Travel,a Linux box created by HackTheBox user xct and jkr was a hard box, but was a real fun box. The Initial foothold was finding the .git folder on the blog-dev and analyzing the code to see that there is a SSRF on memcached and a Deserielization on SimplePie combining both of them we can get a RCE on the box. Using which we can get a shell as www-data enumerating we find a db-dump.sql on in /opt/ which have the user as lynik-admin and a password hash. Cracking that we can get a shell as the user.Privilege Escalation on this box was something new for me it was using the ldapmodify and using the ability of ssh on ldap. We modify a user from ldap and change its UID and GID to 1000 and 117(docker) and quickly ssh to the box using that. now we can use docker to get a shell as root using gtfobins.
nmap -sC -sV -oN nmap/travel $IP Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-17 00:37 IST Nmap scan report for 10.10.10.189 Host is up (0.43s latency). Not shown: 997 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) 80/tcp open http nginx 1.17.6 |_http-server-header: nginx/1.17.6 |_http-title: Travel.HTB 443/tcp open ssl/http nginx 1.17.6 |_http-server-header: nginx/1.17.6 |_http-title: 400 The plain HTTP request was sent to HTTPS port | ssl-cert: Subject: commonName=www.travel.htb/organizationName=Travel.HTB/countryName=UK | Subject Alternative Name: DNS:www.travel.htb, DNS:blog.travel.htb, DNS:blog-dev.travel.htb | Not valid before: 2020-04-23T19:24:29 |_Not valid after: 2030-04-21T19:24:29 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 127.84 seconds
Reading through the code i found out that it is using SimplePie which is used for parsing the feed URL and it is using memcached for Caching. SimplePie is storing the serialized object in cache and unserialize it when using it so we can use a Deserilzation attack here to get the RCE.
But to get that we need the key name which it is using
RTFM of SimplePie I found how it is computing the cache name
i.e
1
md5("md5($url):spc")
googling around i stumble upon a Script to SSRF + Deserilzation to get an RCE script
we get a shell but that is really bad shell and there is no python to spawn a pty shell i tried some from netsec but no luck so i used socat on the machine
Looking around we find a db dump in /opt/wordpress copying it and checking in that we find a username as lynik-admin and a password hash as $P$B/wzJzd3pj/n7oTe2GGpi5HcIl4ppc.
we can use john to crack that password as 1stepcloser
and use that to ssh to the machine using lynik-admin:1stepcloser
dn: ou=linux,ou=servers,dc=travel,dc=htb description: Linux Servers objectClass: organizationalUnit ou: linux
dn: ou=windows,ou=servers,dc=travel,dc=htb description: Windows Servers objectClass: organizationalUnit ou: windows
dn: ou=users,ou=linux,ou=servers,dc=travel,dc=htb description: Linux Users objectClass: organizationalUnit ou: users
dn: ou=groups,ou=linux,ou=servers,dc=travel,dc=htb description: Linux Groups objectClass: organizationalUnit ou: groups
dn: uid=jane,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: jane cn: Jane Rodriguez sn: Rodriguez givenName: Jane loginShell: /bin/bash uidNumber: 5005 gidNumber: 5000 homeDirectory: /home/jane objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount
dn: uid=brian,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: brian cn: Brian Bell sn: Bell givenName: Brian loginShell: /bin/bash uidNumber: 5002 gidNumber: 5000 homeDirectory: /home/brian objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount
dn: uid=frank,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: frank cn: Frank Stewart sn: Stewart givenName: Frank loginShell: /bin/bash uidNumber: 5001 gidNumber: 5000 homeDirectory: /home/frank objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount
dn: uid=jerry,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: jerry uidNumber: 5006 homeDirectory: /home/jerry givenName: Jerry gidNumber: 5000 sn: Morgan cn: Jerry Morgan objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash
dn: uid=edward,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: edward uidNumber: 5009 homeDirectory: /home/edward givenName: Edward gidNumber: 5000 sn: Roberts cn: Edward Roberts objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash
dn: uid=eugene,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: eugene cn: Eugene Scott sn: Scott givenName: Eugene loginShell: /bin/bash uidNumber: 5008 gidNumber: 5000 homeDirectory: /home/eugene objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount
dn: uid=johnny,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: johnny cn: Johnny Miller sn: Miller givenName: Johnny loginShell: /bin/bash uidNumber: 5004 gidNumber: 5000 homeDirectory: /home/johnny objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount
dn: uid=louise,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: louise cn: Louise Griffin sn: Griffin givenName: Louise loginShell: /bin/bash uidNumber: 5007 gidNumber: 5000 homeDirectory: /home/louise objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount
dn: uid=christopher,ou=users,ou=linux,ou=servers,dc=travel,dc=htb uid: christopher uidNumber: 5003 homeDirectory: /home/christopher givenName: Christopher gidNumber: 5000 sn: Ward cn: Christopher Ward objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash
dn: cn=domainusers,ou=groups,ou=linux,ou=servers,dc=travel,dc=htb memberUid: frank memberUid: brian memberUid: christopher memberUid: johnny memberUid: julia memberUid: jerry memberUid: louise memberUid: eugene memberUid: edward memberUid: gloria memberUid: lynik gidNumber: 5000 cn: domainusers objectClass: top objectClass: posixGroup
Reading this article I thought of adding my ssh key for a user and change its UID to 1000 and GID to 117 for docker to get shell as trvl-admin and GID of Docker use that key and username to SSH as the user.
Note: I had thought of adding any of these user to GID 0 and UID 0
