Knife
Linux · Easy
10.10.10.242
Reconnaissance: NMAP
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.242
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 be:54:9c:a3:67:c3:15:c3:64:71:7f:6a:53:4a:4c:21 (RSA)
| 256 bf:8a:3f:d4:06:e9:2e:87:4e:c9:7e:ab:22:0e:c0:ee (ECDSA)
|_ 256 1a:de:a1:cc:37:ce:53:bb:1b:fb:2b:0b:ad:b3:f6:84 (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Emergent Medical Idea
|_http-server-header: Apache/2.4.41 (Ubuntu)
Aggressive OS guesses: Linux 4.15 - 5.8 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 62.96 secondsnmap found two open TCP ports, SSH (22) and HTTP (80): Based on the OpenSSH and Apache versions, the host is likely running Ubuntu 20.04 Focal.
80/tcp open http
Apache httpd 2.4.41 ((Ubuntu)) http://10.10.10.242/
WAP: broswer
Font scripts: Google Font API Web servers: Apache HTTP Server 2.4.41 Programming languages: PHP 8.1.0 Operating systems: Ubuntu CDN: cdnjs, Cloudflare
SOURCE CODE
Read for comments view-source:http://10.10.10.242/
HEADERS BURP: browser
Proxy: HTTP history
SCANNERS:
DIR BRUTE FORCE:
Shell as james
Find Exploit: The X-Powered-By header gives a very specific PHP version, PHP/8.1.0-dev. Some knowledge of the news reminds me that there was an issue with the PHP source repository where it got hacked and a backdoor was inserted (ref1, ref2, lots more).
Kind of surprisingly, on release day, Googling this version didn’t turn up the news stories about this backdoor, so it took a bit more research to figure out that this version was the one associated with the backdoor. That said, two days after Knife’s release, the top link on Google mentioned the backdoor:
Backdoor Details: Because of how GitHub and open-source works, I can look right at the commit that adds this backdoor into the PHP codebase. The commit changes one file, ext/zlib/zlib.c, adding 11 lines of code (all in green): https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d
It’s fascinating to see others commenting on the commit, the first comment asking if the misspelling of HTTP_USER_AGENT as HTTP_USER_AGENTT was a mistake, and four lines later someone asking what it did, and someone else responding basically that’s it’s a backdoor, and how it works.
RCE: To test this, I’ll send the GET request over to Burp Repeater and replace the User-Agent header with the malicious one:
SHELL: I’ll replace id with a reverse shell, and run it again.
Shell as root
Enumeration: When trying to escalate on Linux, always check sudo -l:
james can run knife as root.
Background: Chef is an automation/infrastructure platform:
knife is a command line tool manage Chef. According to the docs, it manages aspects of Chef such as:
SHELL: While GTFObins has a page for knife, it didn’t when Knife released, leaving me to comb the docs. There are several ways to get execution through knife.
exec More simply, knife has an exec command that will run Ruby code. This is the technique now on GTFObins, but it wasn’t there when Knife released. There was a GTFObins page on Ruby that shows running sudo ruby -e 'exec "/bin/sh"'. The Ruby code there is exec "/bin/sh". Using the same Ruby code here works:
Last updated