Complex Attack Types: Sample Scenarios 19

What do we do first?

We need to determine all constant values ​​and save them on the shell. This speeds up our processes and prevents us from getting lost in the goal.

output

You can examine the /usr/share/wordlistslocation for other wordlists you can use.

Let’s go one step further and explore the open doors of the machine in front of us with nmap: nmap -sV -sC -oN nmap_result_1.txt --script=vuln -T4 -A $target_ip

-sV: Version detection to determine the version of the services running on open ports.-sC: Run default scripts. This is equivalent to using --script=default.-oN nmap_result_1.txt: Output the results to a file named nmap_result_1.txt in normal format.--script=vuln: Use scripts from the Nmap Scripting Engine (NSE) to check for vulnerabilities.-T4: Set the timing template to 4 (Aggressive), making the scan faster.-A: Enable OS detection, version detection, script scanning, and traceroute.

This can provide you with a comprehensive report, but you also need to be a little patient because the answer may arrive late.

outputoutput

We learned that ports 22 (SSH) and 80 (HTTP) are open.

We also have some version information, you can scan for exploits if you wish.

Now let’s place the target machine in our /etc/hosts file and make it ready to use in our tests.

output

Then ping it to check connection.

output

Everything seems fine.

Let’s go to the directory discovery phase, use gobuster and check if there are other pages. You can also choose other tools such as ffuf for this.

Use it: gobuster dir -w $wordlist_dir -u http://ourtargetsite.thm

output

Or: ffuf -w $wordlist_dir -u https://ourtargetsite.thm/FUZZ -c -v

output

We discovered some interesting pages with this method.

Now let’s go to our destination and take a look at what’s on the /img page.

output

We might consider starting to analyze the images. Now let’s download these files to our local.

outputoutput

Time to dive deep! We need to inspect these images.

We can use it to check:steghide info white_rabbit_1.jpg

output

We saw a embedded file. Now we need to extract this:steghide extract -sf white_rabbit_1.jpg

output

Perfect. Now examine the file.

output

Interesting… After making a few guesses, you may think that this message could be a directory or directory scheme.

Let’s check!

output

It seems like it has a certain order. We need to check this theory of ours. Let’s create a wordlist with this layout and apply it for directory discovery.

outputoutput

We have the 301 codes, so we thought right… Now it’s time to go to the end!

output

Such a message greets us at the end of the order.

Let’s inspect the page source.

output

We’ve obtained the password for Alice! Remember that SSH is on. Now we can connect with this password.

output

Yes, we are inside! Try some commands.

outputoutput

As you can see, we need to increase privilege for some files. Let’s examine a little more.

output

We also saw other potential usernames.

Do you remember the authorization information we obtained with sudo -l?

output

From the output we see here, we see that the alice user can run the file we have just viewed using the python module for the rabbit user, using the above-mentioned sudo command: sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py

output

We have a standard text before us. Let’s analyze the python file we have.

outputoutput

We need a privilege escalation method based on Python. We can use https://rastating.github.io/privilege-escalation-via-python-library-hijacking/

This method is called “Python Library Hijacking”.

We can create a random.py file ourselves and get the authority we want. We need to test that the theory is correct so that we don’t activate some firewalls for the wrong method…

output

Let’s try.

output

Yeap! Now it’s time for the real method. Design it again.

output

Run again.

output

Did you see that our user has changed? We were successful.

output

We need to go exploring.

output

There is an interesting structure called “teaParty”… It’s time to find out what it is.

output

It looks like it can be run. Try.

output

It is gratifying to know that we are right.

output

No matter what we write, it throws us out. Now let’s check the content and gain additional information.

output

Interesting… There is a “date” information returned in the file, but date is not defined as a path. This program, called “TeaParty”, uses a command called “date” to do things related to time.

output

Time for some deep thinking! We can find the directory where we have write permission by going to the main directories.

output

As you can see, we have permission to write to the /tmp directory.

Let’s go to the /tmp directory and create a date file.

output

Now let’s change the “PATH” constant.

output

We also manipulated PATH now. Now, our favorite step is to authorize the file and get what we want.

output

Then run it again.

output

We have successfully passed another super stage! Now let’s deepen the analysis.

output

We discovered a password. Let’s try connecting to this user via SSH.

output

Login successful.