HTB Sau: Write-up

# Enumeration

I started by running nmap -T4 -p- <ip> to identify all open ports:

Initial nmap scan to identify open ports.

I then ran nmap against the open ports, to identify the service: nmap -T4 -p 22,80,8338,55555 -sV -sC <ip>. This identified the following ports:

• 22: OpenSSH 8.2p1
• 80: filtered-http
• 8338: filtered-unknown
• 55555: Golang net/http server

I then tried visiting http://<ip>:80, which returned a 404. I then tried http://<ip>:55555, which returned a website called “Request Baskets” powered by request-baskets 1.2.1.

Website running on port 55555.

A quick Google search indicates that this version of Request Baskets contains a SSRF vulnerability via /api/baskets/{name} (CVE-2023–27163). According to the description, this vulnerability should let us access both network resources and sensitive information.

According to Huntress, the vulnerability could lead to a “full system takeover”.

# Exploitation

## Server-Side Request Forgery (SSRF)

To find an exploit for CVE-2023–27163, I simply Google’d CVE-2023-27163 site:github.com. I found this PoC exploit and downloaded it.

This exploit takes two arguments:

1. The URL to the website (http://<ip>:55555).
2. The ‘URL’ to my machine (http://<attacker-ip>:<attacker-port>)

First, I set up a netcat listener. Then I ran the exploit, which created a basket called “ragnqt”.

Setting up the listener and running the exploit.

I then opened the newly created basket: http://<ip>:55555/ragnqt. This resulted in the GET request being shown in netcat, proving that the service is vulnerable.

From the enumeration phase, I wasn’t able to identify the service running on port 80. However, we can use this exploit to get the HTML proxied back from the internal/local service. Let’s try.

Get ColdByte’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To do this, we simply change the second argument to http://127.0.0.1:80 and run the exploit:

Now we can visit the newly created basket:

## Command Injection

As we can see above, Maltrail 0.53 was running on port 80. A quick Google search indicates that this version of Maltrail is vulnerable to unauthenticated command injection.

I then Google’d Maltrail 0.53 exploit site:github.com and found this exploit. This Python script takes three arguments:

1. The attacker IP.
2. The attacker listening port.
3. The target URL.

First I set up a listener with nc -lvnp 4448 and ran the exploit. This got me a shell as the user “puma”:

Let’s upgrade the shell before moving on. Follow these steps:

1. In the shell: python3 -c ‘import pty; pty.spawn(“/bin/bash”)’
2. CTRL + Z
3. In your terminal: stty raw -echo; fg (you may have to click Enter a few times)
4. In the shell: export TERM=xterm

Now let’s get the user flag. It’s called user.txt and is located in puma’s home folder.

# Privilege Escalation

When working on privilege escalation in Linux systems, the first command you want to run is sudo -l. The command shows what commands the current user can run as sudo.

Luckily for us, this is really easy to exploit. systemctl uses less as the default pager if the output is longer than the terminal window. Furthermore, in less we can actually run commands, including spawning shells. And since we run the command as root, the resulting shell will be spawned with root. Let’s try.

First run sudo /usr/bin/systemctl status trail.service and then write !/bin/bash and click Enter. This will spawn a shell as root!

The last step is simply to find the root flag, which is located at /root/root.txt.