All right.
Three to go.
Walk through.
Number eight is going to be a machine called Bash.
This is actually a really fun machine.
So we are going to start with IP address of Ten Top Ten Top Ten that 68 and you can go ahead and start
your and map scan now.
You might even want to try this box on your own first see if you can do it.
If you've been following along you've got the VIP check and see if you can do this box.
If you're just taking notes well then come on let's get started.
If you scan and go ahead and pause and meet me back once you've got your scan ready.
See you over there.
All right.
Let's take a look at our map scan.
And let me preface this with the big guys here any purring or meowing anytime I talk lately.
My kitten decides that she's got to be in my lap.
So she's with me in this journey and she's going to be learning as well with you guys.
So here on our end map scan.
We've got one port open and getting these three videos in a row.
So very very nice.
Again same deal.
We know that our attack surface is going to be through port 80 and we see that we have a version information
here.
So we've got a patch two point four point one eight.
Now we could quickly just search for that.
We could say hey search boy do you have anything for Apache to point for.
Remember we don't want to go to specific and see if they've got anything here.
They've got this Apache to Seitel that's maybe a possibility that we could see right away.
Two point four point one seven had denial service.
That won't help us actually route the box though and it looks like this is the only one is this Apache
to Seitel and that's actually a local exploit.
So remember again we're after remote code execution we don't want a local exploits but my help with
privacy.
If we're after something like that but in terms of actually getting execution on the box it doesn't
look like there's anything at least on search flight that's readily available here.
So as usual we'll go out to the web and just check out this Web site here and we'll say ten point ten
point ten point sixty eight navigate their OK so we've got this development Web site here.
And we see an excellent development site and we can navigate around here click and see all these go
to the pound signs.
We won't be doing anything there.
This is an index and this goes to single by age Jamal OK.
And you can see that page v bash helps with pen testing and tested on multiple different servers and
it's got a rectangle page P bash.
You can also see there's an uploads folder right here.
So possibly it's sitting in uploads folder but it looks like this is talking about a dev tool that he's
written just a little bit information gathering there.
There's not a lot here.
So it looks like from a hunch that we can probably just say uploads and see if there's anything there.
OK.
And there is an uploads but not sure exactly what's there.
So a folder definitely is there.
I don't know if there's an actual way to upload yet.
So a good way again to do something along these lines is we probably need to do some directory busting
and we can go ahead and just use dir buster.
And this should all be pretty common right.
This is kind of a refresher up until this point.
So what we're gonna be looking at is this HDP and we're going to be doing ten at 10 10 to 68 on port
80 we'll choose go faster.
And then of course we browse and we're gonna go to the base folder here and go into user share to start
typing wordless
and then dir Buster here.
Again this should be a refresher.
We'll pick the medium or list
and now on this one.
This is an Apache site.
So our file extension of HP is OK.
And I think that's all right.
I don't think we need anything else we'll look for directories and then we'll also look for file extensions
if we don't find anything and we're we're certain that you know there might be more hidden behind the
scenes so we can start looking for text files zip files et cetera.
Let's go ahead and just start that scan.
You can see right away it's already finding images upload BHP finding a bunch of stuff as well at that
run for a second.
Another thing that we can look at is that we can view the source code and see if there's anything in
the source code here again we're looking for anything that might be a hard coded credential or even
though you know even CTF staffer says hey look at this directory you dummy.
So you see all kinds of things in the source code.
So nothing there.
Let's look at this again and let's see the source code here.
Let's see.
There is nothing as well so I will admit that I actually have not done this box.
I understand how to do it.
I've done it one time through but prior to this this wasn't a box that I've actually routed I just picked
it because it looked like it could be interesting.
So let's go ahead and take a look at our door buster and see what's popped up here.
We can click on the list view or the results tree.
There's those trees nice it just gives us some things to look at here is we can dive in we can click
on some of this.
So you can see there is an upload there's P HP send mail.
There is a dev folder as well and
there's some javascript.
OK.
They're running J.
Query main.
So this p p Bash looks interesting because if you look here this p p bash is what he's calling his program
that he said he's written and it looks like it is a terminal on a Web site.
Right.
So we call these web shells so when I see the HP bash and it's in the dev folder maybe that's something
that could be of interest to us.
So let's go ahead and just navigate over to Dev really quick and see what that might look like.
OK.
And let's click on one of these so it looks like it puts us in the var w w w h HTML Dev folder so we
can say l s and send that command.
OK so let's see if we can see these two a different folder.
Ok.
We did LSD there.
Let's look at the home folder.
Ok.
And pushes ask.
We are we are a rectangle or w w w data.
So let's see if we can even look at direct sales information
we can we can actually cat out the user of tax I'm betting and we can.
So we can grab the flag right away.
And in all intents purposes we have a shell at the moment.
This is pretty straightforward.
We can see what kind of information we have.
I'm guessing that we're not going to be able to actually do anything in the shell.
And you could see OK well pseudo dash l we can change into a user called script manager with no password.
That's interesting.
I also like to look at the history.
And I even see me do this before.
OK.
There's no history command here.
You see me do this before where I like to look at sudo shell and history.
Well history is not showing us anything but pseudo dash L is showing us that we have some access to
another user meaning that we don't have to supply a password right.
We can run the following commands with no password.
And that is just switch to user script manager.
So we saw that the user script managers in here are ready so we can take that avenue and see where that
leads.
Because I'm guessing if we go back we can't access the script manager folder.
Maybe we can and we can.
We'll see what's in here nothing in here but let's go ahead and pseudo switch user to script manager
and see what happens
no t t y present.
Oh man.
Okay.
So we're not going to be able to get any farther with the show that we have here.
So we're going to Web shell and we don't actually have a t t y which we'll talk about that here in a
second.
We need to actually get a shell through our terminal and then we'll improve into a t t y.
I'm guessing that we're not gonna be able to get into a t t y from the shell that we're in here.
So let's go ahead and take a look at how we're gonna do that.
So let's think this through here.
We have a user w w w dash data now in the past we have seen that if we can upload something malicious
think the Apache Tomcat situation where we uploaded something malicious to the web server we had access
to the web server we are able to exploit that.
OK.
So in the situation of Apache Tomcat we uploaded an Apache or Apache war file or a we uploaded a tomcat
war file I should say in this situation we're looking at an Apache shell now since we have access to
this w w w dash data that means we have access to right to the var w w w folder.
So let's go back to that and we go to S.D. and we go to var w w w h t AML.
This is the directory of the web page of the LSA here you can see all the page information that we were
seeing before we've got about the h t now we've got the dev folder CSX javascript BHP we've got this
uploads folder here as well.
Let's go ahead and see these into the uploads we just take a look we'll do allies and upload.
There there's an index that h t AML we can copy this in.
Go and see if there's anything on the index that HMO
sorry uploads index to age Jamal see if actually gets us anything and it's just a blank page and that's
OK.
So what we can do is we can upload something to this uploads folder.
Now let's think about this and how we could do it.
How are we gonna get a file from this machine from our machine to this machine if we don't have the
upload function.
Well we do already have a shell so we can use something like W get maybe to upload a malicious shell
OK so spin the wheel started thinking about it.
What what kind of shell are relooking for and you've seen this before in the past as well on a Windows
machine where we did the ISP we generated one and we could potentially generate one with MSF venom but
we can also go out to Google and there's actually a nice p p reverse shell out there let's see which
one it is.
I think it's this pen test monkey Yeah.
This one so.
Page for your verse shall right.
Panties monkey.
Yeah.
You see that there is a shell it gives us and we just change this here.
So all we do is change the IP in the port we wanted to call to and then we run a net cat listener.
Listen for the reverse shell the interact and we should get it back.
So let's take a look at this.
Let's open here.
And open this and I'm just going to go ahead and change this.
Drag this out to the desktop of I can see if I can move this case so I'll change it out to the desktop.
It's not going to let me drag it OK.
That's fine.
So I'll copy all this and then all the save it to the desktop.
So we will do a new tab here.
I'm going to change over to a desktop that's downloads.
You could see where my auto complete in my mind is going.
So we'll get it and we'll just call this we'll call it red dot.
BHP OK.
Paste this in here and then they already told us what we need to do.
Look it says change this.
It's got a common next to it.
Change this.
OK so let's look at our IP address our IP address is 14 that 20 1 10 top 10 to 14 not 21.
Let's go ahead and answer that in part 1 2 3 4 it says change it.
We could just leave it it's fine.
Let's say that OK.
Now if we're going to do w get why do we need to do we need to host this file so we can get it from
the other machine right.
So let's go ahead and do that.
Let's use our Python Dash.
M simple H TTP server on port 80 this should all be very familiar in terms of the process and what we're
doing.
So come back here and let's just say ok w get and let's just grab that file so we'll grab HDP and we'll
do tend at 10 to 14 not 21 slash rad t HP see if that executes says saved so alas here and Rab that
P P is there meaning we should be able to navigate to Rab that P HP under uploads and execute that before
we do that.
Let's go ahead and kill this server here and let's set up a net cat listener with a switch of NBL P
and then remember we set 1 2 3 4.
So we're gonna listen on 1 2 3 4.
Now write a verse shall right.
We listen.
The victim connects.
So here hopefully this should work.
We're gonna go uploads because that's the folder we put it in.
And then we call it read that page P.
Fingers crossed.
Some interaction.
Hey it works OK.
We are still this w w w dash data user.
Now we can't access the t t y if you don't know a t t why is it is what prints out stuff to the terminal
right.
It's it's hard to explain.
Call it stands for teletype.
We are not in a teletype shell.
So we have to improve this and one way that we can do this.
And I could show you.
Because if we try to do pseudo dash Al again let's see if we can escape this.
We could say suited ash or pseudo switch user script manager and see if that works.
Now T2 I present same issue OK so let's come up to here and go to Google and this is something that
you should familiarize yourself with because you will run into this situation even in some rural real
world situations trying to talk to you fast let's do t t t t t y escape and just enter that in and this
net set out w s here is a t t y shell.
This is a good one so we can use a combination of one of these.
What I normally do in this situation is I'll just go down the list and copy and paste and see if I can't
improve on this shell so we'll copy and paste this first one here.
And it's been s h but we're actually after bin bash.
So let's let's try to get a bash shall if we can and then we'll.
If it doesn't work we'll try.
Ben S age and friendly note this may actually kill your shell if you fail so just be ready to have to
improve upon that or redo the shallow if it fails.
But look now we improved it so that actually worked OK.
So we're looking at this and see how we just have the dollar sign here because we're not in t t y now
we're in t t y.
This looks familiar to us.
This is what any other Linux looks like right.
Root actually here you can see w w w dash data at bashed.
OK.
So you've got that user.
And now we can try the pseudo switch user and go into a script manager should be able to do without
any password
and I'm failing you.
OK.
So I should be able to instead.
Instead of switching user let's try something else if we can't do without a password we can run commands
as the password.
So without a password I should say I self against which the user.
That's OK.
What if we can do sudo and then user and then we just do script manager instead and if we want to run
a command as a user what if we run the command.
Bin bash Well there you go.
We just switched into bin bash as script manager.
So we have a TDY as the user anyway case that's a little trick if you're in this situation sometimes
you will see something along the lines of you may run commands on bash as user or you can run or change
user into the user without a password at all.
So it's always good to try especially if you have sudo privileges as root which I've seen before.
You can literally just use sudo switch user dash like this and get you into a route without having to
supply any password at all.
So it looks like here we actually do have to supply a password.
No big deal.
We can just work around that by supplying the user with a forward such bin for its last batch and calling
that out here.
OK so now we say who am I.
We are script manager good OK so we are in what directory we're in the forward the base directory here
for its last right.
So let's let's play this one first OK.
And if we come through and just look at this also we should before we look at all this let's let's pseudo
dash L and see what we can do.
We can't do anything.
So that's gonna be a fail for us.
No big deal.
Other thing we should look at is history got no history either so that's OK.
No history no pseudo privileges.
Let's go back to this scan here or this ls L.A. just to look at our base folder and see where we have
access.
So if we look at the ownership of who owns what folders you can see there's actually a scripts folder
here.
Now if you are familiar with Linux at all there's not typically a scripts folder so you have common
folders like bean boot Etsy.
Right.
Scripts is not one of them so the more experience you have with knowing folder structure and looking
for certain things like a lot of times you'll see backup folders or something in the bass folder the
forward slash here you'll see backup folders or weird folders here and you just kind of want to dig
into them.
Well this is one of those weird folders because it stands out in a couple of ways one we know scripts
doesn't exist and two everything's owned by root except script manager here is not owned by root.
So if we go ahead and just see these into scripts K and we analyze this ask that chalet
OK.
We have a script manager test out pi and we've got a test stat text.
Let's cut out the test PI because we own that OK.
So we we are running test up pi and when we do that we set a variable the open test on tax so we're
gonna write to it.
We're going to write Testing one two three and then we're going to close it.
OK so what can we do.
Let's see.
Well here we can my guess as to what's going on.
Thirteen thirty three.
Look what time it is.
Thirteen.
Thirty three.
So my guess is that this is taking a script.
It's running a cron job somewhere or a scheduled task.
Same thing right.
It's running a scheduled task and it's saying hey every so many minutes.
Go ahead and write this file out to test that text.
And look what it's saving and storing as it's saving and storing as root.
All right.
So what can we do here.
Well let's take a look.
Let's let's play again.
See it.
Has it updated.
Yeah it's updated again.
So it's running pretty much every 1 minute.
Now we can overwrite this file and set up a listener.
So what if the overwrite this python file with a python command that will tell this this output or however
we do it.
However we want to make it this python file to execute as root.
And then talk back to us.
So think about what I'm trying to say here I'm saying what if we make this python command into a reverse
shell somehow.
How do we do that well let's go to our Google machines and we'll just type in Python reverse shell and
let's take a look at the reverse shell cheat sheet.
This is a great cheat sheet.
I think we've been here before as a as a class if this is our first time I'm sorry.
By feel like we've seen this at least once before.
But this is the cheat sheet of all the possible one liners.
Now this I use all the time most commonly bash here but in other terms we can do.
I mean we could do anything like if we need if we can execute Perl on a machine or python a machine
BHP etc..
Net cat.
So a lot of examples here.
What we're going to do is we're going to use this one liner we're not going to execute Python dash see
that's just a command.
We're gonna go ahead and copy what's inside of it and let's open up a notepad first so you can see what
it's calling out.
Is Ben S H.
We can make it bin bash as well and we can just say dash I.
Which is interactive mode.
So all we're saying is hey we want interactive mode which is just what you're seeing here with a T T
Y so what we need to supply is a whole host a listening host and a port.
We've already used one two three four four this shell so we can make this something like two three four
five and then we just need to supply our IP address.
So 10 10 14 20 one for me.
And some of this should look familiar if you're familiar with Python a f iiNet is your IP V for address
SOC stream is just your port.
So just calling socket dot socket setting it to a variable s here and it's doing it as connect to this
and then it's calling out to actually run been bashed with an interactive mode.
So I'm going to go ahead and actually just copy this and let's see if we can paste it in a nano if we
can't paste it Nana.
That's fine.
Let's see if nano exists.
But before we do that let's also call out that we're going to be listening just because this is on a
timer so we'll do two three four five.
Listen here and let's go ahead and just nano test stop pi.
See if that's on the machine.
OK.
There is no nano for this.
What we can do then is we can all this close this and over here we'll host up one more time we'll just
say get it test stop pi pace this guy and say that close and then we're gonna say pi fine simple H GDP
server for 80
come back and let's just do a W get again.
So we'll replace the file that's in here and we'll say 10 10 to 14 that 21 slash test that pi K saved
it oh it's not going to overwrite let's remove let's remove test stop pi and then we'll w get that again
OK alas and let's also remove our old test pilot we're at it
OK.
So in theory whenever this runs again this should create a shell here that should talk back to us and
let's cover while we wait.
Everything that we've seen so far.
So we started with our map scan our map scan revealed port 80 and this lesson for you guys may have
been a little bit faster but that's only because I expect more out of you.
Now we are in episode eight right.
So and there's our shell or an episode eight.
And you've kind of been handheld and I'm still going to hold your hand all the way through this series
but I expect more I expect some of these things for you to have practiced and for you to you know be
familiar with.
So we saw poor 80s open.
We know a few things on that.
Right.
We could check the service version information.
We can go check out the Web site look at the source code.
We can also run something like Nikko if we wanted to for vulnerability scanning we can run door buster
like we did and find information and it just kind of think it through.
From that point we already found a shell we were able to get a user tax if we really wanted to.
But you know we just have to think outside the box.
OK.
Well we have access to this folder we are WW w dash data.
We've seen reverse shells on web servers before we've seen of a tomcat.
We've seen it with ISP or I guess.
So what is any different than what we've done before except where just using HP so a little bit of thinking
outside the box a little bit of googling and it tells you hey you know just I'm going to go ahead and
use PSP reverse shell find one on the web that you like generate one if you if you want in and use that
but you should be able to do it on your own now.
And then once you're in there.
OK.
We don't have the best experience with privacy.
You know and there's a lot of things that we could do a privacy.
We're just very very lightly touching the service still when it comes to privacy especially on the Linux
side.
But what you saw here was OK pseudo Dasha.
We saw that that worked just fine.
And it showed us hey you can run commands as this user.
OK.
So we were able to run the command we ran into a little issue with the UI escape.
You've never seen that before.
But T2 escapes are pretty straightforward for the most part.
Sometimes you get stuck in what's called T Y how.
But in this instance it was very very straightforward first when we copy and paste it actually work.
So that's very good thing there.
And then once we did that we were able to switch our shell into our new user from that user.
We were able to look around we check sudo again couldn't use it.
We checked history nothing there.
And we just did a quick LSD L.A. to see properties and ownership permissions and those ownership permissions
showed us a folder that typically isn't on a Linux machine.
And it showed that we are owner of that folder and you dig into that folder and you see hey there's
a script running.
You read the script it's very basic python and it tells you what it was doing and then you look at what
file it's creating and you see that it's running as root and it's updating every minute.
That just tells you in the background you go look at the cron jobs and see if it's there but those tells
you in the background there cron job is running and that cron jobs are running every minute to update
this.
This shell the script right.
So we update it.
We use a one liner and that's something that's new but we use a python one liner because it's written
in Python.
That's what it's expecting right.
And we get this nice reverse shell here we are root here we can say who am I.
And you see that we're root.
So we have own this machine as well and hopefully that's a nice lesson and it's a little straightforward.
Some of you have been saying that you really like the homework aspect of what we've been doing so I'm
going to go ahead and announce here at the very end that for the next homework what I want you guys
to do is I want you to look at the boxes Granny and Grandpa OK.
They're very very similar boxes if you root one you root the other guaranteed.
And I think that I know I know that everything I've showed you this far.
You have all the tools to do it.
It will be a very very basic refresher for us.
I even think that these boxes are easier than optimum because optimum required a little bit more detail
thinking outside the box.
So let's go ahead and just do those two boxes next.
And since they're so similar and they were released around the same time they are meant to couple with
each other a will does do the videos together in one session and we'll run both of them at the same
time.