Last updated
Last updated
PC is an easy machine from HackTheBox which you need to explore a gRPC server with a method vulnerable to SQL injection to get the sau password. On the machine, you need to enumerate the processes and discover a pyload with a version vulnerable to unathenticated RCE running as root and exploit it with a public exploit.
Running a TCP port scan with rustscan and trying to get the versions of the running services on the machine, we got besides the SSH port the unrecognized port by nmap 50051.
Trying to connect to this port with netcat and waiting a while, we got multiple unprintable characters followed by a error message about HTTP/2:
So, assuming that port is a gRPC server, I started to search about gRPC clients.
Downloading the client and starting it to use the port 50051 of the server, the client started to listen on a port on my machine and redirected me to it.
It seems it got the methods on the machine and listed it to me.
It has a method called LoginUser, trying to fill it with admin:admin credentials it gave to me an ID and a JWT token.
Trying to get info with the method getInfo about the ID with the tokens I adquire it sends to me a Will update soon. message.
Intercepting the request of my client with Burp Suite, saving it to a file and using sqlmap to find a SQL injection flaw, we got a SQLite union based sql injection.
As our attack is union based, we can dump all the database quickly with --dump-all flag.
After dump the database, I got the credentials sau:HereIsYourPassWord1431. We can connect on the machine with SSH with that credentials;
After I did a complete enumeration with linpeas, I saw the root is executing pyload (a download manager made with python).
Checking the version, I discovered it is 0.5.0.
Forwarding the pyload port (8000) to my local machine, and using the exploit to download and execute my reverse shell, I could to execute commands on the machine as root.
Searching about this error message, I got to an on gRPC GitHub repository.
With a I decided to use the client.
Searching about this pyload version, I discover it is vunerable to RCE and a is avaiable.
