Waldo

Waldo - 10.10.10.87

Target Enumeration:

OS: Linux

IP: 10.10.10.87

User: 32768bcd7513275e085fd4e7b63e9d24

Root: 8fb67c84418be6e45fbd348fd4584f6c

Ports / Services / Software Versions Running

22/tcp open ssh

80/tcp open http

8888/tcp filtered sun-answerbook

Vulnerability Exploited:

LFI to read nobody users ssh key

Privilege Escalation:

Root capabilities on /usr/bin/tac to read the root flag.

Exploiting the host:

Nmap

Looking at the webapp its a list reader/writer

Capturing the requests in burp allows dir listing for the root folder, you cant read files outside of this dir.

There is a file read so check the sourcecode

Start reading the sourcecode of the webapp

Can read and write to files

List all the files and copy output to a text file for review

Reviewing the code made lfi a little harder than normal

Eventually we found a payload that worked.

Now considering the ports we had open we would probably need to find some ssh keys of some sort.

Searching around we found a key for the user nobody.

The file is all messed up so copy to a text file and remove all instances of \n and replace with a new line:

And also delete all instances of \ through the file

Once Cleaned you will have the following file:

Chmod 600 the file and login as the user nobody to get the user.txt flag.

After enumerating the system it appears we are in a restricted docker container so try and use the previous key to login to the actual host with ssh

Another restricted shell, using the following command we can see a few things we can use

Rnano may allow us to create files

Bypass by issuing “bash --noprofile”

https://speakerdeck.com/knaps/escape-from-shellcatraz-breaking-out-of-restricted-unix-shells?slide=9

We have none of the correct paths with noprofile so execute the following

For privesc you need to understand capabilities

http://man7.org/linux/man-pages/man7/capabilities.7.html

https://packetstorm.foofus.com/papers/attack/exploiting_capabilities_the_dark_side.pdf

Run the following command to find all capabilities

getcap -r / > capabilities.txt

Then read the file

Tac will allow us to get the root flag

You can also read the root’s ssh key

Reverse the ssh key with sed

The key will not allow you to login to the root account so for now we will try and crack the root account with unshadow shadow password > keys

There is not much point as the following is set in sshd_config