Bite Me - Easy

This lab relied on a lot of different attacks. First by fuzzing directories I could

Find the /console/ path which led me to a login screen. From there I needed to find a password

Which I was able to do by looking through the configuration file:

define('LOGIN_USER', '6a61736f6e5f746573745f6163636f756e74');

We can decode this base64 and get a username jason_test_account.

Now we need a password, looking at the code for checking passwords:

function is_valid_pwd($pwd) {

    $hash = md5($pwd);

return substr($hash, -3) === '001';

}

We see that it only checks if the password hash ends with 001, so I can use someone elses script

To generate a password until its hash ends with 001.

After logging in we needed to crack a MFA code, luckily there was no timeout or ratelimit so we could easy bruteforce this with a python script ensuring we passed the user accounts cookies.

Once we are in we can then use the internal console to look around, we find user.txt. We also see

/home/jason/

Inside of this we see .ssh/ and from there we can copy jasons id_rsa key.

Now on our attacker machine we can crack this rsa key to get ssh access, we will use johntheripper and rockyou.txt.

With the password cracked we can simply ssh -I id_rsa jason@123.123.123.123

And our password: 1a2b3c4d

And we are in.

Now to get the root flag we need to see what privileges we have. Running sudo -l we see jason is very limited however the fred user has NOPASSWD access to systemct and fail2ban. Lets exploit fail2ban for a priv esc.

Looking at a online guide we can modify the “actionban” command, this command executes everytime a user is banned. Lets replace the default ban script with one to create a privileged shell:

actionban = cp /bin/bash /tmp && chmod 4755 /tmp/bash

Since fail2ban can run as root with no password this is no issue and will create a priv shell after we restart the service and get a user banned.

Since fred has access to systemctl we can simply ‘sudo systemctl restart fail2ban’

Now we just run a hydra attack from our attacker machine to bruteforce any kind of field, it doesn’t mater as we just want to make as much SSH noise as possible.

After running hydra we can check and see if it worked. We can see a new ‘bash’ file in /tmp/

Running it with /tmp/bash -p we get a root shell and cat /root/root.txt.

boom

Previous: TOR   Next: Cicada - Easy