Res
#cracking, #linux, #rce, #redis, #sudo, #SUID
Last updated
#cracking, #linux, #rce, #redis, #sudo, #SUID
Last updated
Date: 27/03/2022
Difficulty: Easy
CTF:
Hack into a vulnerable database server with an in-memory data-structure in this semi-guided challenge!
First of all, let’s visit the webpage hosted on the port 80:
It displays a default page of an apache server recently installed.
As we have seen, there is a redis server running on port 6379. After some reading, I found that there is a way to interact with this service.
Let’s download the redis application:
Let’s test the connection:
It seems like we have connection with the redis server!
The info command seems to be helpful to retrieve redis server information:
We should know the path where we want to write the php file. Since we have visited the page before, we know that the folder is: /var/www/html
So, following the steps we do the same in our case:
Now let’s visit the page:
It works, now let’s try to write a reverse shell in php:
Let’s open a netcat listener in our machine:
And let’s visit the rs.php file:
We got a connection but it quickly disconnects...
Let’s try with this other one-line php reverse shell:
Yeah, this one works!
We found the key file in the /home/vianka folder.
Before anything, let’s try to stabilize this shell:
Python is installed in the machine, so let’s use it:
Ok, shell stabilized, now let’s look for the local user account password. Can we read /etc/shadow file?
Nope, we can’t.
Something interesting in the history?
Let’s see if we find some keys in the user directory... nothing useful I can see...
After spending some time looking for ssh keys or something useful, I look for files with SUID activated:
From this list, xxd appears in the GTFO Bins list:
Exploiting this, we should be able to read /etc/shadow file!
Yeah! Now with the info of /etc/passwd, let’s use unshadow and John the ripper to crack the hash!
Unshadow done, now let’s crack it!
Cool!
Let’s login as vianka and see if we have more permissions:
Enough permissions to access to root folder?
Nope. Let’s see what we can execute with sudo:
Really? We can run any command using sudo...
Woah
And this quickly we get the last flag!
According to this webpage () there is a way to do a Remote Code Execution on a redis server:
