Stocker

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 10.129.98.240 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-19 00:30 EST
Nmap scan report for stocker.htb (10.129.98.240)
Host is up (0.015s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

The domain was stocker.htb, and we can add that to the /etc/hosts file.

Subdomain Fuzzing

There was nothing of interest on the website. gobuster scans and default enumeration did not really help out a lot.

I decided to use wfuzz to fuzz the possible subdomains present on the website, and actually found one at dev.stocker.htb.

Interesting.

Login Bypass

At the dev site, all we see is one login page:

I tested out sqlmap or other SQL injections but it didn't work. It seems that we have to bypass this login to carry on with the machine. Proxying the traffic via Burp gave me a clearer picture on the error received when I entered wrong credentials:

There was a connect.sid endpoint, indicating that this was some type of Express website. Perhaps this was using MongoDB instead of regular SQL. I tested this JSON payload to bypass the login and it worked.

The website was some ordering website where we could place orders for items.

Stock LFI

I added some items and attemted to checkout from the website.

Viewing the purchase order brought us to a PDF page.

I downloaded the PDF and used exiftool on it to find that Skia is used to generate this PDF from Chromium.

Additionally, this was the request sent when we clicked checkout.

The exploit is obviously to do with some parameter within the request being vulnerable when generating the RCE. I did some research on PDF related exploits, and found that it was possible to inject some HTML frames to cause an LFI.

LogoPage not found – TechKrantitechkranti.com

I attempted this exploit using the file:/// wrapper to read the /etc/passwd file and it worked within the title header in the JSON data.

We find that the user is called angoose. I attempted to read more files such as the private SSH key of the user, but it seems that I either could not read it or it did not exist.

Remembering that this was an Express website, perhaps there was a Javascript file that I could read to find some credentials, particularly those used to access this server in the first place. WIthin the /var/www/dev/index.js file, I managed to find some credentials.

With this password, we can ssh in as angoose.

Privilege Escalation

Sudo

Checking sudo permissions, we find that angoose can use node as an administrator. There's also a wildcard in the scripts we can execute, which is never a good thing.

Within that folder, there are some scripts already present.

I don't have write permissions in this folder. Neither can I read the scripts to find out what they do. However, because there's a wildcard, we can just enter ../../ to execute any script we want.

Here's a basic JS script for RCE using child_process.

Then, we can simply do this:

Pwned.

PreviousSteamCloudNextSwagShop