HTB Quick

10.10.10.186 | 40 pts | Synack Track

PART 1 : INITIAL ENUMERATION

1.1 nmap

$ nmap --min-rate 3000 -oN nmap-tcp.initial -p- -v 10.10.10.186

  PORT     STATE SERVICE
  22/tcp   open  ssh
  9001/tcp open  tor-orport

$ nmap -oN nmap-tcp -p 22,9001 -sC -sV -v 10.10.10.186

  PORT     STATE SERVICE VERSION
  22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
  | ssh-hostkey: 
  |   2048 fb:b0:61:82:39:50:4b:21:a8:62:98:4c:9c:38:82:70 (RSA)
  |   256 ee:bb:4b:72:63:17:10:ee:08:ff:e5:86:71:fe:8f:80 (ECDSA)
  |_  256 80:a6:c2:73:41:f0:35:4e:5f:61:a7:6a:50:ea:b8:2e (ED25519)
  9001/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
  | http-methods: 
  |_  Supported Methods: GET HEAD POST
  |_http-server-header: Apache/2.4.29 (Ubuntu)
  |_http-title: Quick | Broadband Services
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

$ sudo nmap -oN nmap-udp.initial -sU -v 10.10.10.186

  PORT    STATE         SERVICE
  443/udp open|filtered https

PART 2 : PORT ENUMERATION

2.1 TCP PORT 9001 : HTTP

2.1.1 Crawling index.php for "href" links:

2.1.2 Directory brute forcing using gobuster

2.1.3 /login.php -- Login Page

2.1.4 /clients.php -- Client List

#

Client

Country

1

QConsulting Pvt Ltd

UK

2

Darkwing Solutions

US

3

Wink

UK

4

LazyCoop Pvt Ltd

China

5

ScoobyDoo

Italy

6

PenguinCrop

France

2.1.5 /index.php -- Potential Usernames

Name

Company

Possible Email

Tim

Qconsulting Pvt Ltd

[email protected]

Roy

DarkWng Solutions

[email protected]; [email protected]

Elisa

Wink Media

[email protected]; [email protected]

James

LazyCoop Pvt Ltd

[email protected]

2.2 UDP PORT 443 : HTTPS

How to Connect ? 1. Once router is up and running just navigate to http://172.15.0.4/quick_login.jsp 2. You can use your registered email address and Quick4cc3$$ as password. 3. Login and change your password for WiFi and ticketing system. 4. Don’t forget to ping us on chat whenever there is an issue.

PART 3 : EXPLOITATION

3.1 /login.php

3.2 /home.php

3.3 /ticket.php

3.4 ESI Injection Part 1 (RFI)

  1. Create a file, something.html:

  2. Start an HTTP Server using python:

  3. Raise ticket with ESI Server Include payload that will request something.html:

  4. Search the generated ticket:

  5. Check the HTTP requests:

3.5 ESI Injection Part 2 (RCE)

  1. Create a file, test.xsl:

  2. Start an HTTP Server using python:

  3. Raise ticket with ESI Server Include payload that will request test.xsl:

  4. Search the generated ticket:

  5. Check the HTTP requests:

PART 4 : GENERATING A SHELL

4.1 Reverse Shell

  1. Write a reverse shell on a file, index.html:

  2. Create a stager file for the reverse shell -- stager.xsl:

  3. Raise a ticket that will request stager.xsl:

  4. Search the generated ticket then view the HTTP requests on the python server:

  5. Create another file that will call the reverse shell -- shell.xsl:

  6. Start a netcat listener:

  7. Raise a ticket that will request shell.xsl:

  8. Search the generated ticket then view the HTTP requests on the python server:

  9. Look back to the netcat listener:

4.2 Connection via SSH

  1. Generating an RSA key pair:

  2. Add the public key to /home/sam/.ssh/authorized_keys using the reverse shell:

  3. Connect to the machine via SSH:

PART 5 : sam -> srvadm

5.1 Web Service Enumeration

5.1.1 /var/www/html

Checking /var/www/html/db.php for database credentials:

Then using it to check for other user credentials stored in the database:

The password for [email protected], although to be known as Quick4cc3$$, don't seem to match the hash stored in the database.

Seeing how the password hashes are generated:

The plaintext password is passed through a crypt() function before hashing using md5().

5.1.2 /var/www/printer

Checking the running processes on the machine:

Checking the contents of /home/sam/esigate-distribution-5.2/apps/esigate.properties:

All services running via HTTP using localhost should be accessible via port 9001 based on the running process for Esigate. And as previously inaccessible, there seems to be another deployed service in the machine:

There is a printer service running as printerv2.quick.htb but it is not accessible via port 9001. Looking at the open ports, there is indeed a service running on port 80:

Since there is a service running on port 80, printerv2.quick.htb should be accessible locally but the virtual host name is not listed in the /etc/hosts file.

5.2 Cracking srvadm

Validating the way the password hashes are generated

The password of [email protected] is indeed hashed as c6c35ae1f3cb19438e0199cfa72a9d9d in the database. And using the same functions to crack the password of [email protected]:

The password has been successfully cracked -- yl51pbx. Using this password to switch users using su does not work so access to printerv2.quick.htb might be necessary for privilege escalation.

5.3 Forwarding printerv2

Getting the service to run locally using port forwarding:

Afterwards, point printerv2.quick.htb to 127.0.0.1 in /etc/hosts:

The service should now be accessible:

5.4 The Printer Service

5.4.1 Figuring out the login credentials

Based on /var/www/printer/db.php, it's' using the same database as the ticketing service.

However, based on /var/www/printer/index.php, the credentials used should be the account of [email protected]:

The cracked password from earlier should work for the login page and it should bring you to:

5.4.2 Creating print jobs

First a printer needs to be added to the service. This could be connected to your local machine:

Then to test if the service could connect to "your printer":

With that setup, you can now create print jobs using the following command:

5.4.3 Exploiting the Printer Jobs

The bash script executed above will wait for a new print job to be created and then leveraging the 0.5 seconds sleep time of the job execution by deleting and replacing the file with a similar filename but symbolically linked to a file of your choice; in this case -- /home/srvadm/.ssh/authorized_keys

After starting a listener on port 9100 using netcat, the job will be triggered by the command above.

Looking back to the listener, the contents of the authorized_keys file has now been sent to the "printer" meaning the arbitrary file read of files owned or readable by sysadm succeeded.

5.4.4 Reading files with sysadm

Now to see if there is also a private key stored in the same directory using the same process above:

Luckily, there is also a private key stored in the .ssh directory.

5.5 SSH with sysadm

PART 6 : PRIVILEGE ESCALATION

PART 7 : REFERENCES

PreviousHTB TravelNextHTB Ellingson

Last updated