Executive Summary

Introduction

This Pentest report documents the security assessment conducted on the IP address 10.10.10.13. The assessment aimed to identify vulnerabilities that could be exploited to compromise the security of the target infrastructure.

Objective

The objective of this security assessment was to identify and exploit vulnerabilities in the Cronos CTF's infrastructure to evaluate existing security measures and provide recommendations to mitigate the identified risks.

Requirements

• Identify vulnerabilities in the web application hosted at IP address 10.10.10.13.
• Exploit critical and moderate vulnerabilities to assess potential exposure to attacks.
• Evaluate the possibility of unauthorized access to systems and data.

High-Level Summary of Found Vulnerabilities

DNS Enumeration

1. Zone Transfer (Moderate): A DNS Zone Transfer attack on 10.10.10.13 (cronos.htb) allowed the retrieval of domain name information, potentially spreading the attack vector. To mitigate this, restrict DNS Zone Transfers to authorized IP addresses and modify the DNS server configuration (BIND) to limit Zone Transfer permissions.

Web Server Enumeration

1. admin.cronos.htb - SQL Injection (High): A SQL injection vulnerability in admin.cronos.htb enabled the extraction of sensitive information from the database. Remediation involves implementing input validation and parameterized queries to prevent such attacks and setting up logging to detect and respond to potential attacks in real-time.

2. admin.cronos.htb - Authentication Bypass (High): By using a SQL injection payload, the authentication mechanism at admin.cronos.htb could be bypassed, allowing login as 'admin' without a valid password. To fix this, address the SQL injection vulnerability mentioned above.

3. Initial Access - Command Injection (High): After logging in as admin without a valid password (using the Authentication Bypass above), a remote attacker can inject OS commands through the Net Tool v0.1 panel. Mitigation includes patching SQL injection vulnerabilities and implementing correct user authentication. Thoroughly validate and sanitize user input to prevent command injection attacks.

Post Exploitation

1. Database Credentials: Database user credentials were extracted from the file config.php after obtaining a foothold on the machine. To improve security, store credentials securely using encryption or hashing, and regularly rotate and update database credentials.

2. LPE to root (Local Privilege Escalation to root): An active crontab was abused to run as the root user every minute. This crontab executed PHP on Laravel's 'artisan' file, owned by the low-privileged user www-data. To prevent this privilege escalation, run the crontab as www-data instead.

Recommendations

1. Implement measures to restrict DNS Zone Transfers to authorized IP addresses and limit Zone Transfer permissions in the DNS server configuration (BIND).
2. Address the SQL injection vulnerability in admin.cronos.htb by implementing input validation, parameterized queries, and real-time attack detection through logging.
3. Correct the SQL injection vulnerability in the authentication mechanism at admin.cronos.htb by applying the same recommendations mentioned above.
4. Thoroughly validate and sanitize user input in the Net Tool v0.1 panel to prevent command injection attacks after login.
5. Enhance security for database credentials storage, including encryption or hashing, and establish a regular rotation and update process.
6. Prevent local privilege escalation to root by configuring the crontab to run as the user www-data.

Methodology

The assessment involved service enumeration, DNS enumeration, and web server enumeration. DNS Zone Transfer attacks, SQL injection, authentication bypass, and command injection vulnerabilities were identified and exploited. Post exploitation activities included the extraction of database credentials and a local privilege escalation to root scenario through an active crontab.

Color Legend

Console color legend:

Risk Classification