search

Knife

Linux · Easy

10.10.10.242

hashtag
Reconnaissance: NMAP

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.242

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 be:54:9c:a3:67:c3:15:c3:64:71:7f:6a:53:4a:4c:21 (RSA)
|   256 bf:8a:3f:d4:06:e9:2e:87:4e:c9:7e:ab:22:0e:c0:ee (ECDSA)
|_  256 1a:de:a1:cc:37:ce:53:bb:1b:fb:2b:0b:ad:b3:f6:84 (ED25519)

80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title:  Emergent Medical Idea
|_http-server-header: Apache/2.4.41 (Ubuntu)

Aggressive OS guesses: Linux 4.15 - 5.8 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 62.96 seconds

nmap found two open TCP ports, SSH (22) and HTTP (80): Based on the OpenSSH and Apache versions, the host is likely running Ubuntu 20.04 Focal.

hashtag
80/tcp open http

Apache httpd 2.4.41 ((Ubuntu)) http://10.10.10.242/

WAP: broswer

Font scripts: Google Font API Web servers: Apache HTTP Server 2.4.41 Programming languages: PHP 8.1.0 Operating systems: Ubuntu CDN: cdnjs, Cloudflare

SOURCE CODE

Read for comments view-source:http://10.10.10.242/

HEADERS BURP: browser

  • Proxy: HTTP history

SCANNERS:

DIR BRUTE FORCE:

hashtag
Shell as james

Find Exploit: The X-Powered-By header gives a very specific PHP version, PHP/8.1.0-dev. Some knowledge of the news reminds me that there was an issue with the PHP source repository where it got hacked and a backdoor was inserted (ref1, ref2, lots more).

Kind of surprisingly, on release day, Googling this version didn’t turn up the news stories about this backdoor, so it took a bit more research to figure out that this version was the one associated with the backdoor. That said, two days after Knife’s release, the top link on Google mentioned the backdoor:

Backdoor Details: Because of how GitHub and open-source works, I can look right at the commit that adds this backdoor into the PHP codebase. The commit changes one file, ext/zlib/zlib.c, adding 11 lines of code (all in green): https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d

It’s fascinating to see others commenting on the commit, the first comment asking if the misspelling of HTTP_USER_AGENT as HTTP_USER_AGENTT was a mistake, and four lines later someone asking what it did, and someone else responding basically that’s it’s a backdoor, and how it works.

RCE: To test this, I’ll send the GET request over to Burp Repeater and replace the User-Agent header with the malicious one:

SHELL: I’ll replace id with a reverse shell, and run it again.

hashtag
Shell as root

Enumeration: When trying to escalate on Linux, always check sudo -l:

james can run knife as root.

Background: Chef is an automation/infrastructure platform:

LogoPlatform Overviewdocs.chef.iochevron-right

knife is a command line tool manage Chef. According to the docs, it manages aspects of Chef such as:

SHELL: While GTFObins has a page for knife, it didn’t when Knife released, leaving me to comb the docs. There are several ways to get execution through knife.

Logoknife | GTFOBinsgtfobins.github.iochevron-right

exec More simply, knife has an exec command that will run Ruby code. This is the technique now on GTFObins, but it wasn’t there when Knife released. There was a GTFObins page on Ruby that shows running sudo ruby -e 'exec "/bin/sh"'. The Ruby code there is exec "/bin/sh". Using the same Ruby code here works:

Logoknife execdocs.chef.iochevron-right
Logoruby | GTFOBinsgtfobins.github.iochevron-right
PreviousArmageddonNextPrevise

Last updated