BitForge: Proving Grounds Linux Walkthrough

Nmap output

Nmap scan report for 192.168.239.186
Host is up (0.059s latency).
Not shown: 65531 filtered tcp ports (no-response), 1 closed tcp port (conn-refused)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 f2:5a:a9:66:65:3e:d0:b8:9d:a5:16:8c:e8:16:37:e2 (ECDSA)
|_  256 9b:2d:1d:f8:13:74:ce:96:82:4e:19:35:f9:7e:1b:68 (ED25519)
80/tcp   open  http    Apache httpd
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://bitforge.lab/
|_http-server-header: Apache
| http-git: 
|   192.168.239.186:80/.git/
|     Git repository found!
|     .git/config matched patterns 'user'
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|_    Last commit message: created .env to store the database configuration 
3306/tcp open  mysql   MySQL 8.0.40-0ubuntu0.24.04.1
| mysql-info: 
|   Protocol: 10
|   Version: 8.0.40-0ubuntu0.24.04.1
|   Thread ID: 70
|   Capabilities flags: 65535
|   Some Capabilities: SupportsLoadDataLocal, InteractiveClient, SwitchToSSLAfterHandshake, SupportsTransactions, LongColumnFlag, Speaks41ProtocolOld, FoundRows, IgnoreSigpipes, SupportsCompression, Support41Auth, Speaks41ProtocolNew, LongPassword, DontAllowDatabaseTableColumn, IgnoreSpaceBeforeParenthesis, ConnectWithDatabase, ODBCClient, SupportsMultipleResults, SupportsMultipleStatments, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: 3jz8q-{Z<\x0CJ"\x16a8)i\x0Cns
|_  Auth Plugin Name: caching_sha2_password
| ssl-cert: Subject: commonName=MySQL_Server_8.0.40_Auto_Generated_Server_Certificate
| Issuer: commonName=MySQL_Server_8.0.40_Auto_Generated_CA_Certificate
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-01-15T14:38:11
| Not valid after:  2035-01-13T14:38:11
| MD5:   6ffd:19b3:1593:91e3:ca5f:95c7:4224:8213
|_SHA-1: 5a03:d302:2473:ec92:5347:eaca:48cf:80ea:90c3:2a64
|_ssl-date: TLS randomness does not represent time
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have bitforge solutions page running on port 80

BitForge walkthrough, Got reverse shell as root, screenshot 1 — BitForge, step 1

When we click on “Employee Planning Portal” we are redirected to plan.bitforge.lab which we need to add in /etc/hosts file to access

BitForge walkthrough, Got reverse shell as root, screenshot 2 — BitForge, step 2

We have .git directory on bitforge.lab

BitForge walkthrough, Got reverse shell as root, screenshot 3 — BitForge, step 3

We clone .git locally

BitForge walkthrough, Got reverse shell as root, screenshot 4 — BitForge, step 4

We have multiple entries in git log

BitForge walkthrough, Got reverse shell as root, screenshot 5 — BitForge, step 5

We got db admin credentials

BitForge walkthrough, Got reverse shell as root, screenshot 6 — BitForge, step 6

Use creds to login to database

BitForge walkthrough, Got reverse shell as root, screenshot 7 — BitForge, step 7

We have SOPlanning db here

BitForge walkthrough, Got reverse shell as root, screenshot 8 — BitForge, step 8

We got password hash of admin from the SOPlanning github repo

BitForge walkthrough, Got reverse shell as root, screenshot 9 — BitForge, step 9

Changed admin password hash to new hash using mysql

BitForge walkthrough, Got reverse shell as root, screenshot 10 — BitForge, step 10

Now trying login with admin : admin

BitForge walkthrough, Got reverse shell as root, screenshot 11 — BitForge, step 11

And we got it

BitForge walkthrough, Got reverse shell as root, screenshot 12 — BitForge, step 12

Found https://www.exploit-db.com/exploits/52082 this exploit & ran it

Got reverse shell

We got jack user password using pspy

BitForge walkthrough, Got reverse shell as root, screenshot 15 — BitForge, step 15

Got local.txt (f0cabfc889d164296a7400ae80be3a7a)

BitForge walkthrough, Got reverse shell as root, screenshot 16 — BitForge, step 16

We have sudo access on flask_password_changer

BitForge walkthrough, Got reverse shell as root, screenshot 17 — BitForge, step 17

Inside flash_password_changer we have following script

BitForge walkthrough, Got reverse shell as root, screenshot 18 — BitForge, step 18

Jack hash write access on app.py

BitForge walkthrough, Got reverse shell as root, screenshot 19 — BitForge, step 19

Added python reverse shell payload in app.py and ran the flask_password_changer as sudo

Got reverse shell as root

Got proof.txt (0b84bee2876cdd5f7836a9e8f72a078b)

BitForge walkthrough, Got reverse shell as root, screenshot 22 — BitForge, step 22

More walkthroughs

CLUELinux

Full walkthrough of the CLUE box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

CockpitLinux

Full walkthrough of the Cockpit box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

CodoLinux

Full walkthrough of the Codo box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

AccessAD

Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.

HeistAD

Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.

HokkaidoAD

Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.