# Cat Pictures 2

{% embed url="<https://tryhackme.com/room/catpictures2>" %}

## Recon

Scanning our target with Nmap we can discover five open ports, of which three are running a web server and two are an ssh server.&#x20;

We have a web server on ports 80, 8080, and 3000.  On Port 22 and 222 an SSH server.&#x20;

On the web server on port 80 a photo management application called Lychee is running.&#x20;

The application running on the web server on port 3000 is the software development platform Gitea, recognizable by the set cookie `i_like_gitea`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FefVGb1ZXLw4R9GYPR7E4%2Fimage.png?alt=media&#x26;token=bf2153c1-05be-461f-9ef7-cdc31a95d044" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FiPvGQ8NGOK9m5DA6P7xG%2Fimage.png?alt=media&#x26;token=81579cbd-b925-450a-9362-9cffbdc43f24" alt=""><figcaption></figcaption></figure>

Visiting the web servers, we are able to see, that on port 80 a Lychee instance is running with  version `3.1.1`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FfJY0xSX82OcCFKTME6Mf%2Fimage.png?alt=media&#x26;token=c506ec30-651b-4cfa-acb4-6f25573811ba" alt=""><figcaption></figcaption></figure>

On 8080 just nginx.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FU5bdAJIBocbUnY9TZeX0%2Fimage.png?alt=media&#x26;token=dd711a69-6a88-4194-b96c-31ef65cea319" alt=""><figcaption></figcaption></figure>

On Port 3000 as mentioned Gitea with version `1.17.3`, and there is also already a user present, `samarium`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FPI73pZrQBlONGe3Z9n9X%2Fimage.png?alt=media&#x26;token=e97e4357-1b00-4235-a854-71f57c0f5328" alt=""><figcaption></figcaption></figure>

## Flag 1 - Metadata and Repositories

For the first flag, we are inspecting the contents of the web server on port 80. Here are some cat pictures in an album.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FDphgNe0jOZFfzHdgaAQE%2Fimage.png?alt=media&#x26;token=9fb34e9d-bc72-483f-8440-c890d6cc9e91" alt=""><figcaption></figcaption></figure>

In the album itself, there are seven cute pictures of different cats. Each picture has some basic information.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FKqQKLqW2HzOqDspQeWe5%2Fimage.png?alt=media&#x26;token=ecc3c6a0-8425-4a2a-84c5-001bc73b013b" alt=""><figcaption></figcaption></figure>

But the first picture has a description that states "note to self; strip metadata". So maybe we can find some hints or information about the first flag in the metadata of this picture or the other ones.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FObmcuQ1Z5dFgnSRJc49s%2Fimage.png?alt=media&#x26;token=eb6400f3-887a-43e9-b0ec-327f3f78df4a" alt=""><figcaption></figcaption></figure>

Downloading the image and running Exiftool on that to retrieve the metadata of it does not reveal anything of interest.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FXTxQkQLzkfUw1yX09cJp%2Fimage.png?alt=media&#x26;token=fef3e9f8-dd81-4ee6-a483-f24e7afc9ae0" alt=""><figcaption></figcaption></figure>

Just by running Strings on the picture to print any printable characters in the file and looking at the first elements, we are able to receive the first hint.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FjjljetiAS4wnelInQRer%2Fimage.png?alt=media&#x26;token=cc0f2488-ce50-4c71-977d-5a6f91a924c3" alt=""><figcaption></figcaption></figure>

On the webserver on port 8080 is a cryptic named text file hidden.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FyBfFDVl3AUQQ0r20Nl9z%2Fimage.png?alt=media&#x26;token=a7cafd53-032d-46dd-ae25-c2c465d1bf5a" alt=""><figcaption></figcaption></figure>

There we see a note from the dev himself, putting a password there to not forget it. In his perception of security, it is probably enough to have valuable things like user credentials that are hard to find. Besides the credentials, there is a second hint: that there is an Ansible runner - olivetin - running on port 1337.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F4lZwRRnJEjHVqlTrlu5o%2Fimage.png?alt=media&#x26;token=5b068e2d-1d23-4bc8-8c4d-8dd9b9246e90" alt=""><figcaption></figcaption></figure>

With the found credentials we log in to the Gitea application.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fhg6koyoKEzi8LuaiPZVu%2Fimage.png?alt=media&#x26;token=8fa40e37-d910-4f5a-8112-072d3b28dd34" alt=""><figcaption></figcaption></figure>

From there, we are able to see a repository called Ansible in which the first flag is viewable.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fh1g01WCW6n9iVAPelxgz%2Fimage.png?alt=media&#x26;token=8313d72d-c855-4043-8769-13189f34ef16" alt=""><figcaption></figcaption></figure>

Looking a the source of flag1 we are able to read it.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FlgBDR7iEQbz1iYHi5WPj%2Fimage.png?alt=media&#x26;token=2a2cb4b8-3597-447e-a059-02bce73f30dc" alt=""><figcaption><p>Flag 1</p></figcaption></figure>

## Flag 2 - Ansible and Playbooks

In the Ansible repository, a `playbook.yaml` is present. Which runs the `whoami` command as the user `bismuth`. As we remember, there is an Ansible runner present on port 1337.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F7OI94fMWln9PJrzxEOFO%2Fimage.png?alt=media&#x26;token=bb0ada5e-5cc0-4e0d-9302-5a67a4c8a329" alt=""><figcaption></figcaption></figure>

Visiting the runner on port 1337 with a browser, we are able to run Ansible Playbooks.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FOTKN8Q7xLD1BEkfEhO6C%2Fimage.png?alt=media&#x26;token=541a3012-6497-4a90-bf42-1c3642420c80" alt=""><figcaption></figcaption></figure>

And see the results in the logs.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FgjZVAnRTYJoiZvjX2llz%2Fimage.png?alt=media&#x26;token=f42fab8f-d800-4455-a694-ed599d1630cd" alt=""><figcaption></figcaption></figure>

Hitting the panel `Run Ansible Playbook` the playbook in the repository gets executed, and in the logs, we can see the results of `whoami`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FJSYV4RQntqatFMDpxO2i%2Fimage.png?alt=media&#x26;token=b2620a3d-25ce-44de-aa14-531e14abe12a" alt=""><figcaption></figcaption></figure>

Knowing this, we are able to execute OS commands by editing the playbook, running the playbook, and viewing the results in the logs.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FIcQMdPEMhmertgTOPk0P%2Fimage.png?alt=media&#x26;token=187e8b7c-88c4-4e61-b1e4-983db7d04816" alt=""><figcaption></figcaption></figure>

To retrieve the second flag, we use the commands `ls -lah` to check where we are. And see, we might be in the home directory of the user `bismuth` with the `flag2.txt` being there.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FZLmVmnvd3ThggyZeDfnl%2Fimage.png?alt=media&#x26;token=7b5c5173-769c-4b5b-8b2a-1ed35672853f" alt=""><figcaption></figcaption></figure>

Editing the playbook to be able to retrieve the second flag.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FgmtCh7ZaEp4xNW2iuGc7%2Fimage.png?alt=media&#x26;token=cfddd2ec-50a1-4549-b28f-fe0cf1a3d9fd" alt=""><figcaption></figcaption></figure>

And we are able to retrieve the second flag.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FFJwm0O3h7sElAWrn2UPz%2Fimage.png?alt=media&#x26;token=cb2f0097-7446-4ba7-8da7-db4356229286" alt=""><figcaption></figcaption></figure>

## &#x20;Flag 3 - The Obvious and the Easy

While browsing the home directory using Ansible, we could see that there was also a `.ssh` directory there. Using Ansible we look into it and find a private SSH key `id_rsa` of the user `bismuth`. Via `cat` we get the key and edit it with the help of Cyberchef to restore it.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FVhVYwwKoLJqJllbZlI3b%2Fimage.png?alt=media&#x26;token=43d9104c-36c2-4a6e-815e-247a94a56721" alt=""><figcaption></figcaption></figure>

Get the private key of user `bismuth`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FZzXIY1zdTHAl3D7NJE5i%2Fimage.png?alt=media&#x26;token=1a4a6049-f83f-46ad-a7a7-8ca255c4ec5e" alt=""><figcaption></figcaption></figure>

Edit the key via Cyberchef, removing `"`,`,` and the spaces.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FWA4RRwaTFgtUZSVPnVOx%2Fimage.png?alt=media&#x26;token=bab3a5c8-1614-4a82-b95b-a1d6efaa36c9" alt=""><figcaption></figcaption></figure>

Next, add the correct permissions to the key and use it  to log in as the user `bismuth`using SSH.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FVcgmuye19UCs3FZ5gVdY%2Fimage.png?alt=media&#x26;token=eab803a0-55c6-4816-ab9b-4936b7e491f6" alt=""><figcaption></figcaption></figure>

From there, we are able to enumerate the machine. Neither are we able to run any commands as sudo without providing a password, nor are there any suid binaries to escalate privileges. Via SCP we get our tools like Linpeas and pspy to the target and make them executable.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fu5LYaqXTTbVZPf1hrwMA%2Fimage.png?alt=media&#x26;token=da9b849d-efe1-40c5-9623-32688edad083" alt=""><figcaption><p>Getting the tools via ssh</p></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F0opwLnYh28swB3UuCH7v%2Fimage.png?alt=media&#x26;token=b2c2a934-b5ba-46fa-9bba-0fd4b0fe6a90" alt=""><figcaption><p>Applying execution permissions</p></figcaption></figure>

Running Linpeas, we see that the PATH variable is set to a writeable location and stated as a 95% PE vector by Linpeas. A `bin` folder and `.local/bin` folder in the home directory of the user `bismuth`. That was my rabbit hole, which I want to briefly explain at the end. But there is also the version of the tool sudo marked.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FkDOOQXTHde69QZHXwE0r%2Fimage.png?alt=media&#x26;token=e84ae2fb-17af-4891-ba82-4f6bd9433666" alt=""><figcaption><p>Linpeas extract</p></figcaption></figure>

Looking for an exploit, we directly get a hit. CVE-2021-3156 a Heap-Based Buffer Overflow in Sudo (Baron Samedit).

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FieyzBzBuNJQ8ddaqef2h%2Fimage.png?alt=media&#x26;token=4dfebd9c-f0e2-4113-a13e-ac6dba30ea5d" alt=""><figcaption></figcaption></figure>

Next, we need an exploit that gives us a root shell to abuse this vulnerability. CptGibbon has a PoC exactly doing it.

{% embed url="<https://github.com/CptGibbon/CVE-2021-3156>" %}

For the exploit we have to get the files from his repository to the victim machine and compile the exploit via make, resulting in the exploit. Running it gives us a root shell, and we are able to retrieve the third flag.

Via SCP we transfer the source files from CptGibbon to the target machine.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F2CHPsmkFGVEQr3u6vzQ0%2Fimage.png?alt=media&#x26;token=87719c26-b0e7-4261-be14-b89f23a96cf4" alt=""><figcaption><p>Getting the exploit to the victim</p></figcaption></figure>

There, we compile the result via `make`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F4YELRjBteQ7IEzSRrb0b%2Fimage.png?alt=media&#x26;token=4ea8aa66-eccc-4024-9b28-685d3c572ddc" alt=""><figcaption><p>Make the exploit</p></figcaption></figure>

Running the exploit, we are able to get a root shell and retrieve the third flag.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FR9ViALhQyk4a013BJH5k%2Fimage.png?alt=media&#x26;token=117f9f45-8263-41a9-9056-758c99564704" alt=""><figcaption><p>Run the exploit and getting the thrid flag</p></figcaption></figure>

## My rabbit hole

From the Linpeas output with the 95% PE vector, I was highly distracted, didn't keep in mind possible other vulnerabilities, and just wanted to find a way to exploit the writable path.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FLBI27aS9TZLbXn2rNZbF%2Fimage.png?alt=media&#x26;token=9a863380-310b-4f33-9e1f-d1c777be4157" alt=""><figcaption></figcaption></figure>

So I thought that maybe placing a script at `/home/bismuth/bin` containing a reverse shell gets somehow called by the root user, by using a binary without an absolute path and the root user shares the same path variable - why not?

Checking cronjobs and running processes via `pspy64` nothing was found. Then I had the idea, that executing the playbook might have some interactions with the root users. And it had. But it was not abuseable. Maybe this can be used in another CTF.&#x20;

So keep this in mind; don't just get distracted by the most flashy and obvious things.
