Hi everyone
Today we are going to look for a Box called Bullybox which is rated as intermediate in terms of difficulty. This machine has various phases: Recon, Enumeration, Exploitation and Privilege Escalation.
Difficulty – Intermediate
Operating System – Linux
Focus Areas
- Directory Enumeration
- Credential Discovery
- Exploit Discovery
- Privilege Escalation
In this writeup, I exploit an exposed Git repository to recover the application’s source code and identify valid credentials. I use the recovered credentials to gain an initial foothold on the target, then enumerate the system and discover unrestricted sudo privileges (NOPASSWD: ALL). Finally, I escalate privileges to root and obtain complete control of the machine.
Recon & Enumeration
Enumeration plays a very significant role in pen testing. The more properly you enumerate the more it will be easy to get a foothold on the target.
First, we will check whether target is reachable or not with ping command:
ping Target_IP
With ping command output we found that the target is reachable.
Now let’s move ahead and run the port scan for which we will be using Nmap a popular tool for port scanning and it will provide details of the various ports which are in Open state. The command for that will be:
nmap -sC -sV -O -oA nmap/initial 192.168.195.27
nmap -sC -sV -O -p- -oA nmap/full -T4 192.168.195.27
I discovered these ports are open:
- 22/tcp SSH service running OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
- 80/tcp HTTP service running Apache httpd 2.4.52 (Ubuntu)
- OS: Linux 5.0 – 5.14 (Ubuntu)
Then I went ahead and checked the IP in the web browser and it was redirecting to bullybox.local:
No luck with robots.txt:
Added the IP to the /etc/hosts files shows the box billing CMS:
A quick search shows a RCE but it requires admin login:
A few attempts using gobuster reveals .git directory:
A tool called git dumper is used to dump a git repository from a website:
A config file called bb-config.php revealed an area called /bb-admin and user and password:
git log shows email address of admin:
When vising /bb-admin I found another login:
I used the discovered creds and the login was successful:
Exploitation
I went to the exploit which was Authenticated RCE.
A quick search tells the GitHub link for the exploit:
https://github.com/0xk4b1r/CVE-2022-3552
The exploit was modified with IP and Port number:
Started the netcat listener and I was able to get the initial foothold:
Privilege Escalation
Now it was a time for escalating the privileges.
I quickly checked which sudo privileges the current user.
Running sudo -l revealed that the current user has unrestricted sudo privileges, including NOPASSWD access. This allows us to execute any command as root without being prompted for a password.
The above image shows the proof.txt file.
Key Takeaways
- Thorough web enumeration can uncover exposed development artifacts. Publicly accessible Git repositories often reveal source code, configuration files, and sensitive information that significantly simplify the attack path.
- Source code analysis is a valuable post-enumeration technique. Reviewing the application’s codebase can expose hardcoded credentials, authentication logic, and other implementation details that are not visible through the application’s interface.
- Credential exposure in version control repositories can directly lead to initial access. Sensitive information should never be committed to source control, even if later removed, as historical data may remain recoverable.
- Effective local enumeration is essential after obtaining an initial foothold. Regularly checking user privileges, scheduled tasks, services, and sudo permissions can quickly reveal privilege escalation opportunities.
- Misconfigured sudo permissions represent a critical security risk. Granting unrestricted NOPASSWD access violates the principle of least privilege and allows attackers to obtain root privileges without exploiting additional vulnerabilities.
- Security misconfigurations are often more dangerous than software vulnerabilities. In this case, the combination of an exposed Git repository and excessive sudo permissions was sufficient to fully compromise the system without requiring a kernel or application exploit.
If you enjoyed this post, share it with your friends and colleagues!