Surveillance
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 3000 10.129.39.121
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-09 22:13 EST
Nmap scan report for 10.129.39.121
Host is up (0.0081s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open httpDid a detailed scan as well:
$ nmap -p 80 -sC -sV --min-rate 3000 10.129.39.121
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-09 22:14 EST
Nmap scan report for 10.129.39.121
Host is up (0.0062s latency).
PORT STATE SERVICE VERSION
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://surveillance.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelAdded the domain to the /etc/hosts file.
Web Enum -> CVE-2023-41892
The website was promoting a security solution provider:
Checking the page source, I found that this website used Craft CMS 4.4.14.
This version of Craft CMS was vulnerable to CVE-2023-41892.
There are a few PoCs publicly available:
Initial exploitation did not work:
When reading the exploit, it seems to proxy requests through local port 8080.
I opened a HTTP Server on port 8080, and it returned some errors when the exploit was run:
It didn't make sense to have a proxy in the first place, so I removed that since I could not find a good explanation of why it was included (probably Burpsuite testing by the researcher). After removing that, the script still did not work.
I troubleshooted this by printing contents of variables within the script (as you usually do...) and I found that the upload_tmp_dir variable was being incorrectly checked:
Seems that it was being updated wrongly, and the if condition wasn't checking the value properly since it was being set to <i> no value </i> instead of no value. After replacing that, the RCE worked.
Getting a reverse shell is easy from here using nc mkfifo.
Privilege Escalation
Basic Enum
There are 2 other users on the machine:
There is also a MySQL service available:
There was also a .env file to read:
I could access and enumerate the database via mysql using these credentials.
These hashes could not be cracked though.
User Creds
Within the ~/html/craft directory, I checked for any configuration or backup files, and found one:
The storage folder contained some interesting stuff:
When unzipped, it just contains an ASCII text backup for the database. When read, I found a hash for the user within it:
This hash could be cracked using CrackStation:
Using this, I either use su or ssh to the matthew user:
CVE-2023-26035 -> Zoneminder User
The matthew user had no sudo privileges or any interesting files, and I was wondering why there was a user was called zoneminder. Turns out this was a surveillance software (which explains the box name).
Port 8080 was running the software, which I could find after port fowrarding with chisel.
I found the web directory via locate:
Searching online for recent ZoneMinder exploits returns CVE-2023-26035, an unauthenticated RCE exploit.
I didn't know where to find the version, so a simple grep -R for both 1.36 and 1.37 gives me a strong indication that this is vulnerable:
When I read more about the exploit, it seems that the vulnerability lies within these 2 lines of code:
The machine had these two lines present:
This confirms that this instance is vulnerable. I could only find one PoC for this exploit, which requires the usage of msfconsole:
I dislike using Metasploit in general, so I read the exploit and did it manually. In the exploit, the execute_command function is quite simple:
Basically visits localhost:8080 and then sends a command to that specific directory with the __csrf_magic parameter, of which the latter can be found in index.php:
To confirm this, I just created a file on the machine with echo rcecfm > /tmp/test:
The above shows that I had RCE as zoneminder. To get a shell, I used chmod+%2bs+/tmp/zone on a copy of bash.
Afterwards, I could just drop my SSH key in authorized_keys for the zoneminder user to upgrade shells.
Sudo Script Privilege -> Root
The zoneminder user had some sudo privileges:
Seems that I can run a bunch of Perl scripts with whatever arguments I want. The problem was that there were many scripts, and each of them were quite long:
The sudo privilege also allows me to specify any arguments, so I think looking for anything that takes user input and throws into a command is key. I was lazy to read each file, so I copied all the scripts to another directory, then checked for keywords like cmd or command within them. The zmupdate.pl file contained some interesting stuff:
It contained this snippet:
The function above is only executed if the version parameter is set. The script also accepts some user input, which looks exploitable:
There was no validation for the parameter entered, so I just made bash an SUID binary using sub-shells $():
Getting root is easy from here:
Rooted!
Last updated