Flasky

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.201.141
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-15 14:02 +08
Nmap scan report for 192.168.201.141
Host is up (0.17s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
22/tcp    open     ssh
5555/tcp  open     freeciv
20202/tcp open     ipdtp-port

Ran a detailed scan on the unknown ports.

$ sudo nmap -p 5555,20202 -sC -sV --min-rate 3000 192.168.201.141       
[sudo] password for kali: 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-15 14:03 +08
Nmap scan report for 192.168.201.141
Host is up (0.17s latency).

PORT      STATE SERVICE VERSION
5555/tcp  open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Calculator
|_http-server-header: nginx/1.18.0 (Ubuntu)
20202/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html; charset=utf-8).

Based on the box name, we are likely dealing with a Flask application here.

Web Enum -> JWT Exploit

Port 5555 just shows us a login page:

We don't have any credentials, so let's move on for now.

Port 20202 shows us another login page:

We can use the guest access to view the dashboard, and hints towards abusing JWT:

We can take a look at the cookie value assigned to us:

We can easily change this to exploit it. I also ran a gobuster scan and found an admin directory:

Visiting it just shows us this:

Running scans against both of these directories show nothing. I checked the requests in Burp, and there are some allowed methods:

We can send POST and OPTIONS requests to this, but we first need to modify our cookie. The JWT cookie has 3 parts, the encryption type, the actual data and the signature. Since we know there's a problem with the JWT, we can abuse this by replacing the encryption type and the payload:

For the signature, since we did not specify an algorithm, we can leave it blank. The full token is thus:

We can then send an empty login request to generate a POST request in Burpsuite, and then modify it to include our JWT token:

When we load the request in a Browser, we would see the admin dashboard:

Config -> SSH Creds

At the bottom, we can see users making posts about the configuration files:

This step took forever, but I eventually found the config file at cisco_config.

These are Cisco Type 7 passwords, which can be decrypted here:

LogoCisco Type 7 Password Decrypt / Decoder / Crack Toolwww.firewall.cx

We can then try each password with ssh, finding that john:NezukoCh@n works.

Privilege Escalation

Calculator Backup -> Root

Within the user's directories, there's a calc.bak file present:

It's the Python source code for the calculator application:

Since we have the Flask secret, we can create a cookie to bypass this since it only checks for the logged_in parameter.

This allows us to access the calculator application:

The source code uses eval to calculate the results, which is vulnerable to RCE. We can just inject Python code like this:

Then, we can become root:

Rooted!

PreviousFantasticNextForward

Last updated