This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:
- Creating wordlist using cewl and bruteforcing
- mySQL commands to get the data from database
- Using pspy64 to find the process run by root and exploiting it for privilage escalation.
I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:
Scanned at 2022-04-21 03:32:33 EDT for 8s
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 64 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 67:34:48:1f:25:0e:d7:b3:ea:bb:36:11:22:60:8f:a1 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfI+Um/NEmaDpzy9kccx
80/tcp open http syn-ack ttl 64 Apache httpd 2.4.38 ((Debian))
|_http-title: Site doesn't have a title (text/html).
| http-methods:
|_ Supported Methods: GET POST OPTIONS HEAD
|_http-server-header: Apache/2.4.38 (Debian)
TRACEROUTE
HOP RTT ADDRESS
1 0.45 ms 10.0.1.129
There are only two ports open, port 80 and port 22. I will start my enumeration from port 80.
A quick gobuster scan shows a new interesting directory. /joomla
I ran the joomscan and could find the more interesting directories and joomla version.
Now I couldn’t find any other vector to proceed ahead. So I decided to bruteforce the joomla using the normal potential username admin , joomla and for password I created a wordlist using the homepage of /joomla.
cewl -w pass.txt -m 3 http://10.0.1.129/joomla
Now I used ZAP to bruteforce the /joomla/administrator login. I got a hit with username joomla and password Gotham.
I edited one of the template aand created a new hello.php file. Now I copied the pentest monkey php reverseshell script there and got a reverse shell.
There are three users according to the home directory. abner penguin and rob
Looking around I found the config files inside /var/www/html/joomla directory, which has a credential for database.
So there is mysql running internally. I tried to login to mysql using the above credentials and it was a HIT.
Looking inside the database I was able to find the user: password table. There seems to be a password for user rob, which exist as a user in our system too.
Looking at the table it looks like the password are base64 encoded. Lets decode the password now.
So the password is ???AllIHaveAreNegativeThoughts??? . Now port 22 is open for ssh so i will ssh as user rob using the password above.
Inside the home directory there is a file with name Abnerineedyourhelp . Looks like it is encoed using one of the rot rotation of characters.
Playing with the number of rotations to make sense, I used rot 1 and was able to decode the text.
I further decoded the base64 string at the end to get the potential password for user Abner
Password for Abner is I33hope99my0death000makes44more8cents00than0my0life0 . I was able to switch the user to abner using the password above.
Now I was stuck for a while to find the password for user penguins. I though I might have missed something, So I started looking again and found .dear_penguins.zip file inside /var/www/joomla2/administrator/manifests/files/.
Now unzipping the file using the password of user abner and looking at the content I found the password for user penguin.
No Iinside the home directory of user penguin, I find a SUID binary file.
But after reading the content of one of the file, it mentions that Joker is trying to create a find binary which only runs with root permissions, which won’t be of any use to us. There is another .trash_old which is an executable file.
Now again I was stuck here for a while for potential vectors. I started looking for the processes running using pspy , which looks for process that running in certain interval. Root is executing that .trash_old file every 2 minutes.
Now its all easy. I am going to add the malicous code in .trash_old file to get the reverse shell. The file is owned by penguin user so we can edit the file.
After waiting for a minute, I got the reverse shell as root.
