HighOn.Coffee

• Remote Exploit
• Local Enumeration
  • Weak Filesystem Permissions
  • Enumeration Findings
• Local Privilege Escalation
  • Got Root

I thought I’d have a go at a Boot2Root over Christmas, looking through the VM’s I came accross Tr0ll: 1 the description caught my attention:

Tr0ll was inspired by the constant trolling of the machines within the OSCP labs. The goal is simple, gain root and get Proof.txt from the /root directory. Not for the easily frustrated! Fair warning, there be trolls ahead! Difficulty: Beginner ; Type: boot2root

I downloaded the VM, span it up in VMWare and got cracking.

##Enumeration

###Service Enumeration

###FTP Enumeration

Nmap discovered anonymous FTP was exposed on the target, I downloaded lol.pcap from ftp root:

Examined the contents of lol.pcap in Wireshark, discovering the following message:

For clarity the message read:

FTP Data (Well, well, well, aren’t you just a clever little devil, you almost found the sup3rs3cr3tdirlol :-P Sucks, you were so close… gotta TRY HARDER!

Checking for exposed serives in the previous Nmap scan we can see FTP, SSH and HTTP are exposed.

A quick attempt at logging in over SSH with root with the password “sup3rs3cr3tdirlol” - resulted in a fail (as expected).

Onto the next service in the list.

###HTTP Enumeration

Entering /secret/ url in the browser rendered:

Nothing exciting was in the page source…

I took a guess and entered sup3rs3cr3tdirlol as a dir:

Lucked in! But it didn’t contain this:

strings output for “roflmao”:

The binary appeared to just print “0x0856BF”, I entered this in the browser again - not expecting it to work.

I lucked in again!

Another dir contained:

Containing:

Good_job_:)

##SSH Brute Force

I manually attempted a SSH brute force using the previously discovered usernames + password from Pass.txt. After several attempts the connection was refused via SSH, rebooting the target VM did not help - I suspected iptables, fail2ban / DenyHosts.

Changing the attacking machines IP address allowed me to reconnect, none of the usernames authenticated with the password in Pass.txt.

Not sure what to do next, I tried the file name as the password against the previous list (annoyingly I had to change the target machines IP address again to complete).

Remote Exploit

Success, I managed to authenticate using:

Then almost as soon as I’d logged in, the following message printed to console and the session closed:

This became rather annoying…

Local Enumeration

I copied over my local enumeration sctipt to /var/tmp/ which discovered the following world writable files:

Weak Filesystem Permissions

The enumeration script identified the following world writable files:

#########################################
## 777 Files                           ##
#########################################

/srv/ftp/lol.pcap
/var/tmp/cleaner.py.swp
/var/www/html/sup3rs3cr3tdirlol/roflmao
/var/log/cronlog
/lib/log/cleaner.py

Enumeration Findings

/lib/log/cleaner.py was owned by root and executed by cron to clean out /tmp

Local Privilege Escalation

From the attacking machine I downloaded an suid bin (spawns a shell) to /usr/bin/suid on the target.

Exploiting the poor filesystem permissions, I swapped out the contents of /lib/log/cleaner.py for:

#!/usr/bin/env python
import os
import sys
try:
    os.system('chown root:root /var/tmp/suid; chmod 4777 /var/tmp/suid')
except:
    sys.exit()

Got Root

Went to get a coffee, came back and reconnected after the annoying message.

Executed my suid binary, got root.

####Root dance…

##Thanks

Thanks to @maleus21 for creating this VM challenege.