HackTheBox Beep Walkthrough - LFI Exploitation

Key Takeaways

[Music] hey guys hackersploit here back again with another video welcome back to the oscp prep series in this video we're going to be taking a look at beep on hack the box so this is a retired box so you can actually go through i think it requires a vip subscription i'm not entirely sure but i think i went through it when it initially released as you can see it's quite old with you know talking about more than uh more than two years old but it's a very good box as far as i remember not not that complicated and it's a linux box of course um so we're going to be exploring that in this video um so we know without any further ado let's get started so the first thing we want to do is take a look at the nmap results um so i've already ran a scan quite a while ago in preparation for this video and you can take a look at my scan options right over here and the ip address is uh different in the nmap scan so i just want to make sure that that is clear right out of the box so as you can see for the services we have uh you know port 22 running which is ssh of course we have open sh 4.3 we also have smtp we have a web server that redirects to ssl over here on port 443 which i'll get to in a second we also have rpc pop3 and mysql server mysql database server rather and we also have a webmin instance running on port 10 000 which we'll explore in a second as for the operating system detection we don't get much but if we take a look at the banners we can see from apache which you know very thankful it tells us that it is actually running centos but we don't get an exact version of centos so let's get started so i've opened up vip in a new tab here and you can see it says that it's running elastic so we can perform some enumeration so robots dot txt let's just see whether we have anything that's being disallowed we don't have anything there so let me just zoom in there we are nothing there so let's try and find out what exactly elastics is um so elastics looks like it is a linux pbx unified communication solution so it's a service software that brings up that brings together ip pbx email im faxing collaboration functionality so essentially it um it sort of uh con conjoins all of these various uh you know pieces of functionality uh right over there so if we view the source here i don't think that'll give us anything much uh yeah it just gives us the image there so we have already our first directory i think directory indexing is enabled so themes elastics neo let's see if that actually opens up themes but yeah so it looks like we can actually access the themes directory so directory listing is enabled which is not a good thing well from the person from the perspective of the individual who configured this uh we don't get a version here but we know um yeah we don't get a version um so let's try and perform some directory brute forcing um so i'm just gonna you know split this so i can actually do it in a new tab here um so what we can do is we can just say go buster we will use go buster so go buster directory and we then say the url is https uh let me make sure i can actually copy that so it's 10 129. let me just copy that there will it actually copy the protocol with it no it did not all right so the word list we can say is user share user share word lists and we can use the bust and directory list 2.3 medium which is a fairly good uh starting point and for threads we can go for 50 threads hit enter it looks like it's saying unable to connect invalid certificate we can use the k flag here because that ssl certificate is invalid so it's performing the directory brute forcing and immediately we get themes module mail admin so let's check them all out so we'll get rid of that there so we can say themes we already know let's see modules modules that should bring up a directory of modules it appears here okay nothing too interesting we'll get to this in a second uh mail and uh let's see we get a male uh yeah so this is essentially what elastics provides to us which makes a round cube we have a round cube instance running here it looks like we have an issue with the connection so request cancelled while waiting for connection so there's a timeout error here we also have an admin we also have an admin page here let's open that up so admin that brings up a admin login prompt so i'll just hit sign in with an incorrect password of course write um let's see whether that gives us anything so it's yeah this is the verge this is the pbx system that it's using in this case free pbx 2.8.14 we'll get to this in a second i'm not really sure let's see whether it's giving us anything else here any other versioning um nothing else for versioning there as per what that's telling us we also have a panel page which i don't think it'll actually give us so let's try and open up the panel adobe flash player is no longer supported so that doesn't give us anything there let's also try and access the webmin page here just to make sure that it is working so that was on port 10 000 if i remember correctly um so it's taking a few seconds here let's give that it's a due due time all right so we get a certificate error which i guess is fine we just need to hit advanced and proceed um and yeah it looks like webmin is working we can you know provide a username and password we can test you know admin admin or i think it's admin webmin i'm not really sure um yeah default credentials don't work there all right let's perform a bit of enumeration regarding the actual um the actual system being used which as we know is elastic so search exploit um elastics let's just see what this brings up um so we have cross-site scripting we have graph dot php local file inclusion let's perform a bit of research on that we also have a blind sql injection which we'll also check out php code injection for but we don't really know the version we also have pbx version 2.1.0 uh is that a display mode you'll know that isn't that is uh a remote code execution exploit uh but that is not the correct version this is 2.8.14 um let's just perform some research on this particular exploit so there we are that's the one so exploit db um so there we are it says all right so elastics is prone to a local file inclusion vulnerability um let me just zoom this in because it fails to properly sanitize user supplied input an attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process all right that's great so we can do this remotely through the web server this may aid in further attacks elastics 2.2.0 is vulnerable all the other versions may be affected so we can try this out um so this is a script here and the lf5 exploits all right so it looks like uh tavi tiger crm so it looks like it i it uses a these vdog crm uh system which i don't know whether it's actually installed we can actually try it out right now let's see if that's actually installed because there we are so we'll just say v tiger crm let's see if that actually is installed yes so it looks like the crm is installed that's version 5.1.0 but this exploit really doesn't target that so let's take a look so v the lfi exploit this will uh let's see what what that does am portal so hcm portal so this is a local file inclusion exploit however um that's the actual exploit that's been commented there and this is the exploit script that automates it so we can actually run this and let's see what this brings on up so i'll get rid of that there paste that in there and it gives us the actual configuration file and it looks like we have some password entries let me just perform a quick search for password entries so password password password password we don't have anything so these are just giving us entries so password his password looks like we get a password value there so let me note these down here i'm not really sure what users they belong to but we'll find out in a few seconds right okay we also get another password here so let's note that down so that's ari admin the ari admin password so uh let's see this is the default admin position an administrator to login to ari bypassing all security change that and then we have this password here which is uh let's see this looks like it is for webroot which we can actually try so let's note down these passwords and we'll try them out in a second i also remember that we have the ssh port running so we we could be able to access this that way it looks like we don't have any other password here um so yeah if we just take a look at the nmap results one more time we can see we have ssh here so we try you know ssh root at the ip is actually 10 to actually know the ipi head so 10.129.168.83 putting the ip there unable to negotiate with ip no matching key exchange method found there all right so it looks like ssh authentication has been disabled uh because the algorithm um the algorithm has not been uh they haven't actually implemented the exchange algorithm which in this case is the the default sorry the diffie hellman group exchange algorithm so that's i don't think we can actually authenticate there let's try and access the let me just duplicate this tab here let's try and access the webmin uh control panel s3 see if we can actually log in there so 10 000. by the way also saw another admin panel here um where did it actually enumerate the directory so this looks like it we get a var directory uh nothing there libs yeah so nothing much here that we already don't know but we also have the admin we can actually try and log in there so let me just duplicate that again and uh there we are so we type in admin and um so let's try admin and we then try this password here there we go sign in doesn't work let's try it root put that password in there nothing there let's try the other password so let's try admin put that in there doesn't work well it looks like it is loading so free pbx yeah so they were able to log in directly i'm not really sure what we can do with free the free pbx uh control panel but we probably just monitor you know for example let's just see what we can do but before i do that let me try and log in here so we'll try root and that same password because it looks like that is the correct one and uh yeah it looks like we get access to webmin so this is cool so we have root access to webmin which is awesome um so with webmin we can do a few things we can boot and shut down we can change password disk quarters we can also run commands and cron jobs which pretty much means i guess we can actually get a reverse shell here so let me just search for uh bash reverse shell and we'll use pentest monkey and uh we can actually test this out just to see whether we'll actually execute for us um so we can go back in here so netcat n vlp if it's it's actually going to allow us to run the commands or you know we can actually run a schedule a cron job as root then we should be able to get root access with and we don't need to perform any privilege escalation which is awesome so we'll listen on what port one two three four because you know this is just a demonstration we're not really evading any firewalls here so we'll just copy that and let's modify this a little bit uh the command here so there we go let's actually get our ip because we i don't actually know it so um ipas sorry ipas there we are and the ip is right over here so we'll copy that and the port we need to configure for the reverse shell sorry let me just open that up and we'll paste that in there like so and we then paste in the port here all right so we have the reverse shell set up there so through webmin um let's try and schedule a command here so we can run as root as user let's see what users we can run this as so we have the admin user can we actually run as root it looks like we can which i'm guessing in this particular case will give us access no matter the case so we'll we need to specify the time so the current time is 3 35 let's run it at 337 and the command to execute i'm guessing it's not going to use bash by default so we can actually specify bash so that's the bash command there so if we say bash and then we specify the command itself and then we say let's just encapsulate the command itself right over here it should actually execute for us so let's hit create and it's created it for us for us sorry and yeah so it'll execute the it was created in 3 35.53 seconds so it should take a few seconds i'm just going to wait for this and let's see if we actually get a reverse shell back alright so i waited for about i guess 60 seconds and well actually 70 seconds and looks like we get the reverse shell and we pretty much have root access again i can just confirm that so there we are we have root access and we can pretty much get the root flag so i'm just going to cap the contents of the root flag here root.txt and we get the flag there we check the home directory we can see that we have the user fanness so cd fineness and if i list the contents there we have the user flag so use the dot txt we hit enter and we pretty much get access just like that right so that pretty much is it now i i do know the last time i went through this box there was another technique that involved free pbx or an exploit for free pbx i'll probably be making a second follow-up video that covers that technique um it looks i also believe the last time i did this that they you could actually log in with those credentials via ssh but i think that was disabled to make things a little bit more difficult uh although you know it really doesn't make sense to have ssh running at all given the fact that you know you're just going to disable it anyway but in any case uh is a very very interesting box with you know a a system that you you're likely to find you know few companies running but uh as for the viability and how realistic this box is i think it's quite realistic but most of the software looks uh slightly outdated and the there really isn't any security practices being implemented here uh so nothing really is patched but at the end of the day this is quite an old box uh but you know a fairly interesting you know challenge or adventure if i can say that but yeah that's pretty much it for this video guys thank you so much for watching if you have any questions or suggestions you can hit me up in the comments section or on my social networks i'm usually you know quite active on twitter uh or if you want to start up a discussion you can join our forum at forum.hackersplay.org and i will be seeing you in the next video peace i just want to take a moment to thank all our patreons at patreon.com forward slash hackersploit for all the support your support and help is truly appreciated you keep us making uh newer and fresher and better content so i just want to say thank you to all the patreons so thank you murph the surf daniel bork jonathan kyle adam mack jamal guillory defean barry jeremy nikolai marie harrah max ciao dustin empress michael hubbard and jerry speds [Music]