Overpass has been hacked! Can you analyse the attacker's actions and hack back in?

Metadata

Tasks

Task 1: Forensics - Analyse the PCAP

What was the URL of the page they used to upload a reverse shell?

We begin by loading up the pcap in wireshark. A file upload via the webserver hints that we should look at the http traffic. More so the files found in the pcap.

To find the files go to File -> Export Objects -> HTTP.

By clicking on them we get the packets for that file on the main wireshark window. Clicking on the `upload.php` (with larger file size) and following the HTTP-stream (Right-click -> Follow -> HTTP-Stream) we find the following:

We find the PHP reverse shell together with the URL. Note that we also find the malicious IP-address being 192.168.170.145

What payload did the attacker use to gain access?

Answer to this question is found in the previous What was the URL of the page they used to upload a reverse shell?.

What password did the attacker use to privesc?

Knowning the IP-address of the adversary - we can filter on the address as src to see what traffic it is generating:

ip.src == 192.168.170.145

It looks like the adversary is trying to get a stable shell - now we can follow the TCP-stream to look further (Right-click -> Follow -> TCP-stream).

How did the attacker establish persistence?

Answer to this question is found in the previous What password did the attacker use to privesc?.

Using the fasttrack wordlist, how many of the system passwords were crackable?

In the same TCP-stream, the adversary listed the /etc/shadow file, where we can see the following hashes:

james:$6$7GS5e.yv$HqIH5MthpGWpczr3MnwDHlED8gbVSHt7ma8yxzBM8LuBReDV5e1Pu/VuRskugt1Ckul/SKGX.5PyMpzAYo3Cg/:18464:0:99999:7:::
paradox:$6$oRXQu43X$WaAj3Z/4sEPV1mJdHsyJkIZm1rjjnNxrY5c8GElJIjG7u36xSgMGwKA2woDIFudtyqY37YCyukiHJPhi4IU7H0:18464:0:99999:7:::
szymex:$6$B.EnuXiO$f/u00HosZIO3UQCEJplazoQtH8WJjSX/ooBjwmYfEOTcqCAlMjeFIgYWqR5Aj2vsfRyf6x1wXxKitcPUjcXlX/:18464:0:99999:7:::
bee:$6$.SqHrp6z$B4rWPi0Hkj0gbQMFujz1KHVs9VrSFu7AU9CxWrZV7GzH05tYPL1xRzUJlFHbyp0K9TAeY1M6niFseB9VLBWSo0:18464:0:99999:7:::
muirland:$6$SWybS8o2$9diveQinxy8PJQnGQQWbTNKeb2AiSp.i8KznuAjYbqI3q04Rf5hjHPer3weiC.2MrOj2o1Sw/fd2cu0kC6dUP.:18464:0:99999:7:::

I put them in a new file (hashes) and used JohnTheRipper with the following command:

john hashes --wordlist=/usr/share/wordlists/fasttrack.txt

Task 2: Research - Analyse the code

What's the default hash for the backdoor?

We navigate to https://github.com/NinjaJc01/ssh-backdoor to look at the code and see if it has a hash to match against itself. We look more specificly at the main.go file.

What's the hardcoded salt for the backdoor?

If we keep looking at the main.go file, we see the following two functions mentioning the variable salt:

func verifyPass(hash, salt, password string) bool {
	resultHash := hashPassword(password, salt)
	return resultHash </b> hash
}

func hashPassword(password string, salt string) string {
	hash := sha512.Sum512([]byte(password + salt))
	return fmt.Sprintf("%x", hash)
}

At the bottom of the file we find the function passwordHandler utilising verifyPass... with the hardcoded salt!

func passwordHandler(_ ssh.Context, password string) bool {
	return verifyPass(hash, "1c362db832f3f864c8c2fe05f2002a05", password)
}

What was the hash that the attacker used? - go back to the PCAP for this!

If we look one last time at the code, we find the flag to take in the has value:

	flaggy.UInt(&lport, "p", "port", "Local port to listen for SSH on")
	flaggy.IP(&lhost, "i", "interface", "IP address for the interface to listen on")
	flaggy.String(&keyPath, "k", "key", "Path to private key for SSH server")
	flaggy.String(&fingerprint, "f", "fingerprint", "SSH Fingerprint, excluding the SSH-2.0- prefix")
	flaggy.String(&hash, "a", "hash", "Hash for backdoor") // HERE
	flaggy.Parse()

Looking at the same TCP-stream as before we find the adversary running the command:

james@overpass-production:~/ssh-backdoor$ ./backdoor -a 6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed

Crack the hash using rockyou and a cracking tool of your choice. What's the password?

From the code we know that it is SHA512. To identify the hash-type number for hashcat use:

hashcat -h | grep SHA512

Put the hash into a file and crack it using hashcat:

Task 3: Attack - Get back in!

The attacker defaced the website. What message did they leave as a heading?

Navigate to the webserver of the attackbox (port 80).

What's the user flag?

In the same TCP-stream as before we can see on the last line that the backdoor is open on port 2222:

SSH - 2020/07/21 20:36:56 Started SSH backdoor on 0.0.0.0:2222

Thus when trying to connect to the server we need to specify the port number.

The flag is located in the users home directory.

What's the root flag?

I have a habit of always using ls -la to list hidden files. In this case it helped me find the elf-file .suid_bash with the suid-bit active. What this mean is that we can execute it with the permission of the file owner, which is root.

If it does what the file name says it does, it means it will spawn a bash shell. So if we activate it with the suid-bit, it will give us a root shell instead!

Cheat Sheet

You can also find all of the following under the notes category.

JohnTheRipper

Also:

# Combine passwd and shadow for linux systems
sudo unshadow /etc/passwd /etc/shadow > unshadowed

# unshadowed parser
cat unshadowed | awk +F: '{print $2}' | sort -u

john --wordlist=list.txt --format=md5crypt unshadowed.txt

Cracked passwords stored in ~/.john/john.pot or add --show and --show=left

Hashcat

Rules (-r):

Cracked passwords stored in ~/.local/share/hashcat/hashcat.potfile or --show --user

SUID-, SGID-, Sticky-bits

Check SUID bits:

find / -perm /4000 2>/dev/null

Support me

Thank you so much for reading and I hope you found it inspirational or helpful! You can best support me by doing any of the following bellow!

You can read more about the perks of being a Member or Subscriber here.

Additionally, you can stay updated and engage with me on social media:

Contact me here: [email protected]