text: What's going on YouTube? This is IPSAC be doing code from hack the box which is a pretty easy machine but there is definitely something that could trip people up during the root step if they try to run the exploit out of a temp directory like dev shm ortemp because the sticky bit is set there which is preventing root from modifying files. I'll do a thorough explanation at the very end of the video. But before we get into the priv, we first have to get a shell on the box and that is through a website that allows us to just run Python code. But there is a filter in place that's preventing a lot of uh bad words from being said. This step's pretty easy if you just pull up a sandbox evasion cheat sheet and try proof of concepts until they work. But I'll do my best to do it manually and explain exactly how it works under the hood. So if it sounds complicated, don't

title: HackTheBox - Code


text: be intimidated. You don't have to understand how it works. But I just like to explain things in depth. After that, we get code execution. We can dump the database and then exploit a backup script, which is where that temp directory thing I mentioned earlier comes into play. So with that being said, let's just jump in. As always, we're going to begin with an end map. So - SC for default scripts, SV numeric versions, VVV for double verbose. This gives us things like the TTL OA output all formats in the end map directory and call it code. And then the IP address of 10101.62. This can take some time to run, so I've already ran it. Looking at the results, we have just two ports open. The first one being SSH on port 22, and the banner tells us it's an Ubuntu server. We also have HTTP on port 5000. And the banner tells us it's running G Unicorn, which

title: HackTheBox - Code


text: is a Python library. And the title of the HTTP page is Python code editor. So everything lines up. This is definitely going to be a Python um website. It's also exposing the G Unicorn version of 2004. And we could look for vulnerabilities there, but Python code editor sounds like a really juicy website. So let's just go take a look there. So I'm going to go to 1010 1162 port 5000 and we get looks like a web IDE type thing. If I click run it prints hello world. So it is running Python code. The first thing I'm going to do is try to like run a system command. So I'll do import OS then os.system and then let's just run ID. And if we try this we get use of restricted keywords is not allowed. So the next thing I normally try to do is like include files, right? So we can do like with um open let's do etsy pass wd as read and this would be called

title: HackTheBox - Code


text: f and we can do like f read lines and see if I can print this out and we still get use of keywords is not allowed. So now I want to see exactly how this filter is in place right is it just looking at the input we send to the web server or is it actually hooking in the Python code and seeing what is being executed. So, I'm just going to comment this out. And then we'll just do a print. Uh, let's do please subscribe.

title: HackTheBox - Code


text: And then we'll send it. And we still get the same thing. So, I'm just going to confirm um the thing is still working.

title: HackTheBox - Code


text: So, I'll just erase that. And we get it. So, it's just looking at the text we send it, right? Um, we could find out what like bad words there are. So, if we just do like print uh let's try import.

title: HackTheBox - Code


text: Click run. That's not allowed. Test. That looks like it is um width.

title: HackTheBox - Code


text: Width is allowed. Let's try open. And that is not allowed. We could also play with like case sensitivity. And looks like um that is still being restricted. So we kind of have an idea what the filter is in place. And this is going to be where I make it a little bit more complicated than it is because in reality you could probably just go and Google uh like Python sandbox evasion cheat sheet and then copy and paste a bunch of things until something works right. Um let's see. I'm not finding something I'm familiar with. Let's just look at some of these. Uh that's not it. Um let's see. Sandbox evasion cheat sheet. If we do it on duck.go, do we get anything different? I think this page I recognize. Um, this is like a defense thing of people evading.

title: HackTheBox - Code


text: There's something here of just giving a lot of things to run. Uh, we know this won't work probably because we we tried it. Uh, there's pop as well. We could check if like OS is a bad word. So, we could do like print OS run. That looks like a bad word as well.

title: HackTheBox - Code


text: So when you combine the knowledge of um what bad words there are, you kind of guess which one to use. And some of these get relatively complicated. And I'm going to step through it. Um so hopefully you can understand by the end of it. Um not sure exactly where some of them are. Like this is complicated, right? What the heck is going on here?

title: HackTheBox - Code


text: It's got like a list comprehension, which is not like a beginner thing. Doing something with this classbased sub. like what is going on there? So, this is essentially what we're going to do, but just step through it, right? So, it all starts with that class base um subasses. So, let's run this real quick. So, I'm going to do a um let's do print.

title: HackTheBox - Code


text: Let's make sure my syntax is right. We'll do class base then sub I got to do the dunders sub classes. And if we run this, uh, we get invalid syntax because we screwed something up. Uh, I'm using Python 2 syntax that hasn't happened in a while. There we go. So, this is going to list every class that is currently loaded.

title: HackTheBox - Code


text: And if we guess where this class is, we can actually reference it and use it, right? Um, so the key step here now is finding where um, a dangerous one exists. So I'm going to change this print statement up and do like for C in I'm using C because C can stand for classes, right? And I can do print C dot and then this should have like a name attribute. And if we run it, we get a list of everything, right? And some have case like a capital letter. So what I also want to do is change this to lower just to make it easier for me to find. And there we go. Everything has been changed to lowercase. So now what we want to do is um find out where these are all loaded because this is just a giant um I want to say list but you it's like a an array right so I'm going to set I is equal to zero and then we'll do I plus equals 1 and we'll do print um the

title: HackTheBox - Code


text: string of i then plus a space and this right so what this is going to enable me to do is say hey type is loaded at one weak ref is loaded at type is loaded at zero weak ref is loaded at one uh weak callable proxy is two so what I want to do is find a um library that's loaded that I can get command execution from. So we're just going to change this to be uh let's see uh we'll put an if statement here. So we can do if C name do lower is equal to um let's do OS, right? We're going to see if OS or uh system we'll look for the system command. We print we run uh oh we have um the keywords not allowed but we can now break this string up. So we can do like sy then st then em. So when Python combines this all um it becomes system and we don't have anything. Let's try like p open that's another common way to get code execution right. So if we

title: HackTheBox - Code


text: change this we do run and we see pop is loaded at 317.

title: HackTheBox - Code


text: So what we can do with this information is um let's comment everything out real quick because I can leave this here so you can read it if you want. But I can now run pop commands. So I'm going to copy this and then we're going to say at 317. And now I'm just in pop, right? So P open you give it a list. The first thing is going to be um the binary and then you can do comma and parameters. Right? That's how you run P open. So if I run this, we click run. I'm not getting any output. Um, I'm just going to do a ping then dash is it dash c or dash n. I always get this mixed up. I think it's dash c on Linux. I just want to make sure I only ping once because if I let this open and we ran it, um, it's just going to do like an indefinite ping and I never want that, right? So, I'm doing - c. We'll do one and we can say 10 1048.

title: HackTheBox - Code


text: So, we're just going to test if we have code execution here. So I'm going to do pseudo TCP dump- I ton0 ICMP. And then when I click run here, we can see the server does indeed ping us, right? So we could easily now go for an rce. So I'm going to listen on 9001 and then I'm going to create a um like web cradle like not web cradle um a B 64 thing of just to get code execution, right? So the standard oneliner shell 148 9,000 1 zero and one like that.

title: HackTheBox - Code


text: We'll base 64 it. And then I always like um making sure there's no like special characters in B 64 because why not? Every now and then those special characters will um screw you over. I just put two spaces here. I kind of eyeballed where that plus was and that got rid of the plus. It also got rid of the equals here. So now I just have an alpha numeric payload which is very easy to use. So we can say um actually before we do this uh let's make it easier for us to run commands right. So I'm going to change the ping to be a bash then we'll do c and then we'll put our script here. So we can do echo paste this all in b 64-d and run bash. When we click run we get a reverse shell. So, let's get a proper pty. So, we do python- c import pty pt y.spawn bin bash. I forgot the single quote. Um, Python 3- C. Let's put this in.

title: HackTheBox - Code


text: That error message was because I did Python, not Python 3, and my whole terminal died. That was odd. Um, going to exit this real quick. There we go. Let's listen again. nclvmpp 90001.

title: HackTheBox - Code


text: Let's run this. Send this. Then sty raw minus echo foreground. Enter. Enter. And then export term is equal to xterm. And now let us clear the screen. I'm not sure if after like a minute this um shell would die or not. So, um, I kind of want to know if it does. So, let's go and over complicate this payload real quick.

title: HackTheBox - Code


text: So, um, we have a oneliner here, but we already knew what this 317 was. If we look at kind of how they're doing it, they're like going over complicated with a um, list comprehension. So, let's use that. So, we don't if we didn't know um P open was at 317. How can we do that, right? Well, for starters, if we had this um we don't not need that. We could just say if CNAME lower, then we can say um actually we do need the I uh no, we don't. Then we could just do like um C and commands, right? So we want to convert this essentially into one line. So to do that, I'm going to say x4x in and I'm going to copy this. And then what we're going to say is um if x name lower is equal to then p plus op + en.

title: HackTheBox - Code


text: Okay. Um, I'm screwing something up because I forgot a parenthesy there. So, what this is going to do is essentially um, let's put it down here. This terminal is still working. So, I think after stabiliz stabilizing my shell, it became more stable. So, what this command is going to do is return a list of all the subasses that are loaded that have the name P open. So, I'm just going to now do a zero because I just want to get the very first item. And then we can do a command. So, I'm just going to copy and paste that reverse shell command.

title: HackTheBox - Code


text: Right. There we go. Paste that there. And let's delete everything and hope we did it correctly. So, let's do NC LVMP 90001.

title: HackTheBox - Code


text: Run this. not erroring and we get a shell. So, um hopefully now like all those complex payloads that you just copy and paste and blindly run make somewhat sense, right? Um this is just list comprehension to get a if then comparison on one line. And um yeah, so I don't know what else to say there. So let's just go uh back to the box where we have the shell. So, whenever I land on um a web server, I like to extract any credentials. And I know we kind of skipped over like the ability to save, register, login because running commands just look so interesting, but it's got a register and login. So, it's got to have users, right? So, let's look at app.py.

title: HackTheBox - Code


text: And then let's see where the database is. Um if we go all the way up, we see um it's looking at databases. DB. So, I'm just going to do a find-ash type F.

title: HackTheBox - Code


text: If we do this, is there too many files? There's not. Awesome. Um, we have databases. DB right here in instance.

title: HackTheBox - Code


text: So, if we do cd instance, we have database.db. So, I'm just going to do SQLite database.db. We do a dump. And we see there's two um MD5 hashes for development and Martin.

title: HackTheBox - Code


text: So, I'm just going to, and I'm saying MD5 because I can just eyeball this.

title: HackTheBox - Code


text: This is going to be 32 characters, right? Um, echo-N WC- C. Yep. 32. Whenever you see like a 32 character string, probably MD5 some because it's that common. Um, we can do crackstation.net. And then I'm just going to input these MD5s.

title: HackTheBox - Code


text: We could send it over to like hashcat and try to crack it. But whenever I get MD5s that are like unsalted, um my first instinct is always just to use hashcat, right? And the first hash is development. The second half is nafil swordmaster. And that's going to be Martin. And if I cat etsy pass wd and I'm going to grap for everything that ends in sh because those going to be the shells. We see there's a user called Martin. So, I'm going to just try sshing as Martin at um 1010 11162, I think the IP was.

title: HackTheBox - Code


text: Yes, it is. Put the password in. And we get logged in. We do our ls. We can see um user.ext isn't there. I bet it's in app production. Uh yes, it was in app production. But looking at Martin, there is a backups directory. If I look at backups, uh, we can see Martin owns this. And there's also a task.json.

title: HackTheBox - Code


text: So if I cat task.json, um, the destination is home and backups.

title: HackTheBox - Code


text: And it's backing up the production app. We could go look at this backup. But I'm also just going to run a pseudo. And we see I can run this script back.sh. Right? If I didn't have anything in pseudo, I'd probably look at like set UID binaries. If nothing there, then I'd probably go examine this backup because there may be a different password in there and then try to um crack that password. Maybe that's going to be root or something like that. But we have this backup script. So, let's go ahead and take a look at it. So, I'm going to open up in Vim and we see the usage. Um, it wants us to give it task.json. So, the very first argument is a JSON file. If it's not, then it's going to say not found. Um, allowed paths is going to be slashvverhome.

title: HackTheBox - Code


text: And then it's running this jq. And I don't know exactly what this is doing.

title: HackTheBox - Code


text: Um, I'm going to copy this to my clipboard. Um, but we're going to do a jq on this parameter directories to archive. Then we're going to do a map g sub. I'm guessing this is going to be dot dot slash. And these escapes are serving at or these backslashes are serving as escapes. So, we're just um replacing dot dot slash probably with nothing is my guess. And then we're going to um echo the updated JSON to the JSON file and looks like we're going to then start backing it up, right? So, if allowed path for directory and then um runs it. So, let's now figure out exactly what that jq command is doing.

title: HackTheBox - Code


text: So, I'm going to copy the task.json JSON over to devshm and I can go in there and then I'm going to paste this. I'm going to do uh task.json. There we go. And we see pretty much exactly what that file is.

title: HackTheBox - Code


text: So I'm going to go v.json. And then the attribute it is looking at is directories to archive. And then the allowed path is in home or opt. I think it was. So I'm just going to do home. I think there was a comma there. Um maybe it was this. No, forget exactly what it was. Uh just a quote. Okay.

title: HackTheBox - Code


text: So do the quote. I'm going to put dot dot slash. And let's see what happens to this. So um we're going to rerun that jq command. and it erased that dot dot slash. We do multiple dot dot slashes.

title: HackTheBox - Code


text: Let's see what happens. So, we do two, run the thing again, and erased it again. So, now I'm curious if that um map g subcomand we're running is going to be recursive. And what that means is after it does the replace, does it check it again? Maybe it's iterative, not recursive. I may be messing up terminology. So, what I'm going to do is um a dot then dot dot slash. You could also do like um four dots and then two slashes. There's a lot of ways you can go about this. But this what this is going to do is when it removes the dot dot slash, it's left with one here. So, by removing it, it creates the dot dot slash. And if it doesn't check the string again, then we now have a bypass to that um path sanitization. Right? So running it again, there we go. We see now we're at home do slash. So uh we have successfully bypassed that

title: HackTheBox - Code


text: detection. So, what I want to do is backup root and the destination I'm just going to put this to um dev shm right dev shm and then might as well set verbose log to true um because whenever I'm like playing with things I want verbosity so if it fails um I know why, right? And it's excluding anything that begins with a period. I'm going to get rid of the exclusions because I want to back up everything. So let's see what happens here. So I'm going to do um pseudo-l so we can get the command again. And then I'm going to specify the task.json that we just wrote. And let's see um backy working with JSON archiving this uh failure to previous errors.

title: HackTheBox - Code


text: Not exactly sure what happened there. Um, permission denied on line 19.

title: HackTheBox - Code


text: Let's look at this. Uh, that's not it. The We screwed up something. User bin backy.sh 19 updated JS.

title: HackTheBox - Code


text: That's weird. It failed at writing that back. Um, chod. Let's just give 777 so anyone can write or execute this file. Run this pseudo again. Still getting permission denied.

title: HackTheBox - Code


text: Uh, dev shm task.json.

title: HackTheBox - Code


text: Not sure exactly where that um error is coming from, but it is reading the file.

title: HackTheBox - Code


text: So I think the error is maybe the SHM needs a slash, right? It's just two dev shm. Maybe it's treating that as a file. Um, so let's try this real quick. Um, I actually had that there. Uh, let's try this.

title: HackTheBox - Code


text: I cannot stat file.

title: HackTheBox - Code


text: Let's see.

title: HackTheBox - Code


text: Is my destination wrong?

title: HackTheBox - Code


text: Let's see if I do So dot dot slash is Oh, I have an extra slash here. I put the dot dot slash in the wrong location. So I think that's it. Oh, no I didn't.

title: HackTheBox - Code


text: That's right. We have three dots. So it removes these three and left with dot dot.

title: HackTheBox - Code


text: See directories to archive.

title: HackTheBox - Code


text: It's definitely not archive anything.

title: HackTheBox - Code


text: I just really don't like that line 19 error. Um I don't know exactly what is going on there. Let's look at the code again. 19.

title: HackTheBox - Code


text: So it's erroring when we try to overwrite this JSON file and updated JSONs. the results of this and JSON file is the first argument, right? Um, do we have to be in the allowed paths? Let's see. Is allow path? Um, it's setting local path to be the first argument there. And it's doing a directory and directories to archive. So, I don't think that's it. Let's just try um let's see rename this to t.json I guess. And let's try running it again. This I'm guessing is going to error.

title: HackTheBox - Code


text: There's no way the file name changes anything. Okay, still nothing. Let's copy t.json.

title: HackTheBox - Code


text: Is it operating out of like backups or something?

title: HackTheBox - Code


text: Let's rerun this. Did this suddenly just fix it.

title: HackTheBox - Code


text: Yeah, I am not sure what's going on there.

title: HackTheBox - Code


text: Uh maybe devsh is like a bad directory to run this from. That's my only guess.

title: HackTheBox - Code


text: Um uh let's do ver attemp. Let's see. Can we copy backups t.json here? What if we run it out of our attempt?

title: HackTheBox - Code


text: Uh, permission denied. So, it really definitely likes being in my home. Uh, I wish I could explain it right now, but I can't. Um, it wants to be in home backups. That is bizarre, but okay. So, we ran it. It should have copied to devsh. And we do have a backup here. So let's do tar xjvf code home. And then we're extracting all the files. And we see root.ext. There is a Python history. Uh but there is SSH um ID RSA and authorized keys. So let's go in root SSH. There's an authorized keys and ID RSA.

title: HackTheBox - Code


text: So I'm going to chod 600 on ID RSA. Let's make sure we own that file. We do.

title: HackTheBox - Code


text: So I can just do SH- ID RSA and then root at127001 log in and there we go. We have now rooted the box. We could also easily just copy that IDA file to our box and then SSH in as root that way. But that is going to be the box. Actually I lied after recording the video. There's one thing that was just eating me up and that is what kept failing on line 19 in the backycript when trying to run it out of the dev shm or vamp directory and it took me a little while to figure this out with the help of oxdf we just kept troubleshooting a lot of things and the answer turned out to be sticky bits before we just show the answer I want to talk about some of the things we did to kind of troubleshoot it right if we look at the script I think it was in user bin uh yeah this is it uh we spent a lot of time just editing around line 19 like putting the current working directory putting the full path exactly what it

title: HackTheBox - Code


text: was doing here. Essentially all that happens is it uses the jq to remove one dot dot slash and then overwrites the JSON file, right? And we just kept being puzzled about like is it like changing a directory somehow? Like why can we not overwrite this file when it's in dev shm? And if you look at like the mount permissions of it, like if we do mount gp shm, it's easy to think maybe this no sue it a node dev is doing something.

title: HackTheBox - Code


text: But then that doesn't make sense because it also didn't work in temp or var, right? And if we gpped on these directories, those the var directory doesn't have any special uh permissions.

title: HackTheBox - Code


text: So it still didn't fully make sense, right? And if we run it, we see uh we get that permission denied. I also like let's try chmod 7777 on task.json and then run it again and it still gets permission denied. So why is something getting permission denied when it's world writable right? That doesn't make sense at all to me. And the next thing we did was run an s trace. And to do srace we had to be the root user first because something with pseudo um kind of breaks s trace right. So, let's go ahead and copy this and then we're just going to run it as root and see exactly what happens. So, we'll do S trace and then paste this in. And then we want to look at where the exit is. Um, I'm just going to search up for task.json and see if we see there it is. We have permission denied. And then looking back, I really don't see anything. Here

title: HackTheBox - Code


text: we go. were reading the updated JSON and then it's doing things and then we just get permission denied. So that didn't really help me. So I went to look at the audit log which is going to be audit d and we have laurel installed on our Linux machines. That makes this really easy, right? So if I g for task.json out of uh what is it? Audit.log, we can see this. And what I'm going to do is look for when success is equal to no. Right? So I'm going to grab that. And then we can also grab success. And I'm going to replace yes with no. And here we go. We see there is indeed um a time when it doesn't succeed. And we're going to go up and see what the SIS call is. Right. So there's the exit code -13 and it's sys call 257. So I'm going to search sys call table and then we're going to look at what sys call 257 is and I think this is fine the

title: HackTheBox - Code


text: chromium os doc maybe. Let's see. Uh there we go. 257.

title: HackTheBox - Code


text: This is going to be open at. So open at is failing. And that gave us enough to just Google around and go to like chat GPT and eventually get the answer. But it's sticky bits. So um when it's set to one, don't allow Ocreate open on regular files that we don't own in world writable sticky directories unless they are owned by the owner directory. So when sticky bits is set and that's going to be a one. So we can do statdev shm.

title: HackTheBox - Code


text: So if it's world writable and this bit is set and we don't um the owner of the directory doesn't match the owner of the file then it's going to be denied no matter what. Um so if I go to devshm and we just try writing to this. So we can see uh it's worldw writable echo please subscribe over top of task.json. Let's just do that. Failed. If we tried to append to it, failed. And that's because the devshm directory is owned by root. It has a sticky bit set. And then task.json is owned by Martin. I don't know exactly why this is the case. My guess is like the temp directory is used for special files. Like you never want things just overwriting your curb roast tickets and things like that. So maybe it's just like to prevent accidental clobbering of things like that, right? So let's just go ahead and test this out one step further. So, I'm just going to

title: HackTheBox - Code


text: go slash I'm going to make a directory called um sub uh yeah, that's uh let's make a directory called please subscribe. There we go. So, we have that directory and what I want to do is ch own Martin martin on this directory and then I'm going to go into the directory. So we'll do slash please subsubscribe and I'm gonna touch ipsack. We're going to do cd please subsubscribe. We'll do echo test to IPSAC. And that works just as we expected because we didn't set the sticky bit yet on this directory. So let's go ahead and do that. I'm going to do chmod 1755 on dev. Please subscribe. Uh oh, not dev. It's just slash please subsubscribe. Uh there we go. And it's still going to work, right?

title: HackTheBox - Code


text: Because the directory owner does match. And we also didn't make it worldw writable. So if we do 177 like this, it's somehow going to work. Um if we look at the permission of the file, everything's there. So now watch what happens when we're going to change please subscribe to be root owned.

title: HackTheBox - Code


text: Now you would think changing the owner to who is going to be writing to this file um would um not change it being able to write. So I'm going to do that. And now I'm going to attempt to write. And we get permission denied. And it doesn't have to be the root user. Um we could change it to any user. Um I want to say like app production also exists on this box.

title: HackTheBox - Code


text: So if I do uh let's do ch own app at production app production and now we try to write it fails and that's because the directory owner and the file owner don't match right and also if um it's not world writable. So let's go back to this actually we should do it down here. So, chmod1755 um on slash please subscribe. So, now it is no longer world writable, right? Um maybe it is. Uh no, it isn't right. Uh let's check.

title: HackTheBox - Code


text: Uh no, we remove the right permission. So, let's now go ahead and attempt to write. And we can. So, it's one of those weird situations where um you don't have the right permission and it works because you root and then you add the right permission and it no longer works because it's a really um specific edge case of where the sticky bit permission comes in to protect against directories. And I can't remember the box off the top of my head, but we also dealt with the protected sim links once. um because when it's in a sticky bit directory, sometimes sim links will not be followed because it becomes a protected sim link. But yeah, that is going to be the uh beyond route of this box. Just looking into uh the sticky bit on directories and why that whole um script did not work. So hopefully enjoy that. Take care and sorry for the sloppy cut. Um but

title: HackTheBox - Code


text: apparently I lied again and there's one more thing I wanted to include. OXDF had found this after I recorded the video and I thought it'd be interesting enough to include it because it's a default behavior in bash scripts and the fact that when they encounter an error, they're not just um producing a stack trace and exiting the script. They normally attempt to continue. So, let's go ahead and demonstrate that. I'm going to copy a uh default task.json JSON back over to dev shm and then we're going to edit this and we'll put the destination as um what is it slash uh devshm going to be where we want to back up to and we have to do a comma there we go and the directory to archive we're just going to do um home dot right and we didn't try this at first because when we looked at the backup script we saw the um script was removing any dot dot slashes. So I

title: HackTheBox - Code


text: just assumed it would change this path to be home root which isn't a path so it would exit but it actually removes the dot dot slash and then attempts to write this file back to the disk. And since that fails it never actually removes the dot dot slash which is I find is very interesting. Um let's also set verbose to true. So let's demonstrate this real quick. So, I'm going to do a pseudo user bin backy.sh over top of task.json. And we see it magically works, right?

title: HackTheBox - Code


text: The first thing we have is line 19, the permission denied. But then it goes ahead and archives this. So, let's take a look at exactly what um backy is or user bin, the backy uh script. And here we're just making sure we have an argument. Then the next set we're making sure that argument is a file. And then we have allowed paths. And what allowed paths is doing is just making sure slashvar or slhome is within the allowed path. Right? It's not going to check if dot is in the allowed path and then return one if it's not. It just wants to make sure slashvver and/home exist within directories to archive. So here it's going to run jq on the file we specify remove dot dot slash from it and then save that to a variable and then here is where we write that uh variable back to the file and at the very bottom

title: HackTheBox - Code


text: of the script it's going to call the backy binary which is just a binary that's on GitHub against that JSON file.

title: HackTheBox - Code


text: So because it's actually um erroring here, it never writes it to the disk.

title: HackTheBox - Code


text: And because the allowed path isn't checking for directory traversal, we still hit this and it works, right?

title: HackTheBox - Code


text: There are two ways you could have patched this, right? Or we could have, I should say. Um after you run the command, you could do like a if statement. So if you do if um I think this would be the last exit code. So we say the exit code is not equal to zero.

title: HackTheBox - Code


text: Then um we'll exit and fee. I think that's right. Um it's been a while since I did bash scripts. I probably should do like a exit one I think. So now if we attempt to run this again, we'll have to remove that turb 2 file. But here hopefully it just stops, right? Because the exit is um one. Um, if I do echo like this, there we go. If you did echo test, we have exit a zero. If I try to write something over top of this file, so we'll do please subscribe over task.json. Oh, we have to do this as root because of course Martin can um write that. So the last command has been zero. Do this. And now the exit is one. Um, the other thing we could have done to fix this, so let's go back into the backup script. Um, if we remove this if then statement, you could also at the top of the script say set-ash e, and I forget what e stands for, but this is going to mean anytime

title: HackTheBox - Code


text: the bash runs a program and it comes back with a nonzero, it's going to exit, right? So now, let's go ahead and run this. And again, we have that same behavior. So either one of those two things needed to happen in order for that vulnerability um to not exist. So maybe that's something if you're ever running bashcripts you want to make sure you do is always put that set- e because if you don't um a lot of unintended things can happen just because bash is going to continue um whenever it comes across an error and that's not a intuitive thing to think about. So with that being said, this time um I'm going to conclude the video. Hopefully I don't have to make another edit.

title: HackTheBox - Code