search

Toolbox

Windows : FTP, sqlmap, SQLI Blind,

hashtag
Reconnaissance: NMAP

┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.236                     

21/tcp  open  ftp           FileZilla ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-r-xr-xr-x 1 ftp ftp      242520560 Feb 18  2020 docker-toolbox.exe
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla

22/tcp  open  ssh           OpenSSH for_Windows_7.7 (protocol 2.0)
| ssh-hostkey: 
|   2048 5b:1a:a1:81:99:ea:f7:96:02:19:2e:6e:97:04:5a:3f (RSA)
|   256 a2:4b:5a:c7:0f:f3:99:a1:3a:ca:7d:54:28:76:b2:dd (ECDSA)
|_  256 ea:08:96:60:23:e2:f4:4f:8d:05:b3:18:41:35:23:39 (ED25519)

135/tcp open  msrpc         Microsoft Windows RPC

139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn

443/tcp open  tcpwrapped

445/tcp open  microsoft-ds?

Aggressive OS guesses: Microsoft Windows Server 2019 (96%), Microsoft Windows Vista SP1 (93%), Microsoft Windows 10 1709 - 1909 (93%), Microsoft Windows Server 2012 (92%), Microsoft Windows Longhorn (92%), Microsoft Windows 10 1709 - 1803 (91%), Microsoft Windows 10 1809 - 2004 (91%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows Server 2012 R2 Update 1 (91%), Microsoft Windows Server 2016 build 10586 - 14393 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-01-16T02:02:31
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

hashtag
Enumeration: HTTPS Port 443/tcp

There’s a certificate on 443 with the domain name admin.megalogistic.com.

Apache/2.4.38 (Debian) Server 10.10.10.236 Port 443

https://10.10.10.236/ https://10.10.10.236/index.html https://10.10.10.236/booking.html

view-source: https://10.10.10.236/index.html Copyright ©document.write(new Date().getFullYear()); All rights reserved | This template is made with by Colorlibarrow-up-right

The site is for a shipping / logistics company: megalogistic.com

Most of the site is just lorem ipsum text (filler), and the forms don’t seem to submit anywhere. I could make a list of potential usernames from about.html, but it’s just names without emails, so I’ll look elsewhere first. All the pages look static at this point.

Fuzz for VHosts:

Given the existence of admin.megalogistic.com, I’ll fuzz to see if any other virtual hosts display something different, but didn’t find anything besides admin:

admin.megalogistic.com: This page presents a login form: https://megalogistic.com/arrow-up-right https://admin.megalogistic.com/arrow-up-right

hashtag
Enumeration: SMB Port 139/445/tcp

Anonymous access is not permitted to SMB:

hashtag
Enumeration: FTP Port 21/tcp

As nmap noted, anonymous login is available for FTP. I’ll give it the username anonymous and a blank password:

FileZilla ftpd ftp-anon: Anonymous FTP login allowed (FTP code 230)

Docker Toolbox is an older solution for running Docker in Windows, before Windows had native Docker support. It basically ran a VirtualBox Linux VM that runs Docker and its containers.

LogoInstall Docker Toolbox in Windowsdocs.bitnami.comchevron-right

hashtag
Shell as postgres in container

Identify SQL Injection: If I try to login with password ', the page return the form, with an error message in the background at the top:

There are multiple things to learn from this:

  • The form is likely vulnerable to SQL injection.

  • The error is from pg_query(), which suggests the backend database is PostgreSQL.

  • The passwords are stored using MD5 hashes.

Bypass Login: From the error above, I can guess that the SQL query being run looks like:

Then the site likely checks if there are results to determine if access should be allowed. If I submit the username ' or 1=1-- -, then the query will be:

Because -- - makes anything after a comment, this will return all users, and hopefully let me in:

I’m at the admin dashboard, but it doesn’t do much: ToDo List

  • Send credentials to Tony

  • Update Printer Drivers

Enumerate DB: A login form isn’t displaying data from the DB back to the page, so it’s a more difficult blind injection. For an easy-rated box like Toolbox, I’ll turn to sqlmap. I’ll save a POST request for login from Burp to a file with right-click, “Copy to file”. It’s important that this request not have any injections in it, or sqlmap will yell.

I’ll run with -r login.request to give it the file to work from, --force-ssl (as that’s where the site is), and --batch to accept the defaults at the prompts. It finds four injections:

I’ll add --dbs to the end of the command and run it again to list the dbs:

I will list the tables in public, finding one:

I will dump a single user, admin, and their password hash. sqlmap tries to crack it but fails, and Google doesn’t know it either.

Commands via SQL: One technique that rarely works, but is always worth trying is the --os-cmd flag in sqlmap. From the docs, for PostgreSQL, it will upload a shared library to the system that will work with the database and run arbitrary commands on the system.

LogoUsageGitHubchevron-right

I’ll try whoami since it will work on either Linux or Windows, and it works:

The previous command identified the OS as Debian 10. Given this is a Windows host according to HTB, this must be in a Docker container. The id command returns as well:

Shell: The --os-shell flag will drop into an interactive prompt to run more than one command as well:

I’ll start nc and give sqlmap a Bash reverse shell to see if it works:

Legacy Python is not installed, but Python3 is:

I’ll upgrade my shell using the standard trick:

This is important as I can’t do the next steps without a full TTY. There’s also a user.txt in postgres’ home directory (not sure why it says flag.txt in the file, but the hash works):

hashtag
Shell as docker/root in VM

Enumeration: I’m definitely not on the host machine now. ifconfig shows the IP 172.17.0.2:

The file system is quite empty.

Docker-Toolbox: At this point, a bit more detail about Docker-Toolbox is necessary. The solution is deprecated, but that doesn’t mean it can’t be seen in the wild. Docker Toolbox installs VirtualBox, and creates a VM running the boot2docker Linux distribution. From it’s README:

LogoGitHub - boot2docker/boot2docker: DEPRECATED; see https://github.com/boot2docker/boot2docker/pull/1408GitHubchevron-right

Boot2Docker is a lightweight Linux distribution made specifically to run Docker containers. It runs completely from RAM, is a ~45MB download and boots quickly.

sudo:

hashtag
Shell as root

Enumeration: There’s nothing interesting in any of the homedirs on this VM. This is, as I suspected, boot2docker:

There’s an interesting folder at the system root, c:

It looks like it has mounted the Users directory, which is standard in a Windows system:

In the Administrator’s folder, in addition to a bunch of typical Windows stuff, there’s a .ssh directory:

While this is typically thought of as a Linux thing, Windows with SSH can have this as well to allow for key-based auth and other standard SSH needs. There is a key inside:

The public key here is in authorized_keys, as this returns nothing:

ssh-keygen -y -e -f keyfile will return the public key for the key, so I can use that to check if the private key here matches the public (and the one in authorized_key):

They match!

SSH: I’ll create a copy of the private key on my local VM, and set the permissions so that SSH will trust it:

PreviousBuffNextDriver

Last updated