Hack The Box Popcorn Writeup (Medium Linux)

Summary

Directory brute forcing Popcorn turns up a torrent hosting application under /torrent, whose login form errors on a single quote. sqlmap confirms the injection and dumps the users table, and the same flaw allows logging in as admin with a classic or 1=1 payload instead. As admin, the application accepts file uploads for torrent entries, and replacing an image with a PHP shell, once the server side magic byte check is satisfied, gives command execution on the host. The kernel is 2.6.31-14-generic-pae, which puts the box squarely in range of Dirty COW, so compiling and running the public CVE-2016-5195 exploit creates the firefart user and hands over root.

export IP=10.10.10.6

Service Enumeration

IP Address	Ports Open
10.10.10.6	TCP: 22, 80

Web Server Enumeration

Directory Bruteforcing

Vulnerability Explanation: Behind Security was able to enumerate the directory tree of the web server further by conducting a directory bruteforcing attack, leading to the discovery of hidden directories and a potential entry point.

Vulnerability Fix: To mitigate this vulnerability, the web server should implement security measures such as Web Application Firewalls (WAFs) to detect and block excessive or malicious directory enumeration attempts. Additionally, unnecessary hidden directories should be removed, and access to sensitive directories should be restricted.

Severity: Moderate

Steps to Reproduce the Attack: Execute the command: feroxbuster -u http://$IP -w /usr/share/wordlists/dirb/common.txt -t 10 -d 3 -o scans/ferox-common

SQL Injection

Vulnerability Explanation: A SQL injection vulnerability was identified at http://10.10.10.6/torrent/login.png. Behind Security successfully exploited this vulnerability using a tool named “sqlmap” allowing unauthorized access to the database. This presents a high security risk as it exposes sensitive information, including user emails and usernames.

Vulnerability Fix: To address this vulnerability, the application’s code must be reviewed and sanitized to prevent SQL injection attacks. Prepared statements and parameterized queries should be used to ensure proper input validation and data protection.

Severity: High

Steps to Reproduce the Attack:

1. Provide a single quote as the username to observe the SQL error.
2. Execute the command: sqlmap -u http://10.10.10.6/torrent/login.php --data "username=*&password=admin" --threads=10 --technique=E --batch.
3. Dump the users table using: sqlmap -u http://10.10.10.6/torrent/login.php --data "username=*&password=admin" --threads=10 --technique=E -T users --dump.

Authentication Bypass

Vulnerability Explanation: A SQL injection vulnerability at http://10.10.10.6/torrent/login.png enabled Behind Security to bypass authentication and log in as an admin without valid credentials.

Vulnerability Fix: This vulnerability can be remediated by implementing proper input validation and authentication mechanisms. Input should be sanitized, and multi-factor authentication can be used to enhance security.

Severity: High

Steps to Reproduce the Attack:

1. Visit http://10.10.10.6/torrent/login.png.
2. In the username field, input: admin' or 1=1#, along with a random password.

Initial Access - Arbitrary File Upload

Vulnerability Explanation: Exploiting the ability to upload torrent files as an admin, an attacker can replace a torrent icon with a malicious PHP shell, aiming to execute remote commands on the victim’s machine. Successful exploitation requires bypassing the server-side “magic byte” check.

Vulnerability Fix: To address this vulnerability, the application should thoroughly validate uploaded files, ensuring they adhere to acceptable formats. Additionally, server-side validation should be augmented to prevent the bypass of security checks.

Severity: High

Steps to Reproduce the Attack:

1. Log in as admin using the login form at http://10.10.10.6/torrent/login.php (use admin' or 1=1# as the username and any password).
2. Access http://10.10.10.6/torrent/index.php?mode=directory.

Post Exploitation

LPE to root

Vulnerability Explanation: The machine’s kernel version, 2.6.31-14-generic-pae, dates back to 2009 and is susceptible to the “Dirty Cow” vulnerability (CVE-2016-5195). This flaw enables an attacker with an unprivileged account to exploit the kernel and gain root privileges.

Vulnerability Fix: To mitigate this critical vulnerability, the system’s kernel should be updated to a version that includes the necessary security patches.

Severity: Critical

Steps to Reproduce the Attack:

1. Confirm the kernel version using: uname -a.
2. Download the Dirty Cow exploit and transfer it to the victim machine.
3. Compile the exploit: gcc -pthread dirty.c -o dirty -lcrypt.
4. Execute the exploit: ./dirty.
5. When prompted, set an arbitrary password for the new user (e.g., “firefart”).
6. Log in using the new user credentials: su firefart.