Sau is an Easy Difficulty Linux machine that features a Request Baskets instance that is vulnerable to Server-Side Request Forgery (SSRF) via [CVE-2023-27163](https://nvd.nist.gov/vuln/detail/CVE-2023-27163). Leveraging the vulnerability we are to gain access to a Maltrail instance that is vulnerable to Unauthenticated OS Command Injection, which allows us to gain a reverse shell on the machine as puma. A sudo misconfiguration is then exploited to gain a root shell.
Area of Interest
Web Application Injections
Technology
Request Baskets Maltrail
Vulnerabilities
OS Command Injection Server Side Request Forgery (SSRF)
Security Tools
Netcat Nmap
Languages
Bash
Techniques
Reconnaissance SUDO Exploitation
CVE
CVE-2023-26604 CVE-2023-27163
Task 0 - Deploy machine
🎯 Target IP: 10.129.229.26
Create a directory on the Desktop with the machine's name, and inside this directory, create another directory to store the materials and outputs needed to run the machine, including the scans made with nmap.
Task 1 - Reconnaissance
su
echo "10.129.229.26 sau.htb" >> /etc/hosts
mkdir -p htb/sau.htb
cd htb/sau.htb
mkdir {nmap,content,exploits,scripts}
# At the end of the room
# To clean up the last line from the /etc/hosts file
sed -i '$ d' /etc/hosts
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
ping -c 3 sau.htb
PING sau.htb (10.129.229.26) 56(84) bytes of data.
64 bytes from sau.htb (10.129.229.26): icmp_seq=1 ttl=63 time=61.0 ms
64 bytes from sau.htb (10.129.229.26): icmp_seq=2 ttl=63 time=59.5 ms
64 bytes from sau.htb (10.129.229.26): icmp_seq=3 ttl=63 time=60.0 ms
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target should be a *nix system, while Windows systems usually have a TTL of 128 secs.
1.1 - Which is the highest open TCP port on the target machine?
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp filtered http no-response
8338/tcp filtered unknown no-response
55555/tcp open unknown syn-ack ttl 63
command
result
sS
SynScan
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are 2 open TCP ports on the machine: 22, 55555 and 2 filtered TCP ports: 80, 8338.
55555
1.2 - What is the name of the open source software that the application on 55555 is "powered by"?
Then, we can proceed to analyze services active on open ports:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 aa:88:67:d7:13:3d:08:3a:8a:ce:9d:c4:dd:f3:e1:ed (RSA)
| 256 ec:2e:b1:05:87:2a:0c:7d:b1:49:87:64:95:dc:8a:21 (ECDSA)
|_ 256 b3:0c:47:fb:a2:f2:12:cc:ce:0b:58:82:0e:50:43:36 (ED25519)
55555/tcp open unknown
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| X-Content-Type-Options: nosniff
| Date: Sat, 09 Nov 2024 14:27:59 GMT
| Content-Length: 75
| invalid basket name; the name does not match pattern: ^[wd-_\.]{1,250}$
| GenericLines, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 302 Found
| Content-Type: text/html; charset=utf-8
| Location: /web
| Date: Sat, 09 Nov 2024 14:27:33 GMT
| Content-Length: 27
| href="/web">Found</a>.
| HTTPOptions:
| HTTP/1.0 200 OK
| Allow: GET, OPTIONS
| Date: Sat, 09 Nov 2024 14:27:33 GMT
|_ Content-Length: 0
Strangely enough, port 80 is filtered, but there seems to be some relationship with the service active on port 55555, let's go and see.
Browsing it: http://sau.htb:55555/web we see that there's up a web app to create a basket to collect and inspect HTTP requests. using request-baskets app vs 1.2.1.
and now we can concatenate basket value to our URL and finally reach filtered port 80: http://sau.htb:55555/hbvoml
maltrail
2.2 - There is an unauthenticated command injection vulnerability in MailTrail v0.53. What is the relative path targeted by this exploit?
Googling 'MailTrail v0.53' we discover that's vulnerable to an unauthenticated OS Command Injection (RCE)
the username parameter of the login page doesn't properly sanitize the input, allowing an attacker to inject OS commands.
The exploit creates a reverse shell payload encoded in Base64 to bypass potential protections like WAF, IPS or IDS and delivers it to the target URL using a curl command The payload is then executed on the target system, establishing a reverse shell connection back to the attacker's specified IP and port.
