Publisher Write-Up
Introduction
In this write-up, I will guide you through the steps I took to complete the HackMyVM - Publisher CTF challenge. The objective is to gain root access to the target machine by exploiting identified vulnerabilities. Checkout the video here.
TL;DR
Reconnaissance
Network/Port Scanning (Nmap)
Command:
Explanation:
nmap: Tool used to scan network and ports to discover which services are running.-sV: Perform version detection of services.-sC: Scan using default scripts.-oA: Output in filename "publisher".172.16.101.88: IP address of Publisher VM on my network.
Output:
Analysis:
The scan reveals two open ports: SSH (22) and HTTP (80). The HTTP server is running Apache 2.4.41 on Ubuntu. Let's investigate the web server for potential vulnerabilities.
Directory Brute-forcing (Gobuster)
While we brute force the directory of the website, we can check out the website on a browser.
Note: I have setup an alias to run gobuster inside a docker container.
Alias:
Explanation:
dir: Mode of operation indicating directory/file enumeration.-u http://172.16.101.88: Base URL of the target web server to scan.-w /SecLists/Discovery/Web-Content/directory-list-2.3-big.txt: Path of word list to use.
Output:
Analysis:
The /spip directory looks interesting as the website is related to SPIP. Let's investigate further for SPIP-related vulnerabilities.
And here is the web page:
The whole web page is about SPIP and our directory brute force also revealed a directory called /spip in the website which looks like:
A basic Google search of SPIP vulnerabilities gives us the exploit of CVE-2023-27372.
Exploitation
Exploiting The Vulnerability (Metasploit)
CVE-2023-27372
We will be using Metasploit to exploit this vulnerability.
Command:
Set the options and run the exploit.
Note: Make sure to set the TARGETURI as /spip
Meterpreter Session:
Analysis:
We successfully exploited the SPIP vulnerability and obtained a Meterpreter session. Next, we will use Linpeas for further enumeration and privilege escalation.
Background the meterpreter session using the command:
Note: Install Linpeas modules in Metasploit using the instructions here.
Set the options and run the module.
In the Linpeas out, you can find the following:
We see that the id_rsa.pub is present in the authorized_keys so we can copy the Private Key to your own .ssh directory to SSH into the machine using the think user.
User (think) Access
Copy the SSH Private Key.
Command:
SSH into the machine:
Read the user.txt file to get the flag:
Privilege Escalation
Gaining Root Access
Run Linpeas again to see what we can do with the think user:
We see that the /usr/sbin/run_container binary has extra permissions.
Trying to run the file, we get permission denied.
Upon closer inspection, we see that it is an other file which we are not allowed to execute. Which means /usr/sbin/run_container is trying to execute /opt/run_container.sh.
Let's check what permissions we have for the /opt/run_container.sh file.
We can see that we have all the permissions, and yet we are not able to execute the script. That means some other software (like an Endpoint Detection and Response) is not allowing us to execute the script.
Let there be ChatGPT, to solve our problems:
So, on checking out this AppArmor thing, we see that its rules are saved in /etc/apparmor.d
It is not necessary that we may be using the Bash shell, so lets checkout which one it is. Command:
Now lets checkout what we are not allowed to do because of AppArmor.
Line 12 denies read (r) access to the /opt/ directory and its contents. Line 13 denies read (r), write (w), and execute (x) access (rwx) to all files and subdirectories (/opt/**) within the /opt/ directory. Line 14 gives only some permissions to the /usr/bin directory and its contents.
So from the above, specifically Line 14, we understand that even if we call other shell binaries (bash, sh), it will have constraints.
So, instead we can just copy the bash binary to a directory which gives us all the permissions.
Checking which directory gives us all permission,
we see that /tmp is the one.
Let's try copying bash to /tmp and running it to read the /opt/run_container.sh file.
And thus we have the content of the file.
Since the file runs as the root user (when called by /usr/sbin/run_container), we just need to call a shell binary (bash, sh, zsh, ash, fish, etc) from it to get the root shell.
So, we edit the /opt/run_container.sh as such:
Now, run /usr/sbin/run_container and you will have root access.
And finally, we can read the root flag:
Last updated