mirror of
https://github.com/AbdullahRizwan101/CTF-Writeups
synced 2024-11-21 19:43:03 +00:00
Create Faculty.md
This commit is contained in:
ARZ
GitHub
parent
e3cc16fe77
commit
fc76c1ceb1
1 changed files with 186 additions and 0 deletions
186
HackTheBox/Faculty.md
Normal file
186
HackTheBox/Faculty.md
Normal file
|
|
@ -0,0 +1,186 @@
|
|||
# HackTheBox-Faculty
|
||||
|
||||
## NMAP
|
||||
|
||||
```bash
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
|
||||
80/tcp open http nginx 1.18.0 (Ubuntu)
|
||||
| http-methods:
|
||||
|_ Supported Methods: HEAD POST OPTIONS
|
||||
|_http-server-header: nginx/1.18.0 (Ubuntu)
|
||||
|_http-title: Did not follow redirect to http://faculty.htb
|
||||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
```
|
||||
|
||||
## PORT 80 (HTTP)
|
||||
|
||||
Visting port 80 it reidrects to `faculty.htb`, so adding that in hosts file
|
||||
|
||||
<img src="https://i.imgur.com/0sRH0qp.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/Irqlh0M.png"/>
|
||||
|
||||
I tried with a random ID number but it failed
|
||||
|
||||
<img src="https://i.imgur.com/gywUc2F.png"/>
|
||||
|
||||
On trying a sqli to bypass login it worked
|
||||
|
||||
<img src="https://i.imgur.com/J2lvlg7.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/drCUZGg.png"/>
|
||||
|
||||
I intercepted the request with burp to run sqlmap on the parameter to dump database
|
||||
|
||||
<img src="https://i.imgur.com/AoScERj.png"/>
|
||||
|
||||
But the issues it, it's time-based blind sqli so it;s going to take a lot of time in dumping data, in the meantime I ran `gobuster` to fuzz for files and directories which found `/admin`
|
||||
|
||||
<img src="https://i.imgur.com/PShV5vj.png"/>
|
||||
|
||||
After bypassing login, we can just visit /admin to access the admin dashboard
|
||||
|
||||
<img src="https://i.imgur.com/ygdxXtP.png"/>
|
||||
|
||||
From the `Course List` we have an option to download the course list in pdf format
|
||||
|
||||
<img src="https://i.imgur.com/1TRJV2n.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/xj5I1km.png"/>
|
||||
|
||||
On intercepting the request we see base64 content in the `pdf` POST parameter
|
||||
|
||||
<img src="https://i.imgur.com/zp6eZO8.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/NFkYoyX.png"/>
|
||||
|
||||
Using cyberchef we can see that data is first being double URL encoded then base64 encoded and then generated into pdf format and it's just html data being converted
|
||||
|
||||
From the url it seems that it uses `mpdf` which is a php library for generating pdfs, and from googling it seems that it's vulnerable to remote code execution but that requires a crafted image with php deserlization to be uploaded on the server
|
||||
|
||||
https://github.com/mpdf/mpdf/issues/949
|
||||
|
||||
There was LFI (Local File Inclusion) through mpdf
|
||||
|
||||
https://github.com/mpdf/mpdf/issues/356
|
||||
|
||||
This was found by Jonathan Bouman
|
||||
|
||||
https://medium.com/@jonathanbouman/local-file-inclusion-at-ikea-com-e695ed64d82f
|
||||
|
||||
So our payload will look like this
|
||||
|
||||
```bash
|
||||
<annotation file="/etc/passwd" content="/etc/passwd" icon="Graph" title="Attached File: /etc/passwd" pos-x="195"/>
|
||||
```
|
||||
|
||||
<img src="https://i.imgur.com/HrjUd67.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/FyjGITX.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/73aOXI4.png"/>
|
||||
|
||||
Even tho the page looks empty but on clicking on the attachment it shows the `passwd` file
|
||||
|
||||
<img src="https://i.imgur.com/o0NsuYi.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/vRuLx44.png"/>
|
||||
|
||||
From the passwd file we can see two users, `developer` and `gbyolo`
|
||||
|
||||
<img src="https://i.imgur.com/kLayohq.png"/>
|
||||
|
||||
I tried to read ssh keys of the users if they were readable and were there
|
||||
|
||||
<img src="https://i.imgur.com/ddFsKEC.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/F9JKvGZ.png"/>
|
||||
|
||||
## Foothold (gbyolo)
|
||||
|
||||
Which failed, going back to login page, we can see the error message through sqli which reveals the full path of the php file
|
||||
|
||||
<img src="https://i.imgur.com/aVeO6eO.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/uKX4rpV.png"/>
|
||||
|
||||
Placing the encoded content in the POST parameter again we'll get `admin_class.php`
|
||||
|
||||
<img src="https://i.imgur.com/ENZ4Yp0.png"/>
|
||||
|
||||
We can see it's including `db_connect.php` file which might be having credentials to database
|
||||
|
||||
<img src="https://i.imgur.com/i41P6DS.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/05sVcYH.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/ezEbcK2.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/OGawptu.png"/>
|
||||
|
||||
Using the password `Co.met06aci.dly53ro.per` we can login through ssh as `gbyolo` user
|
||||
|
||||
<img src="https://i.imgur.com/A6ntN2p.png"/>
|
||||
|
||||
## Privilege Escalation (developer)
|
||||
|
||||
|
||||
We can see a message on login `You have mail` , on checking `/var/mail/gbyolo` it tells that we can manage git repositories belonging to `faculty` group
|
||||
|
||||
<img src="https://i.imgur.com/wikA0JI.png"/>
|
||||
|
||||
Doing `sudo -l` we can run `meta-git` as `developer` user
|
||||
|
||||
<img src="https://i.imgur.com/40QcsCR.png"/>
|
||||
|
||||
I didn't find any files owned by faculty group but meta-git itself was vulnerable to remote code execution
|
||||
|
||||
https://hackerone.com/reports/728040
|
||||
|
||||
It doesn't sanitize user input so we can execute arbitary commands
|
||||
|
||||
<img src="https://i.imgur.com/sjkDB7J.png"/>
|
||||
|
||||
This user is in `debug` group and checking what files or folders does this group have access it to reveals that it can run `gdb` binary
|
||||
|
||||
<img src="https://i.imgur.com/TIsvd50.png"/>
|
||||
|
||||
## Privilege Escalation (root)
|
||||
Checking the capbilites on this system it seems that gdb has `cap_sys_ptrace` through which we can inject commands into the process
|
||||
|
||||
https://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-capabilities#example-with-binary-1
|
||||
|
||||
<img src="https://i.imgur.com/8VfjDiO.png"/>
|
||||
|
||||
We need to fiind the process id (pid) of processes running as root user
|
||||
|
||||
<img src="https://i.imgur.com/lyZkEb2.png"/>
|
||||
|
||||
I first tried attaching the process of id of cron job ` 908`
|
||||
|
||||
<img src="https://i.imgur.com/LTrZfle.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/Nal7Bn7.png"/>
|
||||
|
||||
But this didn't worked, next I looked for another root owned process which was running python3 with process id `730`
|
||||
|
||||
<img src="https://i.imgur.com/ZO0B6Uw.png"/>
|
||||
|
||||
<img src="https://i.imgur.com/wo7DbsH.png"/>
|
||||
|
||||
Attaching it to a python3 process makes it possible to execute system calls and we can execute arbitary commands, all that is left is to get a reverse shell
|
||||
|
||||
<img src="https://i.imgur.com/vmXj8d7.png"/>
|
||||
|
||||
|
||||
## References
|
||||
|
||||
- https://security.snyk.io/vuln/SNYK-PHP-MPDFMPDF-73647
|
||||
- https://github.com/mpdf/mpdf/issues/949
|
||||
- https://github.com/mpdf/mpdf/issues/356
|
||||
- https://www.youtube.com/watch?v=tbjtfGvym4M&ab_channel=byq
|
||||
- https://medium.com/@jonathanbouman/local-file-inclusion-at-ikea-com-e695ed64d82f
|
||||
- https://hackerone.com/reports/728040
|
||||
- https://book.hacktricks.xyz/linux-hardening/privilege-escalation
|
||||
- https://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-capabilities#example-with-binary-1
|
||||
Loading…
Reference in a new issue