STRATOSPHERE
- Layout for this exercise:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiflx7M4UlTEWOQmBKoY2XnuCvcq-g4Wl0nrJ2omwj3eRCoBdoJ_E1hWqz817Hq8NeXf-2XFt-3bkPLFR8wTkJ2LA9pHORF8gcSsUsO6T4kQLqDAeCWWYKnBfbtVNELITP1cqochPnb37bz/s1600/screenshot.45.jpg)
1 - INTRODUCTION
- The goal of this exercise is to develop a hacking process for the vulnerable machine Stratosphere, what is a retired machine from the Hack The Box pentesting platform:
https://www.hackthebox.eu/
2 - ENUMERATION
- Stratosphere's IP is 10.10.10.64:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjN1_o4HBTgPXx0RjtGVPttZXxQIQkheKIhAt29omDP5BQciJ87_jIydJAIjOMhYM51d1k4iVCIeVfZixNfkEDwXrY8-mgUWJATIOsRywuByvg2BYnhtNgpv9cYoLvDnyhSVPrYBbxk4zey/s400/screenshot.2.jpg)
- Scanning with Nmap:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYInLXkQQpRLw3Xmf9Gwyjih3kD8oyqYDQuHOAn-Tl7o6I8F7swAEETgax6LHm8g1-6EZy1LTYd2wRlHLafVBxk2UdTqJocfYsPsstb5UGDnaxhnrHttUBZYhm92zQNpmilSAKzq7CuRXv/s1600/screenshot.3.jpg)
- Connecting with the browser:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAaN1YRnAtEs51G50MfgcRregzQUa0esHu_BXpiN8Qp0CYVanKFLDn7ZGRW5YYkSm0LO6Diod00Z9HIapKG9k-xB_KgKJ81HXLgFH143qR5lySohdySqLlEFCJT93Xl11ZHPpn3oeIVBHR/s640/screenshot.4.jpg)
- Bruteforcing with Dirbuster and the medium size directory list:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2bfk9L_eHNm51ufaBTBOIfwatSm9Y4elU77ZWNl3WD_hQBkueewSz1M7bLmDGvGAgodZNtD-UOiYzYWfOg0ZKsYpq5zdIhQKh6TR55HASLmy3kJTkCWDTToC2jsGN0EB3dxP15US9m7FZ/s1600/screenshot.5.jpg)
- Dirbuster finds folders like /manager or /Monitoring:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRXh5kXuPTP9afDoW9sX6NiYIzE3ayCydbE-kmrUV-jkPIK_mC52YvyITQe_CUPIj38AdcET6AZdhrx2UFIxWnWFoCtSbQFHbuMHZFTMszR5REdvypPZ3ry5qgSzQRJFC7J1TcTsQ__Y3u/s1600/screenshot.7.jpg)
- Going to /Monitoring we are redirected to this web page:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy4TUbetYcJvauxXUXkCe2Z4DkAbg9asiZ8U4iLb8nXJCZB2WCXQocOhQZmgEkpOxOUlJ0l1xOsPKg-sfJlgpPjOX1eCFDznUBzYYSK9OUYjrFgcRvxs2p3SvyZdqZ4JJMh2ireZK4tC8g/s640/screenshot.6.jpg)
- Clicking Sign On:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdLDv62GHjorig08x3aPBrpEL4MZvdd8lJ6lFiQJpzvfKZOcNry5z8IloOGPtximCaWRE2DPoafDxgA3X1BPDRH-ph4fScz4zcB1Go_-i28XcyoseSKYpCygG7eV8xxLODRE9Hn_oR9Cyz/s1600/screenshot.9.jpg)
- In both cases let's notice the presence of the extension .action, what is a class used by Apache Struts:
https://svn.apache.org/repos/asf/struts/archive/trunk/struts-doc-1.1/api/org/apache/struts/action/Action.html
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM6hJl1KxH0vv9qrM3vOO0z3HY77yHbLxf_8e-f6Ufk8f8TIZw5ruJkWXJybaWnxETZ4uSvEqRMrfzBar1S0zjZoKEQ0jXXeexf6VRzB-L59QDSSixgfilb02o-Fm-jFM0IuRf4623dZg3/s1600/screenshot.46.jpg)
3 - EXPLOITATION
- Apache Struts is vulnerable to multiple exploits, like explained at CVE-208-11776:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11776
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgk2Zq_Y2oMf0xd40WhVgJpxcyrb7ELE6Kh2NaVseYJ4H8rvGcPancq8qXELzxgIY2Cloz4pgfYTm6RxaL1rLNKVnYBmNNNEOfxjXJs1xLwr73uYlc3QSLV5CFalwms5MZBJRF4wVg_CNXL/s1600/screenshot.50.jpg)
- There are a lot available exploits, so let's take for instance the Python script struts-pwn:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhln3rpPBDVnW3yQOYML_46qpOdzUfCYmdbUJltZkGMaC6896iVeeVCbmMoUxbUrTbA9Ln2P7jvSt9p32Mfd90VRS26LViGSlQ164WnRJdjwNkbkhnbuPzzj17_Jca6Y8FFPpAjfI6lP-2C/s1600/screenshot.44.jpg)
- Downloading to Kali:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ-MzJVXTJJuuH1D5cD3cGzWG0pCygkdDPCwHSqbGctic67gcB_RmUPQzc2hwpJIrs3sa_8bpGxt0gXarSN2PnPHQ-SbqhSKeBDThA3yXTuFy1dbye5iMBHKJqAVyyI3paKx_Qw0lb93nm/s1600/screenshot.29.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijBCnuRGeYagmgFpnpJ7brKorD4OdnnEcOsHNjXUh3IWPUiegluC-LfwcDdv4mPSO9Wu1wZ3FWc-qjRJD6rv7y4Xv-7oGWGYnkfrzW7xTbGdffMN_6eIwAqXDcJ-SXNhiHGX8VWbzPlXDy/s1600/screenshot.30.jpg)
- Reading README.md we find an example of usage:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7x6ixF_EiGDoU1lNZ4L_ll2g7dItzVSx1MeK923hMVEuq5xbgmiiDcqZ2lqZ5gSOpjfmCDuquSDP_cRD-k_vNt34TiGPc8zqL1FQKeA3p5hzj3XgzE94mNWoBoKrWWQfQpznjBzgPwmnU/s1600/screenshot.31.jpg)
- Now let's check that the script works (by default it runs the command id):
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3Lknd0mp3NrRo5oVdA8N6OJdvLZAw9B60owWEoTkXk1MJpAeueV8-NC5fXq45EnsUaC9r_hUeAnv2KT1PAghjLEq2bGntflvuWtfxvpFJuphPeo8t1SE75Ye6BArA-_BuoKpyRu-liTdy/s1600/screenshot.34.jpg)
- Also, we can use the script to read /etc/passwd:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEim1h2ZgUw3fmfp8zjgjYkErbu0FaqpJdHGB6Bk33Nkl6_h8nZR6umxH-pHeHe589T5jg3R8Z816gD-CjhuyByWtaXa3yL5tCqDCuMA5Vi2c4snVohQTN-sxA0qPf4psKiUYCqh1VlXf9_U/s1600/screenshot.36.jpg)
... etc ...
- Listing /home content:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOp2zTaCFw1CtXajMeCALceUgMXegSUilpUafmh3Evdk8gMd6gjGRxJgFVwng7B7uk1Ru9IGQapBXBEur1c2V7U66ZuY7YTZzWm8KUO4f6dIU7bntOuKkSn_wfNU5szPLVrypC_y1olIRl/s1600/screenshot.37.jpg)
- Listing richard's folder content:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjul0Iys4RtH5mc3nQeMiGuvxwplYDhsfq4WdkulfFb-YQla2DqLuMj4H0rswxbw_G43PgEG4rC82BSgsXhyZfCOxn07uYkZxg8t0ZX1kbA-3Io6xIIJZQR08SFTra9mJZPHZmHXZNxIrO9/s1600/screenshot.39.jpg)
- Reading db_connect we find credentials for databases ssn and users:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeVpiCHC4Dzc6V3eoCFzFScZRcbxSJbVIw3MV8gwwcNG8oRhS5s4tlGzuHQAZZhqL9loaLmDMEAij2qmKbmjK_eR3UlKfr8hP2O5slyf7aFyTET_ckUGu9wpbgVxS5a21RMPxof3iWXCsK/s1600/screenshot.40.jpg)
- Showing tables from database users we find the table accounts:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCjJV2Dia9tYuATpXWt76YDQVKHtEnnNcInKEDngloCgR-qlwmKAZHzije0lyGJwUu6kbUUt-vJbc_BrBJViSymfYO8Sz9F2l5MYHVshJc7x25N3knRjtkZpxxXHBljGr6yQ-fxpnpQziI/s1600/screenshot.43.jpg)
- Selecting * from table accounts we find a password for user richard:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0cJM3rRt3QpGOTUiPjEL-7xRuKIn_epAxOKh33MyoM2BT6UMWInfj38-L54AKU9deTh7ga0OhP4mw2pAMnhXbEAmJy83Q4DD8rD6IoqWcT8TgVeqLqhavDumDZpwjfcpmfjsx1BJGUum5/s1600/screenshot.42.jpg)
- Connecting to SSH with user richard's credentials we get a low privileged remote shell:
richard:9tc*rhKuG5TyXvUJOrE^5CK7k
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvZTm7P1-yAN2mnqKxEUpWVI8eKH6AdW8k7LDloYe99K2BB6BGKrvFUnFC85CMmTml8UQNqETZKwjfaiElCLd6Uj15cu2UxGD5nRuW9SXadX_p2jK-poZt_g4EKfw5gvyE9D4bEcZyfOO5/s1600/screenshot.21.jpg)
4 - CAPTURING THE 1st FLAG
- Reading user.txt:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPqeERqyi0hLPo0vrTQXlbD2VyKiztxrf8JidbbAq-XijeuVocXHCxlEI-Vb-sYNCsoYZ_BCX5Sh2CELG1TBTuIX9DmXfSWkwte69TUuRDQY9Bh4UmxLlMEbUm__4A-FHA7ciwwX5tV1ZI/s1600/screenshot.22.jpg)
5 - PRIVILEGE ESCALATION
- However access to the root folder is denied, so we need Privilege Escalation:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJ1WUFsyExvsp3gP3WqxwuFnKdqMLZ0hfo2RQTS4l6TjtUa0wUdQuj9TkXTUTPHgE777jjB1Vxa1pO0W4CVeIBOvLu23KlDfokRdYgx9zi7TQOetZbePD2W8U6ENhp75P4NUNc9KwhY7WU/s1600/screenshot.23.jpg)
- User richard has got some sudoer privileges:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpiC5YOjT5wq_KO3dFjYxzqdmoxC8urlV-CweCcTUys8VCBij7RSIWR7-m-kFmAKOzZjhUpwrC2xYzTTVhRyX67bu6BNHy2UBPMCXezCZEM_GnOATIP_L6GzhBCChKaG5Vxu3xO895FT21/s1600/screenshot.24.jpg)
- Reading test.py content it seems that it holds some encoding/decoding and hashing processes:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAGxTCUEjEG0RJMABhY7sUOgsb8Mzu30A-ODrPa-r4eoXyHLq1LpZ3l09i1dGaR73Wv9aGhvbiU_JKftiH3AcHtdYAyDecKypN7zgUIS5DPsSJ_tJmYZ9-l_6LaHFF46zJZJb-CMDgLTr3/s1600/screenshot.25.jpg)
- Executing test.py, just in case, it does not show any output:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi14U4PjbZc2d2nlhP_YmlqHOe_lcwbipMjwSmdQVN_TBikpFk5gWvs3y_YHcE9JG6X7QRYQPmvTfI49HeSgpVw-L99cRuwvw8lpUdzsI1mv6udQMKPG6W-MB1oEPGMtgtMeoUSJl3qYhCm/s1600/screenshot.28.jpg)
- Let's see that test.py imports hashlib, so we can write hashlib.py in this way:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJnPfFMcoDwmudH0-Q59H0BYMTPs6wUfNY1xzNdqKfYkTFVsTOY-_wLvybaO4bl6VJrIn8LBSrhFc2CgE0nS7ErY_oNHVDIi2AAPCPyd4uo3Z8xkQR7HE6YDtau5X3U4FCP_TT1mTp4Isg/s1600/screenshot.49.jpg)
- Now, just following the sudoer message and executing the command a root shell is achieved:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjChfnhyphenhyphenJduooGdTosMiNhzxWdzFlgrN4XaatU-iWsbZnkkbMcQT9ndYg9Mu8VWsHpBR7GPzA_PHB6sy1cVSXeEfhEMxZ7jxi2R-UVJypnuCbsp7304wyKQlt1o5f270LkPYTvTHJ2ivJ5A/s1600/screenshot.48.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm-QY4bJk4MeHCoCXq8IyPb3-hlt-x5fu-7lhwe2YBrMgX0Gc-nuYZzmfTH2cgEyO9y2H3H_gqe9dkmrE5T2_ju6m53Ojb0NNWS5Ocow6_2m_9ApDU5hyphenhyphenkccZT7qVbYB57L_h3VgqsXWlc/s1600/screenshot.26.jpg)
6 - CAPTURING THE 2nd FLAG
- Reading root.txt:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWYW5Kg50BTG9fpa3LvB0jMGvvHxP2P8f0DypYUbtrXqjzxNEOUhuvwh5Ugf4Hn12HzwGXPiXKaJjT-NIaCUp6tELjRe1IVeEiAUC-Ld3G9i_9F9DlIay17G5FdyD9yXW0seofUAE2CjAG/s1600/screenshot.27.jpg)