HTB Mischief

10.10.10.92 | 50 pts | Tricked Badge

PART 1 : INITIAL RECON

$ nmap --min-rate 1000 -p- -sT -sU -v 10.10.10.92

  22/tcp   open  ssh
  3366/tcp open  creativepartnr
  161/udp  open  snmp

$ nmap -oN mischief -p 22,161,3366 -sC -sT -sU -sV -v 10.10.10.92

  22/tcp   open          ssh            OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
  | ssh-hostkey:
  |   2048 2a:90:a6:b1:e6:33:85:07:15:b2:ee:a7:b9:46:77:52 (RSA)
  |   256 d0:d7:00:7c:3b:b0:a6:32:b2:29:17:8d:69:a6:84:3f (ECDSA)
  |_  256 3f:1c:77:93:5c:c0:6c:ea:26:f4:bb:6c:59:e9:7c:b0 (ED25519)
  3366/tcp open          caldav         Radicale calendar and contacts server (Python BaseHTTPServer)
  | http-auth:
  | HTTP/1.0 401 Unauthorizedx0D
  |_  Basic realm=Test
  | http-methods:
  |_  Supported Methods: GET HEAD
  |_http-server-header: SimpleHTTP/0.6 Python/2.7.15rc1
  |_http-title: Site doesn't have a title (text/html).
  161/udp  open          snmp           SNMPv1 server; net-snmp SNMPv3 server (public)
  | snmp-info:
  |   enterprise: net-snmp
  |   engineIDFormat: unknown
  |   engineIDData: b6a9f84e18fef95a00000000
  |   snmpEngineBoots: 19
  |_  snmpEngineTime: 59m39s
  | snmp-interfaces:
  |   lo
  |     IP address: 127.0.0.1  Netmask: 255.0.0.0
  |     Type: softwareLoopback  Speed: 10 Mbps
  |     Status: up
  |     Traffic stats: 0.67 Kb sent, 0.67 Kb received
  |   Intel Corporation 82545EM Gigabit Ethernet Controller (Copper)
  |     IP address: 10.10.10.92  Netmask: 255.255.255.0
  |     MAC address: 00:50:56:b9:2c:07 (VMware)
  |     Type: ethernetCsmacd  Speed: 1 Gbps
  |     Status: up
  |_    Traffic stats: 618.08 Kb sent, 23.39 Mb received
  | snmp-netstat:
  |   TCP  0.0.0.0:22           0.0.0.0:0
  |   TCP  0.0.0.0:3366         0.0.0.0:0
  |   TCP  10.10.10.92:22       10.10.14.213:32850
  |   TCP  10.10.10.92:22       10.10.14.213:32864
  |   TCP  10.10.10.92:22       10.10.15.54:40920
  |   TCP  10.10.10.92:22       10.10.16.63:40704
  |   TCP  10.10.10.92:3366     10.10.14.213:47812
  |   TCP  10.10.10.92:3366     10.10.14.213:47814
  |   TCP  10.10.10.92:3366     10.10.14.213:47816
  |   TCP  10.10.10.92:3366     10.10.14.213:47818
  |   TCP  10.10.10.92:3366     10.10.14.213:47820
  |   TCP  127.0.0.1:3306       0.0.0.0:0
  |   TCP  127.0.0.53:53        0.0.0.0:0
  |   UDP  0.0.0.0:161          *:*
  |   UDP  0.0.0.0:34424        *:*
  |_  UDP  127.0.0.53:53        *:*
  | snmp-sysdescr: Linux Mischief 4.15.0-20-generic #21-Ubuntu SMP Tue Apr 24 06:16:15 UTC 2018 x86_64
  |_  System uptime: 59m39.09s (357909 timeticks)
  |_snmp-win32-software:
  Service Info: Host: Mischief; OS: Linux; CPE: cpe:/o:linux:linux_kernel

NOTE(S):

  • An SNMP service is running at UDP PORT 161.

  • The web service running on TCP PORT 3366 is served using a Python BaseHTTPServer.

PART 2 : PORT ENUMERATION

UDP PORT 161 (snmp)

Processes (hrSWRunEntry):

  • The process for the hosted webservice is found.

  • HTTP Authentication credentials are found - loki : godofmischiefisloki

  • The web service is hosted from /home/loki/hosted

  • IPv6 Addresses (ipAddressIfIndex):

    • The 1st one is the Loopback Address.

    • The 2ns one is the Unique-Local Address.

    • The 3rd one is the Link Local Address.

Evaluate the IPv6 address of the system:

See if there are other ports open for IPv6:

  • There is another http service open using IPv6.

TCP PORT 3366 (http, IPv4)

http://10.10.10.136:

Using the credentials found during the SNMP enumeration -- loki:godofmischiefisloki

Two sets of credentials are found:

Username

Password

loki

godofmischiefisloki

loki

trickeryanddeceit

TCP PORT 80 (http, IPv6)

http://[dead:beef:0000:0000:0250:56ff:fea4:29f2]/

Attempting to log in using the credentials found on PORT 3366:

The credential pair, administrator : trickeryanddeceit, worked and so far, only the ping command could be executed. There is also a message written below.

PART 3 : EXPLOITATION

Bypass the command execution in the service running on port 80:

The command execution could be bypassed by using a ;.

PART 4 : GENERATE USER SHELL

Take the file called credentials from the home directory:

The word, credentials, is being filtered out by the service but it was bypassed by using a wildcard.

Logging in via ssh:

PART 5.1 : PRIVILEGE ESCALATION (loki -> root)

Check for interesting files in loki's home directory:

There was an attempt to execute su root in the .bash_history. There is also a .sudo_as_admin_successful which might mean the attempt was successful.

A previously unknown credential pair was used to initialize the python simpleHTTPAuthServer and this might be a lead for the root password.

Attempting to execute su root:

Checking privileges for the su command:

The user, loki, only has read (r--) permissions for both su and sudo. Good thing we still have access to another user -- www-data

PART 5.2 : PRIVILEGE ESCALATION (www-data -> root)

Set-up a listener for IPv6:

Execute an IPv6 reverse shell on the web service running on port 80:

While inside the reverse shell:

PreviousHTB FlujabNextChallenge Writeups

Last updated