HTB - Unbalanced

Zweilosec's writeup of the hard-difficulty machine Unbalanced from https://hackthebox.eu

Overview

Short description to include any strange things to be dealt with

TODO: finish writing and do cleanup

Useful Skills and Tools

Useful thing 1

  • description with generic example

Useful thing 2

  • description with generic example

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.200. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oA <name> saves the output with a filename of <name>.

three ports open, 22-SSH, 873 - Rsync, and 3128 which was identfied as an HTTP Squid proxy

https://en.wikipedia.org/wiki/Rsync

rsync is a utility for efficiently transferring and synchronizing files between a computer and an external hard drive and across networked computers by comparing the modification times and sizes of files. It is commonly found on Unix-like operating systems. The rsync algorithm is a type of delta encoding, and is used for minimizing network usage. Zlib may be used for additional data compression, and SSH or stunnel can be used for security.

Rsync is typically used for synchronizing files and directories between two different systems. For example, if the command rsync local-file user@remote-host:remote-file is run, rsync will use SSH to connect as user to remote-host. Once connected, it will invoke the remote host's rsync and then the two programs will determine what parts of the local file need to be transferred so that the remote file matches the local one.

Rsync can also operate in a daemon mode (rsyncd), serving and receiving files in the native rsync protocol (using the "rsync://" syntax).

found an article on pentesting port 873 - rsync - https://book.hacktricks.xyz/pentesting/873-pentesting-rsync

apparently this machine had some EncFS-encrypted configuration backups enabled

I pulled the files to my machine using rsync.

The files looked like base64 names at first, but then I realized that they were likely AES encrypted, and the .encfs6.xml showed this to be true.

This XML file gave me all the information I needed to decrypt the files, except one thing...

I installed encfs and attempted to decrypt the data, but I found out I needed a password. While searching for how to crack the key from the .encfs6.xml file, I found https://security.stackexchange.com/questions/98205/breaking-encfs-given-encfs6-xml which led me to discover another "X2john" command that I didnt know: encfs2john.

While installing, got this warning

I found that the encfs2john program must be run on a directory, rather than a single file by itself. Using this script I was able to get a hash

Using john I was able to quickly crack the hash and discovered the password was...bubblegum.

I used the encfs program to extract the encrypted files from conf_backups to a folder.

It turned out that this folder contained backups of all of the configuration files for the system. There should be lots of juicy information here!

Inside the squid configuration block rules I found the subdomain intranet.unbalanced.htb, which I added to my /etc/hosts file.

there was a password of Thah$Sh1 which enabled a lot of the actions

I ran nikto to see if there were any vulnerabilities, it reported a few different backdoors, but must have been showing false positives since none of these existed.

while trying to connect to intranet.unbalanced.htb I saw and added intranet-host3.unbalanced.htb to hosts, but was denied.

noticed that this time the intranet host was was different: this time was host2. After testing a few times I only got host 2 and 3.

only one directory found. Tried again with files

searched for a way to enumerate squid more -

The squidclient utility is a simple HTTP client, with a few special features for use with Squid. For example, you can use a shortcut to request the cache manager pages. Rather than typing a long URL like this:

you can use this shorter version:

looking back at the config page, the allowed methods for the squid manager were given:

I was on the right track, now I just needed to figure out how to authenticate with the password I had found. The man page showed me that the -w $password would allow me to authenticate the proxy

menu got me a list of all of the info types I gould enumerate, though only a handful of them weren't disabled, and all of those were protected (required authentication)

it looked like intranet.unbalanced.htb resolved internally to a different address than I thought. It was pointed towards 172.17.0.1.

I put this address in my (proxied) browser, and it navigated to the same page!

mem and diskd did not return anything useful, but fqdncache gave me some interesting internal information

There were the IPs for the intranet-host 2 and 3 I had seen earlier. There didnt seem to be anything on 172.31.179.1 listed, so I tried it to see if it wasnt listed for some reason

pic

Taken out of load balancing, but not down? I wondered if there was a way to load it to evaluate this "security maintenance" of theirs

cache log at /var/log/squid/cache.log could be interesting. There was not much interesting in the rest of the available methods

Since each of the other hosts redirected requests for index.php to intranet.php I manually typed it in for host1 and it brought up the page. Now I needed to find out what the page was taken down for 'security maintenance'. The page looked pretty much exactly like the others, so I figured the vulnerability must be in the input fields

I entered a standard test for SQL injection a ' or 'a' = 'a in both the username and password field and my first try got a list of users. Only the username field was vulnerable to this

searched for how to use hydra with a proxy - https://forums.kali.org/showthread.php?18055-Hydra-using-Proxy

https://stackoverflow.com/questions/517127/how-do-i-write-output-in-same-place-on-the-console

For some reason sending the username in the username field caused my SQL injection to not work, however sending it as SQL parameter in the password field worked...strange, but I got it to work

For some reason I had to strip off extra ' characters from the passwords. I suppose the server was returning the same message for a '`' as it was for a valid character. I could have done a check and removed tests for a single quote, but if the password contained that character I would have missed it, so I left them on and stripped them at the end.

Initial Foothold

Road to User

Further enumeration

Finding user creds

Using bryan's password, I was able to login using SSH

User.txt

Luckily, this was also the user with the flag!

Path to Power (Gaining Administrator Access)

Enumeration as bryan

Unfortunately bryan was not able to run commands using sudo

ss -lntp showed a couple of ports open internally that were not visible externally

both of the ports gave an error while connecting. Port 5553 simply hung, taking my session with it

the hosts file did not show anything that I hadn't already enumerated through squid

Found the IP for the docker container mentioned in the TODO

was able to login to the container with Bryans creds

Only bryan and root are able to login

inside dnsmasq.conf there was a listen address of 172.31.0.1 - this was the same address I saw for the docker container earlier

checking locally cached routes and neighbors gave a new IP I hadn't seen before 172.31.11.3

I was not able to connect to the new address with nc, but there was a page hosted there on port 80 that curl was able to pull. I tried to curl the /admin page, but nothing returned

navigated to 172.31.11.3, found a pihole page, clicked on the link to the admin page and found a new vhost at pihole.unbalanced.htb

I searched for releases for pi-hole and found that the newest version was 5.1. After that I searched for exploits for 4.3.2 and found a remote command execution vulnerability had been discovered https://frichetten.com/blog/cve-2020-11108-pihole-rce/ and a metasploit module https://www.exploit-db.com/exploits/48491

Needed a password in order to log into the setting page,

The forgot password link gave some interesting information about setting the password for a pihole, but unfortunately it required sudo privileges.

https://hub.docker.com/r/pihole/pihole - tried to find it in the docker logs, but couldn't find the docker-compose.yml file.

Also did not have pernissions to read the docker logs

tried logging in with admin...and got in! (Should have tried that first!). I noticed that the service was running with root privileges

blocklist

blocklist update

The first part of the exploit seemed to work, but after the refresh I couldn't get it to display .domain. Perhaps it wasn't vulnerable to this?

https://github.com/frichetten/CVE-2020-11108-PoC

running the POC with all of the proper inputs stil did not work. I went looking for another exploit and found https://github.com/AndreyRainchik/CVE-2020-8816

the payload was away...

and I got a shell...as www-data!?

Getting a shell

and I got a shell...as www-data. I was in a pretty limited shell. I had no TTY, and some commands would not work (I couldn't even upgrade my shell using python!). AFter loking around a bit I figured I must be in the pihole docker container.

uname -a confirmed this for me

in the filesystem root / there was a file pihole-install.log which contained a hash of the webpassword

After poking around for awhile I realized that I had access to the /root folder.

In the file ph_install.sh I found the instructions for creating the WEBPASSWORD

The pihole_config.sh script contained another bubblegum-flavored password. Since the web portal was running with root privileges, I guess that the administrator may have used the same password for their root account.

I was not able to use su from this limited shell, so I tried it from my SSH terminal as bryan

Root.txt

Finally!

Thanks to polarbearer & GibParadox for... [something interesting or useful about this machine.]

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - IntenseNextHTB - Feline

Last updated

Was this helpful?