search

TheNotebook

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.71.99  
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-08 09:27 EDT
Nmap scan report for 10.129.71.99
Host is up (0.0081s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http

hashtag
Notebook -> JWT Spoof

The website is a notebook website:

We can create a new user because we don't have any credentials. Once created, we can login and view our notes, of which we have none:

When the requests are viewed in Burp, we can see that it uses a JWT token and a uuid parameter:

We can take a look at this cookie within jwt.io and see that it uses a private key hosted on the server.

The token is spoofable, similar to another machine Unicode. We can generate our own private key using openssl and use it to spoof the token by replacing the kid parameter with a link hosting the key instead. Also, we can change admin_cap to be 1.

When we use this token after refreshing the page, we can see an Admin Panel present.

Then, we can view the notes of the administrator through Admin Panel > View Notes.

Conveniently, the first note reveals that PHP files are left executable on this website.

The admin panel also has an upload file feature:

I uploaded a basic PHP webshell, and the page shows this:

Using this, we can get RCE:

And subsequently, a reverse shell.

hashtag
Privilege Escalation

We can't grab the user flag yet as noah owns it.

hashtag
Home.tar.gz

I viewed the nginx configuration files:

There was nothing much there that was new. Within the /var/backups file, there was an extra file present:

We can copy this folder to /dev/shm and open it there since we can't create new files within /var/backups.

We can grab the id_rsa file and ssh in as noah.

hashtag
Sudo Privileges

We can check our sudo privileges:

It seems that we can run docker as root. Googling for exploits pertaining to this version reveals a CVE that allows for RCE. This is caused by an outdated runc binary that is run from the container.

LogoGitHub - Frichetten/CVE-2019-5736-PoC: PoC for CVE-2019-5736GitHubchevron-right

Download this repositroy, and we can change the payload run to something else:

Then we can run go build main.go to build it. Then, following the PoC, we can create a Docker container using the sudo command allowed.

Afterwards, within the container, run the main binary and it will hang:

On a second Window, we need to run the sudo command one more time, and on the Docker container, it would execute properly:

Then, we can just ssh into root.

Rooted!

PreviousTenetNextTime

Last updated