mKingdom

Beginner-friendly box inspired by a certain mustache man. - by uartuo

The following post by 0xb0b is licensed under

Recon

We start with a Nmap scan and find only one open port, 85. We are dealing with an Apache httpd 2.4.7web server. The title suggests defacing has happened.

On the index page, we are greeted with a picture of a very well-known villain.

We enumerate the pages, level by level, with Gobuster. Meanwhile, we look at the image with exiftool and https://www.aperisolve.com/, maybe we discover something hidden. Except for a set author name, we do not find anything else of relevance.

Manually and with Gobuster we reach a blog at endpoint /app/castle.

There is only one blog post.

But this one reveals us a potential username we might need later.

We see that the CMS concrete is being used. In the source, we also find the version used: 8.5.2. This is vulnerable to authenticated remote code execution.

This vulnerability is explained step-by-step in the following post. The requirement here is to be in possession of admin credentials, as this allows you to remove the upload restrictions by adding file types and then uploading and triggering a PHP reverse shell.

Shell as www-data

We know about the possible entry point through authenticated RCE, but still need credentials. Here, the defaced page was my first dead end, because I thought that the picture was deliberately placed here for stego, but this is not the case.

We can log in with the username admin and a very well-known insecure password that starts with p.

We are able to log in and have the admin dashboard available.

Next, we follow the steps described in the article below:

Select System & Settings, then Allowed File Type.

Next, add php, separated by a comma, and save the changes.

Now we create a PHP reverse sell on revshells.com, selecting the PHP Pentest Monkey.

To upload files, we simply drag them into the File Manager at /app/castle/dashboard/files/search⁣⁣. We get the URL to access the file. Before we do that, we set up a listener on our chosen port.

Next, we dial up the link presented.

We get a connection from our reverse shell as www-data. Unfortunately, we won't find the user flag here. We have to move laterally. By inspection /etc/passwd we find two users, toad and mario.

Shell as toad

We run linpeas.sh and find cat as a SUID binary that is owned by user toad. So, in that case, by running cat as another user, that binary gets executed as user toad. That might give us some restrictions if we want to read files as another user.

MySQL is running internally. Maybe we can retrieve some credentials from the web app.

By checking out the config files, we can find the database credentials. We could now look up the database, but we won't find any new users. Instead, we could check if the credentials were being reused.

First, if this has not already happened, we need to upgrade our revers shell to have it more interactively and be able to switch users.

We paste the database credentials for toad and are able to switch users, but this user has no flag.

Shell as mario

Let's try to switch to user mario. While enumerating the target manually, we find a strange password token in the env variable encoded in base 64.

We use CyberChef to decode it...

... And switch users to mario. This is the password for mario.

Here we find the first flag, and we can't read the flag, because of the SUID bit set. We look for another copy of cat on the machine and find one at /usr/lib/klibc/cat, With that, we can read the last flag.

Shell as root

If this has not already happened, we upload and run pspy64 on the machine to discover processes running in the background.

Here we find a cronjob that uses cURL to download a script at mkingdom.thm and execute it. If we are somehow able to write to /etc/host, we can easily supply the machine with a malicious script that executes a reverse shell for us.

Again, we use revshells.com to generate a reverse shell. This time using BusyBox.

We see we are able to write to /etc/hosts as mario.

With nano or vi we can update the /etc/hosts and replace the existing IP for mkingdom.thm with our own IP address.

Next, we create the folder structure, create the script, place it in the correct location, and set up a web server on port 85 using Python. Besides this, a listener is running on our desired port.

After a short duration, the script gets downloaded...

... And executed. We get a reverse shell connection back as root. We can read the flag in the home directory of root using /usr/lib/klibc/bin/cat.