What's going on YouTube? This is IPSAC and be doing Checker from Hack the Box which is a pretty unique box that has a lot of cool techniques. It starts off with two websites running some open source code. The first is Bookstack and the second is team pass. You can enumerate the version of them and discover an authenticated serverside request forgery and bookstack and unauthenticated SQL injection and team pass. Obviously, we start with the SQL injection and that will get us credentials over to the bookstack application and then we can exploit the serverside request forgery vulnerability. However, we're not going to just use it to make a web request. We're going to use a pretty cool PHP gadget that allows us to turn a SSRF into a file disclosure vulnerability, which leads us to an SSH session as the

HackTheBox - Checker


reader user. And this user can run a custom binary with pseudo. And upon reversing it, we discover it writes a string to shared memory and later uses the string in a pop call which is vulnerable to command injection. So we create a program to monitor the shared memory space. And once the string is written, we update it with the payload to exploit the command injection vulnerability. It sounds pretty tough, but once you do it once, it becomes much easier. So let's just jump in and do it. As always, we're going to start off with an end map. So - sc for default scripts.

HackTheBox - Checker


SV enumerate versions vv for double boost. This gives us things like the TTL OA output all formats put in the end map directory and call it checker. Then the IP address of 10101.56. This can take some time to run. So I've already ran it. Looking at the results, we see three ports open. The first one being SSH on port 22. And the banner tells us it's an Abuntu server. We also have HTTP on port 80. Its banner tells us it's Apache. And we also have HTTP listing on 8080, which is Apache as well. The interesting thing is on the title of both these pages is a 403 forbidden message. We also have this warning up at the top of end mapap of something happening. I don't know exactly what's going on here, but let's go take a look at the um website because right now we just see two forbiddens. So let's see if we're actually forbidden. So we'll do http 1010 1156 and it

HackTheBox - Checker


redirects us over to checker.htb. So end mapap didn't tell us about the redirect which is a little bit odd. So let's go ahead and curl it. So we'll do a curl 10 10 11 uh 56 and we get the page. So what this tells me is there's probably some type of web application firewall configured with Apache. Most likely going to be mod security and it's blocking on the user agent or something like that, right? We could add like d- user agent and then let's try n mapap. It still works. So is it like end mapap scripting engine? There we go. We get blocked. So yeah, there is a um blacklist on the user agent end mapap.

HackTheBox - Checker


There's probably a bunch of other things that it's blocking. Probably also going to block um like go busting and things like that like just fuzzing against the web server. So I'm not going to run a lot of automated tools against this just in case uh mod security is in play. We could try to enumerate that, but let's just go take a look at the website first. So let's do a pseudo v etsy host to add the checker.htb to my host file.

HackTheBox - Checker


So 10 10 11 uh 56 checker.htb this will let us hit the page. And if we go here we get a page called bookstack. If we try going to port 8080. So I'll do 1010 1156 8080. We get a page called team pass. So let's go ahead and look at book stack. If we look at the um page source, we can see in the stylesheet, it has version is equal to 23102. And this could be the version of Bookstack it's running. It could just be a bunch of other things, right? So, I always like just looking at it to see if it makes sense as a version for the software. So, if I Google Bookstack um where is that version? 23102. So, 23102. I'm going to add release to it.

HackTheBox - Checker


And let's see. Uh, we have vulnerabilities, but we do have bookstack version 23.10. So, it does look like that is going to be the version. If I go to um like CVE details, we can look at all the vulnerabilities for it. There was a serverside request forgery, but that isn't really that interesting to me. We can have the web application make a request, but we don't know exactly what that buys us yet, right? So just keep that thought in the back of the mind. But we can look at the vulnerabilities for book stack and let's see uh we are 2310. So that's 22. So probably one of these top two, right? So the first one is allows attackers to confirm existing system and users. So this is um like user enumeration. I don't think that's going to be too important. Uh this is going to be that SSRF I think we saw

HackTheBox - Checker


allows for filtering local files on the server because the application is vulnerable to serverside request forgery. So we have something here that's going to let us um have a file disclosure according to the CVE. But if we look at it, it will require some type of privilege. We don't have um any account yet. So let's go ahead and look at team pass because we don't have anything to go off of here. We need an account in order to perform that SSRF.

HackTheBox - Checker


So looking at team pass, I don't see any clear indication of a version just like we did on bookstack in the source code. So I always go to GitHub and then go to their page and see if I can find a file that discloses the server version pretty easily, right? Um a lot of times you may be able to access like the readme, the change log, things like that. So going over here, let's see. The first thing I get is security.md because that file just stood out to me. Uh security.md uh not found. So we don't have a direct clone on this. So we won't be able to just get anything we want. Um we could try readme.md lowercase. See if this exists and it does. So we have the readme but looking at it the readme was updated last year. So it's not updated that frequently many of these months, days, etc. But we could potentially identify um around the time

HackTheBox - Checker


based upon the readme. Let's just see if there's any other files, right? The composer.json's always a good one or the lock because that contains all the libraries the application uses. So it gets updated um pretty frequently, right? But we have forbidden on both of those. So we can't access these files.

HackTheBox - Checker


There is a change log.ext. So let's go ahead and grab that. So I can do changelog.ext text. And this isn't what I was expecting, honestly. Like I'm used to seeing like versions, things like that in the change log, but we just get an HTML page. But looking at it, the thing that really sticks out is a copyright. We have 2022. So let's go ahead and take a look at the history of this change log because we see the last commit was updating the year to see how often this updates. So, if we go over to history, let's see, um, update of the year. I'm going to go and look at this commit. And then we'll look at this one and the one before. So, here they're changing quite a few things, honestly. U, looks like the year on Oh, a lot of things. So this commit they updated the year on pretty much everything. So we know they updated at

HackTheBox - Checker


the start of 2023 which is good. And this one let's see adding API. So they're changing from team pass API to team pass and have API as the version. Let's see. So that is let's see can I just go copy we look at the file it's taking its we time to pull uh project team pass so we're probably just before this change log but the key thing is the copyright is correct so it is going to be a version from 2022 too. So, we can do kind of the same thing we did before with the CVE and let's just search team pass here and look for possible vulnerabilities. So, if we do team pass, uh let's go over here, get over to the product vulnerabilities and let's see. Um let's doesn't check mail. Is there a way to like filter authenticated? Maybe not. Let's see.

HackTheBox - Checker


XSS sensitive escape. Here's a high CVE. This is code injection. So, we can take a look at this one. More cross- sight scripting escaping. See, there are a lot of CVES related to this. I do see a SQL injection as well. So looking at this one, looking at the privileges required, this is high. So we don't have any um credentials yet. So I'm going to go ahead and ignore that.

HackTheBox - Checker


Looking at the SQL injection, privileges, none. So this is unauthenticated SQL injection, which is nice. We can look at the um patch that fixed it. I'm not going to spend too much time here, but this is just talking about the endpoint and they're doing some sanitization it looks like. But if we go to this blog post, it talks about the exploit, right? The authorized endpoints vulnerable to SQL injection and they normally just shove a hash in here to bypass login, but it doesn't contain a valid username when you do that. And the data gets put under the JWT public key. But um instead of just reading through this, let's just run it and step through each step to see exactly how this works. I find that to be a pretty good way to um analyze things, right? So, I'm going to just copy this exploit here. We can get an idea of what it does. We should always

HackTheBox - Checker


do a cursory look to make sure it's not like doing anything dangerous. Um we set the URL. We're just hitting this um endpoint to see if the authorize is um enabled or the API is enabled. If it is, then we can potentially exploit it. right here. They just make a arbitrary hash because they use that for the SQL injection. So, let's see. They have a token and then they're just um curling it.

HackTheBox - Checker


Okay. So, let's try this. Let's just run it. And actually, before we run it, let's set a proxy. We'll run it and then set a proxy. That sounds good. We do exploit HTTP 10 1156 8080 and I think it adds everything else for me. It finds two users and then gets me admin and Bob. So let's go ahead and add a proxy to this. So where it has curl, I'm going to do -x and then I think it's lowerase x. I hope it's lowerase x.

HackTheBox - Checker


127001 8080. and maybe an uppercase X.

HackTheBox - Checker


Um, we'll see. Okay, let's just comment this out without the proxy so we can easily revert it if we want to. There we go. Run this. Let's make sure our proxy is on. Sweet. We had that correct. I'm just going to turn intercept off and we'll look at it from the history tab because this lets us see what it does. Right.

HackTheBox - Checker


So, first we do a get. We get a 422 which I guess it's happy with. Maybe it's just looking for if it's not a 404 error message. Um, and here's the first thing. So, we're doing this SQL injection here. We see union select ID. And then I think we're just hand jamming this um hash in. And then here's where the SQL injection comes from, right? Select star from team pass user where password is null. Oh, it's doing count. So, we're looking for how many users um exist when there is a password set. Right? If we look at the response, it it's not that obvious what's going on here, right? But if I double click this and then look at it from Burpswuite, it is obvious, right? We have JSON data. So, let's just make this in bash so it's a bit easier to read. We'll do echo this B64-d jq dot and there we go. So for the username, it's our SQL injection because that's

HackTheBox - Checker


what we tried to log in as. And then it's putting the data actually in the private key of the public key of what we're extracting, right? So the query we're looking for how many users um exist, right? How many users where there's no where there's a password set and we get two. So let's look at the next query. So we can just go ahead do the same thing we did. Copy this and then echo basics d4-d jq dot. So right here what we're doing is selecting the login from team pass users where password is um not null and we're grabbing the very first user which is admin. And this number is going to increment because it's going to be the very first one then it's going to be one for the next one. And if there were three users the next thing would be two. This is how many lines to return. So we get admin. So the next query is probably going to be grabbing the password hash,

HackTheBox - Checker


right? So let's try this again. Delete that. Paste that. Go query. And where the public key is, we get the password hash of admin. So that's how this SQL injection is working, which is pretty neat. Um, I hadn't actually seen the an SQL rejection like return data this way. It's really cool seeing it in the token, I think. Um, it's just something I've never seen before. But let's go ahead and try to crack these. So, I'm going to go over to the Kraken, which is just another box where I have hashcat installed. So, we can do v uh hashes, and I'll call this checker dot, I guess, brypt. and we'll do username colon the hash and let's do dot slashhashcat um the hashes. So we'll do hashes checker brypt and then opt word or list rocku. It's probably going to tell me um this mode conflicts with other ones and make me specify brypt which I think is 3200 and that's if I put these in the

HackTheBox - Checker


correct order. The word list comes first and then the hash. Oh, wait. Um, I need the username. So, let's do dash username. I think that is because my format is user password. So, that's what it is. Um, so let's see. We need the mode. So, we'll do mode 3200. And then it's going to start cracking and we'll see if it gets any hits. Um, it's initializing it right now. It should take just a couple seconds. And the reason why I like having the username part of the hash is because after this you can just do hashcat show and then it'll tell you where this password went to. Right? So we see one user cracked as cheerleader. It's not telling us. We could g this and find out ourselves or we could just do um a d-show command. Right? So if we get rid of the word list d-show, we see Bob the hash and cheerleader. So let's try to log into um the app with the password, right? So

HackTheBox - Checker


we can go back over to team pass and then log in with what Bob and cheerleader as the password and progress and it lets us log in. Awesome.

HackTheBox - Checker


And let's see, we have Bob access and SSH. So, let's go over to SSH. We can see this. We have Bob's password right there. Let's just copy it. And I'm going to do vcreds.ext Bob. Put this That's not what I copied. That is sh bobchecker.htb. Paste in the password.

HackTheBox - Checker


Uh, did I not copy it right? Hiccup. Oh, the account is reader, not Bob. So, reader. Paste in the password. And it wants a verification code. So, this is going to be multiffactor authentication on SSH. Most likely probably going to be Google authenticator, but we'll probably enumerate that in a little bit. But, we can't just log in um with SSH. Uh, let me update the creds real quick because that's not Bob, that's reader. So, if we think back when we're enumerating bookstack, we had a ability to um retrieve files off of the local server. So, a file disclosure vulnerability. So, we can potentially steal the two-factor seed with this file disclosure and then let us log into the application. So, let's look at what the other password was. Um, it's loading right now. It's not the quickest. We got

HackTheBox - Checker


a bookstack login. Um, bob checker.htb and my secret wiki password. So, if we go here, we can do bob at checker.htb put in this password and we get logged in. And there's some pages here we can take a look at. So, we have this like basic backup with cp. So, recursive copy, update, whatever. This is going to become key later on. Um, they like backing up the home directory to back up home backup. So, we'll just keep that um in the back of the mind. This is Linux basics. But, we want to look at the way to retrieve files off of bookstack. So, if we go back to this CVE, let's see. I think this one is just like the change log. So, that's not going to be too interesting. They have the PC here and then a video of showing them exploiting it. Um, I'm not going to watch the video because it's just slow

HackTheBox - Checker


to do, but we can explain what's going on. Um, they put the URL inside this image.

HackTheBox - Checker


And this is going to be a really cool attack that I can't fully explain, but we're going to um demo it because most people would just think this is a way to make serverside request forgery attack work. But in PHP, apparently you can convert a serverside request forgery often to um local file disclosure, which is pretty cool. So if we just B 64 decode this um it's just going to be the URL, right? So all they're doing is putting this payload in the save request of a book.

HackTheBox - Checker


So let's just go create a book. So we'll do books create new book. We'll do ipsseack description that does not matter. Save book create new page.

HackTheBox - Checker


And this is where they um do the exploit. And if we watch the video, it would be clear. I don't I never found a good blog post to show that had it in text form. So that's why I'm doing it this way. So we should be in Burp Suite. Now let's go over to proxy. Um intercept on. Let's go ahead and save the draft.

HackTheBox - Checker


So now we have the draft here. So, what the exploit is having us do is where is it? Right here. We'll copy this. Go back in Burpswuite. Paste it. So, we put a URL here. This is just going to be um having the server reach out to us.

HackTheBox - Checker


So, let's create a URL. So, we'll do echo-ashn. And the dash n's important so you don't have the um line break at the end. So, we'll do 10 1048 port 8000. Uh we'll do SSRF, I guess. And then base 64. If there's equal signs on it, you can cut them off. Or if you want to do the equals, I think you have to URL encode them. But thankfully, there's no equals right here. So, I'm just going to put this URL in. We're going to hit send. It doesn't give us a response because it is making a request to us. Once we kill this then that's when the request comes and it doesn't give us any data here. Right? If I made a actual directory dubdubdub ssrf um please subscribe and then we'll do python 3 http server rerun it. So it got it. Look back here. It never um puts the data. If we look at the draft, the please subscribe text isn't there either. Uh let's see if we can show that

HackTheBox - Checker


real quick. I think I put an exclamation point on it. But we're modifying the HTML which is down here. And we just have a dead link, right? So it never actually puts it here. So that's why we can't just include a file easily. But what we can do, um, I think let's verify this real quick. I may be wrong with what I just said. So, let's see. Uh, locate star png. Find slashdevnull grab png. Okay, I'm just going to copy this to ssrf and we're going to test it real quick. So, start it. Is it going to download the image? No, it's still a dead link. Awesome.

HackTheBox - Checker


So, there's no way for us to actually um see the data, but we can do a error based brute force and brute force it one character at a time because of a weird PHP quirk. So, let's go into that. I'm going to Google like um let's see PHP filter error Oracle. I think this is going to be it. It's a blog post on Synactive and it's going to be relatively tough to understand and I'll do my best to explain this. This article pretty much starts off by saying PHP filter chains are the gift that keeps on giving for PHP hackers, which is definitely true because people keep finding new ways to abuse filter chains in order to increase the severity of their vulnerability. The PHP filter chain itself is not a vulnerability. It's just something that gives a lot of control over to the user that they can do a lot of weird things with, right? Um, back when I first got started in Hack the Box, I think it was 2015 2016

HackTheBox - Checker


time frame, the only known thing you could really do was convert files to B 64 at the filter chain. And this was used in include statement. So you could um leak source code, right? Because if you just include a PHP file, the include will execute it and you don't get the source out of it. But if you B 64 encode it, now you get the source code and they can find sensitive things like passwords and things like that in PHP scripts. People eventually found out ways to write data with PHP filter chains. I think this was probably like 2022 time frame, but that allowed you to take an include statement and even if there wasn't a file on the server, you could do a um PHP filter, create that file out of thin air with whatever PHP gadget you wanted to get code execution. It's a really cool attack path that still works

HackTheBox - Checker


today. Um, people eventually found out you could also just use this to write magic bytes to beat mime type checks. In the big bang video, which we did um, a couple weeks ago, I think it was, we used filter chains in order to exploit a buffer overflow that turned a file read and PHP into a file, write. That was a really cool attack. I definitely recommend watching the Big Bang video. But here, we're going to take a serverside request forgery and turn it into a file disclosure. So let's scroll down a little bit and it starts off talking about where they found this. This was in the down under CTF of 2022 and this was the application, right? It's just a docker basic PHP config and copying index copying the flag and here's the code.

HackTheBox - Checker


This only opens the file and reads it. It doesn't print anything back to the user. So there's no way to just say, "Hey, give me slash flag." you have to abuse something in order to get it because it's not like a file get contents that's going to echo the contents of the file back to you. It just reads it, does nothing with it. And then relatively good meme. Um PHP really loves file leaks because you can do so much from them. But let's go into the attack, right? It's going to um start off by making a file to be the maximum size. And it does that by doing a bunch of conversions. So it's going to convert to UTF. then uni-ode UTF USC4 and does these encodes over and over again until it hits the maximum memory limit for PHP which I think is 128 megabytes. Right?

HackTheBox - Checker


So we just do this in code. This is kind of an example of it. Um if we just do I convert UTF8 UTF uh UCS4 little Indian string. This is what it looks like. Then we're going to add um another one. We add more bytes. So we just keep doing this to make a huge file and eventually we exhaust PHP and that crashes. So whenever it crashes you can potentially turn that into like an error based um oracle. And they're going to use dchunk to do this. And they don't give a lot of information on exactly what dchunk is. Even in PHP documentation it's kind of um slim. But essentially what they found out is if you dchunk something and it begins with a hexadesimal character it just erases that. So if we have a payload we convert it to be the maximum size of 128 megabytes and then we send it crashes. If we do a dchunk and it still crashes we know the first

HackTheBox - Checker


character wasn't hexadimal. If we dchunk it and it doesn't crash now we know that very first character was hexadimal.

HackTheBox - Checker


Right? And then they can do other weird things with I convert to change that character around like rot 13 things like that in order to figure out what hexadesimal character that was, right? Um and then they're also going to do a another thing in this which will just reorder the um bite. So um eventually they change like the start of the string here they do I convert. Now the start of the string is t and this is at the end. So they kind of just changed the order so they can now brute force the entire file. That's essentially how this all works. So I'd highly recommend reading this. I don't fully understand enough to explain it, but hopefully after we demo the attack, it'll kind of make sense to you. Um, so let's go ahead and do that. Let's see. If we go to GitHub, we can download this exploit. So let's just do

HackTheBox - Checker


a get clone.

HackTheBox - Checker


And then let's go into the directory and let's see.

HackTheBox - Checker


Um, there's going to be one thing we have to do. We have to update a file in the actual GitHub. They talk about like you probably should use the class. I don't know exactly how to do it. So, I'm going to do a relatively hacky thing and find where it makes the request and hand jam our modification in. Right? because this isn't expecting us to have to um put this in, right? The whole like B 64 image thing. So that is going to be in this in core and I think it's like request.py. I want to see where it makes the um request. So here it's making the request and we just want to update our filter chain. So instead of just being the PHP filter, we also have our URL encoded um payload, right? So it's an HTML image.

HackTheBox - Checker


So we do this and then we need to do a B 64 encode on the filter chain and it wants that as binary, but we want it as AS asy like that. And then we terminate with a single quote slash and carrot like that. There we go. And then we have to import B 64. So from B 64, import B64 encode. And I don't know why it just did two fours there. Save that. And then before we actually run this exploit, right? Um what is it? Filter exploit.py.

HackTheBox - Checker


Make sure it works. I want to make sure um we don't have to send the data as JSON. It looks like it does support it, but it would be slightly easier if we just did this all as um the standard xdubdub url form encoded. So, let's see if we can change that real quick. So, we'll do this dubdubdubdub uh form URL encoded. And then let's change this to be just HTML is equal to our payload. So this just simplifies the arguments for us if this works. Uh 8,000. Run it. And it looks like it does. Awesome. So if we go back to the help, what we need to do, let's do Python 3. Um where is it? Exploit uh filter exploit like that. Let's see. We can set the target. So we'll do d-target is equal to http checker.htb and then we need the page this. Paste that. And then let's see what do we need? Uh the verb. This is

HackTheBox - Checker


going to be a put request. We have that here. Um, let's see what else. Uh, the parameter that we're using. So, that would be parameter HTML. And then let's see, we need the headers. So, this is going to be cookie. And then let's grab this. So, I'm going to add this header.

HackTheBox - Checker


And then we also need the cross-sight scripting protection XC surf token. And then that's going to be this. Okay. Headers are set. Um I'm going to do d-proxy http 127001 8080.

HackTheBox - Checker


This lets us actually see what's going on. And let's see, is there anything else we need? Feel like I'm forgetting something. Oh, the file. Duh. So, let's do Etsy host name because that's a relatively small file and we have an idea what it's going to be. Let's see if this works. It's taking its time. If I go over into the proxy, uh oh, there we go. We can see a bunch of 500s and then some 200s. So, this is it brute forcing the characters one character at a time, right? If we look at what the payload looks like, um, let's see right here. Let's just do a echo-n B 64-d. Uh, that's not what I expected. Oh, because I got um random HTML stuff, too. That's probably it. You can see the filter doing just various conversions. There's a rot 13 uh D chunk and more conversions. So, it's working. It's just slow. And you see it

HackTheBox - Checker


does a bunch of um 500 requests because that's it failing. And then also a lot of times when we people are using these PHP filters to do things, it truncate it loses like the last bite of the file. If you prepend a lot of data to the file, it loses more than one bite. So you don't always get the end of the file, which is a bit odd. But we can see that's probably right. It the host name of the box is probably checker, right? So, we could try and um get the uh PAM configuration for SSH. I'm not going to let this run all the time, all the way because it's going to be really slow. But generally, if you're doing MFA on SSH, you have to modify this uh pluggable authentication module to put the uh program, right? So, we're going to try to include this and then we'll let it go for a few characters. Um B. There we

HackTheBox - Checker


go. See, it's starting to work. Um let's see. While that goes, let's go.

HackTheBox - Checker


Catcreds shreer at checker.htb and we'll paste this in. And then we can also just Google like this string.

HackTheBox - Checker


So, I'm going to say SSH put verification code in quotes like that. And Google Authenticator comes up quite a bit, right? So, chances are it's using Google Authenticator. Um, let's see. Google Authenticator C. Uh, let's do setup. Uh, let's see. Sh MFA Ubuntu. Is that going to be a better one? Let's see. Is this going to use Google authenticator? Yes, it does. So, configure SSH. This is them editing the SSH config. Um, they're adding this line and the PAM that we said. So, that's how we know they'd run it. And then configuring. Let's see. I think this is the file. So, I think that file goes into your home directory. So, I'm going to kill this because we've accepted this is working.

HackTheBox - Checker


Um, we can change the file to be home reader Google authenticator and see what happens. And it errors right away, which makes sense because we can't go into the reader directory. But if you remember back when we um started on this box and logged in, they talked about backing up the home directory and they did the home backup and backup home backup, which is a bit odd, but let's try this. So file see can I put this on like that so it's easier to see and let's see if we can read this file. It looks like we can. We got the first character. So DV and keep in mind it is um it extracts it over B 64. So then does the decode here for us. but we're getting the Google Authenticator um timebased onetime pad key. So, I'm going to pause the video and let this finish. Okay, now that we have this file, let's go ahead and try logging in

HackTheBox - Checker


again. So, I'm going to get the credential for reader again. We can SSH um reader at checker.htb. paste this in. And then I'm going to run ooth. Is it like this? There we go. Ooth tool. Uh, tootp specify this hex encoding failed. There's an option for that. Uh, base 32. Whoops. Need a space. There we go.

HackTheBox - Checker


So, let's try 667 943. And we get a weird error. And I don't know exactly why it's doing this.

HackTheBox - Checker


Well, it's doing it because the time is wrong. But if I just put like one two one two one two, we get back to password. So, it fails differently when the time is close or something. I don't fully understand that. It should either be failed or success. But it looks like there's three cases. And we can get the server time through curl. Right? If we just look at the headers of checker.htb, we can see there is a date header, right? So we can grip for date. Uh let's do a - s for silent.

HackTheBox - Checker


There we go. And then we want to um grab everything after the delimiter of a space. Everything after three like that. Is that it? There we go. So we have the date format here. And then we can use the date command of date-d format this how OOTH tool wants. Um, forget exactly how that is. That's going to fail. Python 3. Oh, not all tool like that. Let's see the date. There we go.

HackTheBox - Checker


So we do date like this and then plus percent y for year lowerase m lowerase d hour minute second like that. Uh that's not working.

HackTheBox - Checker


put this in quotes maybe. There we go. So now we have the date. So we can go back to the ooth command and use this. Where is that? Right here. And then we can do dashn now is equal to and paste this in. Hopefully that works. I just probably did quote seception with all these double quotes. Looks good to me.

HackTheBox - Checker


Um, we got to get the password again. I should probably use like SSH pass or something so we don't have to keep copy and pasting, but oh well. Run this. Let's get a new code. 708017. And there we go. We get logged in. Awesome. So the first thing I like doing whenever I SSH into a box, especially if I know the user's password, is checking pseudo rules. And we can see I can execute this uh bash script as root. So let's see exactly what the script is. So I'm going to cat it. And then we see the very first thing it's going to do is source the current directory name um which is going to be the opt hash checker and then env. So let's see if we can read that environment variable. So if we cat env we can't we get a permission denied. We look at the permissions and only root can read this file. So we never get access to this. Um the next thing it's

HackTheBox - Checker


going to do is I guess check if this is I don't know exactly what this is doing.

HackTheBox - Checker


Um it looks like it's just grabbing the username but making it like over complicated. So let's do echo. We'll do it all caps. That works. If I do zero, that says all numeric, so probably alpha numeric. Um, oh, maybe that's getting rid of special characters. Yeah, that's what that's doing. So, that's going to get rid of special characters. And then we're going to run this binary, this check leak. And if we look at it, um, we don't have execute permissions. Only root does. So, we have to execute this with pseudo. So, let's do a pseudo and execute the script. So if we do pseudo this uh we'll check reader right and we see user is not found in the database. Um I'm going to do Bob because that was the user of the u book stack application. So I know it's a user on the box and we see it says password is leaked using shared memory at this as temp location. User

HackTheBox - Checker


will be notified. So if we do a ls we can also see there are leaked hashes.

HackTheBox - Checker


So, I'm guessing Bob's hash is in this file, right? But let's go ahead and copy this binary over to a box so we can begin analyzing it and um see what the vulnerability here is. So, we're going to do a NC LVNP check leak and then uh we'll do port 90001 and direct to a file like that. There we go. We can cat check leak and that'll be to devcp 10148 9,0001. Okay, so now we have the file on a box. I'm going to open up gedra and then we'll just analyze it and see what we have. We probably should have done a file against it to see um what type of binary it is, but we'll just yellow for now. So, let's go here. Uh project name doesn't matter because I'm not saving anything. Open the little dragon and then we'll go and select this binary when it comes up. So let's do checker and then um we'll do check leak. There

HackTheBox - Checker


we go. Analyze now. Analyze.

HackTheBox - Checker


Okay. And I'm waiting for this to finish and us to have like a main function.

HackTheBox - Checker


Uh there it is. We have main. So let's take a look at kind of what it's doing.

HackTheBox - Checker


So right off the bat, um we're going to get environment variables DB host user password name. So this is going to be all the like environment stuff we had saw. And I'm just going to quickly rename these so if they show up later, uh we know exactly what it is. This is DB password. And then this will be DB name. There we go. uh DB host DB name. Okay, so the first thing we're doing is I don't know what that's doing right here. Let's see. So this is failing to load environment. So if we don't get any database credentials or something, um this is just checking if any of these variables is equal to zero. Then down here uh let's see this is probably incorrect number of parameters based upon the usage and then let's see username's too long. So if we have a username that's longer than 20 characters, it's going to error. And here's the first thing. Fetch Hash from DB DB host DB user DB

HackTheBox - Checker


name. And this so this is going to be um user I guess we can call that. And that'll be a pointer. Um this will be maybe um handle DB maybe. I don't know exactly what this is. Um but if we look at fetch hash from DB, we could name these things. The last thing we got was um user. So this is going to be username. The rest I think was like um all the environment variables. So it's not going to matter too much, but we see we're using the MySQL library to run a query. Most likely we're doing real connect. So there's all the DB strings. And then we have select password from team pass users where login is equal to the username. And then we do the MySQL query and this just gets the hash. So nothing too fancy there. It is using the MySQL library which is going to be something to keep um in memory when we go uh later on in this program. So here we have the hash from

HackTheBox - Checker


the database. Then we're going to do this check brypt in file. So, all we're doing here, and this is going to be um hash, right? Uh PW hash. There we go. Because we're comparing the PW hash against the um leaked hashes, right? And if that string does not exist in that file, it's going to say the user is safe. Else the string, the hash existed in that file, it's going to say password is leaked.

HackTheBox - Checker


And then I don't know what this is doing. is checking if something is not set. I guess we're going to flush standard out and then we're going to write to SHM. And this is interesting.

HackTheBox - Checker


Um this is going to be write to shared memory. And if we look at this um I'm guessing all this stuff is probably because it's like compiled maybe debug or something. This is probably going to be stuff to help um a debugger. I don't know exactly what that's doing here, but we see it's doing this shmit. So this is getting shared memory and you can think of this as like dev shm it's just a spot on the box where um memory can be shared between various programs and beforehand we're going to do a time then we're going to call srand then we're calling rand so we're getting a random number based upon the current time and then we're going to um forget what the percent means um we're limiting the file size here. Um it's a modulo operator I think. So this is just going to limit how big it is. If it's if the number goes beyond this then it kind of rotates the beginning and

HackTheBox - Checker


goes to one, right? So this is just limiting the size that um the key can be. This would be the number of bytes and then this is actually the file permission. Um I was wondering if the tool tip would tell me. Maybe it does right there. And shm flag. So yeah, this is going to be the permission and 0x3B6. This is in hex format. If we go over to Google, uh we can probably convert uh 0x3B6 to octal. And this is going to be the format you're used to seeing. It's going to be 1666, right? The um I guess I think that's the sticky bit is set. Uh that's not too important but the important thing is the permission is 666 which means anyone can read and write this memory space. So um we have read write access to this even if we're not part of the program. So right here we're checking if it's negative one. So this is going to mean that um it could not allocate this memory for whatever reason.

HackTheBox - Checker


right here. We're going to I want to say read the memory right here with shmat.

HackTheBox - Checker


What is that doing? Let's just Google exactly what this is doing. Does this read and see? Oh, it attaches to the memory space. So, um we see if we can access it, then we attach to it. And then we're probably going to write to it somewhere. uh shmat there's time store there that's detach. So right here this is going to be um I'm going to call this shm id. So we got there where is this string shm id. So it highlights the next one.

HackTheBox - Checker


uh right here with this print f we are writing leaked hash detected at and then the probably memory location and then we're putting this carrot and then um is that the hash exactly? I think that's the hash. Let's see if we go back here.

HackTheBox - Checker


Let's do the pseudo command again. Password is leaked. User sharing. So it never actually prints that. But I think this is going to be the hash. We'd have to like go back here. Uh C time put this right. I'm pretty sure that's going to be the hash. So we're writing to a place in shared memory that anyone can access. So what are we going to do after that?

HackTheBox - Checker


Um we write to shared memory. Then we print that string. Um then we're going to sleep for one second and then notify user and u 2. This is going to be the shared memory uh location or ID. So I'm just going to rename that to SHM ID. We go to notify user. I'm just going to label that because that's important. I think all these again are database things. So let's go down here. We're going to get the memory location. So it's important to note in that main function when we call this the notify user, we're not passing the password hash or any of that in, right? We're just running to a shared location and then saying, "Hey, that's where it is. Go and grab it." So, we have this. Let's see what are these strings doing. Uh, shm ID. We can just label this. There we go. Um, call it handle shared memory. I

HackTheBox - Checker


don't know exactly what to call it. Um, if we can't access it, it's going to error out. This hstack is probably going to be the data. Let's see. SHM this is allocated stuff unable to attach. There we go. So this is going to be a string. So right here let's see don't know what this is exactly doing. So no hash detected in shared memory. So this is if we get down to this function and um the hash is blank, it's going to just say um nothing. Right? So then we're going to go here. So we have data in the shared memory and we're going to look for the character of that um greater than sign and then we're going to get to that location. So, right here, this is going to be um Can I do this in a name? Uh, let's see. I'll put spot. That's a horrible name. Um, I don't know. I don't know how what to call this, but this is going to be the string of the location of this.

HackTheBox - Checker


Maybe location of that. There we go. So, we're going to find the location of the greater than sign. And what we're doing here is setting that to this trim brypt hash and then plus one, right? Because when we looked at um what it was before, it was like leaked. Oh, right here, I think. Right. It was right here. or like leaked hash at Luke and then we pass in a variable, right? Uh this is the hash we pass in.

HackTheBox - Checker


So all that's doing is gra finding where this is in the string adding one. So we get rid of the space. So we just have the password hash. So that's where that is. And this is going to be pw hash. And here we're going to make sure we have a MySQL password set. Um, this is making sure that set and succeeded. And right here, we're going to um probably get the length of this command because we see we're changing that. So, this is going to be like um a length indicator maybe. I don't know exactly what to call it, but we're reusing that variable. So, I renamed it. It's just going to be like length of string multiple times because we're going to allocate this um length in memory. And then we're going to put this string there. And this is going to be my SQL. This is going to be the user, the database, um email, team pass user, and then

HackTheBox - Checker


password hash. So this is why this function needs the password hash. We're just going to do a mysql and find the user that has this password hash, right? And then what we're going to do with that is let's see a pop. So if you're still following me, um this password hash comes from shared memory and we're going to do a pop on that and that's part of a myql string.

HackTheBox - Checker


So the challenge here is when we go into main, we check, we validate that a user has um a leaked password, then we're going to sleep for 1 second. And in this second, we're going to write to the same shared memory location, replace that string with one of our own, and that's going to have command injection because popen is vulnerable to command injection, right? So all we have to do is escape this single quote in the my SQL and then we can do a semicolon and then a command. But it's going to be a little bit tricky to do. So um let's try it out real quick. Uh we'll call this um shm write I guess. I don't know what to call it. And then we're going to do the standard includes in C.

HackTheBox - Checker


I probably should do this in like um something where I have co-pilot, but I've never used co-pilot with C. I don't know how it would do and how confused I'd get. So, we're just going to um do this manually and hope that everything works. So, let's do include the last one. I think this is what we need. And then we can do int main. Okay. So what we have to do is um first replicate the um random thing right uh the shared memory location and that was in the write function right so this is where they do the time so all they're doing is um an insecure randomization they're just getting the current time stamp and then setting the seed to that and then calling random So as long as we set the seed exactly like this program does then all the random we'll be able to replicate. So every single second we're going to just um generate a number check

HackTheBox - Checker


if that exists in memory and then if it does we're going to overwrite it. Right? That's going to be the gist of it. So I'm going to do a um infinite loop first and then we're going to um set the time. So now is going to be unsigned int time and then we're going to pass in null and then we'll call sr rand on now and then the key that is an integer and we're going to do rand and then the modular operator and I want to say that was six fs right let's count that Um, you don't see it here because they're doing it on the shm get. Uh, that is 1, two, 3. Is that five? One, two, three, four, five. Five fs. So get rid of that. One, two, three, four, five. Awesome. So now we have the key set. So what we want to do is um try to access this. So we'll do int shim id and that's going to be the shim get that

HackTheBox - Checker


we've seen. We'll do key. I want to say it did 400 bytes and we're going to pass in a zero. We're not going to do any permissions here. All we're doing is seeing if this uh place and memory exist. And if it does um or if that shared memory does not exist, this is going to return um negative one if it fails. We're just going to call sleep and this is micros secondsonds. Um let's see view sleep we'll do um half second and I'm actually going to make this even quicker. So this is half a second. We're going to do this 10 times every second.

HackTheBox - Checker


And then we'll just call continue. So we get back into this loop. Okay. And then here we're going to say key exist. So what that continue is going to do is it's going to um go back to the beginning of the loop. So if we can't access that spot in memory, go back to the beginning. And now if we can then um let's do a print f just to let us know uh found key and we'll print this out. And this is mainly a debugging thing because um when I run this program I'm going to get no output. So if I ever um see this not equal to negative 1, I want to know because that means I'm starting to do something. If I run the program and I never see this print statement, then I know um I have an error up above. So this print f mainly debug. So now we have to do the um shim get again because we're going to access this the same way it did which I think was what was the permission bit it

HackTheBox - Checker


did 0x3b6 0x3b6 like that there we go and let's see uh we have to call that Um what is it? Allocation and we do shim ID. Give it a pointer. There we go. I think that's how we do the allocation. Um and now we just have to put the string in. So they used um print f like this point it to the shared memory location 400 bytes and what did they put in here? Uh leaked hash. So we'll do leaked hash and then um it doesn't matter what we have here as long as we have that. So right here it's going to get chopped off and this is what's going to think the new password hash is. Right? So we're going to do a single quote to terminate the parameterization in the my SQL command. So that's going to get us where we can do the semicolon and then we can just do um let's do touch temp please subscribe and then we'll do another

HackTheBox - Checker


semicolon and we'll do a comment as well. So it just um breaks everything else off of that string. So I think that's good. And now we have to detach. So we'll do shm dt and then handle that.

HackTheBox - Checker


And then let's break to exit the program. So I think we have this now.

HackTheBox - Checker


Moment of truth. Do I have typos? It compiles first time. Um, so let's go ahead and copy this over. So I'm going to cat my program. Let's copy this. And we will go over here. And we probably need to SSH in again um because we need two shells open to make this easy. We could just run it in the background, but I think it's better if we have two shells.

HackTheBox - Checker


So, we'll do the OOTH tool again. Cat creds shreer at checker.htb. Uh, copy this 174484. Sweet. I did that within the time. I was worried that would take too long. So, let's go to cd temp v. I'll call it like exploit.c. Oh man. Uh eh nano. Uh that's not the right clipboard. That is save it. GCC exploit C. We'll call this exploit. And then if we run this uh found key negative one. That's not what we want.

HackTheBox - Checker


Um we screwed something really silly up.

HackTheBox - Checker


him get like I'm confused real quick cuz we're doing if it does not equal negative 1 here but we still got here. I am afled right now. We have something really silly that I don't know cuz we should just hit this.

HackTheBox - Checker


Oh, that's equal to negative one. That's a stupid mistake.

HackTheBox - Checker


There we go. So that's why I did that print statement because I knew I would make something um silly. So now this program is running and it's just constantly checking the shared memory location. So as long as um we did the whole randomization, right? Hopefully the program does something when we run this script. So I'm going to run it. We see found key 47. Um, I kind of expected a error message.

HackTheBox - Checker


No hash detected in shared memory. So I think we screwed up the right. If I do lsa on temp, uh, we don't have that. Please subscribe. So we definitely screwed up the right. Um, we found key. We do a get here 3B6. So, that's writing. I wonder if this needs to be longer.

HackTheBox - Checker


Um, let's copy this. I guess we can go. Try this.

HackTheBox - Checker


So let's write more data. Uh don't know what I just did. There we go. That's what I want. Leak hash detected at um something that Save. Compile.

HackTheBox - Checker


Run. Let's do the pseudo again. And it never detected it. There we go. Found key. An error. This looks better, right? Uh, so the MySQL errored out. If we do lsla on temp. There we go. We have please subscribe. So I wonder if I just ran that multiple times if it would work because it doesn't look like it just works every single time. But uh it's close enough. So now what we want to do is real code execution, right? Because we only touched a file here. So let's do um cp bin bash over to temp. We'll call it IPSSAC. And then chmod 4755 to give it the set UID bit temp IPSAC like that. That should be fine. Save it. GCC and write. So now it's running. I'm going to run my script again. And it looks like it worked. Um we have found key. My SQL error failed to read the result. But if we do lsi on temp, we have IPSC. It is in red. So

HackTheBox - Checker


this means it's going to be set to ID. We can do temp ips-p. And if we do ID, we are now effectively root. So if we do cdroot, we can get root.ext. So that's going to be the video. Hope you guys enjoyed it. Take care and I will see you all next time.

HackTheBox - Checker