GitHub
Page cover

Week 6. Sightless

TL;DR

This is an Ubuntu 22.04 machine that hosts a vulnerable (CVE-2022-0944) version 6.10 of SQLPad. We find a bounty report that explains how to exploit it to get an initial shell in a Docker container. Then, since we are root in the aforementioned container, we move laterally to a low-priv user by unshadowing and cracking user hashes. Regarding escalation, we find an internal management application called Froxlor installed in the server. We bypass the authentication and then use the tool to modify an FTP account password. In this FTP we find a Keepass database file protected with a vulnerable password that, once cracked, allows us to get access to the root SSH private key that is stored in the database.

KEYWORDS

SQLPad 6.10, CVE-2022-0944, unshadow, Froxlor, lftp, Keepass.

REFERENCES

https://www.cvedetails.com/cve/CVE-2022-0944 https://huntr.com/bounties/46630727-d923-4444-a421-537ecd63e7fb https://github.com/froxlor/Froxlor/security/advisories/GHSA-x525-54hf-xr53

ENUMERATION

Port scan.

> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-08 12:34 EDT
Nmap scan report for 10.10.11.32
Host is up, received user-set (0.038s latency).
Not shown: 62894 closed tcp ports (conn-refused), 2638 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON
21/tcp open  ftp     syn-ack
22/tcp open  ssh     syn-ack
80/tcp open  http    syn-ack
 
Nmap done: 1 IP address (1 host up) scanned in 14.00 seconds­­­

Enumerate the open ports.

Add to hosts file and inspect the site with Firefox.

Take note of the subdomain in the lower left corner, add to hosts file and inspect with Firefox.

Take note of the SQLPad version, and search for vulnerabilities such as this one: https://www.cvedetails.com/cve/CVE-2022-0944

In the same link there is another link to a bounty report where you can see how to exploit it: https://huntr.com/bounties/46630727-d923-4444-a421-537ecd63e7fb

USER

Follow instructions in the bounty report, first navigate to http://sqlpad.sightless.htb, click on Connections -> Add connection, then add the connection name, the driver and in the "Database" field add the payload.

Click on "Save" and start a listener, then execute the reverse shell.

A reverse shell for user root is received on port 1919. After having a look at the host name, and taking into account we are running under root, we deduce we are in a Docker container.

Enumerate the system users.

Let's see if we can unshadow and crack password for usermichael

Use the password to login as michael and collect the user flag.

ROOT

Start from the low-priv shell for user michael and take the opportunity to enumerate the user and the system.

There is something listening on port 8080.

Forward to Kali and enumerate with Firefox, a Froxlor web site login portal appears.

This site provides instructions to bypass authentication:https://github.com/froxlor/Froxlor/security/advisories/GHSA-x525-54hf-xr53

Let's follow the instructions: execute a random login attempt, intercept the request and add the provided payload in the parameter loginname

The payload needs a minor modification: just update the URL.

Send the payload.

Now you can login as user abcd: Abcd@@1234

Navigate to Resources -> Customers -> web1 -> FTP -> Accounts -> Edit -> Change password. Then change the FTP password.

Connect to the FTP using the new password with a client that supports TLS/SSL, such as lftp, and download the Keepass database Database.kbd

Crack the Keepass database master password (module 13400).

Open the Keypass database, there is an SSH id_rsa private key inside.

Export the key and connect to the host.

You are root.

PreviousWeek 4. MonitorsThreeNextWeek 8. Trickster

Last updated