Today we are going to crack a machine called SneakyMailer. It was created by sulcud. This is a Capture the Flag type of challenge. This machine is hosted on HackTheBox. Let’s get cracking!

Penetration Testing Methodology

• Network Scanning
  • Nmap Scan
• Enumeration
  • Enumerating HTTP Service
  • Enumerating Email Addresses
  • Extracting Email Addresses using CeWL
  • Send Phishing Mail using swaks
  • Extracting Credentials
  • Decoding URL Encoded Password
  • Setting Up Email Client
  • Enumerating Emails
  • Gathering Credentials form Email
  • Login into FTP Service
  • Enumerating FTP Service
  • Uploading Shell on FTP
  • Enumerating dev Virtual Host
  • Getting Shell as www-data
  • Enumerating the credentials for pypi
  • Cracking password for pypi using John the Ripper
• Exploitation
  • Creating SSH keys
  • Crafting Malicious Package Files
  • Transferring Malicious Package
  • Logging in as Low User
  • Reading User Flag
• Privilege Escalation
  • Enumerating Sudo Permissions
  • Exploiting pip3 to root
  • Reading the Root Flag

Walkthrough

Network Scanning

To Attack any machine, we need the IP Address. Machine hosted on HackTheBox have a static IP Address.

IP Address assigned: 10.129.2.28

Now that we have the IP Address. We need to enumerate open ports on the machine. For this, we will be running a nmap scan.

The Nmap Version scan quickly gave us some great information. It positively informed that the following ports and services are running: FTP (21), SSH (22), SMTP (25), HTTP (80), IMAP (143,993), HTTP Proxy (8080).

Enumeration

We can take clues form the nmap scan and the name of the machine that this will be based on emails and email clients. We tried to enumerate FTP service but Anonymous Login was not allowed and we didn’t had credentials for it yet. Also, we skipped SSH because we didn’t have credentials for it. Since there was an HTTP service on port 80, we tried to browse it but were unsuccessful. Hence, we might have to make an entry inside the /etc/hosts file.

Now we try to browse the application or the HTTP service on port 80. It is a dashboard of some sort for the Sneaky Corporation.

We found a Team link on the home page that takes us to the team.php. This page contains a list of email ids all belonging to the employees of SneakyCorp.

We use the cewl tool to extract all the mails found on the team page and put them inside a text file named emails.txt

Here we can see that CeWL extracted all the emails.

After enumerating for hours and performing various kinds of brute forces, we were lost. At that time, we thought maybe what we really need to do here with the mails is to send phishing mails to them. We thought of one of the best tools in this trade swaks. But it will take a lot of time to send mails on each mail id if we do it manually. We decided to automate this task using a simple loop. We use the cat command inside the to the parameter of swaks. The cat command will read the emails and tr will add comma at the end of emails and we will be able to send mail to all the emails we extracted form the team page. But it’s not a phishing mail if it doesn’t contain any link. We will enter our own IP Address so as to receive any requests that might be generated if that email is read. We can start a netcat on our local machine as well to capture if any request is generated.

After we run swaks, we check our netcat listener and it captured something. It is a POST request containing the Account Information of the User Paul Byrd.

The Password was URL Encoded. We used asciitohex website to decode the password.

Now that we have all the information for the user Paul Byrd, we can set up his mail on an email client to browse his emails.

We find 2 emails. Let’s read the first one. It is addressed to a user by the name Low. It says that Low has to install, test and then erase every python module found in the Corporation’s PyPI service. This might be a hint for the things to come.

The next Email contains straight-up credentials for a user by the name of the developer.

We note the credentials for the user developer and try those in the FTP service and we were allowed to login.

We found a dev directory and it contains an index.php. This means this is an alternative website. This might be a virtual host of the original hostname.

We try to upload a shell through FTP using the PUT command. The shell gets uploaded with ease. Time to locate it.

We try to locate it on the application but we are unable to. Then we went back to our thought that dev might be a virtual host of the application. So, we make an entry in the /etc/hosts file.

We again try to locate the payload. This time we are successful into triggering the payload.

We started a netcat listener on the port mentioned on the payload. When the payload is executed, we found a shell of the user www-data. We upgrade the shell to TTY shell. We started to enumerate around the different directories. We ended up inside the /var/www/ directory. We find a pypi.sneakycorp.htb directory. This means there is a third virtual host on this machine. We enter the directory to find a .htpasswd file. We read it; it contained the encrypted password of the pypi user.

Now that we have found another virtual host, let’s make another entry in the /etc/hosts/

Back to the encrypted password that we got for the pypi user. We use the john the ripper to decrypt it. We get the password as ‘soufianeelhaoui’

We open the newly added virtual host on the browser. It gets redirected to the proxy on port 8080.

Here we see that it is shown that the application is running pypi version 1.3.2.

Back to our shell, we login into the developer user. We try to locate the user flag. We find it inside the low user’s directory. We found the user low in the mails as well. We try to read the user flag but it is not readable. We need to get the shell as the user Low.

Exploitation

After many enumerations, we concluded that we need to install python packages and get low user access from them. We decided to replace the ssh key for the user low. To do that we need to first create one.

Now for the difficult part. We will create a malicious python package that will replace the ssh key for the user Low. We will need to create a folder for our package. Then create a setup.py file and a pyirc file. There is other file that are the contents of a package but those are not absolutely necessary. We will skip those files. We created the both files. First, we added the credentials that we found for pypi user into the pyirc file. Next, we will be adding the ssh key into the setup.py file.

Note: Python is based on indentions. So, make sure it is in the correct order so that it can execute without any runtime error.

After creating both files, we sent the files to the target machine.

.pypirc File

setup.py File

On the target machine, move to the tmp directory and create a directory for your package files. Download both the files using wget command.

Now since we need to execute the command, we first need the path to be added into the Environment Variable. The at last we will convert the independent files into package.

Now we use the authorized key that we created and made an entry into the target machine to get the session of the user low.

Privilege Escalation

After getting a session as Low. We can read the user flag but we decided to first focus on the getting root. To do this we enumerated the sudo permissions. We found that low can run pip3 without a password. So, we proceeded to add a shell invocation command into the setup.py file we just used. Then we used the pip3 to run it as pip3 is used to install packages on the system. As soon as the package is installed, we get the shell as root.

Source: https://gtfobins.github.io/gtfobins/pip/

Author: Pavandeep Singh is a Technical Writer, Researcher, and Penetration Tester. Can be Contacted on Twitter and LinkedIn