HTB - Doctor

Zweilosec's writeup on the easy-difficulty Linux machine Doctor from https://hackthebox.eu

Overview

Short description to include any strange things to be dealt with

TODO: Finish writing and clean up

Useful Skills and Tools

Useful thing 1

  • description with generic example

Useful thing 2

  • description with generic example

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.209. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oA <name> saves the output with a filename of <name>.

Only three ports open: 22 - SSH, 80 - HTTP, and 8089 - Splunk

Port 80 - HTTP

on port 80 found Health Care website; contact information including domain info@doctors.htb

Further down the page found some potential usernames: Dr. Jade Guzman, Dr. Hannah Ford, Dr. James Wilson

Port 8089 - Splunk

Needed to use https. After accepting the security warnings about the self-signed certificates was led to a Splunk Atom Feed. Says Splunk build: 8.0.5

I tried clicking on the services link, but was prompted to enter credentials

https://eapolsniper.github.io/2020/08/14/Abusing-Splunk-Forwarders-For-RCE-And-Persistence/

Universal Forwarder is accessible on each host at https://host:8089. Accessing any of the protected API calls, such as /service/ pops up a Basic authentication box. The username is always admin, and the password default used to be changeme until 2016 when Splunk required any new installations to set a password of 8 characters or higher.

Crafting a python password brute force tool

Brute force does not seem to get me anywhere

Next I tried navigating to doctors.htb...and got redirected to a login page

Testing for SQLi gives me an error " Nope, no such luck. "

found link to /archive in source code,

this page is blank with no content

Registered for an account

After I created an account, I noticed a banner at the top of the page warning me that I would only have 20 minutes for it to live.

I tried some basic tests for XSS

I could see my post, but no alert after I opened it.

I tried putting a link to my machine in the Content box, but got a message that the link I posted was not valid, but I still got a connection back to my machine

Looks like the service is running curl. If there is no input sanitization I may be able to get code execution here.

Putting in a command at the end of my URL results in a request with the id context information the service is running under as the user web.

I tried to do some of my normal enumeration such as cat /etc/passwd, but it seemed as if I couldn't use any commands with spaces. Any commands I sent with spaces did not connect back to my machine.

Didn't work

in bash $IFS is a space by default

After discovering that I could use commands by plugging the space with $IFS, I sent a lot of different commands trying to enumerate the machine. (As you can see below, I only got very limited information back from each attempt.)

I figured out how to enumerate /etc/passwd one line at a time using tail -n;

I hoped that perhaps I could see more of the output in Wireshark, but unfortunately I could not.

I found a username shaun using tail -n2. Next, I tried to see if I could send my SSH key to shaun'sauthorized_keys file but it didn't work. After that I decided to try to get a reverse shell by sending a bash script and then executing it.

my shell script which simply contained a bash reverse shell

The three commands I sent through burp traffic:

sending the file using curl,

I verified that the file was there and accessible.

chmod +x to make executable,

and executing my shell script

I got a connection back from the remote host which downloaded my shell script

Initial Foothold

Road to User

After the shell script ran I receieved a connection from the reverse shell to my waiting netcat listener. Python2 wasn't installed, but python3 was.+-

Further enumeration

I was running as the user web which I immediately noticed was a member of the adm group.

Finding user creds

adm group can access process files and logs in /var/log

There were no useful hits for the word 'password' in these log files.

however in the apache2 folder there was a file named access.log.1 that contained even more log information, including a history of web searches for how to crack passwords and creating strong passwords. Then, in the file backup I found a attempt by the user to change thier password. It seems like the user got scared and decided to change his web password. I decided to check if this password would work for the other user on the machine (shaun).

User.txt

Path to Power (Gaining Administrator Access)

Enumeration as shaun

Could not use sudo as this user. However, now that I had credentials, I could potentially use the exploit for splunkd that I had found earlier...

Found a password hash in the file site.db. I was unable to crack it with hashcat, however.

Was able to use shaun's credentials to log into /services page on the Splunk site.

Getting a shell

In the exploit I had to configure some parameters

Root.txt

Got a root shell back, and collected my proof

Note: After finding the username of shaun, my password brute force method would have actually proved useful had I been a patient attacker. The vulnerable version of splunkd used here does not lock out accounts, so brute force is entirely feasible. The only problem is shown below.

I used grep to figure out whether shaun's password existed in rockyou.txt, and found that it did indeed exist, but was on line 2,136,945!

Using my python brute force script it took roughly a quarter of a second per try.

This would have taken over 154 hours to guess the correct password (this is assuming single threaded attempts). So, if the attacker had not been able to get a shell on the box as the web user and used the privilege escalation route, simply getting the username from /etc/passwd would have eventually provided access to a determined attacker!

Thanks to <box_creator> for... [something interesting or useful about this machine.]

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - TabbyNextHTB - Luanne

Last updated

Was this helpful?