Zipper - Proving Grounds Practice
Enumeration
Nmap
Initial nmap scan revealed HTTP and SSH ports were open.
Web Enumeration
Website had a single point where we could input a file. Files were then converted to a zip.
Exploitation
PHAR or ZIP wrapper
When I clicked Home, a parameter named file occured. So, I thought maybe this parameter gets a name and appends .php at the end.
To test this idea, I created a file named test.php which executes phpinfo() function.
Then uploaded it to site.
Then using phar wrapper, I tried to access it without adding .php extension and it worked.
I then simply downloaded pentestmonkey/php-reverse-shell, and updated the IP.
Then simply uploaded the file and accessed with PHAR wrapper to get a reverse shell.
And I simply obtained local flag.
Privilege Escalation
7za wildcard (7zip wildcard) exploitation
There was a cron job running on behalf of the root.
I checked the file and found out it was using 7za with root’s password to zip files with wildcard zip.
So I did some research and found that 7za wildcard can be exploited using links to reveal file contents with error disclosure.
To do that:
- We need to create a zip file and link it to a file where we do not have read access, for example:
ln -s /root/.ssh/id_rsa root.zip - Then when 7za is called with
*zip, it will give error onroot.zipand reveal the contents of/root/.ssh/id_rsaon its output
However, there was already a linked file named enox.zip on the target machine.
As root backup cron job saves output of the command to a backup.log file, we could simply read it to reveal /root/secret file’s content.
We could also use pspy64 to check the command as it directly uses password on command line.
Then use it to obtain root shell.