Last updated
Last updated
Format was a medium machine from HackTheBox which you will need to explore a LFI to read nginx configuration files to discover a proxy_pass vulnerability which you will be able to communicate with the redis unix socket on the machine to change set to a pro status to your account and create a directory which the application have permission to write and execute PHP script. On the machine, you will be able to execute a python script as root, which you need to explore a format string vulnerability to read a secret on the program memory and use it as root password.
After ran rustscan with nmap, I noted that's two web services running, entering the page running under de port 3000, I got to a gitea page. Exploring the repositories on the site, I noted a repo called "Microblog", so I downloaded it and started to try find a vulnerability before explore the site in practice.
Exploring the code searching by vulnerable function, I discover how the site is getting the content and sending to the person who access the site.
At first, we can see the PHP is opening the file called order.txt, reading it contents line per line and passing the line content to the file_get_contents function.
Now, browsing the source code to verify when the order.txt file, I found in the edit/index.php file and started to analyse it.
This part of the program is getting the id post parameter, writing it contents to the order.txt file, getting the txt or header parameter and writing it content to the id value file.
Sending a path traversal payload to read the contents of the /etc/passwd file, we received with successfully the content of the passwd file.
After reading some configuration files, I came to the /etc/nginx/sites-avaiable/default file and noted an interesting parameter called proxy_pass.
The attack is a bit simple, the proxy_pass option is used to the nginx send connection received to a location chosen by the system admin. But instead of we communicate only with http service, we can use the unix wrapper to communicate with socks.
So, checking the source code to see how the Microblog access the redis database, is possible to see it's using the /var/run/redis/redis.sock socks file.
Now, doing a HSET to set the pro value of our account to "true", we received an 502 Bad Gateway message.
But verifying the dashboard if the payload worked, we can see a star informing our account now is pro.
Going back to the code and searching by what in fact changes when we are pro, I noted a new directory called uploads is created and we have permission to write on it.
So using our previous arbitrary file write to write this file to upload/shell.php and acessing the page on the browser, the server downloaded my reverse shell, executed it with sh and I received a shell remote connection.
Accesing the redis database and dumping the cooper.dooper password, I got the zooperdoopercooper password, which I used to login the cooper account using SSH.
Executing sudo -l to get the programs the cooper can run on the machine with other users we can see the /usr/bin/license python script.
Reading the source code, a thing called me attention: the format function.
The attack is simple, we just need to pass an object we can read inside a {} tag. So, creating a new account on the database and inserting a custom payload in the value of first-name key to read the globals, I could to retrieve the secret unCR4ckaBL3Pa$$w0rd and login the root account using it as password.
At first view, it seems like a simple SSRF attack, but searching a little bit more I found an by Detectify explaining how we can explore it to communicate with unix socks.
Searching on the web if we can explore this in any way, I found a topic about it on explaining how to read in-memory objects.
