OSCP Preparation [ Development ]

j1gs@w
8 min readMar 22, 2023

--

This is the second machine that I have pwned for my OSCP preparation. Without further ado, let’s get into it!

The attacker’s IP address

First of all, our attacker machine has the IP address of 192.168.181.132.

The victim’s IP address

Performing a host scan with nmap along with the -sn switch, our subnet, and outputting the results to a file with -oN switch. The results show that our target has the IP address of 192.168.181.148.

Port scanning with nmap

Then, performing a version scan with the -sV switch along with the default nmap scripts loaded with the -sC switch shows that the target machine has an SMB service, a web server hosted on port 8080 and has enabled ssh.

Page displayed for the web service

Going to the website hosted on the target reveals a development page. The page mentions that some of their projects are in /html_pages

Source code of the initial page

Viewing the source code reveals that there is a secret development page.

Pages available on the web service

Going to the /html_pages directory reveals several html pages.

about.html

/about.html reveals nothing of use.

config.html

config.html reveals nothing of use as well.

default.html

Within /default.html a sequence of 1’s and 0’s is displayed.

Converting binary to ASCII characters

Converting the 1’s and 0’s shows the string, “HUH?”.

development.html

In /development.html shows a paragraph regarding unknown backdoors within web applications inserted by the IT administrators without the project team knowing. This may be a clue.

Source code for development.html

Viewing the source code of /development.html reveals the secret development page, /developmentsecretpage.

downloads.html

/downloads.html shows us the following images.

martell.jpg
tryharder.jpg

None of the images is of use.

Source code for downloads.html

However, the source code reveals a hidden test.pcap file which can reveal network-related information.

login.html

/login.html has nothing of use.

register.html

/register.html reveals a sequence of 1’s and 0's.

Converting binary to ASCII characters

Converting the sequence of 1’s and 0’s from binary to ASCII values reveals the string “Surely development secret page is not that hard to find?”.

tryharder.html

/tryharder.html reveals nothing of use.

uploads.html

/uploads.html displays a paragraph regarding upload vulnerabilities.

Index of /developmentsecretpage

Finally, going into /developmentsecretpage reveals another page, patrick.php.

patrick.php

Within patrick.php, the page gives us the web server’s sitemap.

sitemap.php

In sitemap.php, a few links are present.

Source code for sitemap.php

The source code of patrick.php shows us a comment that the hyperlinks of the sitemap should be fixed. The page also shows the potential users that may be related to the challenge, patrick and intern.

securitynotice.php

securitynotice.php reveals that the target’s users are using weak passwords. This could be a clue that brute-forcing the password is possible.

test.pcap

At this point, there I thought there was nowhere else to explore on the website. So, I moved on to the pcap file.

TCP stream for /developmentsecretpage/directortestpagev1.php

Within the pcap file, by following TCP connections, a stream reveals a page within the directory /developmentsecretpage/directortestpagev1.php.

TCP stream for /qinyi/motivation.html

Following another stream reveals another page located in /qinyi/motivation.html. This page reveals nothing.

TCP stream for a SMB transmission

The last that was significant was the stream that reveals an SMB transmission which verifies the nmap scan that was done just now.

directortestpagev1.php

Within /developmentsecretpage/directortestpagev1.php, reveals a page that is supposed to be presented to the director.

Source code for directortestpagev1.php

Viewing the source code reveals that test.html is approved.

Login page revealed

At this point I was stuck. However, viewing a writeup revealed that there was a link that I didn’t explore; /developmentsecretpage/sitemap.php?logout=1. With that said, a login page was presented.

PHP error message

Entering default credentials such as admin for the username as well as for the password shows a PHP error, ereg_replace on the page slogin_lib.inc.php.

Information about CVE-2008-5763 (CVE Details, 2008)

Searching up slogin_lib.inc.php reveals a CVE for it, CVE-2008-5763.

This exploit is an exploit that came out from CVE-2008-5763. Where the usernames and passwords can be accessed by the attacker.

Exploit to view usernames and passwords (Osirys, 2008)
Usernames and passwords revealed

As shown above, the passwords of the users seem to be hash values. Cracking those passwords with CrackStation and Hashes reveals the following passwords.

Cracked password for user intern

12345678900987654321 is the password for the user intern.

Cracked password for user qiu

qiu is the password for the user qiu.

Cracked password for user patrick

P@ssw0rd25 is the password for the user patrick.

Using enum4linux

Now that the web application is completely scanned through. The SMB service can now be enumerated with enum4linux.

Users allowed for SMB

Doing so reveals that the only user that is allowed to login is the user intern. However, logging in with the password that was gathered from the web application for the user intern reveals nothing of use.

ssh into intern’s account

However, using the intern’s credentials, ssh into the user’s account was successful.

Commands allowed for intern

However, the number of commands that were allowed was limited.

Induced error

However, by inducing an error, it can be determined that the shell that was limiting the user’s actions was limited by a Python shell.

Spawning shells (sushant747, nd)

Knowing that the user can execute the echo command, and that the shell is limited by a Python shell, a shell can be spawn using the command shown above.

Gain an interactive shell with no limitations

Doing that allows new bash shell to be spawned without any limitations. Using the ls command, user flag is now visible.

User flag

Using the cat command reveals the contents of the user flag.

Changing users

Knowing that there is another user called patrick, the su command can be used to switch to the user patrick, with the password obtained through the web application.

Viewing sudo privileges

Using sudo -l displays the programs the user can execute with sudo privileges. Looking at the listing, vim and nano can be executed with sudo.

GTFOBins command to gain a root shell

Using GTFOBins, the command to spawn a root shell using is shown above.

Gained root shell

Using that command gives the user root privileges.

root flag

Finally, the root flag located in /root/proof.txt is concatenated.

In conclusion, this challenge is fairly easy. However, I was in a hurry to find every information that I missed out some links which required me to search up a write up of the challenge to refer to. Even though I cheated on this challenge. I learned to review every link that was present as it may reveal some hidden information.

References

Details, C. V. E. (2008, December 30). CVE-2008–5763. Retrieved March 22, 2023, from https://www.cvedetails.com/cve/CVE-2008-5763/

Osirys. (2008, December 14). Simple text-file login script (sitefilo) 1.0.6 — file disclosure / Remote File Inclusion. Exploit Database. Retrieved March 22, 2023, from https://www.exploit-db.com/exploits/7444

sushant747. (n.d.). Spawning shells · total OSCP guide. Spawning shells. Retrieved March 22, 2023, from https://sushant747.gitbooks.io/total-oscp-guide/content/spawning_shells.html

--

--