Quick | SecJournal

Gaining Access

Nmap scan:

JetSpeed

Port 9001 had a typical corporate website:

There was a link towards a new portal hosted on portal.quick.htb. However, it pointed to port 443 and I could not access that for now. Looking at the rest of the page, we can see other information like the clients they had:

There are also some testimonials from users:

We also can note that this is a PHP website as the page above is at clients.php. A quick directory search revealed the following:

When viewing the login.php page, we see some Ticketing System is used:

Default credentials don't work here, when examining the HTTP reply we get from trying to login, we see that this is powered by Esigate:

Normally, the X-Powered-By is Express or Flask or something, so this was new to me. Googling for exploits led to ESI injection:

Edge Side Inclusion Injection is similar to XML injection in syntax, and it allows us to run code and stuff. But, it doesn't appear that this login page is vulnerable, so let's keep it in mind for now.

Portal HTTP/3

The only lead left was the portal mentioned earlier. The websiter leads us to port 443 on TCP. However, why would they give us access to the service? I decided to read more about HTTPS and port 443, and found that it can actually run on UDP instead of TCP.

A quick scan reveals that UDP port 443 is indeed open.

So to access this, we can use a custom curl binary.

Afterwards, we can access the site using curl --http3. When we view the site, we would see this:

We can view the docs to get this:

So there are 2 PDF guides that are present. We can download them with the following commands:

Afterwards, when viewing the PDFs, we find some credentials in the Connectivity one.

Cool! This also tells us that there might be a Docker container present. Now, we need to guess the email address. Earlier, we saw a bunch of testimonials with countries. I assumed that this was a hint to guess the email somehow.

Since there's a country, I assumed that it would end in something like .fr for France or something. Then, we can take the company name and construct a company email.

For example, here's some possibilities:

After some brute forcing via hydra and guessing the right email, I found that elisa@wink.co.uk was the right email to use with this password.

Ticketing System

After logging in, we see a Ticket Management System:

We can raise tickets and it takes a message from us.

This is where ESI injection can come in handy. Following the PoC earlier, we can use this:

This command would download a reverse shell and execute it. Now, we just need to append this to an existing ticket query like this to download and run the XML file we created:

This would download the XSL file we created. Afterwards, we need to create another one to run the file and execute commands via the same method.

Our listener port would then receive a shell:

We can grab the user flag now.

Privilege Escalation

The shell can be upgraded by dropping our public key into the SSH directory.

Printers

There was another user srvadm present on the machine:

It also appears there are other websites present on the machine:

We can find out who is running this website by reading the apache2 configuration files:

So there's another subdomain present. However, it seems that we cannot access it from our machine and we need some port forwarding to do this. For some reason, when we forward port 80, we cannot visit the site, but forwarding port 9001 works in visiting it.

Then we need to add printerv2.quick.htb to our hosts file under localhost. Then, we can visit it and see a login page.

SQL Credentials

Since we have access to the machine, let's try to find the credentials for this website. Within the db.php file in the /var/www/printer folder, we see this:

Now, we can access the SQL database and find the password hash for the printer service.

We get a hash and it's not crackable on CrackStation for some reason. I ran john and rockyou.txt didn't find anything either. Since we can't find an easy password, let's take a look at the authentication mechanism used.

So this first takes the password and then passes it to crypt, then md5. We know both the cleartext and hashed password of elisa, so we can reverse engineer this. The passing to crypt indicates why we cannot just crack this normally, because it's not just the MD5 of an encrypted password.

We can just create a quick PHP script that brute forces for us:

This does the same thing as index.php, and it compares each hash to the correct one. We can then find the correct password. We can then login to the service.

Printing LFI

We can add printers and customise them to connect to other IP addresses:

We can also make them run jobs. We obviously need to add a printer pointing to our IP address, but what do we do with it? Let's analyse the job.php file to find out more:

It appears that a job is created and this creates a file within the /var/www/jobs folder. Afterwards, it seems to send a request to the printer (us) and sends it the contents of the file. This is another race condition exploit, as we can replace the within the /var/www/jobs with a symlink to another file, like the id_rsa file of the srvadm user.

Since this is another race condition exploit, it's best to have a bash script running in the /var/www/jobs folder, which we conveniently have write access to.

We can use this one-liner here:

Worked! Now we can use this private key to gain access to srvadm.

Root Creds

We are part of the printers group, which might have unique permissions. Googling about this group leads to CUPS, which is a printing system used by Arch Linux distros. We can use locate to find all files related to cups.

We see some in the home directory of the user.

Within the printers.conf file, we can find some credentials.

When URL decoded, we can just use that as the password to su to root.