search

zerotroll

### By b13ss3d ###

There's also a video version, if you want to check it out: zerotrollarrow-up-right

Port Scanning

First we perform a port scan using Rustscan to identify open ports.

rustscan -a 10.0.160.113 -u 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Making sure 'closed' isn't just a state of mind.

[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.0.160.113:22
Open 10.0.160.113:1337

The scan shows that port 22(SSH) and port 1337(Unknown) is open. Next, we use Nmap to determine the services and their versions running on these ports.

  • -p <ports>

  • -sCV combines the options -sC and -sV.

  • nmap help: -sC: equivalent to --script=default

  • -sV: Probe open ports to determine service/version info

  • -n: Never do DNS resolution

  • -vvv: Increase verbosity level

  • -oN <file>: Output scan in normal format.

The output of the scan indicates that port 22 is running SSH and port 1337 is running a web server, so we can use a web browser to view the site’s content.

Searching on Google, i found the wollowing site where they gave Admin credentials: https://www.sourcecodester.com/php/15304/toll-tax-management-system-phpoop-free-source-code.html

Those credentials actually worked!!! OMG

SQL Injection

The previous Google results showed also this Github where we realize there are multiple SQL injections in this system.

https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Toll-Tax-Management-System

To exploit one of them we click on "User List", then on "action" and finally on "Edit".

Then we can read the /etc/passwd file with the following query:

' union select NULL,load_file('/etc/passwd'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL -- -

Because of the page structure we can see the contents of the file in a good way, so pressing Ctrl+U to see the source code fixes this.

Here we find the first flag, also that "ETSCTF" is a valid user on the target.

SSH Keys

Taking advantage of that we can read files, let's see if the user has a private key that we can use to obtain a shell as him.

' union select NULL,load_file('/home/ETSCTF/.ssh/id_rsa'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL -- -

He has!!!!!

Again we can press CTRL+U to view the content with a better structure.

Finally we save this key on a file, i saved it with the name id_rsa. Also we have to assign the file with the adecuate permissions:

We are in!!!!.

Privilege escalation

We search for files with SUID permissions

Among the files, we can see the "zero" file which is an uncommon file, so let's see what it does.

It just reflects the path of the binary.

Also if we execute it this way:

Since the binary has the setuid permission and the output reflects the first argument, we can use symbolic links to change this path and see if we can inject some commands: First let's see if it reflects the name of the symbolic link, we create a symbolic link called test.

and it does.

Now let's create other with a name between backticks like this: Also we put this between single quotes because if we didn't the command would get executed.

The command is being executed and as ROOT!!!!!!!!!!!!!!!

Finally we can assign SUID permissions to bash with the following command.

The slashes cause trouble, so instead of placing the absolute path, we can try nesting another command in this case $(which command) that when gets executed is gonna give us the path of the bash.

It worked!!!.

We execute bash with the -p (Turn on privileged mode) flag.

And we are root!.

Flag paths:

PreviouslightlyNextmezcal

Last updated