Mission : Get the root flag on `Pipe` which is a deliberately vulnerable virtual machine hosted at https://www.vulnhub.com/. The virtual machine can be downloaded at https://www.vulnhub.com/entry/secos-1,88/. I quickly loaded up the virtual machine into my VMWare Player and i was good to go !
Detailed Steps for getting root:
I ran a quick nmap scan to identify the Ip address of the Pipe VM. I use `host-only` networking for both my Pipe Vm and Kali box.
We identify the IP address of the new VM as 192.168.28.138.
A nmap scan of the box shows that the box is running a http service on port 8081 and a ssh service on 22.
We run nikto againts the webserver but dont find anything of much interest. We then dirbust the webserver which reveals a bunch of interesting directories that we should look into.
It seems that the vulnerable application allows us to create a user account and have a look at the various pages on the website. We see that among other things there seems to be 3 users on the box one of whom is the administrator. Also there is a way to send messages to the admin.
We also see an About page that tells us that the site has been developed using Node.js and MangoDB. At this point we try the an authentication bypass seen in Node.js and MangoDB systems. A good discussion of it is here : Hacking Node.js and MangoDB http://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html: . It seems that the box is not vulnerable to this bypass. We begin to observer the webapp more closely and find that the login page source code has comment which is a hint.
We have a look at the /hint page and its source code which reveals that we should launch a CSRF kinda attack on the administrator.
The hint page tells us that the administrator will visit any site running on 127.0.0.1 if he is asked to do so. The hint is clear that we should feed a URL to the administrator to see. This can be done via the messaging feature of the webapp which allows us the send messages to the administrator. Relooking at the webapp we see that there is a feature to change the password. We decicde to trick the admin into changing his password to our specified one. For this we create a HTML page with hidden inputs and POST the data to the /change-password .
We know ask the admin to view this page by sending him a message .
We hope that when the admin visits this page his password will get reset and we can login. Well after a few minutes we try logging in as admin and we see that our little trick has worked !
We login to the admins message board and see that he has a message from a user 'pirate` who claims to have cracked his password.
We try ssh'ing into the box with these credentials and we are immediately logged in !
Once we login we see that there a bunch of interesting files in the users home directory.
If we do a quick directory listing 2 things stand out. i) There is an internalServer running as root on the box ii) there is a additional ping.ejs file which is not normally visible via the public facing web interface.
We look at the contents of both the internerlServer and ping.ejs files.
It seems that besides the public facing webapp there is an additonal server running on the box on port 9000. This server provides a Ping capability for the admin to maybe ping other systems. When we look at the code for the ping service we see that the exec api is called with the user provided IP address without any input checks. We can inject code here as the application does not sanitize the input data.
We can launch the command injection both via the web browser or the command line. Let see both approaches .
a) Command line : We can use wget or curl to post data to the internal server and inject our code in the post request.
Here we send a post request with a ip address =1 and inject our 'id' command along with the request .
Similarly we can use curl to post data as well
b) Web browser : In order to be able to see the internal webapp on our attacking machine we use a ssh reverse port forwarding technique using the ssh -L parameter. Via this method we make the port 9000 of our victim machine available on our kali machine at port 4545.
Now we can access the port 9000 of the inernal web application
Detailed Steps for getting root:
I ran a quick nmap scan to identify the Ip address of the Pipe VM. I use `host-only` networking for both my Pipe Vm and Kali box.
We identify the IP address of the new VM as 192.168.28.138.
A nmap scan of the box shows that the box is running a http service on port 8081 and a ssh service on 22.
We run nikto againts the webserver but dont find anything of much interest. We then dirbust the webserver which reveals a bunch of interesting directories that we should look into.
It seems that the vulnerable application allows us to create a user account and have a look at the various pages on the website. We see that among other things there seems to be 3 users on the box one of whom is the administrator. Also there is a way to send messages to the admin.
We also see an About page that tells us that the site has been developed using Node.js and MangoDB. At this point we try the an authentication bypass seen in Node.js and MangoDB systems. A good discussion of it is here : Hacking Node.js and MangoDB http://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html: . It seems that the box is not vulnerable to this bypass. We begin to observer the webapp more closely and find that the login page source code has comment which is a hint.
We have a look at the /hint page and its source code which reveals that we should launch a CSRF kinda attack on the administrator.
The hint page tells us that the administrator will visit any site running on 127.0.0.1 if he is asked to do so. The hint is clear that we should feed a URL to the administrator to see. This can be done via the messaging feature of the webapp which allows us the send messages to the administrator. Relooking at the webapp we see that there is a feature to change the password. We decicde to trick the admin into changing his password to our specified one. For this we create a HTML page with hidden inputs and POST the data to the /change-password .
We know ask the admin to view this page by sending him a message .
We login to the admins message board and see that he has a message from a user 'pirate` who claims to have cracked his password.
We try ssh'ing into the box with these credentials and we are immediately logged in !
Once we login we see that there a bunch of interesting files in the users home directory.
If we do a quick directory listing 2 things stand out. i) There is an internalServer running as root on the box ii) there is a additional ping.ejs file which is not normally visible via the public facing web interface.
We look at the contents of both the internerlServer and ping.ejs files.
It seems that besides the public facing webapp there is an additonal server running on the box on port 9000. This server provides a Ping capability for the admin to maybe ping other systems. When we look at the code for the ping service we see that the exec api is called with the user provided IP address without any input checks. We can inject code here as the application does not sanitize the input data.
We can launch the command injection both via the web browser or the command line. Let see both approaches .
a) Command line : We can use wget or curl to post data to the internal server and inject our code in the post request.
Here we send a post request with a ip address =1 and inject our 'id' command along with the request .
Similarly we can use curl to post data as well
b) Web browser : In order to be able to see the internal webapp on our attacking machine we use a ssh reverse port forwarding technique using the ssh -L parameter. Via this method we make the port 9000 of our victim machine available on our kali machine at port 4545.
Now we can access the port 9000 of the inernal web application
No comments:
Post a Comment