✅Node (Medium)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Unrestricted access to sensitive information and Weak password policy
System Vulnerable: 10.10.10.58
Vulnerability Explanation: Fuzzing the hidden files and directories which exposed the URL path to API contained list of users and password hashes. Due to weak password set that could allow to crack and gain access to backup file that stored user credential.
Privilege Escalation Vulnerability: Misconfigure group permission on backup
Vulnerability Fix: Restricted access to sensitive Path and implement strong password policy
Severity: High
Step to Compromise the Host:
Reconnaissance
Start with scanning all TCP port.
Filter out all unnecessary character and just grep only open port.
Enumeration
Port 3000 Apache Hadoop
First I will check on webpage. By going through port 3000, it displays a webpage of myplace.
By clicking on each user profiles, it doesn't return anything interest. There is a login option. By viewing the source code also no comment need to notice.
By running discovery hidden directory we didn't find any interest.
Let can back to the webpage and press Ctrl+Shift+C > Debugger. We can see there are some custom scripts.
Going through admin.js and /api/admin/backup, it returns authenticated False.
Going through home.js and /api/users/latest, we found there are 3 username and hash passwords and not admin account.
Again going through profiles.js, we found the code /api/users + $routeParams.username.
By following through /api/users, we found there are 4 users and 1 of them is admin.
Let grep all the hashes and try to crack them if they are using weak password. Go to crackstation and paste all the hashes in. Immediately, we found there 3 hashes were cracked.
Login with user and password on the webpage, it works. Once, we are in, it allows us to download Backup files. Let download and check if there is any interesting.
Checking the file type and it contained ASCII text with very long lines.
Checking the content on files and seem like it's base64 encoded.
Again check the file type is ZIP. Listing the file content in the zip folder.
Let try to unzip the file but it requires the password which we don't know.
Cracking ZipFile With John
We can use zip2john to grab the hash of the zip file.
Cracking ZipFile with Fcrack
Now we can Unzip the file. Enumerating on the file we extract, we found credentials on app.js.
Exploitation
Shell as Mark
We are now can ssh to the machine with credentials of user mark.
We are now on the machine but there is no flag of user mark. Enumerating on the machine, we found 3 users that allow /bin/bash.
Find user flag and we found it under user tom. By this, we will escalate to user tom or root.
Shell as Tom
Let check the service port running on the machine and process that user Tom's running.
Auto script JS
We can see service port 27017 listening on locally. Let check the content of both the files /var/www/myplace/app.js and /var/scheduler/app.js.
On /var/www/myplace/app.js we already check the content but /var/scheduler/app.js didn't.
The script will connect to mongo database. The function doc will run doc.cmd and delete the doc.
Let connect to mongo database with username and password.
Let now add reverse shell into object of tasks.
Start our netcat listener on port 5555 and wait for sometimes the shell pop up.
As we can see the user Tom is a groups of admin.
Privilege Escalation
Let check if there is misconfiguration of file permission.
We can see there is one file set SUID with admin group.
We should get back to the file app.js and found this path.
It looks like the script call out three arguments: -q, backupkey, __dirname.
Let start execute the file with following parameter. Otherwise, we could read the file properly. From Ippsec's Video, /root is bad characters, once we decode base64, it will show troll face.
But if we extract the file just specify root, it will display the correct content of root flag.
Priv-Esc Technique
Last updated