✅Nineveh (Medium)
Lesson Learn
Report-Penetration
Vulnerable Exploit: LFI, Code Execution, Weak password policy
System Vulnerable: 10.10.10.43
Vulnerability Explanation: The machine is vulnerable to LFI on port 80 and set up with weak password policy. On port 443, it is vulnerable to Code Execute via phpLiteAdmin. It chain from LFI to execute our reverse shell and allow us to gain initial shell on the machine.
Privilege Escalation Vulnerability: Chkrootkit version out of dated
Vulnerability Fix: All users must set with strong password, validated the user input and apply patch to the system.
Severity: Critical
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 Apache/2.4.18
By going through webpage on port 80, but nothing is there even source code.
By nmap script, we found hostname nineveh.htb. Let add to /etc/hosts.
Following through the hostname, we still got the same page.
Let run gobuster to find if there is any directory hidden. We found one directory /department.
Going through with /department directory, it leads us to the login page. First thing come to mind when I see login page, I will try with default credential and SQL injection but doesn't work.
By viewing the source code, we can assume those are username admin and amrois. On the login webpage could allow us to enumerate the username.
Once we enter username admin and random password, the error message display "Invalid Password" and if we enter username amrois, it displays "Invalid Username". We can confirms that username is admin.
Let start intercept proxy on burp to check how many parameters are require once we hit login.
Brute Force web
Let perform hydra to brute login with username admin.
Wait for sometimes, we found the valid credential with username admin
We are now successfully log into the webpage. By click on Home button it doesn't work. Then, on Notes button, it displays some information.
There is another way to bypass the authentication.
strcmp() function in php use for comparing 2 strings.
Port 443 Apache/2.4.18 (Ubuntu)
Let start with port 443, we found the different webpage. Viewing the source code but nothing.
Let enumerate on Certificate whether we can find other hostname. We got the same result.
Let run gobuster to find if there is any directory hidden. We found there are two directories are interesting /db and /secure_notes.
Following with /db directory, it let us to phpLiteAdmin login webpage. Trying with default credential and SQL injection but doesn't work.
Let start bruteforce once again against db login webpage. We got a valid credentials.
We can log into phpLiteAdmin now. phpLiteAdmin is a PHP tool to interact with SQLite Databases and it's similar to phpMyadmin databases.
SQLite is a kind of plain text database system, we can insert php code in a table and rename that database to .php we can execute it.
Then, going to /secure-notes, it just displays an image seem like it's something we need to check.
Exploitation
Port 80 (LFI)
On the URL, we have seen the parameter file path and the thing we need to test is LFI.
include(): is the php function and if we get any PHP code there, it doesn't matter what extension is, it's going to execute that file with PHP.
From the above result, if we don't include the /ninevehNotes, it will return "no Note is selected".
Now it's working. Normally for LFI vulnerable, it usually needs another vulnerability in order to get remote code execution.
Port 443 (Code Execution)
By searching for public exploit on phpLiteAdmin, it is vulnerable to PHP remote code injection.
PHPLiteAdmin RCE
First create a new table with name: testing and number of fields: 1.
Let inject the php code into the field and change type to text and hit create.
We can go change the database name with .php extension and we can see the path to execute.
Let get back to our LFI and get execute the file path. As we got the error message.
Let change execute to <?php system($_REQUEST["cmd"]); ?> and now it executed.
By now let send this request to burp and start our netcat listener on port 4444.
Let grab revershell from pentest monkey.
Privilege Escalation
Let start transfer file lineum.sh for enumerating on the victim machine.
From our victim machine, we can grab and execute the file.
As we can see port 22 open on the machine but our nmap result doesn't detect that.
Let start transfer fie pspy32 to our machine to enumerate the process running on machine.
chkrootkit (Priv-Esc)
We notice every second or minute, file chrootkit always run.
Otherwise can run the script from Ippsec video,
By searching on public exploit, we found it's vulnerable to local privilege escalation.
Go to /tmp folder and create file update with bash scripting reverse shell.
Let start our netcat listener on port 5555 and wait about 1minute our shell pop up as root user.
Extra Content
Steganography (Image)
Remember, we found an image on /secure-notes. Let download the image file and check on that. Checking the file type of that image just simple PNG image.
We can use strings command on the file to view the image file in string value. We found the ssh key stored on the image file.
other method, we are using binwalk for searching binary images for embedded files and executable code. We can see hidden tar archive file.
-M stand for Recursively scan extracted files
-e stand for Automatically extract known file types
We can now start ssh to the server with private key and username amrois. But unfortunately it doesn't response anything.
Port Knocking
On the machine, we found port 22 open on the machine but nmap can't detect.
We can check on the process running, we found this,
On the machine, we saw this one as well. Let view the file content and we see default_file path.
Viewing the content of /etc/default/knockd, we can see the config file /etc/knockd.conf.
Again, let view the content of the file. We found the sequence port to openssh.
Let knock the port to open with for loop. https://wiki.archlinux.org/title/Port_knocking
Let check on port 22 again, we found it opened now.
Now we can SSH to the server with username amrois.
Last updated