Bashed Writeup
Bashed is a retired HackTheBox machine, rated easy and rightfully. We’ll start by finding a hidden web shell to quickly gaining root level access due to misconfigured permissions to users.
Vulnerability Exploited: CWE-553: Command Shell in Externally Accessible Directory
System Vulnerable: 10.10.10.68
Vulnerability Explanation: A php webshell is exposed to external, and can be used by an attacker to execute commands on the web server.
Vulnerability Fix: Remove any Shells accessible under the web root folder and children directories. Therefore, disable the directory listing.
Privilege Escalation Vulnerability: Misconfiguring permissions can lead to disastrous consequences.
Vulnerability Fix: The system administrator should have conformed to the principle of least privilege and the concept of separation of privileges.
Severity: Critical
An initial nmap scan revealed a 80/tcp port with an Apache httpd 2.4.18 as the following:
80/tcp (HTTP)
Intial page located on http://10.10.10.68/ doesn't reveal anything interesting.
Fuzzing the website using feroxbuster result many sensitive directories as the follow:
A sender mail is exposed on the following path: http://10.10.10.68/php/
A php webshell is exposed on the following path: http://10.10.10.68/dev/
We can run any command using this webshell:
In this stage, launch a local nc listener and runt the following payload on the remote machine (on the webshell).
A reverse shell is received with the user www-data
To make the bash more readable, using python we can spawn a shell as the following
Proof - User
Privilege escalation (1)
Run sudo -l to list all the allowed command for the www-data user.
The user www-data can execute any command on bash using scriptmanager user. To escalate for this use, all we need is to run the following command:
Privilege escalation (2)
On the root folder '\' , there is a non ordinaly exist folder called scripts, which contains two files as the following:
As a scriptmanager user, we can modify the content of ŧest.py file as the follow:
Before modify the content of the test.py launch a local nc listener using the same parameter mentioned on the modified python file.
A reverse shell is received as the root user.
To make the bash more readable, using python we can spawn a shell as the following
Proof - Root
Hardening Tips
Apache Server Harding
Hide Apache Version and Operating System
On the /etc/apache2/conf-enabled/security.conf modify or Add the two following lines:
Then reload Apache:
The nmap result becomes:
Disable Directory Listing and FollowSymLinks
Edit the config file /etc/apache2/apache2.conf by putting "-" before each tag directive in the line Options Indexes FollowSymLinks to become Options -Indexes -FollowSymLinks. As the follow:
This response from the server on the current machine becomes:
Secure Apache using mod_security and mod_evasive Modules
Mod_security Acts as a firewall for web servers and applications, providing protection against brute force attacks. Install it and then restart Apache.
Mod_evasive Detects and provides protection against DDOS and HTTP brute force attacks. It detects attacks whenever: so many requests are directed to a page several times per second; temporarily blacklisted IP still tries to make a new request; child process attempts making more than 50 concurrent requests. Install and restart Apache.
Limit Request Size
By default, the HTTP request in Apache is unlimited hence web server is susceptible to DoS attacks by keeping it open for a high number of request. For example, there is a site that allows users to upload files, then it’s important to set a limit for upload size. This can be done by setting the LimitRequestBody for that particular upload directory as follows:
Disable TRACE HTTP Request
By default, Trace HTTP Request is enabled allowing for Cross Site Tracing. This enables a hacker to easily steal cookie information. Disabling Trace HTTP Request makes the mod_proxy and core server return “ 405 - Method Not Allowed error message to clients. Trace request is disabled by adding the line TraceEnable off in the config file /etc/apache2/apache2.conf Save the file and reload the apache service.
Conclusion
The enlisted 5 steps are the most basic security protection features to implement in your Apache web server.
Last updated