TuxHouse (Machine)
TuxHouse Machine solution.
Enumeration
Pinging the machine doesn't give us anything back, so it seems like ICMP is disabled, so let's add that option in nmap so we can start port scanning:
nmap -sC -sV -Pn 4.172.203.150
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-04 02:30 EST
Nmap scan report for 4.172.203.150
Host is up (0.16s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV IP 10.0.0.4 is not the same as 4.172.203.150
|_ftp-bounce: bounce working!
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:176.29.244.223
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.5 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 bd:11:7f:99:ca:12:28:38:1e:73:2e:04:83:09:4b:76 (ECDSA)
|_ 256 df:ed:f4:51:70:d8:61:07:8b:31:10:3b:a9:90:05:dc (ED25519)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
We see SSH and FTP open, and according to nmap Anonymous login is allowed on the FTP port, so let's connect to it and see what we can see:
Issuing commands on the server is enabling passive mode, so let's turn it off and then see what there is:
Let's get everything in here and check them.
We have a test file, a message that's telling one of the users that his connection is set up, and a file called "access" which looks like a SSH private key, but we don't have a username....
We can extract the public key from the private key using this command, BUT first we need to set correct permissions on it:
And we see a prompt for a passphrase, so let's use "ssh2john".
And we can see after a couple of seconds, the password cracked and is "stonecold".
So let's get back to the private key and login to the server:
We logged in with the username: "penguin"!
Doing sudo -l we see:
As "acaard" we can run this bash scripts and are able to set environment variables, let's read the script:
We see a simple bash scripts that show SUIDs, and the author is hinting towards path hijacking, since find is not using the full path, but echo is, we can make a custom "find" file that will spawn us a shell and set it in a custom path.
We will write the following in /dev/shm/find:
Making it executable, then simply using our sudo right, but with setting the path to /dev/shm so it executes our custom find that will spawn us a shell as "acaard":
And now we have user.txt in acaard's home directory:
Privilege Escalation
For further enumeration, we will upload "pspy64" to the host to see what processes are running:
Making it then executable and running it, after a while we see root is executing the script in acaard's home directory (ApacheTest.py).
Since the script is in a writable place, we can hijack some libraries if the script is using some, let's check it:
We see it's using scripts, when python loads a library it first searches for it in the current running directory, which is in our case here is /home/acaard, since this place is writable, we can make our own library and make root execute it.
We can make a python code to give us a reverse shell, or simple just read the flag and output in another file like so:
Let's make it executable and wait for the script to run.
And done machine! Happy hacking :) 🧛.
Last updated