STAPLER
- Layout for this exercise:
1 - INTRODUCTION
- The goal of this exercise is to develop a hacking process for the vulnerable machine Stapler.
- According to Stapler's author there are multiple methods to hack this vulnerable machine, let's try some of them.
- Stapler can be downloaded from here:
https://www.vulnhub.com/entry/stapler-1,150/
- Once downloaded and extracted with VMware:
2 - ENUMERATION
- Scanning all the ports with Nmap:
- Scanning thoroughly just the open ports:
2.1 - Enumeration for FTP
- Login FTP with anonymous credentials:
- There is a file called note:
- Getting note:
- It is an ASCII text:
- Opening the file:
2.2 - Trying SSH
- SSH-rooting is not allowed:
2.3 - Enumerating SMB
- enum4linux gives us interesting information about SMB shares: /kathy and /tmp:
- Accessing SMB resources with smbclient:
- Because Fred and Kathy seem to be related, let's try this share:
- Listing, getting and opening content:
2.4 - Enumerating the Web Servers
- Now let's go to the two web servers working at Stapler, one at port 80 and the other at port 12380:
- port 80:
- port 12380:
- nikto helps us to discover folders /admin112233, /blogblog, /phpmyadmin, also the robots.txt and the fact that HTTPS is used:
- Connecting againg to port 80, now with HTTPS instead of HTTP:
- Connecting to robots.txt at port 12380 via HTTPS:
- Going to /blogblog we discover that wordpress is used:
- Going to /phpmyadmin:
- dirb discovers another directory:
- Browsing announcements:
- Reading the message.txt, nothing special:
2.5 - Enumerating Wordpress
- wpscan enumerates Wordpress vulnerabilities.
- First try is unsuccessful because there is an ssl_cacert error at checking the cerficate used with HTTPS:
- Disabling the certificate check with option --disable-tls-checks:
- wpscan yields important information like a lot of login, usernames, vulnerabilities, and the existence of two folders: /wp-content/uploads and /wp-includes.
3 - EXPLOITATION
- There are different approaches for exploiting Stapler.
3.1 - Advanced Video Embed exploitation
- Going to wp-content there are 3 folders: plugins, themes and uploads:
- Going to uploads it is empty:
- Goint to plugins, let's notice the first one:
- There is an exploit for the Wordpress plugin Advancedd Video Embed 1.0, it can be found here:
- Using searchsploit we find the Python script 39646.py:
- Reading the exploit we find the Proof of Concept:
- Copying 39646.py, renaming to advanced_video_LFI.py and editing in two ways:
- adadpting to HTTPS
- adapting to IP, port and web page
- Giving execution permissions:
- Executing the Python script:
- As a result of the execution a file with .jpeg extension is created at the uploads folder:
- It seems that the .jpeg file is like an uploaded comment or blog entry at /blogblob:
- Downloading to Kali the .jpeg file:
- Actually it is a PHP script:
- Reading the content we find unvaluable information. Actually it returns the file wp-config.php containing credentials of the Wordpress MySQL database: :
- We have the password plbkac what will be of great interest later.
3.2 - MYSQL exploitation
- Taking advantage of the information obtained at previous point, let's dig into the database:
- Using wordpress:
- Describing wp_users:
- Selecting login and passwords:
- No we have a list of usernames with their corresponding hashes, what could be decrypted later.
- However, for now I am just going to insert a cmd file to the web server via an MySQL command:
- It works, for instance executing pwd:
3.3 - Decrypting the hashes with John The Ripper
- Launching John The Ripper against the hashes:
- After a while we find most of the passwords:
3.4 - Accesing to phpmyadmin
- Also, using credentials root:plbkac we have total access to /phpmyadmin, where we can achieve same information about users and passwords than before:
3.5 - Getting a low privilege shell with php-reverse-shell.php
- Now, let's bring php-reverse-shell.php to our working folder and rename it to keep the original one:
- Adapting the script to our needs:
- Having a look at the last picture from the last point 3.4 the first listed username is john, and it often happens that the first list user is the administrator.
- Using john:incorrect as credentials let's try to login to /blogblog:
- Going to Plugins there is a tab Add New:
- Uploading phpscript.php trough Add Plugins / Browse:
- The upload is successful:
- Setting with netcat a listening session on port 3333:
- Clicking phpscript.php:
- A low privilege reverse shell is successfully achieved:
3.6 - Getting a low privilege shell with Hydra and SSH
- Listing users:
- Let's try attacking SSH service with Hydra using password plbkac (obtained from the .jpeg file at point 3.1 of this exercise):
- Connecting from Kali to Stapler with SSH trying credentials zoe:plbkac:
- We have achieved another low privilege shell.
4 - PRIVILEGE ESCALATION
- To achieve Privilege Escalation we will practice three different ways:
4.1 - Reading .bash_history
- Listing content of the /home directory we find folders for a lot of different users:
- Opening all the folders we find a different structure and content at peter user's home folder, in comparison with other users home folders.
- For instance the hidden file .sudo_as_admin_successful suggests the idea that user peter might be an administrator of Stapler:
.....
......
- At the same time, reading .bash_history for all users we find this self explanatory line:
- The line corresponds to user JKanode .bash_history, and tells us that user peter has got the passsword JZQuyIN5:
- Trying SSH with credentials peter:JZQuyIN5 the result is successful:
- Choosing the (q) option we are given a remote shell:
- Checking peter's sudoer abilities it happens that he may run (ALL:ALL) ALL commands:
- Let's try changing root's password:
- Now peter can do su root and we finally have a root shell
4.2 - Abusing a cron job
- Listing for cron jobs:
- Checking logrotate we learn that the shell script cron-logrotate.sh is executed every 5 minutes with root privileges:
- Now, let's alter the content of cron-logrotate.sh so that every 5 minutes this small script is executed with the goal of launching a reverse root shell at the Kali machine.
- Echoing to cron-logrotate.sh:
- Setting a Netcat listener at port 5555:
- After a while a root shell is achieved at the Netcat session
4.3 - Exploiting the Kernel and Operating System
- We know that Stapler is running Ubuntu 16.04 with a kernel 4.4:
- Looking for an exploit to achieve Privilege Escalation:
- Reading information about the exploit we find the link to the downloading page:
- Saving to Kali:
- Setting a simple HTTP server on port 8000:
- Transferring the exploit to the /tmp folder at Stapler:
- Unzipping:
- Extracting the exploit:
- Going to the new folder:
- Giving execution permissions to doubleput.c:
- Compiling:
- Running the executable ./doubleput:
- Finally we have a root shell:
5 - CAPTURING THE FLAG
- Capturing the flag:
