Nmap scan:
Web Exploit based. We would have to add eforenzics.htb to our /etc/hosts file to access the web port.
The website reveals some web application advertising Digital Forensic Services.
Clicking the big Go button reveals that we can upload a jpg file to the website for analysis.
When I uploada file, it would produce a link to a report.
The file would be a .txt file of output from exiftool being used on the file.
Very obviously, there is a JPG RCE vulnerability here. One possible parameter to inject commands in is the File Name. With the version, I found this vulnerability that allowed for RCE through the pipe character.
From this, I attempted a few direct OS command injections but it didn't work out well. I then attempted some Base64 encoded stuff, and a simple ping command works!
We can then replace the Base64 encoded command with a simple bash reverse shell and it works!
When viewing the /home directory, we see there's a smorton user that we cannot access.
We need to do some looking around. I ran LinPEAS and found an interesting cronjob that was running.
Some backups of the /home directory were being created, and also there was an unquoted service path for the date binary.
Heading to the /usr/local/investigation/analysed_log file, we can find a Microsoft Outlook Message there.
I sent this back to my machine via nc and opened it using msfconvert. Afterwards, we can read the emails. There's a huge base64 encoded zip file attached.
I couldn't decode the base64 to get the file for some reason, so I ported the message to my Windows machine and downloaded the file there.
When unzipped, we would get this MS Windows Vista Event Log.
So the key here is to watch for logging and file transfers that are occurring. We can use this tool to dump the log file into a JSON file for easier reading.
After looking around the entire log file (for a while), I chanced upon this string when searching for the Authentication term.
Turns out that this was the password for smorton. We can now su and capture the user flag.
When checking sudo privileges as smorton, we can find one:
Attempting to run the binary just does this:
So I transferred this binary back to my machine and used ghidra to see what it does. Here's the decompiled main function:
We can use this to get these this information:
It needs a total of 3 parameters
A password of lDnxUysaQn is needed as one of the parameters
It exeecutes curl and perl on the script we download
Then it cleans up by removing the file.
Simple enough. We should just need to host a perl reverse shell on our machine via Python HTTP and let this binary download and execute it.
After a bit of testing about the ordering of the parameters, I found what works:
Definitely more on the CTF side of HTB.
