HTB - SneakyMailer

Zweilosec's writeup on the medium difficulty Linux machine from https://hackthebox.eu

Overview

Short description to include any strange things to be dealt with

Useful Skills and Tools

Save a transcript of any session (even remote nc sessions!)

  • With the command script $log_filename you can save the output of any session, including stderr and output from programs such as nano and vim! This is extremely invaluable when you exit a session and have forgotten to copy or backup something you did. To stop the transcript type exit after exiting any shells you may have spawned during that session.

Useful thing 2

  • description with generic example

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.197. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oA <name> saves the output with a filename of <name>.

21,22,25,80,143,993,8080 open

Port 21 - FTP

First I tried anonymous login through FTP, but was denied access.

Port 80 - HTTP

port 80 - redirected to http://sneakycorp.htb/ - added to /etc/hosts

After adding the domain name to /etc/hosts

I found the names Cara Stevens & Bradley Greer from the messages pop-up. Possible usernames can be extracted from these names using common business username patterns.

I also checked the page source code to see if there was anything interesting in the messages that couldn't be seen in the previews, and found that Bradley Greer was my 'personal tester' and Cara Stevens was the owner of the company. Both seemed like good targets.

On the /team.php page there was a listing of company employees.

There was a huge list of employees at the company. I added the usernames and emails to lists for later use

I found out afterwards that there is a nice tool that can extract emails from a page: https://email-checker.net/extract

In the source code of the page I also found a reference to a register page at /pypi/register.php.

Dirbuster also found this page shortly afterwards, though there wasn't much else to look through.

I navigated to this register page and tried to create an account, however it did not seem to be functional.

typing in pypi.sneakycorp.htb redirects to the main page, loaded ffuf to see if I could find any other virtual hosts

on dev.sneakycorp.htb found a site that was almost identical to main page, though the register page was visible in a link here.

Tried to register again

Port 8080 - HTTP

Decided to check out the port 8080 on each of the virtual hosts, dev did not lead anywhere

, but pypi did: http://pypi.sneakycorp.htb:8080/

found pypiserver version 1.3.2 - newest is 1.4.2

https://blog.pentesteracademy.com/learn-to-interact-with-pypi-server-in-3-minutes-71d45fa46273

Port 25 - SMTP

Verifying valid email addresses

https://www.interserver.net/tips/kb/check-email-address-really-exists-without-sending-email/ https://www.mailenable.com/kb/content/article.asp?ID=ME020207 Sent an email to my personal tester greer-san... tested a few addresses, all seem valid

verified all the usernames

Sending a phishing email with SMTP

Searched how to interact with SMTP through command line - https://github.com/jetmore/swaks

no reply, so maybe try working local address? also put the "link" on a new line in case whatever script cant parse it for some reason (maybe the !?)

going to try restting box since getting no replies to phishing email, also remove ! from body to see if that causing issues

Was doing packet capture the whole time trying to see if my messages were being sent/recieved, and finally got a reply back from one

Got a click! The user Paul Byrd clicked on my link and gave me a (URL-encoded) password.

This decoded to give me a (super-complicated) password of:

Reading Paul's mail

Since Paul was nice enough to send me his email password, I decided to log into his mailbox to see what kind of information I could find

I put in the account information for Paul into my email client and pointed the server towards the target.

After logging into the mailbox I noticed there wasn't anything in the inbox (probably emptied regularly to keep other players from accidentally clicking on each other's phishing email links). There were two messages in the Sent items folder, however. The first was an email to the administrator root@debian asking them to change the password for the developer account. He was nice enough to send the old password m^AsY7vTKVT+dV1{WOU%@NaHkUAId3]C as well. I made sure to take note of this in case it was used anywhere, or in case the admin hadn't changed it yet.

The second email was addressed to low, which I thought was another potential username on the machine. The message laid out a task to "install, test, and then erase" all of the modules in the PyPI service. I hoped that perhaps Paul had created a script to automate this action, and that I could possibly get it to execute a module I somehow got installed to the service.

Since I now had credentials, I though it would most likely log into the PyPI server I found earlier.

nothing in packages

nor in the index page

However, this did not work, nor did logging into SSH. I checked back with my nmap scan to see if there were any other services I could try, and noticed port 21 - FTP was open, so I gave it a try.

FTP Enumeration

Using the credentials I had found for the delevoper account I was able to login through FTP.

I was able to successfully login, and began looking around. It appeared as if the ftp server location and files were the same as the live website. I exfiltrated some of the files to my machine for further analysis, but none of the files seemed to have anything interesting in them.

After testing some things in the FTP server, I realized that I had the ability to use the PUT command. Since this seemed to be the code for the site, I put a test file to see if I could access it from my browser.

Initial Foothold

Using this I was able to identify that I was running in the context of www-data.

, and that there were three users that could log into the machine: low, developer, and root

Next I tried adding my public SSH key to both low and developer since they could log in, but was unable to gain access with SSH since www-data could not write to those files.

Road to User

Further enumeration

got running processes, etc/passwd, could not add ssh keys, next tried reverse shell

sent my reverse shell, and immediately got a connection on my waiting netcat listener

started enumeration (remembered to switch to bash this time since zsh seems to have problems with upgrading nc shells)

in the /home directory there were only two folders, low, and vmail

found what looked like a hash for a user pypi in .htpasswd in the pypi.sneakycorp.htb folder

the hash came up as type MD5(APR)

hashcat's help ID'd it at an Apache MD5 hash

Finding user creds

The password enabled me to log in to http://pypi.sneakycorp.htb:8080/ with the creds pypi:soufianeelhaoui

There was nothing interesting on either of the sites linked on this page however.

I went back to the machine and tried to switch users to developer with the credentials mentioned in the email, and found myself logged in as developer.

I had a weird network hiccup that caused authentication to fail the first try, but then I found out that this user was not able to run commands with sudo

https://pypi.org/project/pypiserver/#upload-with-setuptools

On client-side, edit or create a ~/.pypirc file with a similar content:

Then from within the directory of the python-project you wish to upload, issue this command:

Then I wrote a setup.py python script as specified at https://packaging.python.org/tutorials/packaging-projects/#creating-setup-py

I first tried writing my public SSH key to low but the script was being run in the context of developer and not being installed for some reason. I added a check to make sure that low (userID 1000) was the one running it. Next I followed the instructions to install the package into pypiserver

I created the .pypirc file in my distribution's directory, then set this to be developer's home directory with export HOME=/dev/shm/pypi

User.txt

It complained a bit that I didn't create a readme, but it ran

Next I tried logging in with the ssh key I had made and was successful! I got that same temporary name resolution error when using sudo -l, where it seemed to hang for a minute, but this time I got a very interesting result!

A search for ways to privilege escalation with sudo and pip3 led to https://gtfobins.github.io/gtfobins/pip/

File write It writes data to files, it may be used to do privileged writes or write files outside a restricted file system.

Path to Power (Gaining Administrator Access)

Enumeration as User

Getting a shell

I was not in the directory I expected at first...the shell spawned in the tmp directory where the "module" was installed to

Root.txt

fine

Thanks to <box_creator> for something interesting or useful about this machine.

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - CacheNextHTB - OpenKeyS

Last updated

Was this helpful?