HTB - Blunder
Zweilosec's write-up of the easy-difficulty Linux machine from http://hackthebox.eu
Overview
This easy difficulty Linux machine featured a content management system that was new to me, and a simple to use but interesting way to bypass a common configuration used by system administrators to grant permissions without allowing root access. It required writing a Python script to brute force a login, and had multiple ways to exploit the vulnerable service to gain access. The root privilege escalation method was very realistic, but so simple and easy to do it was almost disappointing to complete this machine so quickly.
Useful Skills and Tools
Bypass restrictions on running commands as root sudo (ALL, !root) /bin/bash
sudo (ALL, !root) /bin/bashsudoallows for the specification of running commands as a specific user with the-uflag.To exploit the above restriction on running commands as
rootin versions ofsudo< 1.8.28Instead of specifying a username with the
-uflag, use the user's ID number (root is#0for example, but will not work since commands as root are disallowed in this case.)Specify an invalid number which overflows the integer buffer for the command. The easy way to do this is to use
#-1since this is an unsigned integer and will flip the bits around to be Integer_Max -1.You must know the current user's password to do this, since you are running a
sudocommand.
Enumeration
Nmap scan
I started my enumeration with an nmap scan of 10.10.10.191. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oN <name> saves the output with a filename of <name>.
There was not much to work with from my nmap scan as only port 80 was open.
Since there was nothing else I could do, I navigated my web browser to the HTTP site hosted on port 80 and found a website of random facts about random subjects.
While manually checking out the site I ran nikto, which revealed a lot of security misconfigurations though not many seemed accessible without credentials.
The nikto scan did reveal an /admin/ directory, at which I found a login page. I wasn't able to find anything useful and couldn't login without credentials.
There was also a .gitignore file that revealed a potential internal directory structure. Searching for bl-plugins led to https://docs.bludit.com/en/getting-started/plugins. Bludit turned out to be a content management system for hosting blogs.
Simple, Fast, Secure, Flat-File CMS
Using dirbuster I found install.php which reported that Bludit is already installed.
I also found the file todo.txt which contained a potential username fergus and some hardening steps that were taken to secure the site.
The header of the file config.log contained the line "/bl-kernel/img/favicon.png?version=3.9.2" which told me the version of the Bludit service was 3.9.2 . I did some research on "bludit 3.9.2 exploit" which led me to a few useful sites.
From the information in these sites I gained enough information to craft a Python script to brute force the login of the CMS. At first my script ran very slowly, so I looked up how to make the script multi-threaded to speed things up a bit.
After writing my python brute-force program based off the one in the POC, I loaded it with rockyou.txt and let it run. After it ran most of the day and didn't get any results, I decided to try another direction. Since the site had plenty of text on it I decided to run cewl against it to build a custom wordlist. I also included all of the pages I had enumerated with dirbuster.
This worked much faster. It still had to go through a few thousand tries, but for my multi-threaded script it didn't take long.
Initial Foothold
Now that I had a working username and password to the /admin/ page I was able to use the exploit I had found. I poked around on the site a bit and found an upload page that looked interesting, but after a bit of quick searching I found out that there was a nice and easy MetaSploit module so I fired up msfconsole.
https://github.com/rapid7/metasploit-framework/pull/12542/files
After doing a few quick configurations of the parameters for the exploit, I had a meterpreter shell.
Road to User
The file users.php in the /var/www/bludit-3.9.2/bl-content/databases/ folder sounded like a likely place to find some information about...users.
It contained what looked like a hash and salt value for an Administrator user. I loaded the hash into the program hash-identifier to see what it was.
The most likely hash type was SHA-1.
Further enumeration
After trying a few online hash-cracking sites and getting nowhere, I decided to keep looking before resorting to trying hashcat or john.
In the www folder I found that a newer version of the Bludit CMS had been installed. I hoped that I would find a newer version of the database, and was not disappointed.
Finding user creds
The updated users.php file contained an (un-salted!) hash for the user Hugo.
I checked the /home folder to see what users were on this machine and there was indeed one named hugo!
The first hash cracking website I tried the hash on immediately revealed the password as Password120.
User.txt
Since there were no remote connection ports open such as SSH, I needed to switch users in the shell I had. I decided to switch to bash since I wasn't too sure what capabilities meterpreter might have, and my commands seemed limited.
Once I got a system shell, I used my standard shell upgrade steps, but it didn't quite work the way I wanted, so I was stuck with a half-functional shell. Despite this I was able to switch users to hugo and collect my user.txt proof.
Path to Power (Gaining Administrator Access)
Enumeration as user hugo
hugoLooking into /etc/passwd revealed that there were three users who could login besides root: hugo, shaun, and temp. I decided to next check the groups of each user to see if one had use groups for privilege escalation.
shaun had a few interesting sounding groups: lpadmin in particular sounded like something to check out.
temp only had access to the temp group.
I also did a privilege check for hugo using sudo -l and found that this user indeed had sudo rights, and some interesting privileges. I did a search for sudo (ALL, !root) /bin/bash and found an exploit on exploit-db which explained a privilege bypass method where I could get around the restriction on running commands as root (!root) by tricking sudo by giving the user id number #-1.
https://www.exploit-db.com/exploits/47502
Description : Sudo doesn't check for the existence of the specified user id and executes the with arbitrary user id with the sudo priv -u#-1 returns as 0 which is root's id and /bin/bash is executed with root permission
The POC code for the exploit included a basic Python script which could automate running a program as root, but it would be much easier to exploit this manually and get a root shell since it is so simple to execute.
Getting a shell
First I ran sudo /bin/bash with user ID '0' to test the restriction on running commands as root to see if it could be bypassed by simply giving the ID number for root instead. This did not work (as expected).
Next I used the invalid user ID number '-1' with the same command and compared my old id command output to my new effective user permissions. I was now logged in as root and able to collect my proof.
Root.txt
Thanks to egotisticalSW for creating this machine with an easy, yet fun new privilege escalation method! I always love learning new ways to exploit systems that are so simple, yet so elegant.
If you like this content and would like to see more, please consider buying me a coffee!
Last updated
Was this helpful?