UpDown
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 5000 10.129.227.227
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-08 07:39 EDT
Nmap scan report for 10.129.227.227
Host is up (0.0060s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open httpSiteisup.htb
Port 80 hosts an application that checks whether a website is up.
We can use nc listener and use a URL that points to our machine.
We can first add siteisup.htb to our /etc/hosts file, then we can do both wfuzz subdomain fuzzing and gobuster directory scans.
wfuzz scan reveals a dev subdomain.
However, we aren't allowed to visit this site yet as it returns us a 403.
The gobuster scan also reveals another directory:
Another gobuster scan using few different wordlists reveals there's a .git repository present:
We can download all the files using wget -r, then we can view the files present:
Reading the .htaccess file reveals why we were blocked the first time:
We need to have a special HTTP header in order to be verified. We can use the Modify Header Value Firefox extension to create a new header Special-Dev with the value of only4dev.
Then we can view the site:
Execute PHP Code
There is probably a PHP file upload vulnerability to exploit here. We can do some basic source code analysis using the Git repository we found earlier. Within the checker.php file, we can view the code that responsible for this file upload:
The website seems to take a bunch of websites specified within the file as specified by the foreach loop, then checks if all of them are alive. The file extension check can be bypassed using .phar, and the check on whether the site is legit can be bypassed by having a lot of websites within our file.
Because it checks each site manually to see if it is alive, we can actually embed a PHP payload within a long text file. As the file checks each of the sites manually, it would detect our PHP payload later, and we can still view the file and get our PHP code to execute.
This is the test file I used:
There's about 2000 lines within this. When the file is uploaded, it hangs for a long me. Then, we can head to /uploads to view the file uploaded.
We can then verify that our PHP code is indeed executed, and the rest of the websites have yet to be evauluated.
When viewing this, we can find that there's a lot of disabled_functions present:
Functions like shell_exec, passthru and system are all blocked, meaning we cannot get a reverse shell using this. We can use Hacktricks's list of useful PHP functions to see which are not disabled:
The proc_open function has not been disabled, so we can use that to get a reverse shell. Searching for proc_open PHP reverse shell returns this:
We can certainly use snippets of this and PHP code to get a reverse shell. Instead, we can change the command to run mkfifo shell:
Embed this within our long text file, and when visited in /uploads, we will get a reverse shell:
Privilege Escalation
SiteisUp.py
There's one user within the machine:
We can't read the user flag, but we can view the /dev directory within it.
It seems that there's an SUID binary in the form of a Python file, and the source code is readable:
When trying to run the script, I noticed there was a string error:
This occurs because the argument is directed taken from the user's input and passed into the next line. The script only works if we specify it as a string. Because of how it handles user input, this makes it vulnerable to Python code injection.
We have to import the os library, and since we cannot do so statically using import, we have to dynamically do it using __import__.
We can the nread the user's private SSH key and SSH in to upgrade our shell. We can also grab the user flag.
Easy_Install
Checking sudo privileges, we find that we can run easy_install:
GTFOBins has a script for this binary.
Rooted!
Last updated