This box is from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:
- Web Enumeration ( HTTP and HTTPS)
- Authentication bruteforce using Hydra
- Exploiting phpLiteAdmin to upload malicious PHP code
- LFI modification to get the shell.
- Checking the procesess using pspy
- Exploiting the chkrootkit vulnerability for privilege escalation
I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
443/tcp open ssl/http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| ssl-cert: Subject: commonName=nineveh.htb/organizationName=HackTheBox Ltd/stateOrProvinceName=Athens/countryName=GR/localityName=Athens/organizationalUnitName=Support/[email protected]
| Issuer: commonName=nineveh.htb/organizationName=HackTheBox Ltd/stateOrProvinceName=Athens/countryName=GR/localityName=Athens/organizationalUnitName=Support/[email protected]
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (text/html).
| tls-alpn:
|_ http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.18 (Ubuntu)
There are two ports open, port 80 and port 443. From the nmap scan result above, I can see the hostname nineveh.htb. I am going to add this to my /etc/hosts file.
Visiting the web page, there is nothing interesting.
fig 1: port 80 (HTTP)
fig 2: port 443 (HTTPS)
I performed the nikto scan and the results are below. It shows that there is /info.php which is infact the phpinfo page.
- Nikto v2.1.6/2.1.5
+ Target Host: nineveh.htb
+ Target Port: 80
+ GET The anti-clickjacking X-Frame-Options header is not present.
+ GET The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ GET The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ HEAD Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ GET Server may leak inodes via ETags, header found with file /, inode: b2, size: 5535e4e04002a, mtime: gzip
+ OPTIONS Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ GET /info.php: Output from the phpinfo() function was found.
+ OSVDB-3233: GET /info.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.
+ OSVDB-3233: GET /icons/README: Apache default file found.
+ OSVDB-5292: GET /info.php?file=http://cirt.net/rfiinc.txt?: RFI from RSnake's list (http://ha.ckers.org/weird/rfi-locations.dat) or from http://osvdb.org/
/info.php
fig 3: /info.php PHP info page
I am particularly interested in file_uploads settings in phpinfo() and in this case, it is on. This canbe useful later.
fig 4: File uploads setting in PHP info.
A quick gobuster scan for directory resulted in the following;
fig 5: Gobuster scan on port 443
fig 6 : Gobuser scan in port 80
So there is a /db and /secure_notes web directory in port 443 (HTTPS) and /department in port 80 (HTTP).
Both web directory results in a login page.
/db
fig 7: /db on port 443
/department
fig 8: /department on port 80
Let’s start enumerating both login pages but one at a time. I will start with /department . I tried normal username: password combinations and found that the page returned an error if the username is not correct.
fig 9: Invalid Username Error
After a few tries, username admin works. I am now trying my luck by bruteforcing the authentication.
fig 10: Bruteforcing the /department/login.php authentication.
So I found the credentials admin : 1q2w3e4r5t . Let’s log in and see if there is anything interesting inside.
fig 11: contents inside /department after logging in.
So according to the notes, the username and password are hardcoded. So we did not need to brute force this login page. To authenticate the hardcoded username and password, PHP uses strcmp() function. So instead of sending the password value, we can edit the request and send the password array, which will also bypass the authentication.
So this was the parameter username=admin&password=guess. Now, we can trick the PHP strcmp() function by sending this parameter which is always true in PHP. username=admin&password[]= . It does not matter now as we are already logged in.
Now, looking at the web address, I see there is a query with notes =. Anytime I see this sort of query I think there might be LFI.
http://10.10.10.43/department/manage.php?notes=files/ninevehNotes.txt
Now, I tried a few combinations and found that the query request must consist of word ninevehNotes for the request to be successful.
LFI = http://10.10.10.43/department/manage.php?notes=files/ninevehNotes/../../
So, now following the explanation of the image above, I was able to confirm the notes = query is vulnerable to LFI. Now, from our initial Nikto scan, we were able to find phpinfo() page with file_uploads enabled. We can exploit LFI with phpinfo() to get the Remote Code Execution (RCE). More details about this can be found here and the python script to get the RCE can be downloaded from here.
However, we are gonna try another process to get the shell. Let’s go to our port 443 and enumerate /db/ web directory. A quick search on searchsploit shows that this version can be vulnerable to remote PHP code injection.
fig 13: Searchsploit vulnerability search for phpliteadmin
But for that exploit to work, we need authentication. I am going to bruteforce. let’s hope we find the password.
hydra -l admin -P /usr/share/wordlists/fasttrack.txt 10.10.10.43 https-post-form "/db/index.php:password=^PASS^&remember=yes&login=Log+In&proc_login=true:Incorrect password." -t 64
fig 14: Bruteforcing the login page /db using hydra.
Now let’s look at how to exploit the database for RCE.
fig 15: POC - RCE on phpliteadmin.
Let’s follow that process to upload the simple backdoor PHP code. Now we know the location of our malicious PHP file. /var/tmp/ninevehNotes.php.
fig 16: Malicious PHP file location
Now, we can use the LFI from our /department page and access this PHP script for RCE
Now when we access the file, we get the reverse shell.
fig 17: Initial shell access
So looking around I couldn’t find anything interesting. I remember that there was a /secure_notes directory before. Let’s check there if we missed anything.
fig 18: Image inside /secure_notes.
Let’s download the image and check for any metadata. Looking inside the image I found an ssh key for the user amrois.
fig 19: ssh key for user amrois.
As we already have access to the system I am going to use this ssh private key to change the user to amrois.
fig 20: Using private ssh_key to ssh to another user.
fig 21: user.txt
Now I upload linpeas and run the script to see any potential privilege escalation vector. I didnt fidn anything interesting. So now I used pspy script to see any processes that we might be able to exploit. There is /usr/bin/chkrootkit running alot.
fig 22: pspy script process report
A quick searchsploit search for chkrootkit gave us following result. It looks like there is a privilege escalation exploit.
fig 23: Searchsploit results for chkrootkit
Following the steps to reproduce the exploit.
fig 24: Steps to reproduce the privilege escalation
I got the reverse shell after waiting a minute.
fig 25: Reverse shell as root
fig 26: Getting root.txt
This box was really interesting but I tried alot to exploit LFI to get RCE through phpinfo() but failed. Spent few hours but the exploit wouldnot work.