Toolbox
Windows : FTP, sqlmap, SQLI Blind,
Reconnaissance: NMAP
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.236
21/tcp open ftp FileZilla ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-r-xr-xr-x 1 ftp ftp 242520560 Feb 18 2020 docker-toolbox.exe
| ftp-syst:
|_ SYST: UNIX emulated by FileZilla
22/tcp open ssh OpenSSH for_Windows_7.7 (protocol 2.0)
| ssh-hostkey:
| 2048 5b:1a:a1:81:99:ea:f7:96:02:19:2e:6e:97:04:5a:3f (RSA)
| 256 a2:4b:5a:c7:0f:f3:99:a1:3a:ca:7d:54:28:76:b2:dd (ECDSA)
|_ 256 ea:08:96:60:23:e2:f4:4f:8d:05:b3:18:41:35:23:39 (ED25519)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
443/tcp open tcpwrapped
445/tcp open microsoft-ds?
Aggressive OS guesses: Microsoft Windows Server 2019 (96%), Microsoft Windows Vista SP1 (93%), Microsoft Windows 10 1709 - 1909 (93%), Microsoft Windows Server 2012 (92%), Microsoft Windows Longhorn (92%), Microsoft Windows 10 1709 - 1803 (91%), Microsoft Windows 10 1809 - 2004 (91%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows Server 2012 R2 Update 1 (91%), Microsoft Windows Server 2016 build 10586 - 14393 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-01-16T02:02:31
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required Enumeration: HTTPS Port 443/tcp
There’s a certificate on 443 with the domain name admin.megalogistic.com.
Apache/2.4.38 (Debian) Server 10.10.10.236 Port 443
https://10.10.10.236/ https://10.10.10.236/index.html https://10.10.10.236/booking.html
view-source: https://10.10.10.236/index.html Copyright ©document.write(new Date().getFullYear()); All rights reserved | This template is made with by Colorlib
The site is for a shipping / logistics company: megalogistic.com
Most of the site is just lorem ipsum text (filler), and the forms don’t seem to submit anywhere. I could make a list of potential usernames from about.html, but it’s just names without emails, so I’ll look elsewhere first. All the pages look static at this point.
Fuzz for VHosts:
Given the existence of admin.megalogistic.com, I’ll fuzz to see if any other virtual hosts display something different, but didn’t find anything besides admin:
admin.megalogistic.com: This page presents a login form: https://megalogistic.com/ https://admin.megalogistic.com/
Enumeration: SMB Port 139/445/tcp
Anonymous access is not permitted to SMB:
Enumeration: FTP Port 21/tcp
As nmap noted, anonymous login is available for FTP. I’ll give it the username anonymous and a blank password:
FileZilla ftpd ftp-anon: Anonymous FTP login allowed (FTP code 230)
Docker Toolbox is an older solution for running Docker in Windows, before Windows had native Docker support. It basically ran a VirtualBox Linux VM that runs Docker and its containers.
Shell as postgres in container
Identify SQL Injection: If I try to login with password ', the page return the form, with an error message in the background at the top:
There are multiple things to learn from this:
The form is likely vulnerable to SQL injection.
The error is from pg_query(), which suggests the backend database is PostgreSQL.
The passwords are stored using MD5 hashes.
Bypass Login: From the error above, I can guess that the SQL query being run looks like:
Then the site likely checks if there are results to determine if access should be allowed. If I submit the username ' or 1=1-- -, then the query will be:
Because -- - makes anything after a comment, this will return all users, and hopefully let me in:
I’m at the admin dashboard, but it doesn’t do much: ToDo List
Send credentials to Tony
Update Printer Drivers
Enumerate DB: A login form isn’t displaying data from the DB back to the page, so it’s a more difficult blind injection. For an easy-rated box like Toolbox, I’ll turn to sqlmap. I’ll save a POST request for login from Burp to a file with right-click, “Copy to file”. It’s important that this request not have any injections in it, or sqlmap will yell.
I’ll run with -r login.request to give it the file to work from, --force-ssl (as that’s where the site is), and --batch to accept the defaults at the prompts. It finds four injections:
I’ll add --dbs to the end of the command and run it again to list the dbs:
I will list the tables in public, finding one:
I will dump a single user, admin, and their password hash. sqlmap tries to crack it but fails, and Google doesn’t know it either.
Commands via SQL: One technique that rarely works, but is always worth trying is the --os-cmd flag in sqlmap. From the docs, for PostgreSQL, it will upload a shared library to the system that will work with the database and run arbitrary commands on the system.
I’ll try whoami since it will work on either Linux or Windows, and it works:
The previous command identified the OS as Debian 10. Given this is a Windows host according to HTB, this must be in a Docker container. The id command returns as well:
Shell: The --os-shell flag will drop into an interactive prompt to run more than one command as well:
I’ll start nc and give sqlmap a Bash reverse shell to see if it works:
Legacy Python is not installed, but Python3 is:
I’ll upgrade my shell using the standard trick:
This is important as I can’t do the next steps without a full TTY. There’s also a user.txt in postgres’ home directory (not sure why it says flag.txt in the file, but the hash works):
Shell as docker/root in VM
Enumeration: I’m definitely not on the host machine now. ifconfig shows the IP 172.17.0.2:
The file system is quite empty.
Docker-Toolbox: At this point, a bit more detail about Docker-Toolbox is necessary. The solution is deprecated, but that doesn’t mean it can’t be seen in the wild. Docker Toolbox installs VirtualBox, and creates a VM running the boot2docker Linux distribution. From it’s README:
Boot2Docker is a lightweight Linux distribution made specifically to run Docker containers. It runs completely from RAM, is a ~45MB download and boots quickly.
sudo:
Shell as root
Enumeration: There’s nothing interesting in any of the homedirs on this VM. This is, as I suspected, boot2docker:
There’s an interesting folder at the system root, c:
It looks like it has mounted the Users directory, which is standard in a Windows system:
In the Administrator’s folder, in addition to a bunch of typical Windows stuff, there’s a .ssh directory:
While this is typically thought of as a Linux thing, Windows with SSH can have this as well to allow for key-based auth and other standard SSH needs. There is a key inside:
The public key here is in authorized_keys, as this returns nothing:
ssh-keygen -y -e -f keyfile will return the public key for the key, so I can use that to check if the private key here matches the public (and the one in authorized_key):
They match!
SSH: I’ll create a copy of the private key on my local VM, and set the permissions so that SSH will trust it:
Last updated