forge — htb writeup · chu@antisec

Back to all write-ups: here

WriteUp by chu

Machine Maker: NoobHacker9999

chu@antisec:~/htb$ cat tools.txt

Tools used:

nmap
BurpSuite
netcat

We'll use nmap to find ports and services running on the machine:

shell

nmap -sS -Pn -A 10.10.11.111 -p 22,80

-v: verbose(output mais detalhado).
-sS: syn scan.
-Pn: já sabemos que o host está ativo então desativamos o discovery.
-A: Detecção de OS, detecção de versão, script scanning, and traceroute
-p: especifica as portas

Our result:

nmap

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 4f:78:65:66:29:e4:87:6b:3c:cc:b4:3a:d2:57:20:ac (RSA)
|   256 79:df:3a:f1:fe:87:4a:57:b0:fd:4e:d0:54:c6:28:d9 (ECDSA)
|_  256 b0:58:11:40:6d:8c:bd:c5:72:aa:83:08:c5:51:fb:33 (ED25519)
80/tcp open  http    Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Gallery
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.6 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.3 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: 10.10.11.111; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   207.80 ms 10.10.14.1
2   207.98 ms forge.htb (10.10.11.111)

We can see two open ports, 22(SSH) and 80(HTTP).

Accessing the site by IP, we get redirected to the forge.htb name, so we need to add forge.htb to the /etc/hosts file

Now that we can access the site, we can see a link to an upload page.

Accessing it, we have two upload options. We can upload files locally or via URL. I tried a bunch of things through the local upload but had no luck.

Trying to pass a local address through the URL, I noticed there was an active blacklist.

A simple bypass was to use uppercase characters, which got me past the blacklist.

With that, we get the link from the successful upload.

Using 'curl' we can see the contents of the file with the index.html, which means our SSRF flaw is validated.

Using ffuf to enumerate subdomains, we get an interesting result: admin.forge.htb

We add the new name to the /etc/hosts file.

Accessing the page http://admin.forge.htb, we get a message saying only local access is allowed.

Let's use the already-proven SSRF technique on the http://forge.htb/upload page to fetch the contents of http://admin.forge.htb

We can see the http://admin.forge.htb name is being blocked the same way as the attempt made using http://localhost

Let's use the same uppercase character technique to get a bypass for the admin page.

I used BurpSuite to make the response easier to read. With that, we can read the contents of the page http://admin.forge.htb, validating the SSRF bypass. We can see two pages besides index.html /annoucements /upload

I used BurpSuite to make the response easier to read. With that, we managed to read…

Now let's pass the full path to the page we want, http://admin.forge.HTB/annoucements

In the response of our request, we can read the contents of the page http://admin.forge.htb/annoucements, and in it we can grab credentials for an internal FTP service. We can also see a message saying the upload page now supports other protocols, like FTP and FTPS. In the third message we have the announcement telling how to use the parameters.

We have an FTP server running internally, and we can interact with it through the page http://admin.forge.htb/upload using the FTP protocol, with the parameters described in the third point. Since both admin.forge.htb and localhost are on the blacklist, we need the uppercase character bypass on both. Our final query http://admin.forge.HTB/upload?u=ftp://user:heightofsecurity123!@LoCaLhOsT

With that, the response of our request gives us the FTP directory listing, in this case /home/user

We can get the link to our first flag by passing the full path of the file: http://admin.forge.HTB/upload?u=ftp://user:heightofsecurity123!@LoCaLhOsT/user.txt

With that, we get our first flag

I tried to log in via SSH using the FTP server credentials, but the authentication method is public key only.

So let's read the RSA key in the user's SSH directory. http://admin.forge.HTB/upload?u=ftp://user:heightofsecurity123!@LoCaLhOsT/.ssh/id_rsa

That gives us the user's private RSA key.

We write the key to a file

And we start the SSH connection using the key we got.

we are in

[Image]() — sem url no arquivo original

if i helped you, add + respect at my profile :D

My references:

references

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery
https://portswigger.net/web-security/ssrf
https://vickieli.medium.com/bypassing-ssrf-protection-e111ae70727b

chu@antisec:~/htb$ cat forge.md