search

DevOops

#Linux #Web #Injection #XXE

Tenten is an medium-rated Linux machine from HackTheBoxarrow-up-right created by Iokori. In the current post, my IP is 10.10.14.76, and the target’s IP is 10.129.102.140

The machine is a good review of concepts, the recognition step is standard and involves fuzzing to find new attack vectors, but it is necessary to have a reliable tool to detect the target's technologies, like Wappalyzer.

Once the correct vector is found, you have to exploit an explicit XXE to extract relevant files and log in as roosa. By the other hand, Privilege Escalation is patience, searching for information from a git project and other important files to extract the public key.

hashtag
Recon

Local Terminal
> ping -c 1 10.129.102.140

PING 10.129.102.140 (10.129.102.140) 56(84) bytes of data.
64 bytes from 10.129.102.140: icmp_seq=1 ttl=63 time=273 ms

--- 10.129.102.140 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 273.347/273.347/273.347/0.000 ms

The machine is alive, and by the TTL (close but no more than 64), it is possible to think that the target is a Linux Machine.

Local Terminal
nmap -p- -sS --min-rate=5000 -Pn -n -oN AllPorts 10.129.102.140
Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-13 16:24 -03
Warning: 10.129.102.140 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.102.140
Host is up (0.27s latency).
Not shown: 65533 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
5000/tcp open  upnp

There are two open ports. First the port 22 with ssh, if you search about "OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 launchpad", we can see that the target is an "Ubuntu Xenial".

hashtag
Port 5000

Nothing relevant yet.

dev.solita.fi could be a domain, but it's a website outside the machine.

From Wappalyzer we know that the website uses PHP, a good option is to fuzz it with that extension.

And we found two alternatives, without the php extension.

This place says XXE everywhere

First, upload an empty file to see how it reacts, with vi test.xml, the create the proper XML, with vi exploit.xml

Fails with test.xml
Works with exploit.xml

From here we got a lot of information. First, the output is visible, this means that is possible to execute an XXE, and second, there is an user called "roosa" at the system.

hashtag
Exploitation

Let's see if the exploits works, creating a file with vi exploit_proof.xml, then upload it.

Target's /etc/passwd

Perfect, it works, remember that with Ctrl+U (view:source) you can see in a better format the targeted file.

Now, time to exploit, upload exploit_exec.xml.

Unencrypted id_rsa

In many machines, this exploits fails, an alternative to these situation, because the target use php, is the use of wrappers, like "php://filter/convert.base64-encode/resource=/var/www/html/index.php" after SYSTEM.

hashtag
Reverse Shell - roosa

Perfect, we can read the id_rsa.

See the content of the "Cross-Site Scripting" exploit, it's the version 4.1.0, it should be that.

hashtag
Privileges Escalation

A lot of files, but there are two curious folder, deploy and work. Let's check work.

Good, there is git, in those cases is always a good practice to see the commits for old relevant information... ALWAYS! But first, let's see if there is another hidden file here.

A file with credentials?

Another id_rsa, go to home to check for more users.

Another way to see the user list with bash, is by reading the /etc/passwd file and check who has the "bash" available.

Many user to test the id_rsa, if is not the correct one, we should check the past-commits for mistakes.

Copy the authcredentials.keys as id_rsa to the tmp folder, then connect through ssh.

Return to the blogfeed folder with cd /home/roosa/work/blogfeed

"reverted accidental commit with proper key" looks like an interesting mistake, copy the commit code.

It shows a deleted id_rsa, copy the red one at /tmp and try to use it.

Color Sample

And it works, the machine is done.

PreviousCanapeNextForgot

Last updated