CTF-Writeups/HackTheBox/Routerspace.md
2022-07-09 21:00:39 +05:00

4.9 KiB

HackTheBox - RouterSpace

NMAP

PORT   STATE SERVICE VERSION                         
22/tcp open  ssh     (protocol 2.0)                                      
| fingerprint-strings:                                                  
|   NULL:                                    
|_    SSH-2.0-RouterSpace Packet Filtering V1
80/tcp open  http                                      
| fingerprint-strings:                                     
|   FourOhFourRequest:                                      
|     HTTP/1.1 200 OK                                       
|     X-Powered-By: RouterSpace                              
|     X-Cdn: RouterSpace-41677               
|     Content-Type: text/html; charset=utf-8                                   
|     Content-Length: 76             
|     ETag: W/"4c-daU9QTsu+JmXzduj1YN/Vqx5tUc"                                  
|     Date: Sun, 27 Feb 2022 16:02:12 GMT
|     Connection: close
|     Suspicious activity detected !!! {RequestID: xJG p RrjCI GYGF c VrTe l }
|   GetRequest: 
|     HTTP/1.1 200 OK
|     X-Powered-By: RouterSpace
|     X-Cdn: RouterSpace-64002
|     Accept-Ranges: bytes
|     Cache-Control: public, max-age=0
|     Last-Modified: Mon, 22 Nov 2021 11:33:57 GMT
|     ETag: W/"652c-17d476c9285"
|     Content-Type: text/html; charset=UTF-8
|     Content-Length: 25900
|     Date: Sun, 27 Feb 2022 16:02:11 GMT

PORT 80 (HTTP)

The web server has a template page which has a download option

This will download routerspace.apk

Now here I ran into a rabbithole or should I say had trouble in setting up the environment, there are two routes in getting a foothold one being reversing the application but issue is that this is react application and it's code is obfuscated, by decompiling the apk with `apktool` we can find `index.android.bundle` file which will have the obfuscated javascript code, I did tried to deobfuscate but couldn't deobfuscated it properly

We can use js-beatufiy to make the code a bit cleaner which can be installed through npm

We do see some strings which tells the url but still I wasn't able to deobfuscate it and make the proper url or endpoint

Foothold

Next was to run this application on android emulator, I like using Genymotion so setup a new device and make sure that you use android 7 because if your android version is above 7 you'll face an issue when you'll try to intercept the requests being made by this application. So using an android 7 device we installed the application using adb

Before running make sure to add a proxy setting to the WiFI access point

Now run the application while having burpsuite to listen on all interfaces and intercept the request

So we can do command injection here and get RCE, next we can just add our ssh public key in /home/paul/.ssh/authorized_keys file and login through ssh

Checking the source code of the application we can see why were able to command injection as it was executing it as a process

Privilege Escalation

So for escalating privileges I didn't find any thing that I could abuse or saw any cronjobs running, so only option I could think of was running linpeas but all outbound traffic was blocked as I couldn't transfer linpeas from my machine

Copying the linpeas bash script and copy pasting it through clipboard was the only solution I could up with and then I ran the script which showed the sudoedit was vulnerable to a CVE know as sudo Baron Samedit (CVE-2021-3156)

We can confrim that sudoedit is vulnerable as when we run sudoedit with -s Y it should not ask for password instead it should show us the usage options

But on the target machin it was asking for a password

We can grab the exploit from here by copy pasting the exploit from clipboard

Running id command we can see that we are root

References