Week 4. MonitorsThree
TL;DR
This is an Ubuntu 22.04 machine hosting a web site whose authentication login page is vulnerable to SQLi time-based attacks. This is exploited to dump a hash that, once cracked, allows access to the admin dashboard of another vulnerable (CVE-2024-25641) Cacti 1.2.26 login portal running in the server. Exploiting this we get an initial shell in the system and then we find an additional hash in another MySQL database. Once cracked we get an SSH credential and the user flag. For escalation we abuse a Duplicati backup application. First we bypass the authentication following a procedure available in GitHub, then we leverage the fact that application is run under root to backup and read the root flag.
KEYWORDS
SQLi, SQLmap time-based attack, Cacti 1.2.26, CVE-2024-25641, Metasploit, Duplicati.
REFERENCES
https://www.cvedetails.com/cve/CVE-2024-25641
https://www.rapid7.com/db/modules/exploit/multi/http/cacti_package_import_rce/
https://github.com/duplicati/duplicati/issues/5197
ENUMERATION
Port scan.
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-28 06:12 EDT
Nmap scan report for 10.10.11.30
Host is up, received user-set (0.037s latency).
Not shown: 64644 closed tcp ports (conn-refused), 889 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASONt
22/tcp open ssh syn-ack
80/tcp open http syn-ack
Nmap done: 1 IP address (1 host up) scanned in 13.56 secondsEnumerate the open ports.
Add to hosts file and inspect the site with Firefox.
Fuzz for subdomains.
Add cacti.monitorsthree.htb to hosts file and browse it with Firefox, we discover the server runs Cacti 1.2.26.
USER
Navigate to the http://monitorsthree.htb login page, click on password reset.
The username parameter is vulnerable to SQLi. Try a password reset and capture the request with Burpsuite, save request to a file and launch a time-based sqlmap attack. Bear in mind that, as the attack is time based, it will take some time to complete.
First dump the database name.
The sqlmap attack outputs 2 available databases. Let's continue dumping the database monitorsthree_db tables.
And dumping the users table.
Admin's hash is cracked with hascat (MD5).
Use it to access Cacti admin dashboard in the cacti.monitorsthree.htb subdomain.
Looking for Cacti vulnerabilities we find this one: https://www.cvedetails.com/cve/CVE-2024-25641. And a Metasploit module associated:https://www.rapid7.com/db/modules/exploit/multi/http/cacti_package_import_rce/
It is pretty recent, so you may need to upgrade Metasploit.
Run Metasploit and configure the module.
Now first step is to get a full interactive shell, for this first send a reverse shell to Kali.
Reverse shell is received on port 9000, upgrade to full interactive.
Under www-data moves are usually limited, but normally this account always has access to the /var/www/html directory.
Credentials to connect to the MySQL database are here /var/www/html/cacti/include/config.php
Use them to log in locally into MySQL.
Enumerate the database from command line, you'll find a user authentication data table.
Dump it for useful data.
We have disclosed again a hash for user marcus (module 3200). Once the hash is cracked, just su marcus to his account. Inside his home directory you'll find his private ssh key, which can be used to open an SSH session.
Use it to retrieve the user flag.
ROOT
Start from the marcus SSH shell and take the opportunity to enumerate the user and the system.
There is something listening on port 8200.
Forward the port to Kali and inspect the site with Firefox. A Duplicati login box pops-up. Authentication is bypassed following a vulnerability posted in GitHub: https://github.com/duplicati/duplicati/issues/5197, and there is also a guide to exploit this vulnerability: https://medium.com/@STarXT/duplicati-bypassing-login-authentication-with-server-passphrase-024d6991e9ee
First we need the server passphrase, which it is stored in a SQLite database located in the path /opt/duplicati/config/Duplicati-server.sqlite. Transfer it to Kali and enumerate with command line command sqlite3
Following the provided guide, first we need to decode base64 the server-passphrase then encode in HEX.
Take note of the salted password.
Now we need the nonce, which is different in each login attempt. Enter whatever password and intercept the request, take note of the session_nonce and URL decode it.
Continue following the guide, in the same Duplicati login page, open a JS console and calculate the value of noncepwd
Where salted_hex_passphrase is the HEX value previously calculated with Cyberchef, and value_of_url_decoded_nonce is the URL-decoded nonce.
After the value is calculated, just type noncepwd to retrieve the value of the password.
Final step is to go back to the intercepted request in Burpsuite and replace the value of password with the noncepwd value, then URL-encode the value of the new password (CTRL+U).
Forward the request, you are now logged in Duplicati.
Looks like a tool to create scheduled backups. It seems to be run under root context, so it can backup and restore any file in the file system. One option could be to create a backup of our own public key, then restore it the root .ssh directory.
Another option is just backup the root.txt file, then restore in a location where user marcus has access.
To do this:
Click on "Add backup", enter whatever name, do not select encryption.
Select a location for the backup, for example
/store/var/tmp, several ZIP files will be stored here.Select which files will be part of the backup, choose
/store/root/root.txtDo not choose automatic backup, save the backup.
Back on the home menu, run the recently created backup.
Restore the backup, select the
root.txtfile to be restored choosing a location wheremarcushas permissions; for example,/store/home/marcus
After the process finishes you can read root.txt file.
Last updated