Talkative

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.227.113
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-01 08:13 EDT
Warning: 10.129.227.113 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.227.113
Host is up (0.012s latency).
Not shown: 65181 closed tcp ports (conn-refused), 350 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   filtered ssh
80/tcp   open     http
3000/tcp open     ppp
8080/tcp open     http-proxy
8081/tcp open     blackice-icecap
8082/tcp open     blackice-alerts

Lots of HTTP ports it seems. We can add talkative.htb to our /etc/hosts file to view these sites. Also, SSH seems to be blocked, so we probably need to access from within a shell.

Talkative

Port 80 hosts a normal corporate website:

This site had some usernames and emails that we can take note of for now.

Other than that, there's nothing much here.

Rocket Chat

On port 3000, there was a Rocket Chat instance.

We have no credentials, so let's move on for now.

Jamovi

On port 8080, I found a Jamovi instance:

This is a statistical software that is used for data analytics. The more interesting part is, we can run R code using the Rj editor. R can be used to execute system commands via the system function.

Logosystem function - RDocumentationwww.rdocumentation.org

We now have a very simple RCE on the machine. We can get a reverse shell using a simple bash script.

Docker Enum -> Bolt Creds

We can take a look within this Docker and see if we can find any sensitive files. Within the /root directory, we can find some files regarding Bolt:

I transferred the bolt-administration.omv file back to my machine via base64 encoding. Then, we can unzip this file and read the data within. The xdata.json file had some credentials:

Now that we have some credentials, we need to find the Bolt login page. Normally, this is at the /bolt directory. We can find this login page at talkative.htb/bolt.

We can login with saul@talkative.htb:jeO09ufhWD<s.

Bolt RCE

This version of Bolt doesn't have any obvious vulnerabilities, so let's take a look at the File Management System since that is the most interesting. It appears that we can edit the themes and templates used for this machine:

The page seems to use Twig templates to display the webpages:

This means that we can probably execute code using SSTI via Twig templates. I added this one liner to the script and saved the changes.

Then, we need to head to Maintenance > Clear Cache, and reload the main page afterwards. Our listener port would catch a reverse shell.

Docker Escape -> User

We had access to yet another Docker container. However, there was really nothing here that I could find or exploit. I tried to ssh to 172.17.0.1 as saul, and it worked surprisingly.

Here, we can grab the user flag.

Privilege Escalation

Docker Discovery

I enumerated the processes operating on the system, and found a load of Docker containers being run.

All of the Docker containers are hosted on 172.18.0.1/24 it appears. There are also a lot of Docker containers on 172.17.0.0/24 that are hosting the port 80 instance. I noticed that they skipped 172.17.0.2, and I wanted to see if it existed via ping.

So this machine exists. We can download the nmap binary onto the machine and scan this host.

Port 27017 for MongoDB is open, and we can forward this using chisel.

Then, we can enumerate port 27017 for ourselves. Since it is running on our localhost, we can use mongo to interact with it.

Mongo Enum

We can first view the databases present:

Seems that meteor is the one from the machine. This database contains information regarding Rocket Chat:

We can view the users present on the Rocket Chat instance.

We can sort of make out how there's an admin user that has a hashed Bcrypt password. What we can do is replace this with a hash of our own choosing and then login as the admin of Rocket Chat.

In this case, I just used a simple password of '12345'. Then we can login to Rocket Chat.

Rocket Chat RCE

The Rocket Chat dashboard had nothong of interest:

I was taking a look at the Administration panel and seeing what I could do, when I found this:

This is sort of like plugins for Rocket Chat, and it appears I can add new ones via Webhooks:

When we click Incoming, it appears we can run some type of Script here:

Reading the documentation for Rocket Chat, it appears that this runs Javascript code!

LogoRocket Chat Microsoft Teams Integrationdocs.rocket.chat

We can grab a quick node.js reverse shell and slap it in there.

After renaming the post and which channel to put it at (use #general), there's a curl command generated at the bottom.

Afterwards, we would catch a reverse shell on our listener port:

Docker Vulnerabilities

This Docker was almost completely empty. We didn't have any tools to run or anything really, and it was a bit difficult to progress from here. Since there was no applications on the machine and we are root, the vulnerability should have to do with Docker somehow.

I enumerated a few things:

  • Kernel Exploits

  • Determined if there commands I could run by checjking the binaries present on the machine, and saw that we could run node, perl and bash. Nothing else.

  • Checked the file system for the 100th time to make sure I didn't miss an obvious file

  • Checked the user capabilities

The last one proved to be interesting. Since we didn't have capsh, we could do it by reading /proc/self/status.

I checked 00000000a80425fd using capsh on my own Kali machine and found that it meant these:

It seems that we have the CAP_DAC_READ_SEARCH capability enabled. This capability allows us to bypass all file permissions and read any file. This means any file, even those outside of the mountspace. Since this is a Docker and (probably) is mounted on the main machine, this allows us to read all files within the main machine, including the root flag.

When searching for tools I could use to exploit, I came across this:

LogoGitHub - cdk-team/CDK: 📦 Make security testing of K8s, Docker, and Containerd easier.GitHub

This was a great tool kit to use to enumerate and exploit the capabilities within Containers that had nothing else to offer. From the repository, we can transfer it like so:

Then, the file would be downloaded. We can try running the exploit for our capability:

Works! Now we could just read the root flag and be done with, but I wanted to get a proper shell.

Getting Shell

Using cdk, we can run this command to get a shell on the main machine.

With this, we just need to echo in a public key and we can SSH from saul.

Rooted!

PreviousSeventeenNextUnobtainium

Last updated