[VulnHub] DC9
Port Scanning
We start with a simple nmap scan:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)
| ssh-hostkey:
| 2048 a2b3387432740bc516dc13decb9b8ac3 (RSA)
| 256 065c93871554686b889155cff89ace40 (ECDSA)
|_ 256 e42c88da8863268c93d5f7632ba3ebab (ED25519)
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Example.com - Staff Details - Welcome
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelWe see that only 2 ports are open:
Port 22: simple ssh
Port 80 Apache web server
Other info
The machine is running Debian
Web Scanning
Website Enumeration
At first we can see that the web server is running with PHP. On the "Display All Records" we notice a bunch of records of the employees (it looks like it got printed from a database, could it be MySql?).
In the "Search" tab there's a search bar and on the "Manage" tab we can view a login page (SQLi?).
More Active Recon
We can start by running gobuster for searching hidden directories and check for manual SQLi at the same time.
On the "search" tab we found something interesting: i we search for mary' or '1'='1 all of the records will be displayed, i tried the same payload on the "Manage" tab but with no luck.
Furthermore I was enumerating with gobuster and I tried some interesting directories:
I tried "/config.php" with no luck but when i tried "/session.php" something magically happened, the server redirected me to the "manage.php" tab and shown to me a "You are already logged in as admin." text, but unfortunately its not what I thought because we couldn't manage anything. I've tried to catch the request where the SQL was injectable, tried to feed SQLmap and it worked! We now have all the Database!
As we have the hashed password we cracked them with crackstation:
This way I retrieved the hashed password, to crack it I used crackstation which is an online tool that cracks the most common types of hashes. The credentials that I've got from the hash is admin:transorbital1. After a good looking and nothing much I observed a strange string at the end of the manager account "File does not exist". [later i discovered that the part of the SQLi was skippable just going trough the "/session.php" file :| ]
After a few tries i have noticed that because it's a PHP-based webserver and a server request a file we can just exploit it with /manage.php?file=../../../../../../../etc/passwd After a while i found nothing with LFI so i started bruteforcing ssh with the passwords (from the sql dump) and usernames (from both sql and /etc/passwd) using hydra:
Now we have a bunch of credentials-combo for ssh!
Internal Enumaration and Privilege Escalation
The first thing we do is enumeration: we log with every account and search for everything useful. The fist thing I've done is to enumerate the files in the exact home directory. the thing that catched my interesting was a file called "passwords-found-on-post-it-notes.txt" in the ".secrets-for-putin" directory on the janitor account, we can retry hydra's bruteforcing but with these credentials. Thanks to this notes we now have a new account to enumerate:
The user "fredf" can impersonate root to run this file:
Time to get more information about it.
File information
The file is an elf executable:
This binary simply takes a file and append the content in another file:
So the privesc is straight forward: we can just append our personalized root user to "/etc/passwd" or "/etc/shadow".
copy the root line from "/etc/passwd" and change the name:
newroot:x:0:0:root:/root:/bin/bashgenerate a new password with openssl:
openssl passwd password321$1$8S09HGZM$h1YN5vVHXZyBLZnahTHXr0replace the "x" with the hash:
newroot:$1$8S09HGZM$h1YN5vVHXZyBLZnahTHXr0:0:0:root:/root:/bin/bashput our new string in a file and run the binary on "/etc/passwd":
fredf@dc-9:~$ sudo /opt/devstuff/dist/test/test hash /etc/passwd
We've done it! Now we just need to "su" to our new user and we got root privilege! uid=0(root) gid=0(root) groups=0(root)
That's was a really cool box and thanks for the reading.
Hope to see you soon!
Pedio Zaki
Last updated
Was this helpful?