Pwned Write-Up
Introduction
In this write-up, I will guide you through the steps I took to complete the HackMyVM - Pwned CTF challenge. The objective is to gain root access to the target machine by exploiting identified vulnerabilities. Checkout the video here (update this).
TL;DR
Reconnaissance
Network/Port Scanning (Nmap)
Command:
Explanation:
nmap: Tool used to scan network and ports to discover which services are running.-sV: Perform version detection of services.-sC: Scan using default scripts.-oA: Output in filename "pwned".172.16.101.85: IP address of Pwned VM on my network.
Output:
Findings:
We see that there is a web server running on port 80, an FTP server on port 21 and an SSH server on port 22 which I am assuming is for better shell access after we find the user password or private key.
Let's check out the web server and in the background we can run gobuster to brute force web directories.
Directory Brute-forcing (Gobuster)
While we brute force the directory of the website, we can check out the website on a browser.
Command:
Note: I have setup an alias to run gobuster inside a docker container.
Alias:
Explanation:
dir: Mode of operation indicating directory/file enumeration.-u http://172.16.100.9: Base URL of the target web server to scan.-w /SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt: Base URL of the target web server to scan.-x php,txt,html: Search for the PHP, HTML and TXT file extensions.
Output:
Analysis:
There are some interesting URLs we can checkout such as /robots.txt, /nothing, /hidden_text. Let's look at them in that order.
Visiting Web Page (Port 80)
So, apparently the company has been hacked by Annlynn and we are looking for flags in a system that has been tampered with by this hacker.
Checking the source code of the page, we see this:
There is a comment at the end of the page, but nothing valuable in it. So. lets checkout the other interesting URLs.
We visit the URL /robots.txt and we see the following:
It shows what we already know that there is a /nothing URL present on the web server. So, it is time we check that one out.
We visit the URL /nothing and we see the following:
We visit the URL /nothing/nothing.html and we see the following:
With the following as the source code of the page:
We found nothing interesting here as well, so we move on to the most interesting one from our Gobuster output, the /hidden_text URL.
We visit the URL /hidden_text and we see the following:
We visit the URL /hidden_text/secret.dic and we see the following:
Output:
Output without "/":
Here we find some more possible URLs that we should take a look at. To see which URL of the above work we can use Intruder from BurpSuite and take a look at the responses.
Send the following request to Intruder in BurpSuite and add the payload as shown:
Copy the payloads from the above list (without the "/") and paste it in the Payloads tab in Intruder, and start the attack.
Following is the result of the attack:
We can see that only one page is reachable and the rest give a status code of 404.
So let's try visiting the URL /pwned.vuln:
With the following as the source code of the page:
The source code gives us the credentials for the user ftpuser. We can try these credentials on the FTP server.
Exploitation
FTP Server (ftpuser) Access
Use the following command to connect to FTP server:
And when prompted, enter the credentials we found.
We get access to the FTP server and we can see that there is a directory share available on the server.
To download all the files from the FTP server, use the following command:
Output:
After running the above command, a directory called 172.16.101.85 will be present in your current working directory and inside it will be the share directory from the FTP server.
Private Key:
From the contents of the files present in the share folder, we get a Private Key and a note which mentions ariana which could be the user associated with the Private Key.
User (ariana) Access
Let's save the Private Key in our .ssh folder and use it to get SSH access to the ariana user.
Save the Private Key:
SSH into the server:
We see that the credentials work and we have shell access for the user ariana.
Read the user.txt file to get the flag:
Lateral Movement
We see that there is another file present in the user's ariana home directory which has the following contents:
We see that there is another file present in the user's ariana home directory which has the following contents:
So, thus we get the names of other users present in the system, namely selena and ajay.
User (selena) Access
To get a privilege escalation, we check sudo permissions with the following command:
We see that the user ariana can run the /home/messenger.sh script as the user selena. So, lets take a look at the script.
Command:
Output:
In the script, we can see that on line number 12, the script asks for a user input which is saved in the msg variable and then this msg variable is run as a command on line number 16. So, we can execute commands by giving them as a input to the msg variable.
So let's run the script as selena and give our command bash when asked for the msg input.
Command:
Output:
On giving our payload bash, the script is stuck and when we give another command, we see that the command executed and that we have a bash shell as the user selena.
First thing we do, is upgrade the shell.
Privilege Escalation
On running the id command as the user selena, we see that selena is part of the docker group, so we can execute docker commands.
Now, it is easy to get a higher privilege access. In this case, we will not get access to the root user of the system but we can mount the whole system as a volume on a docker container and thus have access to all the files in the system without any restrictions.
So, we run the following command to create a container that has a bind mount to the / directory:
Here, we are mounting the / directory to the /rooted directory on the container so that there is no conflict with the container files.
Output:
And finally, we can read the root flag:
Easier Privilege Escalation
As there is not a flag for the user selena, there is another way we can directly get root access from the user ariana. I believe this was not intended by the creator of the box as the box is very old and the vulnerability was reported in 2021.
Anyway, I just want to show that there is another way to get root access to the box.
Run the following command to check the version of sudo program:
Output:
We see that the version is 1.8.27 and there is an exploit available for it in this GitHub repository
Clone the GitHub repository with the following command:
And run the exploit as mentioned in the repository README:
And thus we have root.
And, we can read the root flag:
Last updated