Editorial
Last updated
Last updated
On /about page we find another domain that is tiempoarriba.htb:
Directories and files enumeration with ffuf:
There is the /upload page:
The form allows you to upload a file depicting the book cover or submit the URL associated with the book cover. Also, it is possible to get a preview, but this does not seem to work because, as we can see, the file name is renamed and the file extension is removed. When we open the preview image in a new tab, the file is downloaded directly, so it seems that it is not possible to execute directly on the webserver any kind of command possibly injected into the uploaded file:
If we try to intercept the request we can see that the URL is not sent to the backend and the response is the usual "Request Submited! blahblahblah...":
Instead, the interesting part is the URL preview because this feature might be vulnerable to SSRF and allows an attacker to cause the server-side application to make requests to an unintended location:
but as before the file name is renamed and the file extension is removed.
However, this means that we can control the requests made from the backend to an endpoint we like externally or even internally. We check whether it is vulnerable to SSRF.
Using Burp Suite Repeater and the http://127.0.0.1 as URL for the preview, we will obtain a result in the response:
This machine may have other services in the backend, we can enumerate them burp intruder and add a port number between 1-65535.
All the requests have this path in the response when requested a preview using a URL without any service running (that is the same shown before):
So filter this string with a negative search:
And we will find the only one with a different response, the port 5000:
Download the file and inspect it, seems to be a JSON:
It appears to be exposed on port 5000 an API endpoint and this appears to be the list of exposed methods.
Testing the various endpoints, the only one of interest is the following:
and we find juicy credentials:
Username: dev
Password: dev080217_devAPI!@
With these credentials we can only try to login using SSH:
And user flag is here.
There is another user (prod) that own also the /home/prod directory:
Using the command git log -p we can inspect all the commit messages and differences commited to git repo. We can find the prod credential changed during the downgrade from prod to dev:
Username: prod
Password: 080217_Producti0n_2023!@
The first thing to try on a Linux machine is always sudo -l:
This is the code of script allowed to run as root that performs a clone of a Git repository using the gitpython library:
Searching online how work git module, we can find that EVERY version of gitpython is vulnerable to RCE
The PoC on Snyk website:
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. This is only relevant when enabling the ext transport protocol, as done in the script with line:
Change the command injected by dumping the root flag and saving the output to a file under /home/prod.
ssh and get prod session
Enjoy root
