Dyplesher, a Linux machine created by HackTheBox felamos & yuntao, was an overall insane difficulty box. The inital foothold was finding the .git folder on test.dyplesher.htb which give us the credentials for the memcache server trying rockyou we can leak few hashes from the memcache and we can crack one of that.Using the password we got from the memcache we can login to the gogs as felamos from which we see a gitlab mirror/backup. We see a repo.zip folder on the release page of the repository. After downloading that we see that is a git-bundle. After googling around i saw how unbundle that and get some information. from the repository we got we find a sqlite db looking into that we get another hash and Cracking that give another password. Trying that on the web server we are able to login and we see that we can upload Minecraft plugin. creating a plugin which write to user .ssh/authorized_keys and we can ssh to the user as MinatoTW. After getting a shell we still don’t find user.txt but checking the groups we see this user is a member of wireshark group. so i used dumpcap to capture some packets and sent that to local machine for analyses. which reveal some rabbitMQ messages containing all users password and rabbitMQ password for yunato. Su-ing to user felamos we see an interesting message which states yunato can publish message to plugin_data with an URL of cuberite plugin. so we create a bogus plugin to write to root authorized_keys and ssh-ing using that.
# Nmap 7.80 scan initiated Sun May 24 01:07:11 2020 as: nmap -p- -oN nmap/all 10.10.10.190 Nmap scan report for test.dyplesher.htb (10.10.10.190) Host is up (0.26s latency). Scanned at 2020-05-24 01:07:11 IST for 6056s Not shown: 65525 filtered ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3000/tcp open ppp 4369/tcp open epmd 5672/tcp open amqp 11211/tcp open memcache 25562/tcp open unknown 25565/tcp open minecraft 25572/tcp closed unknown 25672/tcp open unknown
Read data files from: /usr/bin/../share/nmap # Nmap done at Sun May 24 02:48:07 2020 -- 1 IP address (1 host up) scanned in 6056.07 seconds
Web - 80
Visiting that reveal we have a subdomain as test.dyplesher.htb
test.dyplesher.htb
Visiting this shows us this is something to do with memcache and it give us access to write to memcache via
1
http://test.dyplesher.htb/?add=a&val=b
also when sending same key and value we are also getting
1
itsequal
dyplesher.htb - 3000
Visiting Port 3000 reveals that it is a gogs server
So I wrote a simple script to dump stuff from memcache
1 2 3 4 5 6 7 8 9 10 11 12 13
import bmemcached client = bmemcached.Client(('10.10.10.190:11211', ), 'felamos', 'zxcvbnm') fp = open('/usr/share/wordlists/rockyou.txt','r') line = fp.readline().strip() while line: print(f"Trying for key {line}") response = client.get(line) if response: print(f"Got Value for {line} as {response}") break line = fp.readline().strip()
using that on gogs get us access to felamos account
Dumping the repo.zip from release we see that it is a git bundle. googling around i found a article which explains how to restore them.
so doing
1 2
git clone --mirror ./path/*.bundle f mkdir out;cd f; git archive master | cd (../out && tar x)
doing this for all the bundles we found that bundle 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce contain a sqlite db as user.db which contain a password hash as
john --wordlist=/usr/share/wordlists/rockyou.txt sql-pass Usingdefaultinputencoding: UTF-8 Loaded 1password hash (bcrypt [Blowfish 32/64 X3]) Cost1 (iteration count) is1024forall loaded hashes Will run 4 OpenMP threads Press 'q'or Ctrl-C toabort, almost any other key for status alexis1 (?) 1g 0:00:00:07 DONE (2020-05-2612:48) 0.1373g/s 222.5p/s 222.5c/s 222.5C/s alexis1..serena Use the "--show" optionto display allof the cracked passwords reliably Session completed
Cracking the password with john we get the password as alexis1 trying that with email felamos@dyplesher.htb we can login to the home for root domain
we are bought to a dashboard
Trying the upload feature and uploading just a random stuff we see we need to upload a valid minecraft plugin
Low Privilege Shell
Minecraft plugin
Whenever a plugin is loaded on minecraft a onEnable() method is called so googling around i used few tutorials to create a plugin and created a plugin which on load write to MinatoTWauthorized_keys
build it as a jar and upload it
after uploading that we can load our plugin using the reload feature of the page
and using the private key we can ssh to the box as MinatoTW.
NOTE I had tried with all the three username we had felmos,MinatoTW and yunato. And was successful with MinatoTW.
Issue
I faced an issue while doing this was in my plugin.yml instead of using class name i was just passing the package name as
1 2 3 4 5
main:com.f3v3r name: f3v3r version:1.0 author: f3v3r description: An Example plugin
instead of
1 2 3 4 5
main:com.f3v3r.main name: f3v3r version:1.0 author: f3v3r description: An Example plugin
which got me stuck for sometime
User
Capture some packet
As we see that we are in wireshark group we can use dumpcap to capture packets
1
dumpcap -i l0 -a duration:60 -w output.pcapng
Analysing the packets
I initially used strings and grep to look for any password which gave me what i want but also checked that entire package in wireshark
looking around we find a yunato folder which contain
1
echo'Hey yuntao, Please publish all cuberite plugins created by players on plugin_data "Exchange" and "Queue". Just send url to download plugins and our new code will review it and working plugins will be added to the server.' > /dev/pts/{}
indicating we need to something with rabbitMQ to get root maybe
going back to wireshark to look at the dump we see
that the publisher port is 5672
1
Just send url to download plugins and our new code will review itand working plugins will be added tothe server
from the message made me think about what i can do with that so
but we don’t get anything on out http server checking the wireshark again we see that the yuntao rabbitMQ password was EashAnicOc3Op and not wagthAw4ob fixing that in code and trying again we still don’t get anything
so i tried curling that file from the box and saw i was not allowed to do that.
I tried the open ports on the box from nmap and i tried with all those ports and saw only 11211 was allowed so i changed and ran my python server on port 11211 and modified the script to take the lua script from 11211 and running the script and waiting for few seconds we get the connection back on 11211 and using the private key we can access get root.txt
