search

Saptang Labs Hiring Challenge

Challenge Type : Blackbox Testing

Challenge Description :

Download the VM and start it. It has a web application hosted which is configured to boot at start so you can put the VM in the background. Simply find the address of the application and start pentesting.

Challenge Goal : Find the file flag.txt and read its content.

First we start by finding the IP of machine here i used the netdiscover command.

┌─[aftab@parrot]─[~/Downloads/practice/challenge]
└──╼ $sudo netdiscover -r 192.168.1.12/24
Currently scanning: Finished!   |   Screen View: Unique Hosts                 
                                                                               
 5 Captured ARP Req/Rep packets, from 5 hosts.   Total size: 300               
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.1.4     **:**:**:**:**:**      1      60  CHONGQING FUGUI ELECTRONICS 
 192.168.1.1     **:**:**:**:**:**      1      60  Syrotech Networks. Ltd.     
 192.168.1.5     **:**:**:**:**:**      1      60  Intel Corporate             
 192.168.1.21    **:**:**:**:**:**      1      60  Intel Corporate

here 192.168.1.1 is ip of router.

we scane the IP 192.168.1.5,192.168.1.21 and the IP 192.168.1.21 have web service running at port 42710.

I use rustscan for port scaning in CTFs because it is insanely fast.

opening this website we have nothing but this page:

image

First though was to look for robots.txt file but no luck so i did directory bruteforcing with gobuster.

now we have some interesting directories like Admin and search_result.

Admin page requires authentication Username and Password.

http://192.168.1.21:42710/search_result/arrow-up-right

image

now this is something interesting there is link to

http://192.168.1.21:42710/search_result/result_2022.phparrow-up-right

image

The Results of 2022 have not been published yet so let's try 2021 :

http://192.168.1.21:42710/search_result/result_2021.phparrow-up-right

image

on submitting the form we have this response:

image

ID, Name, Roll, Marks it looks like it is fetching this data from sql database so lets try SQL injection.

this POST request have data=NjIxNzI5NTgx it base64 encoded value of 621729581.

lets try with simple payload ' OR 1=1 # but it is not working after few tries i tried 621729581 OR 1=1 base64 encode and it gives us all the entries hooray, and that is successful SQL injection.

payload=

<-- I'm using Hackvertor burp extension.

image

we know the number of columns it is 4 : ID, Name, Roll, Marks.So the payload for union attack would be:

payload:

It gives us the result in response so payload is correct and we also know the data types it should be Integer for ID, Roll, Marks and String for Name so we can put this values in payload.

payload:

response:

image

Now we can try to extract the databases'name, tables'name, columns'name.

Reference: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MySQL%20Injection.mdarrow-up-right

payload:

response:

Now let's try to extract table name.

payload:

response:

We have table with name users let's see the columns of this table.

payload:

response:

We have username and password here what should we do extract them!

payload:

response: |Admin|

username=Admin

payload:

response: |zohl8meicohci9raw0|

password=zohl8meicohci9raw0

We have username and password let's login as Admin.

http://192.168.1.21:42710/Admin/dashboard.php

image

looking at source code we have this comment:

image

visiting this page http://192.168.1.21:42710/Admin/edit_profile.php

image

We have functionality of file upload let's try uploading some php file.

Oops error can't upload php, let's try simple jpg file.

image

so we can only upload jpg file but how it is checking for file type extension? let's do one experiment rename the jpg file to php if error it is looking for extension and if successful it is checking MIME type.

Record updated successfullyThe file has been uploaded

so MIME type it is.

We have to create polyglot PHP/JPG payload. how i do it is open jpg file and append php payload at last so let's create simple.phparrow-up-right payload.

Record updated successfullyThe file has been uploaded and file is uploaded successfully but where ?

we have column name profile_picture in users table, if you remember that we still have SQLi.

payload=

result = |../assets/uploads/simple.php|

so our file is at http://192.168.1.21:42710/assets/uploads/simple.php

image

It works just fine let's get reverse shell. for reference: https://www.revshells.com/arrow-up-right

revshell.phparrow-up-right

we start listener: nc -lvnp 8888

and path= http://192.168.1.21:42710/assets/uploads/revshell.php

on visiting this file we have reverse shell:

We have shell but we can't access /home/heathrow we need to escalate our privilege. first thing that comes in mind is linpeas.sh let's move that to victim machine i create local server with python python -m http.server 80, to transfer file because we normally don't have internet access in victim machine.

change permissions to +x : chmod +x linpeas.sh

Now run the file: ./linpeas.sh

Analyzing the output we have first suggestion for [CVE-2022-0847] DirtyPipe:

image

reference: https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploitsarrow-up-right

we follow the steps in GitHub repo and we have exploit-1, exploit-2. transfer this to victim machine and run.

flag:

:octocat: Happy Hacking :octocat:

PreviousAcademy Box - PEH Capstone TCM Security

Last updated