Zipper
#Linux #Enumeration #Web-Fuzzing #API #PathHijacking
Zipper is a hard-rated Linux machine from HackTheBox created by burmat. In the current post, my IP is 10.10.14.16, and the target’s IP is 10.10.10.108.
Zipper is a machine of hard complexity that demonstrates the significance of privileged API access and its potential exploitation to achieve Remote Code Execution (RCE). In this case we are working exclusively with Zabbix API. After exploiting the RCE, for privileges escalation the vulnerability used is PathHijacking.
Recon
ping -c 1 10.10.10.108
PING 10.10.10.108 (10.10.10.108) 56(84) bytes of data.
64 bytes from 10.10.10.108: icmp_seq=1 ttl=62 time=176 ms
--- 10.10.10.108 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 175.677/175.677/175.677/0.000 msnmap -p- --open -sS --min-rate 5000 -n -vvv 10.10.10.108 -oG AllPortsNmap scan report for 10.10.10.108
Host is up, received echo-reply ttl 62 (0.17s latency).
Scanned at 2023-07-18 12:31:25 -04 for 19s
Not shown: 65530 closed ports, 2 filtered ports
Reason: 65530 resets and 2 no-responses
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 62
80/tcp open http syn-ack ttl 61
10050/tcp open zabbix-agent syn-ack ttl 62
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 19.71 seconds
Raw packets sent: 94425 (4.155MB) | Rcvd: 79589 (3.184MB)If you are curious, you can search for "OpenSSH 7.6p1 Ubuntu 4 launchpad" to see which specific linux sub-system is using, in this case is "Debian Sid"
Port 80 is open with a website, let's see what is inside.
From whatweb we got nothing, it's a default page, this is a clear clue to fuzz the target.
http://10.10.10.108/zabbix
Sign in as a guest, then explore the whole panel, at the Report > Availability Report you will find a file called "Zapper's Backup Script", we can assume that there is an user called "Zapper". we should try with the default password "zabbix" or "zapper"
Uh... the GUI access is disables, with the credentials confirmed now a good option is to search for other ways to login to "Zabbix"
There is a documentation about an API, so now we are going to use that way to login.
Reverse Shell [Zabbix]
The response it's some kind of hash and a lot of information about the user... now that we are logged in, we can use the other API's feature... like scripts
First let's explore with script.get (Remember to replace the default "auth" with the hash retrieved from the previous command).
What if we can create a command to execute a reverse shell?
Info: The current target does not have curl :(
TIP: The host ID can be obtained from host.get
Looks like it received the script very well, now we need to prepare the reverse shell, by using two shells, one listening and other executing the command.
And done! We are in... but the shell doesn't last long... we need and additional terminal and speed.
Our Local Terminal B is "Partially connected" to the target, we are going to prepare another listening port at our Local Terminal C, and prepare the command at B before activating A.
And now our Local Terminal C is the target.
User Pivoting [Zabbix > Zapper]
Finally, we are inside the machine... now we need a way to change our user.
Well... for some reason we have reading permission at another user folder... and inside to "backup.sh" we found a password.
Good... now we are Zapper and the flag is readable.
Privileges Escalation [Zapper > Root]
There is some kind of custom service with high privileges.
Aaaand... Nothing happen? Let's explore with strings
Path Hijacking is our option here, let's prepare everything.
Last updated