Week 12. Headless
TL;DR
This is a Debian 12 machine running a web site vulnerable to reflected-XSS and HTTP header injection. We steal an admin cookie exploiting these vulnerabilities that will permit us to get access to an administration dashboard. Here, a command injection vulnerability is exploited to get an user shell. Regarding escalation, we find a relative path vulnerability affecting a sudo binary.
KEYWORDS
Reflected-XSS, HTTP header injection, command injection, sudo escalation, relative path vulnerability.
ENUMERATION
Port scan.
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-23 15:13 EDT
Nmap scan report for 10.10.11.8
Host is up, received user-set (0.14s latency).
Not shown: 40603 closed tcp ports (conn-refused), 24930 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
5000/tcp open upnp syn-ack
Nmap done: 1 IP address (1 host up) scanned in 21.18 secondsEnumerate the open ports.
Fuzz for hidden folders.
USER
Browse the site with Firefox, in the /support URI we can inject a payload.
A hacking protection alert is triggered, the application replies with info taken from the user HTTP request headers. This means the application is a candidate for a reflected-XSS vulnerability when injecting a payload in any of the HTTP request headers.
Capture an HTTP request and send to Repeater, then inject a cookie-stealing payload in any on the reflected headers such as "User-Agent", "Accept", etc. In this case we will use the "Accept" header.
An is_admin cookie is received on a built-in PHP web server under our control.
Add the cookie to Firefox (or Burpsuite headers) and navigate to /dashboard, an administrator panel appears.
Turns out the dashboard is used to execute a system diagnostic command. This looks like a candidate for command injection. Capture a request and add a reverse shell in the date parameter.
A reverse shell for user dvir is received on port 1919.
Which can be used to retrieve the user flag.
ROOT
From the low-priv shell, take the opportunity to enumerate the system.
And the sudo configuration.
So we can run syscheck as root, no password will be prompted. Enumerate the binary.
There is a vulnerability in this code: in the execution of the ./initdb.sh script the path is not fully defined. This means we can create our own initdb.sh script in a directory with write permissions (for example, our home directory) then run sudo /usr/bin/syscheck from there. This will make the script to be run as root.
Create a script in the home directory /home/dvir/initdb.sh and add a reverse shell in the code.
Update script permissions.
And run with sudo from the directory /home/dvir
A reverse shell is received on port 9000.
You are root.
Last updated