all the content

If you want, compare the hash with md5sum in both terminals to check if the file is the same… now try to unpack.

Delete the marked part from the file "hash"

Now that we have the content of the webpage, we can explore the whole.

New information: {username : ldapuser1 @ password : f3ca9d298a553da117442deeb6fa932d }, now return to the Target Terminal

Root

Openssl with capabilities, we can make use of it, go to https://gtfobins.github.io/gtfobins/openssl/#file-read and try to abuse from that

We could even get the flag by this way, But we want to do a privilege scalation by modifying the root's password… let's go to https://gtfobins.github.io/gtfobins/openssl/#file-write to modify /etc/passwd

Replace the "X" with "z4oRRkp3WBrCc"

With this, the machine will not extract the password from /etc/shadow and decrypt with SHA512 {Check with at TargetSSH: grep "ENCRYPT_METHOD" /etc/login.defs}, and just read it from passwd… with the capability in the Openssl, we will replace the password file.

PreviousJarvisNextMagic

Last updated