Editorial HTB Walkthrough

Dec 22, 2024    #box   #htb   #easy   #linux   #web   #api   #git   #cve-2022-24439   #ssrf  

Editorial Hack The Box Walkthrough/Writeup:

How I use variables & Wordlists:

1. Enumeration:

NMAP:

Basic Scans:

Comprehensive Scans:

Web 80:

Whatweb:

Dirbusting the webserver using ffuf:

Visiting the web page:

Enumerating the “Publish With Us” page for injection points:

Fuzzing for SSRF with ffuf:

As we know the server will try and connect to an endpoint we can fuzz on localhost (127.0.01) for SSRF, by performing a port scan on the host. This will tell us if we can access any locally running services on the host and at the same time if SSRF is a viable path.

ffuf -w ~/Wordlists/45.06-CustomWordlists/Ports.txt -u 'http://editorial.htb/upload-cover' -X $'POST' -H $'Host: editorial.htb' -H $'Content-Length: 315' -H $'Accept-Language: en-US,en;q=0.9' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAKLIgaiMMQNJmTJ6' -H $'Accept: */*' -H $'Origin: http://editorial.htb' -H $'Referer: http://editorial.htb/upload' -H $'Accept-Encoding: gzip, deflate, br' -H $'Connection: keep-alive' -d $'------WebKitFormBoundaryAKLIgaiMMQNJmTJ6\x0d\x0aContent-Disposition: form-data; name=\"bookurl\"\x0d\x0a\x0d\x0ahttp://127.0.0.1:FUZZ\x0d\x0a------WebKitFormBoundaryAKLIgaiMMQNJmTJ6\x0d\x0aContent-Disposition: form-data; name=\"bookfile\"; filename=\"\"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0a\x0d\x0a------WebKitFormBoundaryAKLIgaiMMQNJmTJ6--\x0d\x0a' -x http://127.0.0.1:8080 -fs 61

Abusing SSRF To Access Internal API Endpoints:

Retrieving default credentials from the “authors” API endpoint:

2. Foothold:

Accessing the host by SSH as dev:

Enumerating the host as dev:

Running Linpeas:

Finding prod user password in git commits:

3. Lateral Movement:

Enumerating as prod:

Code Breakdown and explanation of vulnerability:

  1. Imports and Setup:

    import sys
from git import Repo
import os
    • sys: Used to access command-line arguments.
    • git.Repo: From the GitPython library, allows interaction with Git repositories.
    • os: Used to interact with the host os.

  2. Change Working Directory:

    os.chdir('/opt/internal_apps/clone_changes')
    • Changes the current working directory to /opt/internal_apps/clone_changes.
    • This ensures that subsequent operations (e.g., creating or cloning repositories) occur in this directory.

  3. Command-Line Argument Handling:

    url_to_clone = sys.argv[1]
    • sys.argv[1]: Takes the first command-line argument after the script name as the URL of the repository to be cloned.

  4. Initialize Bare Git Repository:

    r = Repo.init('', bare=True)
    • Repo.init('', bare=True): Initializes a new bare Git repository in the current directory (’’ refers to the current path).
      • A bare repository has no working tree and is typically used as a remote/shared repository.

  5. Clone a Repository:

    r.clone_from(url_to_clone, 'new_changes', multi_options=["-c protocol.ext.allow=always"])
    • r.clone_from(url_to_clone, 'new_changes'): Clones the repository from url_to_clone into a directory named new_changes within the current working directory.
    • multi_options=["-c protocol.ext.allow=always"]: Adds a Git configuration option:
      • -c protocol.ext.allow=always: Allows the protocol.ext transport, enabling custom protocol handlers.

  6. What does that mean in english? Here’s a simpler explanation: For the most part the script is very simple, it takes a supplied git repo as an argument and will clone it into a directory called new_changes with the current working directory. However the temporary addition being added is an issue as it allows us to execute code on the host.

    1. What does multi_options=["-c protocol.ext.allow=always"] do?
      • It adds a temporary configuration to the Git command being run by the script.
    2. What is protocol.ext?
      • It’s a Git feature that allows you to define custom commands or handlers for specific types of repository URLs.
    3. What does -c protocol.ext.allow=always mean?
      • It tells Git: “It’s okay to run custom commands whenever a repository URL starts with ext::.”
    4. Why is this important?
      • Normally, Git disables this feature because it can be dangerous. Because it allows us to provide an argument like the below and have it execute on the host system. And as we are allowed to execute this script as root our commands will run as root!
      • e.g. ext::sh -c 'cat //root//.ssh/id_rsa'
      • If we google “GitPython rce” we find CVE-2022-24439 .

4. Privilege Escalation:

Using CVE-2022-24439 GitPython Vulnerability to get a root shell.

Why do we need the % sign after bash:

5. Persistence:

Creating a high privileged “service” account for persistence:

Lessons Learned:

What did I learn?

  1. I learned about retrieving data from git logs.
  2. I learned about the python git vulnerability CVE-2022-24439:

What silly mistakes did I make?

  1. Oh I did not use a forward slash at one point in a command and that was stumping reading the API endpoints at one point, that was fun.

Sign off:

Remember, folks as always: with great power comes great pwnage. Use this knowledge wisely, and always stay on the right side of the law!

Until next time, hack the planet!

– Bloodstiller

– Get in touch bloodstiller at proton dot me


Next: Doctor HTB Walkthrough