In this post, i would like to share walkthrough on Dynstr Machine.
This room is been considered difficulty rated as Medium machine
Information Gathering on Dynstr machine
Once we have started the VPN connection, we can start information gathering on the machine by executing the command nmap -sC -sV <IP Address> -PN
Let’s run gobuster to get a clear enumeration of the machine itself. From the gobsuter result, we notice that there is /nic directory stored over here.
If we continue enumeration on the website, we should be able to be found a file called update
When we access to send the packet to the server, we notice that the Response output for server information such as
server 127.0.0.1 zone no-ip.htb update. delete beta.no-ip.htb good 10.10.14.16
Gaining Access on dynstr
Let’s do some research for further knowledge on the internet
Let’s try to enter the code on BurpSuite Community and i didn’t manage to get a reverse shell back connection.
We managed to get the command correct on the burpsuite and send the request to the server
We managed to get the reverse shell connection back to us.
Let’s read the update file I have noticed that we need to nsupdate the DNS configuration which requires a key
The screenshot above shows the infra.key with the secret key
We need to update the DNS connection configuration with the command nsupdate -k /etc/bind/infra.key
Let’s retrieve the ssh key on authorized_keys but we cannot login to the machine via the ssh service.
Let’s roam around the server and found some script on /home/bindmgr/supported_case-C62796521.
Inside one of the script, we managed to get ssh id_rsa
Let’s ssh into the machine using that id_rsa
We managed to login to the server via ssh service
We can read the user flag by executing “cat user.txt” command
Escalate to Root Privileges Access
We should be able to get the SUID file if we run the sudo -l command
Let’s read the file at /usr/local/bin/bindmgr.sh and we notice that the bug is related to wildcard injection
The command above will be executed by the attacker to get bash copied to our ssh session
I have been manage to found the bash file have been assigned a SUID binary
Let’s run the bash -p at /etc/bind/named.bindmgr/bash -p
We are logged as root
We should be able to read the root flag by going to /root/ directory and running “cat root.txt“
Happy Learning Guys!
We can go to /etc/shadow to unlock the write-up