Last updated
Last updated
We are going to exploit Photobomb on Hackthebox.
After we inspected the Application we will find out that the Credentials for the enpoint /printer
are leaked in a java script file.
To get a foothold we will exploit a command injection vulnerability in the image processor and escalate to root using sudo.
We will start by doing a quick scan using Rustscan and identify that Port 22 and 80 are open.
sudo rustscan -t 1500 -b 1500 --ulimit 65000 -a 10.129.224.239 -- -sV -sC -oA ./{{ip}}
Let's see if we can find any interesting files using feroxbuster
feroxbuster -u http://photobomb.htb/ -t 20 -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt --no-recursion -k -B -x "zip,rar,txt,html,php,js,7z" -v -e -o ./ferox.txt
Great we found credentials to visit the restricted section. There are two ways we can use that info
Set a cookie document.cookie="isPhotoBombTechSupport=1"
Use pH0t0:b0Mb!
as credentials
Burp will help us to enumerate that behavior and request we are sending to the application further. We will discover that the Application takes three parameters and we're sending a POST request to the image processor backend.
POST Request
That's how the POST Request looks like when we just hit Download photo to print
.
Command Injection
After playing around we discover that the filetype
paramter seems to behave akward when we add ;id
for example. Instead of generating an Image we get the message Failed to generate a copy of finn-whelen-DTfhsDIWNSg-unsplash.jpg
Let's get a shell by executing a payload and don't forget to URL encode it.
During enumeration there was a possible privilege escalation vector discovered. We are able to run /opt/cleanup.sh
as root and have privileges to set an enviroment variable.
Sudo Privileges
cleanup.sh
Checking /opt/cleanup.sh
reveals that find
is called without an absolute path to the binary and relies on the PATH
environment variable. Let's create a new folder called bin
in our home directory, a binary called find
in our new folder containing a reverse shell payload
find
Make it executable and start cleanup.sh
sudo PATH=/home/wizard/bin:$PATH /opt/cleanup.sh
We will now receive a connection back on our listener and have a ROOT Shell
When we visit the site we are greeted with a message that we have to click to get started. The credentials are in our welcome pack according to the site. Since we haven't received a "welcome pack" and get asked for a username and password on we inspect the application more and check photobomb.js
On visiting there's not much to discover except some images that we can select, setting the file type, a resolution and a buttong to download photo to print. That's exactly what happens when we select an image and hit Download photo to print
, after some time we are able to download a file.
22
OpenSSH 8.2p1 Ubuntu
80
nginx 1.18.0 (Ubuntu)