Let's fuzz with wfuzz and http verbs to see what we could do
┌──(root💀kali)-[~]
└─# wfuzz -X POST -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -u http://10.10.11.162/api/v1/user/FUZZ --hc 404,405 130 ⨯
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://10.10.11.162/api/v1/user/FUZZ
Total requests: 4702
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000001029: 307 0 L 0 W 0 Ch "cgi-bin/"
000002500: 422 0 L 3 W 172 Ch "login"
000003788: 422 0 L 2 W 81 Ch "signup"
We have a user flag request in the swagger let's try to grab it
we need to be admin to grab it
We get 11 users + 1 (the one we created)
We are also able to see other profile we are player: "profile":"UHC Player", there is also a guest "profile":"UHC Guest", and of course the Admin (the first one we found)
Let's now play with the read file and write file request we can see in the swagger to get a file the name needs to be in base64 url as mentioned in the swagger
Let's try to get the main.py it should be here /home/htb/app/main.py
Let's set a listener on the port we specified in our script (4444) rlwrap nc -lvnp 4444
Privesc
Turns out it is the htb user password not the root so in case we need to ssh as htb we have a password 1qaz2wsx_htb!
It was good that we kept the password because I lost the shell so I could ssh back into it
Let's make a string on the file strings /usr/lib/x86_64-linux-gnu/security/pam_wordle.so
These are all the guess words
We can use the list to cheat
Let's copy it and paste it in a file
Now we just need to launch the game again with sudo -l
--- Attempt 1 of 6 ---
Word: uname
Hint->???*?
So the word has an m somewhere else so let's find a word with another m
--- Attempt 2 of 6 ---
Word: mlock
Hint->*?**?
Bonus
If you do not want to manually fetch the file with burp you can use this script from ippsec's video writeup (see link in resource), it will fetch the files without the annoying chars by using tr
Just like with the first backend box we can enumerate users with the id
We are able to create a user (same process as the previous backend box)
We can now login using the user and we get a bearer token
Then we can access the swager with intercept on we add our token bearer and set the cntent type to json
We get redirected to openapi.json
Also we can enumerate users with burp intruder
In the swagger we can actually edit a profile. Let's try to make ourselves admin. It works!
If we check we are indeed admin
However we can see that we are not super, let's try to put ourselves the is super user to true with the put request to edit
And it worked too
We have to login again and generate a new token, let's replay our initial login request
Let's try to grab the flag again with this new token. It works
We are able to get /etc/passwd this way
Let's try to see /home/htb/app/core/config.py
we apply changes and fetch it
We need to get the /proc/self/environ
Now we just need to modify our token on jwt.io with the private key and add the debug to true. Let's take the token and paste it in there and make the changes
It works!
now we launched it
Now if we refresh our swagger (/docs) we see a new method
Let's try the new method. We get our shell
We can cat the auth.log we see a password
if we sudo -l with the user it launches a wordle game
Let's try to find the script that uses wordle find / -name *wordle* 2>/dev/null
This file seems interesting /opt/.words
So now we have an m an o and a c except the m is not in the begining and not in 4th place let's launch another shell and grep on our file with all the words. Here is what we get:
A the m is not at the begining of the word it let's try chmod, it works
And we can run all the commands so let's just grab the flag with cat sudo cat /root/root.txt
