Overview
Enumeration, OWASP AO4:2021 - Insecure Design, full modification access to automated scripts, and taking advantage of local sudo permissions.
Reconnaissance / Enumeration
Initial Scan
NMAP SCAN
$ nmap -sV -sC -p- $IP -v Service Discovery
| Port | Service | Version | Notes |
|---|---|---|---|
| 22 | SSH | OpenSSH 8.2p1 | Able to spray credentials for a foothold attempt |
| 80 | HTTP | Apache 2.4.41 | The webapp uses PHP |
Home page
Browsing to the web page prompts me to create an account. After doing so, this is the resulting page:
Vulnerability Analysis
Identified Vulnerabilities
- Reverse Tabnabbing: A web application vulnerability that allows an attacker to replace a legitimate page with a phishing webpage. This leads to credential harvesting or sensitive information being leaked because the user may not notice that the site has been changed to a phishing site.
Exploitation Vector
Links within this website use target="_blank" without the implementation of rel="noopener" which shows that this is a viable attack vector.
Exploitation
Step 1: Creating the login page
Since the web pages hints that an administrator checks the links thats inputted and given that the attack vector of tabnabbing is available. Lets make a clone of the original login panel that is displayed when we first access the web page.
Step 2: Using javascript code
Now that we have our replicated login panel, lets embed javascript code in a webpage that links the user session to our phishing site (the replicated login panel).
Step 3: Execution!!
We must create a local web server that we control, set up a netcat listener for port 8000, and enter the link of our html file that uses the embedded javascript code shown above.
Post-Exploitation
Lateral Movement from Danny --> Adrian
When enumerating the initial account I have access to, I found that Daniel is apart of a custom group called Administrators. I issued the find command to search for the files that I have access to under the administrators group. In doing this, I found a python script under the home directory of a user named Adrian. The python code is telling me that it is executing a repeating task which checks the webpage availability. Further examining the home directory of Adrian validates my suspicion because it shows a text file of every time the file executes.
Proof of Compromise
Since I have full modification access to the python file, I can add code which sends me a shell into Adrian's account
Privilege Escalation from Adrian --> Root
Enumerating sudo permissions led me to find a vulnerability where Adrian is able to get into a root shell due to being granted sudo permissions for the vim binary.
Proof of Compromise
I am able to exploit this vulnerability through a one-line command which is
sudo /usr/bin/vim -c ':!/bin/sh'
Key Takeaways & Lessons Learned
- [Skills]: Webpage enumeration, Reverse-Tabnabbing
- [Vulnerability]: We were able to take advantage of scripts that automates mundane tasks to elevate our privilege level-by-level.
- [Tools]: Using my remote web server and netcat port listeners allowed me to get an initial foothold. Re-using netcat allowed me to laterally move to another user with more privileges.
MITRE ATT&CK METHODS USED
- Initial Access | Content Injection T1659
- Initial Access | Phishing T1566
- Execution | Scheduled Task/Job T1053
- Privilege Escalation | Abuse Elevation Control Mechanism T1548