search

La Casa de Papel

La Casa de Papel will show you how to take advantage of services and improper handlement of certificates.

hashtag
Scanning and Enumeration

└─$ nmap -sC -sV -T4 -p- -oN casadepapel 10.10.10.131                                             130 ⨯
Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-04 00:45 EST
Stats: 0:00:05 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 0.54% done
Warning: 10.10.10.131 giving up on port because retransmission cap hit (6).
Stats: 0:00:35 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 1.71% done; ETC: 01:20 (0:34:35 remaining)
Stats: 0:04:10 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 12.15% done; ETC: 01:20 (0:30:15 remaining)
Stats: 0:15:43 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 46.63% done; ETC: 01:19 (0:17:59 remaining)
Stats: 0:15:44 elapsed; 0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 46.71% done; ETC: 01:19 (0:17:58 remaining)
Nmap scan report for 10.10.10.131
Host is up (0.11s latency).
Not shown: 63928 closed ports, 1603 filtered ports
PORT    STATE SERVICE  VERSION
21/tcp  open  ftp      vsftpd 2.3.4
22/tcp  open  ssh      OpenSSH 7.9 (protocol 2.0)
| ssh-hostkey: 
|   2048 03:e1:c2:c9:79:1c:a6:6b:51:34:8d:7a:c3:c7:c8:50 (RSA)
|   256 41:e4:95:a3:39:0b:25:f9:da:de:be:6a:dc:59:48:6d (ECDSA)
|_  256 30:0b:c6:66:2b:8f:5e:4f:26:28:75:0e:f5:b1:71:e4 (ED25519)
80/tcp  open  http     Node.js (Express middleware)
|_http-title: La Casa De Papel
443/tcp open  ssl/http Node.js Express framework
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
|_http-title: La Casa De Papel
| ssl-cert: Subject: commonName=lacasadepapel.htb/organizationName=La Casa De Papel
| Not valid before: 2019-01-27T08:35:30
|_Not valid after:  2029-01-24T08:35:30
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
| tls-nextprotoneg: 
|   http/1.1
|_  http/1.0
Service Info: OS: Unix

hashtag
Adding to host file

hashtag
Exploiting

We noticed that this had vsftpd, a common vulnerablity. Utizing msfconsole, we know there is a vulnerabiliy there, however, it did not work. When we run metasploit with the verbose option on, we do notice something quite intersting.

For some reason this did not show up in our nmap scan. Lets try to use netcat on this box.

It looks like we have a PHP shell!. We can run php code on this, but before we do. Lets do the follwoing

rlwrap makes our interactive shell prettier. After attaining access, we can try to see if we can execute commands with the following commands:

  • shell_exec()

  • system()

Unfortunatley they do noth work, however, we do have scandir(""). Lets try that out.

We were able to get a private key! You may need to do some exploring to get here, but that is how it is done. Note it may not work on all users

hashtag
Edit the private key on vim

Yo will need to edit the key to make it wokr on vim with the following:

  • %s/\\n//g

  • %s/ //g

hashtag
Using the found key to generate client certificates to access page

Dowload the certificate from the Webrowser

Step1: Veriy private key is the right one.

Step 2: Generate client key

Step 3: sign certificate

Step 4: Convert to pkcs12

Step 5: Add to firefox

hashtag
Gaining Access to the system

Notice when you highlight that there is base64 encoding. Lets analyze further.

looks like we can run in tmp

hashtag
Becoming Root

you can rename a file since we have control over our directory

Set up your Listener

PreviousConcealNextLightweight

Last updated