Pyrat
Test your enumeration skills on this boot-to-root machine.
Last updated
Test your enumeration skills on this boot-to-root machine.
Last updated
This work by Manav G Krishna is licensed under CC BY-NC 4.0
Room's Description:
Machine IP: 10.10.192.46
Hosts file entry: echo '10.10.192.46 pyrat.thm' | sudo tee -a /etc/hosts
Nmap Scan:
The scan results show that we have two ports open, that is port 22 & 8000 .
Checking out port 8000:
The page tells us to try an even more basic connection. The only thing that comes to mind is either netcat or telnet. Port 23 ain't open on the machine, leaving us with just netcat.
We can now connect to the port via netcat, like so:
We are connected.
From the Nmap scan results, we notice that the version results for port 8000 says - SimpleHTTP/0.6 Python/3.11.2. This means it is a Python-based HTTP server. So our interaction with the netcat connection will highly likely be through Python.
To confirm the same we can execute a simple print command:
And indeed we get the output. This confirms that we are on a Python shell.
We can also try to find the exact Python version that could be running:
We are on 3.8.10. So the fingerprinting that Nmap did (3.11.2) wasn't accurate.
Now that we have tested enough stuff and have fully confirmed that we are having a Python interaction via the netcat connection, we can go ahead and try to run a Python reverse shell command to see what we are presented with.
Python Reverse Shell:
The IP specified in the command is the tun0 interface IP.
Now, we can set up a netcat listener on our attacker machine and execute the above command.
And we get a connection as www-data.
Firstly we can proceed to upgrade the current shell a little.
Commands:
We land directly within the /root directory.
From the /etc/passwd file contents we have a user other than root having a console, that being - think:
Let us now start traversing other common directories hoping to find some good information. Moreover, the room's description says that we would be able to find some credentials within a well-known folder, it could be think's password!?
Good directories to look into:
/opt and /var.
Checking out /opt:
There is a .git directory. Having access to this folder can help us retrieve some code or sensitive data.
There is a file named config.
And we get the user think's password.
Now we can SSH in as think:
Command:
We get the user flag in think's home directory:
Now let us get back to the .git folder within the /opt directory as we hadn't fully enumerated it before.
Instead of manually examining all those files under the .git directory, we can use Git commands to retrieve useful information.
We do have the git utility on the machine:
Commands:
We have only 1 commit.
The commit message says that a shell endpoint was added or it could mean the endpoint's name is shell. The description of the room talks about endpoints and shell might be an endpoint too.
This is the latest or the most recent commit (HEAD -> master). However, the file name pyrat.py.old suggests that it may be an older version of a script called pyrat.py.
Even though we don't have the full code, what it is mainly saying is this:
It allows a server to respond to commands received from us over a socket connection. The switch_case function checks the input given by us and decides what action to take. If the input is some_endpoint, it calls a specific function. If the input is shell, it gives us access to a command line shell on the server, to execute commands.
So we now know that we have an endpoint named shell. Even though the script might not be the latest code, we can still give it a try by passing this endpoint on the netcat shell to see if it still stands valid:
And it works. We get a shell as www-data. Now let us try to see what is up with that some_endpoint.
Passing in some_endpoint:
So this confirms that this is the special endpoint that we have to fuzz for as mentioned in the description of the room.
These lines:
Says that there is some other endpoint that is present (1st line) and that endpoint is being used like so: get_[that endpoint] (2nd line).
We can now go ahead and fuzz out that so-called special endpoint via some simple Python scripting.
Endpoint Fuzzing Script:
Firstly we have to fetch a wordlist:
I have named the wordlist file: endpoints.txt
And we get a valid hit:
When admin was passed, the response from the server was - Password:
Passing the same:
So we now have found out that special endpoint, that being - admin.
Fuzzing for the password is what should be done at this point, admin password. It is safe to assume the same as the endpoint is named admin, so we have to find the admin's password which we aren't aware of yet.
Password Fuzzing Script:
For this, we would be using the rockyou.txt wordlist.
And we again get a hit:
The response from the server when the valid password was tried: Welcome Admin!!! Type "shell" to begin.
Now we can go ahead and enter the password:
We are now root.
The root flag can be fetched from the /root directory.
Room solved!!
This is something I overlooked when I initially completed the room, in the sense didn't put much thought into that aspect even though I saw it a lot many times on the machine. I will be diving straight into it without any story-building.
Checking out /var/mail:
The mail talks about a RAT that was downloaded by a person from a GitHub page that belongs to Jose.
And we had come across Jose's email ID a lot many times on the machine, a few instances being in the config file contents, in the output of the git log, git show commands, etc.
That email when searched led us to the GitHub account of the maker of this very room.
There is a repo called PyRAT in it:
This repo reveals the special endpoint which was admin:
The code too in the repo reveals the same and it is the same exact code that is running on this room as a cron job as root:
The code:
