what's going on YouTube this is IPC I'm doing Bookworm from hack the box which starts off with a insane cross state scripting payload but don't let that like scare you away from this video I think by the end of um that portion you'll appreciate JavaScript a lot more and learn a lot of things because when I did cross a scripting in the past I always used XML HTTP request in a quote unquote incorrect way because it made sense to me in this one I had trouble using that just because my code was a mess so I tried to use fetch my code became a mess so I tried to use fetch with await statements in async and I couldn't keep track of my variable names so I started creating helpful functions and by the end of the day like I became pretty good at doing this type of exploitation and I think you will be too

HackTheBox - Bookworm


if you watch it after that the Box does get a little bit easier the next step is abusing a Sim link to exploit something but really let's just get into it because this is going to be a fun one as always we're going to start off with an end map so- SC for default scripts SV enumerate versions OA output all formats in the nmap directory and call it Bookworm then the IP address of 1010 111215 this can take some time to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and its Banner tells us it's in auntu server we also have HTTP on Port 80 its Banner tells us its engine X also running on Ubuntu and also redirecting everything to Bookworm htb so let's go ahead and add this to our host file so V ety host and then we can add 10 10 11

HackTheBox - Bookworm


to 15 Bookworm htb and check out the page so let's go HTTP Bookworm htb uh we probably want to turn burp Su intercept off uh let's go over here proxy intercept there we go and it looks like we have a online bookstore so I'm going to check check out the shop and looking at this it looks like there are a bunch of books we can try to view a book and if we add it to our basket which I guess is the same as a cart uh it wants us to log in and at this point I'm going to turn intercept back on and I just want to um intercept the response to something so I'm going to try admin first so we'll do admin admin but the main thing I'm looking for is the headers so we can see X by Express so we know this is nodejs let's just for this request and it just says invalid username or a password so let's go ahead and add an

HackTheBox - Bookworm


account and since this is Express I would probably try for like no SQL injection as well on the login form just because the mean stack is so common um I want to say mean stands for um Express angular and node but I could be wrong there um so let's just put a bunch of junk I'm doing um username and name as IPC password as password and then 1 two three in every other field so it let us create the account we can log in with IPC and password and now we're going to be able to test our cart and we can also see this recent update thing it does work we can see Joe bubbler added the yawning party to their basket so if we add this we can see we also added something to the basket so since we have a thing right here I definitely want to check for like cross- site scripting so I'm going to do a u so this is going to underline my name if it exists right I

HackTheBox - Bookworm


was going to do bold but it looked like my name was already bolded in that so there we go I put a uipsc and we see the um actual HTML so this is not going to be any cross- site script if we attempt to view the book uh let's add it to the basket go over to a basket and see what else there is there is a note here saying as a result we're no longer offering free ebook downloads of purchased books don't fret all previous orders that were made during a moving period will still be downloadable we hope you enjoy the new 4our guarantee so what this tells me is we have have users we know there's some type of simulation going because we see a user adding stuff to the basket we also see there is a download functionality however it's only on Old orders so this is telling me somehow we have to get to a existing users profile examine the previous orders and see if

HackTheBox - Bookworm


we can find out how to download ebooks because when there's a file download maybe there's a file disclosure vulnerability that is just a super good guess at this point right so let's try editing a note of this so the note um let's intercept and we add this let's just do test so it just gets added there and if I looked at that I should have tooken a more second we can see it adds to basket the basket ID which is 359 in this case I'm guessing this is just an incremental number and then edit and it adds quantity and then the note so now if I click this again we have the note here so let's try doing some JavaScript here so we'll do script um alert one SL script and then we can update the note I think my burp site okay it is no longer on intercept so we now have JavaScript it doesn't look like it's loading on

HackTheBox - Bookworm


this page even if I refresh um let's press f2 or was it F12 and it did not load but there is a warning here it says this page of settings or blocked the loading of a resource in line script source so it means we can't load any JavaScript off the existing page we see it again it's blocked so I think that means our JavaScript did run however well it did exist but because it content security policy was blocking it on itself it did not run if I go to The Source Let's see we can see it is here and there is no like HTML ndn coding around the special characters so this definitely is somewhat vulnerable we just can't execute it on itself so what that means is we have to find a way to create like xss somewhere else we could probably try it on our own box let's see uh let's look at it we have content security policy here let's let's try that so I'm going to do nvn p 8000 and let's just

HackTheBox - Bookworm


see if we can make it called back to us so I'm going to redo this whole process of adding a book to a basket then we're going to do a new cross-site scripting payload so we can edit note we can say script source is equal to http 10 1048 Port 8,000 uh it I guess we'll do pone doesn't really matter what the file name is and then we can do SL script update the Note complete the checkout and let's see it does not look like it loaded off a um different website it says loading failed script with Source http 101048 slone so I'm not sure exactly what is stopping this it's probably some type of browser type security so we can't load it off an external resource let's just keep poking at the website so I'm going to go to uh let's shop see if there's anything else we can edit does not look like it we can click

HackTheBox - Bookworm


his book and it just brings us to the book we do have a avatar so let's try updating our Avatar and see if we can put a file there so I'm going to locate every file that be ends in JPEG and then we're just going to copy a random one here actually we probably don't need to do that um let's just touch or Echo please subscribe to T t. jpeg whoops T test.

HackTheBox - Bookworm


jpeg so let's browse htb then we want Bookworm test go over to browser I am going to intercept this request so we can see the MIM type is image JPEG so it is uploading has it I'm going to try just uploading this it's redirected us which I think is good um let's see let's turn intercept off and then we got to figure out how to load a profile we have a broken link where the profile was so if I open image a new tab it goes to download so let's just curl this and and we can see we can write a file the whole reason I'm not trying to um use like a PHP webshell is because this is an Express website right it's very hard to just get code execution there if this was in um debug mode it would be potential to be like overwrite a JS file and get it to reload so we can also test for directory traversal so let's see if we uploaded something to image we did not so I don't

HackTheBox - Bookworm


think it is vulnerable to directory traversal the other reason I'm not trying that that much is because we don't have control over the file name we uploaded test. JPEG and it uploaded as 14 so either that's our user ID or maybe that's just the 14th Avatar that could be an incremental number so that's why I'm not trying a bunch of just directory traversal type of attacks because again we also don't control the file name but we could insert JavaScript here so we can do script we don't want to do that we just want to do alert one okay so now when I go here we have alert one so what I want to do is edit my basket to have that JavaScript to load that so let's go back to the shop go to view book we have a different user there go to add basket add this and then what I want to do is say script source is equal to and I'm going

HackTheBox - Bookworm


to grab the SL static up image uploads 14 and then we can end the script update the Note oh I clicked edit again didn't I update it and then when I click complete checkout we have a JavaScript or alert box so we know this is going to be cross-site scriptable the thing we have to figure out is there an idore vulnerability in the basket itself because this doesn't really do us any good if we can't poison other people's items so the easiest way to test this is just to create another account and have another browser so I'm going to go back to book one. htb on a different browser we can log in we're going to create a new user I'm just going to say this is the victim same password of password and junk everywhere else so we can do victim password then I want to uh let's see I'm going to go to view

HackTheBox - Bookworm


book we can add it to the basket if I go to shop here we can see the victim added it but the issue right now is we don't have the basket ID we could try adding one to ourself and then we'd see like when we edit it and just know we go up one but I'm going to look in the source to see if there is any indication maybe like the link is added but we do have a comment here so 369 um this probably means basket ID 369 because we have 367 down here I'm guessing I was 368 I don't know what 368 is but I'm guessing that was me and then I checked out and it dis appeared from this list that's the best I can guess right now so we have 369 so let's go add something to our basket it'll probably be basket 370 right and we want to edit the note go over to burp intercept and then we're going to do the same thing script source is equal to our JavaScript

HackTheBox - Bookworm


payload we are in intercepting so click Update note we're going to send this to repeater and what basket ID was it uh I think we said 369 because this is 370 so let's just try 36 whoops okay num lock was not on I started hitting 369 and it did not do what I expected to so I'm going to edit this and we can um drop this packet I guess so if I go to my basket here click edit note we do have the JavaScript if I go to um whoops cannot get if we go here we have it as well I thought I dropped this request but I guess maybe I did not oh okay I just had to do a control shifter to refresh it so we don't have the basket here because we never sent it to 37 so there is an idor vulnerability so if we completed this checkout we have the JavaScript so we have a way to now infect other users baskets the issue is

HackTheBox - Bookworm


we're going to have to build a pretty complex cross-site scripting payload to do this because we want to um hit probably the profile page then look at the order history and then grab all these links and click through them because we want to get each of these Pages the reason why we want to get each of these pages is we want to see if there's a download link on any of them because that would give us a new endpoint to hit on this web application so I'm trying to think what we want to do do we want to start with cross-age scripting or start with uh python application to poison uh baskets I think a python application would be the best place to start right now so I'm going to do touch um we'll call it basket poison. py I guess and we're going to um want to have a script that essentially will crawl or hit this shop URL and it will look for any new basket

HackTheBox - Bookworm


it finds and it knows the basket ID because there is a comment uh there we go we have 371 so we want to look for this text and when we have a new number then we know we can poison this um basket so let's start this python script so let's go to visual studio go to basket poison and the first thing we're going to want to do is import request because of course we have to make a python request and I'm going to do something a little bit odd because um in Python I don't really know how to pass point ERS and like there's a bu of just magic go on with variables to me um I want to explain it Qui and hopefully this makes sense so what I want to do is have a python session so we can say session is equal to request. session and I want to do this so I can log in so we can say um session dot was it probably

HackTheBox - Bookworm


post and let's just pretend this is a login it's not going to work because uh maybe that would no Local Host 5,000 definitely not we'd have to put like uh Bookworm htb I'm guessing the endpoint is that and probably username of IPC and password of password I'm guessing that works so then I'd want to create different functions to do things so I'd want to do like uh Define get uh latest bucket and have like pass in the session but I don't like returning session every time right if I was in um C or goang or probably a lot of other languages I would pass in the session as a pointer and then when we call the function we do it so we just pass the pointer in so it updates we don't have to worry about a return um so whenever I want to do something like that where I just want to update a variable without returning the variable exactly I always use classes in Python um maybe my whole

HackTheBox - Bookworm


explanation just confused you more um let's not call this exploit let's call this um basket poisoner so we can create variables on this object so we're going to say self um we can give it a base URL and then we set it up like that so now we can just create this um object so I'm trying to think of what I want to call this um I know this is probably a bad name I'm going to call it sess for session but it probably shouldn't be that and I'm going to put the URL up here so we have it as a variable just say this okay and then we want to create a function here let's call it login self username password and that looks good okay so we can say ss.

HackTheBox - Bookworm


login ipac password uh there we go and now if I do cess dot uh session git URL plus shop and we can say R is equal to this then print r. text so let's just see if this works um yeah that should be fine so I'm going to do Python 3 and we called it basket poisoner we have this I want to make sure IPC is on this page uh let's just search up for IPC okay so SL profile is pointing us to ipac so we know we logged in so we have a working um thing instead of sash I'll call this BP or we'll call it yeah we'll do BP for basket poisoner that s stop session is confusing me so there we go um now what we want to do is be able to get the latest bucket so I'm going to call another function we can say get latest bucket and we're going to Loop this because there's a chance when we hit the page there are no um request in the shop

HackTheBox - Bookworm


right so when we don't have that I'm just going to have it sleep and retry so we'll say session get that looks fine and we don't want to go in the cookies that is co-pilot doing things we don't want to we're going to use a regular expression so I'm going to call I keep saying bucket it's basket right there we go so we can say basket is equal to regular expression find all and we want to import our e okay and we want to create a regular expression to find this so that was a common so we'll do this and then we want to grab all digits so we can do that like this we'll put this in a parentheses and I think think that should be fine oh we have to say r. text the actual HTML and then we can say if the length of basket is greater than zero we can return basket Z so return the first match and otherwise we can

HackTheBox - Bookworm


say basket not found sleeping 5 seconds and we can do time. sleep and then we also have to say import time okay so let's say basket is equal to this and then print basket so if I run the script now let's see what happens we get 377 that is awesome so we all already have it grabbing the um latest basket if I just refresh this page if we'll probably have 377 right at the top so it looks like this is working the next thing we have to do is Poison the basket so I'm going to do um it's almost like it heard me so I'm going to call poison basket and let's see the code it's giving me is not good here so we want to say um the URL is going to be the base URL and then what was it it was like edit right so let's go back to burp Suite intercept we have basket 369 edit so I'll just make this a F string and we can say basket basket

HackTheBox - Bookworm


ID edit there we go the data we want to poison with is going to be this so we can copy this and let's see we'll just paste you can say Quantity one note I'll do this in a single quote because we already have a double quote in our xss payload right so we have the URL and data that looks good and let's see that should be fine so what we have to do here is identify if we have a um new basket so I'm going to do another infinite Loop so we'll do while true and then we're going to say new basket is equal to this and then we'll say if new basket does not equal basket then we found a new basket we will want to poison it and oh I already hardcoded the payload that would be fine so we will poison it and then set new basket equal to or set basket equal to new basket and it'll go back through this Loop so if it attempts to run again and

HackTheBox - Bookworm


it's um not a new basket then we won't poison it because we won't hit this okay uh we probably want to say poison basket and then we can say which basket we poisoned that should be fine I'm just going to do new basket so we stay good or maybe we should put that in here we probably should do some type of like try catch statement around um this so like to do try catch to verify it's poisoned um but I'm not going to do any of that type of error handling in the script so let's see what else do we have we did this so I guess the next thing we just want to do is sleep so we'll do time sleep for 2 seconds so let's see what happens when we run this so when we run it we don't have anything it's sleeping how long do we sleep 5 seconds so I'm guessing it did not have anything I bet if we refresh this page look for this payload we have 380 so I guess if we added a another

HackTheBox - Bookworm


thing to this when it gets to 381 that's when we see output right so I'm just going to do it myself we view book uh book add to basket we go here go back to our payload and we have a error U missing schema invalid URL uh let's check this out which line is this it's probably the poisoner right uh let's see line 40 poison basket poison URL oh we need to do um self. Bas URL there we go rerun this and let's see let's add something else to a basket you book oh that's going to be the same thing because we already have that in our basket we'll do the little mixer this time add to basket okay we go here we poison basket through 383 I'm going to guess that is this if we edit the note here we already have the payload so if I completed the checkout we have the um cross a scripting thing so now we have to build

HackTheBox - Bookworm


the um xss payload because we have the poisoner working so I'm going to create a new file we'll call this payload JS and this part is not going to be fun but at least it's going to be epic and we're going to spend a little bit more time showing like a payload evolve instead of just going straight away to do it the way I think is elegant and it should be mentioned I think this box was blooded in like an hour this piece of the Box took me probably the better part of a day and I'm saying like six to seven hours mainly because I hate JavaScript but I started learning a lot about JavaScript doing this box um we want to use the Fetch and this is going to download a page and we're going to do it a somewhat bad way but the way I see most guides doing it online so we want to fetch profile and then we'll say the mode is going to be we want to disable

HackTheBox - Bookworm


cores we want to um whoops include credentials so if we do include credentials it's going to um include or session cookie with this request um the actual like um cookie is um HTTP only so we can't steal the cookie so we have to like use JavaScript to control their browser so we'll do cach is equal to no store and we want to close that so if we do this we have to create all these nasty um then and because it's like async in this fetch module we have to like grab the text like this and then we do another then we can um grab the response text and then we can um do something else so what we want to do is I'll just print it now we'll do console log um response text and we'll get to make several requests so if we did that this payload is just going to get massive uh is it like that there we go let's try this this so if you want to test it the best way is just your um console window

HackTheBox - Bookworm


right developer tools so this does work but again I think this if you imagine we're going to have to probably get three URLs by the end of the day so you can to have so many thens like it's just going to get crazy and unmanageable right so I evolved or I started using async with my fetch so we could do like a const we'll say profile is equal to a weight Fetch and what a weight does when you call something that's async it's going to wait for it to finish that's why we have to use these thens because we don't have it in a wait call so we have to wait for this to finish then we can get response text then we go here then we can do something if we didn't do that then like all the ordering would go out of whack and um it just would not work it's hard to explain other than it won't work or it didn't work for me so we can do that

HackTheBox - Bookworm


then we also have to grab the text for it so we can do await profile. text and then we can just do console log so this also works right so if I do this we can do it and we get the profile this gets a little bit messy because I hate having to do two variables every time I want to pull a page so because of that I used uh a function so we can then um create a async function then get page and we pass it the URL and let's see I'm just going to copy this okay so we can fetch URL I'm going to call this request reest we'll call this response and we can return response so I can just do now um profile we'll just call it profile is equal to um await get page SL profile and we do this and we can copy this entire function over here and body has already let's refresh it we get our JavaScript uh profile is not

HackTheBox - Bookworm


defined oh we have to call cons profile there we go we could probably also use letter something but whoops let's copy and we have to specify the URL uh HTP let's put put that in this we'll say um HTTP Bookworm htb plus URL there we go uh we'll call this page you can replace URL with page there we go I'm just going to go to the shop page so I don't trigger my xss again we send them uh profile is undefined oh it's request redirect oh my God this is going to be more painful than I thought okay um it was just because I did not refresh so I had a variable but now we can get this so what we want to do is grab all the orders on a profile because we want to get those pages so what we can do here is um instead of just logging the profile we can say um const we'll call this I'll just do re for reg X so re orders is equal to um what is it we want to get

HackTheBox - Bookworm


order then a digit plus we want to get all of them and I'm going to put it in in parentheses so now what we want to do is test if it is a on this page in regular expressions in JavaScript is weird or maybe I do it a bad way so we're going to test profile okay and let's see we want to say while and we're going to call this um order IDs is equal to re e orders. exam profile null like that what are you ering on okay it's not so let's just do console.log order IDs and if we do zero it's going to show us the full string if we do one it's going to show us just the order ID so let's prove this real quick B this get page is not defined because I did not copy everything paste this uh did not work let's see what's profile we have that okay paste this oh we have order ID 139 okay so we have order ID 139 we only have one

HackTheBox - Bookworm


I'm going to complete another order so we have multiple orders I want to make sure that's working add to basket complete checkout yeah we have that xss oh we did have multiple order IDs we have 130 131 13 three so we're screwing something up here let's see go here paste this we have it undefined I don't know why it's undefined we waited there we have that we test I think I have an error somewhere okay it's a pulling everything thing so I think things are working it's weird that I have to call this separately which leads me to believe we have some type of async IO bug because I think it's testing the profile before this finishes which doesn't make sense because we did await it so do I have to put a semicolon here I doubt that I didn't do a semicolon there is this the problem do we have to do maybe that's

HackTheBox - Bookworm


it undefined weird um rype profile it definitely exists so we'll continue and debug it if it doesn't work at the end so we have all the order so what we want to do is get the page here so oh we could also show let's see so if we just copy this we have all the order IDs we could say order IDs one and if we do the same while loop it's only going to print the numbers so let's see we can say order URL is equal to um order IDs zero and then let order ID is equal to one console log I just want to make sure the let is working here Order URL order ID okay so that works so now let's download all those pages so we're going to say const order equals await get page slash order and then we want the order ID I believe right is that where it's linking us to if we go to our profile view order order 130 so that's what we want so we have

HackTheBox - Bookworm


this and what we want to do with this is eventually um send it to us so let's do a new function and I'm going to say uh we'll call it P data I guess try and be it's really xfill I guess we'll say XL data or now we'll just do post post data and this will be URL to make it easy on replacing who we send it to if like my IP ever changed so we do this request we have a fetch this is going to us this is going to go to our IP so we don't need to send credentials we will have to change the method to a post and then we want to say the body is going to be the data okay so we do a weight fetch uh I guess we can we don't need the response we can just return I think that'll be fine okay so let's now say await post data HTTP 1010 148 P 8,000 and we're going to give it the order and I'm going to say um order

HackTheBox - Bookworm


ID okay so I think we're going to send data now so if I copy this and we listen on Port 8,000 then we go back to our browser uh F12 we have to copy everything I really don't like that I'm having to do this separate uh a weight is only async generate what line is that we did a wait get page a wait post data is do I not a wait there uncaught syntax eval code 622 we get rid of this 22 it's going at the end of this I honestly don't know how to debug this we have a profile we do we can test the profile with a regular expression true so we go into this Loop um order ID is not defined let's see while n async do we have to return request let's just do what we did here we'll do response and return like that oh wait I'm really curious why because we have asnc function post data I may pause the video and play with

HackTheBox - Bookworm


this because I am getting confused so if we don't do that does this now error is it this code that doesn't look right it is that const order await get page we called get page here nothing hit us if I put this in my Loop we just going to get our profile constantly which is fine because we're redeclaring it let's do order huh doesn't like us using a weight in this Loop let's move this I guess async function um we'll call it poison and we'll move this entire thing into this and then we can call poison we'll uncomment this we'll just paste everything here get page is not defined because I did not copy it prom is pending we did not hit something really odd is going on we only use order ID once so I didn't reuse that this isn't go so just because I declared this and didn't use it that still should be fine I'm going to put these as constants

HackTheBox - Bookworm


I really don't think that's it but maybe it is promise pending so one URL is not coming back but we're not getting a hit here so it's not getting to my post we don't even have that proxy is off but let's turn it on poison I should see something in burp Suite I do we got the profile then we're going to get a order ID get another order ID another order ID and done fulfilled okay so I think it's working when we put in the function I'm stupidly not doing a log and we're not sending the data um so const uh we will say we'll just do await post data we'll try this again 10 10 148 8,000 then plus order ID order spell a weit correctly I can just do contr a intercept is off promise is pending oh pending because we sent it awesome so now it's working um I think moving this to a function somehow helped I'm not positive but we're just going to

HackTheBox - Bookworm


go with that explanation so now we have the post data so we get um a response to us so the next step is we want to download everything so I'm going to create we'll call it server.py and I'm going to do from flask import flask request and we can say app is equal to flask name app route and we're going to create a order then we'll say um ID like that wonder if I does it want me to do it this way we can try this that's probably more secure so it gets defined as a integer right so we can do methods is equal to post like that I'm missing something no I'm not so we can do Def and what we want to do is save this file so I'll do with open F orders then ID dot we'll call it HTML and we'll write it as a file we'll write the request it's not a form we'll just do request. dat.

HackTheBox - Bookworm


dcode and then return okay okay and we can say app. run host is equal to all IPS p is equal to 8,000 okay go into code let's do Python 3 server.py and then I'm going to copy my payload uh it's this one go back to a browser paste we're sending it and we're getting 404s because we just add um the order ID after the URL so what I want to do is edit my payload and say order slash internal server error because we don't have a directory orders run it and we have saved a few request right least I assume we saved let's go CD code orders and then we last 131 HTML we can see this is our order so what we want to do now is update the um our Avatar which is where we're poisoning buckets to to be this payload so let's copy this entire thing go back to burp Suite go to repeater this is our profile Avatar where we just have the alert one I'm

HackTheBox - Bookworm


going to put this entire JavaScript so we're going to send this so now if I went to one of my pages so let's save this I'm going to let's clear the screen let's just go to my profile I'm going to go to an order I'm assuming I poison this order and our browser sent us all this data so what I want to do is just wait probably 5 minutes because we're going to have users that we assume because of the activity feed here or shopping we can see we poisoned two baskets um that's probably these two um if I control U like this uh let's see uploads for so this is that user um if it was us then we'd see was it 14 was that our bucket ID uh profile Avatar I'm pretty sure we were 14 I don't think I have it here but I think we were 14 so we know we poison this guy's bucket so we want to do is wait for him to check out which it'll probably take about 5 minutes um we have

HackTheBox - Bookworm


409 there let's see I think I want to put the time stamp here because I'm going to pause the video and speed up right so I want you to see how long this can take because this is one of the more painful Parts is waiting here so let's see um where do we print I'm going to disable this so I don't it doesn't flood the screen and then let's see get current time now okay let's do we'll make this an F string now poisoned basket new basket there we go rerun this so hopefully it is a bit more verbose when we do times so we'll add this added uh that is not what I want um let's see oh we sent a bunch of orders so maybe I don't have to pause the video Let's just look at the orders we have so I'm going to go to orders or it was code orders uh we can either less it if we less 11. HTML we can see at the very bottom we have two links and this is

HackTheBox - Bookworm


going to be one of the hard Parts there is a uh file disclosure vulnerability but it's when send multiple book IDs it's only in the download everything and I'll go over it in a couple minutes on why this is but instead of just blindly trying this one and failing I figured I'm just going to go quickly and we'll only do um this one so we want to be able to download everything I'm going to put a file in the second book IDs so typically whenever you can download something I always try um putting a file so we're going to try that but first we have to grab this URL so we're going to go back to our payload or before I do that I'm going to um GP book IDs on 11.

HackTheBox - Bookworm


HTML and it looks like if I make a regx that just grabs digit question mark book IDs and then this and it'll only grab the download everything link and then I'm going to fill out the second book IDs with the Etsy passwd um that makes most sense and if you wanted to you could also Firefox 11 HTML and open it up to see kind of what it looks like so let's go back to our payload and what we want to do we can um send the data but after we send the data we want to do a second regular expression so I'm going to do const Reg X or we'll do re and what is it I want um we'll call this download everything is equal to and then we want to what start with a digit so we'll do back SL D plus and then we want to escape a slash uh do we do this in Quotes no um so we escape the Slash then we can do wait we did

HackTheBox - Bookworm


11 but we escape a question mark That's what I want to do we can say book IDs is equal to another digit and then we want to do camper sand like that what did this say this is a bit of heck but it works how did it know that's a good comment for this line that was one of the better things I've seen co-pilot do I'm going to leave that that is fun uh so we want to test if this regular expression works and then if download everything is there we will want to um get the data so we can say download everything is equal to r e download everything exec on the order and we want to grab the first item so the order this is going to be the HTML page um so that is 11. HTML right that's this so we're looking for to download everything so we have that link so we want to download it so we can say const download is equal to await get

HackTheBox - Bookworm


page and then we say download plus download everything plus and if we go back here we start at this and so I'm going to do book IDs is equal and we're going to do a bunch of do do slashes at pass WD I think that is good I'm hoping it is um and I'm going to do one slight thing I'm going to call this get page binary and we're going to create a new function called get page binary which is going to be the same thing except instead of returning text we return blob because we're deal dealing with the file not asky text I want to make sure we treat it the correct way um if you don't I think like your Zip's going to die in the middle or it will have extra data because it encoded something it shouldn't have and just all like hell will break loose so make sure when you download things you use the blob and then we want to post data to 10

HackTheBox - Bookworm


10 14 8 8,000 and then I'll do xville plus order ID download uh we are missing something I did not end a quote probably here there we go and I think that is going to do it I don't know what it's complaining about this semicolon uh we missing a bracket there we go so what I'm going to do is paste this into our payload because again this can take five minutes and if I see a 404 on this I know it works um but let's now go back to server.py and we want to create a route for xfill so we can say app route we'll do X method post we got to change this so we do xville ID we'll make the directory xville I don't know the type of data it is we'll just call it dot we won't even do that we'll just do order ID and then we are decoding the data um again we're probably dealing with binary data so we're going to write binary and

HackTheBox - Bookworm


we're just going to do um request. dat and I think that should work if I make dur uh we go up one so we makeer xfill we run this server and I think we are good um it's kind of hard for us to test this though right let's see CD orders so the best way I think to test it let's do python 3-m HTTP server 801 and I think it's going to work but we're waiting on time right and you can't hack time so while we wait we might as well be productive and I'm going to test out her actual payload so if we go back to this payload JS we really want to just get this page AG we want to probably oh man I hate that I defined um this let's see I'm just going to copy paste rename debug get page 10 10 148 8,000 okay so let's put this in in my terminal so now that get page is defined to point towards us we can now get 11.

HackTheBox - Bookworm


HTML on 80001 and I called it 8000 it's really 80001 there we go okay go back here we can edit that I'm not using those now so what we want is to redo order so we'll do const order is equal to 11.

HackTheBox - Bookworm


HTML we have to do slash uh let's see read. because we made it constant um I'll call it debug I guess if I do debug we nothing we got it is debug a protected value uh ipac no we still just posting orders there and so we see 23 151 I'm guessing we have something broken because we did not get the post request on xfill so something is broke I don't know what though I wonder if this is some type of course thing if I do 10 10 14 8 or 80001 if we start off on this page F12 get page we defined it we on this tab there we go so now we have it we have a downloads everything link uh what do we call it debug so we want to Define this regular expression I see the error we have four it's D that's probably it I really should not be in the habit of calling everything constant everythingin will be with the slash D then we can test

HackTheBox - Bookworm


this test on debug it is true so we matched it that is good we got to change this back to everything thin and it's no longer order it is debug we have 11 question mark books ID that looks good so the next thing I want to do is print this line console.log and that looks good so I think once we fix that it's all good let's go back to our payload let's put a d there copy everything we have to go to burp Suite rep poison it go back here and I'm just going to let's see python print human timestamp I forget how to format that import time date time maybe that'll be good POS x g try this real quick this is not how I remember doing in the past but it may work so we can say time stamp is equal to this now import date time there we go do this Bookworm view book add the basket there we go we have somewhat of a

HackTheBox - Bookworm


good time stamp um so with that being said I'm going to pause the video and we're going to wait probably about 5 minutes so let's see sleep 300 I'll come back when this sleep is done and we'll see how many requests have been made and um if we have any actual xfill data we have not hit the five minutes yet it was probably I would say one to two and we see some X fills right we have xfill 11 so I'm going to check that out so if we go into our code directory go into xville do a file on 11 it is a zip archive so we can do 7zl 11 and we see it's got two files we got the pirate woman and unkknown so let's extract 11 and look at unknown. PDF and we have the past WD off the server so I'm going to move unknown to be called past WD um we going to remove star.pdf we don't need that one and let's see makeer

HackTheBox - Bookworm


um we'll go up to directories and say xfill I don't know what to call this so there we go I want to save every file we download and we're going to delete that and we want now to get a different file um and this also is going to be a bit like Nostradamus of me just knowing the file I want to grab it is a node thing right so there only like a few files we'd really want we could go um well the files we probably want our um let's see index.js database. JS app.js or something like that right we want to go into um those so I'm going to try proc self current workking directory and I'll do database. JS I would probably start with index and app but I don't want to wait all that time right so we'll start with those files and I think all we have to do is add that so if I now come up paste the payload okay we shouldn't even have to update anything it all should just

HackTheBox - Bookworm


automatically work because um we didn't change the basket poisoner that just sends them the Avatar URL this part didn't change the only part that changed was the Avatar URL and we just uploaded that right so I think that's going to work I'm trying to remember exactly how I did it um I saw this box yesterday and I'm just like recreating all the steps I took but I want to say that's how I did it so let's just leap for five minutes and hopefully I have some type of data in xfill so I'm going to pause the video now probably be back before 5 minutes but if not then that's why I know I need to start debugging because in reality it should not take longer than 5 minutes to get the data it's been probably about 30 seconds since I stopped recording and we did get an xill I probably should fix this condition where we just do it multiple times um there's no reason for

HackTheBox - Bookworm


us to send the file three times or do this three times I don't know where that bug is but I don't know if I want to fix it CU it seems to be working now right so we xill 14 if we do a file on 14 it's a zip so let's unzip 14 we could have also done 7zl there's really not much different right uh let's look at unknown. PDF and we got a file right we have the user Bookworm database Bookworm password Frank the job Giver so if we SSH Bookworm at Bookworm htb put in Frank the job Giver we don't log in right but we do have um the passwd file so I'm just going to move this over to xfi and we can call this um what was it database. piy .js so let's look at P WD and there is a Frank user if we wanted to we could just grab everything that ends in sh so we have root Frank Neil James since Frank is in the password I'm going to try to SSH as

HackTheBox - Bookworm


Frank and I may also like do crack map exact with a bunch of usernames and spray it if I had more than four I would probably go that route but um I like just taking a guess first and we log in as Frank and user. text is right there what's going on this is it from the future and before we go enumerating the box as Frank I want to take a step back and talk about something that I found interesting if we look at the orders and go to like order 11 I had mentioned that only this one was vulnerable the download everything that has two book IDs if you tried the one with just one book ID it wasn't vulnerable and the reason why I found is pretty interesting it's one of the things that node does pretty well on standard things and when you do multiple books you're doing a zip so I wouldn't really call that exactly

HackTheBox - Bookworm


standard how that works but um let's look at the code I'm already there we're defining book IDs we're just saying it's going to be request. query and then we say if the book IDs is a string we go down here so this is the single path all right we're going to do a res. download book IDs file name going to give it the path right well if you look at the zip it's very simple similar right we have this ZIP we have the book IDs um we're getting the file name and we need the file name here mainly because it's a zip file what do we put in it and then we have like the path. jooin command here that looks very similar to this path. join but it's extremely different because this one has root um this res.

HackTheBox - Bookworm


download supports this which kind of like jails it to that directory or makes a CH route I don't know a good way to explain it but you can't go outside of the directory so this is what's preventing the lfi on the single book ID is this makes it so we can't go out of the working directory SL books it is pretty cool so let's take a look at it I had created a simple application and by created I asked chat gbt give me a boiler plate and I finished it off right so we have two post parameters we have no root and with root and and on the no root I'm just doing file is equal to rec. body. file name and then we're going to download the file um with root what we're going to do is assign the file name just like we did before but this time we jail it to the dur name right so let's go play with this if I do

HackTheBox - Bookworm


python or not Python 3 wow um node index.js we're going to stand up our web server and then I'm going to do a curl Local Host Port 3000 uh let's start with no root and we'll specify the um post file uh post parameter file name and I'm going to give it please subscribe because I do have um please subscribe if we go in app web there is a Please Subscribe in this directory we have it right here and I part one up One Directory right right so with the no rout we should be able to read both of them so if we do please subscribe.

HackTheBox - Bookworm


text uh no such file or directory does it help if I can type correctly I'm guessing that was the problem because it's just please sub we get no really please subscribe to me right so let's try doing the directory traversal again there is um no root specified in this so I'm hoping it works right yeah it says thank you for subscribing awesome so what happens if we specify the root parameter right so this is the one that specifies we shouldn't be able to leave this directory so if we do please sub. text um cannot post to oh we called it with rot we get that message and then if we go dot dot slash we get an error message and this is a 500 message I want to say it's 500 let's do a-v so we can see uh 43 forbidden not 500 but it's just giving us the error that um we can't get out of that right I don't know

HackTheBox - Bookworm


exactly what that says I wonder if we can decode this quickly um let's go copy burp sweet decoder paste smart decode o we're getting there fimm test.html Firefox test.html it's probably not the best way to read this eror but hey it worked right you get the Forbidden you can see what that stack looks like but um I hope you guys kind of enjoyed that Beyond rout I really did enjoy um like this feature of nodejs I don't know I'm sure a lot of other languages have it but I normally see it in this this isn't the first time I had a a file disclosure vulnerability and a node application and couldn't do much with it just because they like locking you to directories which is a cool thing so um let's get back to enumerating the boxes for Inc so the very first thing I would do is check out my SQL right because we had the

HackTheBox - Bookworm


credentials for it and there could be um passwords in this so let's try going in I'm going to log in with the username Bookworm to The Bookworm database paste in the password which was Frank the job giver and then we're going to show tables and we can select star from users and let's see we got the name and password so I'm going to do select um name we'll do username as well and password from users and it looks like it's just hashed right um this is going to be password I bet if I Google this it'll come right up let's see it is md5 so these are all just MDS we could see if we could get any other um user and we'd also probably want to um let's see hold on let me look at this page first md5 hold on okay it says it up here um what was I going to say um we could go hashcat route but I don't feel

HackTheBox - Bookworm


like doing that um just send it all here I know none of these actually reverse so it's not going to be that beneficial maybe we can look at what the password is at the end of the day because the password's probably going to be in the like automation that's running but we don't have access to automation so we probably just want to save all these passwords store them because if they ever did crack or we got hits um it may be that user's password um who else was on this system if you do grap sh on Etsy pass WD uh is there a James I don't see James we have Frank there's no Neil so none of the users even line up maybe one of these is the root password but who knows right so the next thing I would look at is um listening ports to see what's on this box we have 300 and 3001 so I'm going to see what 3000 is it's probably going to be the website we

HackTheBox - Bookworm


have right um so why wait join now and start your reading Journey so this is probably just what we're accessing um I would guess if we do what is it Etsy is it engine X running this um sites enabled default let's see 3,000 I was assuming it would do like a proxy pass let's see I don't actually know how this is working CD Etsy engine X grap 300- R here uh it's in engine x.com they didn't do it in then s's enabled that is odd but we can find on Port 80 it's going to forward everything to Local Host 3000 so that is the main site let's check out 3001 so I'm going to curl Local Host 3001 and we get something different so what I'm going to do is set up a tunnel so to get into this SSH prompt if the first thing you do on a line is the squiggly C it drops you in that SSH prompt so I'm going to do - L uh 3001 1271

HackTheBox - Bookworm


31 so once I hit enter we can go to Local Host 3001 on our box and it will for us through that ss8 session so we have this Bookworm converter demo we have a file to convert and output file type I want to see if I can find this so let's see um I'm going to find. GP convert I don't know if this is going to be a good one thing to do or not uh we see a bunch of things up in home Neil So if we go to home Neil we can actually go in other users home directories which is interesting is there any other homes if we go James permission denied so let's go to Neil then we have converter and this is going to be the source code to this so I'm going to copy this over over um let's see let's just open a new tab make dir we don't have to make dir converter we can just copy it there so we can do xfi database uh grap pass there we go um

HackTheBox - Bookworm


sccp Frank Bookworm htb and then we want to give Frank the job Giver um oh before we do that home is it NE l yep then converter to this directory - R for a directory paste in the password and we probably should have zipped it I just realized because this is going to be a npm thing um there's probably a lot of files let's do find.

HackTheBox - Bookworm


wc- L 2,000 files so I'm going to stop that real quick r- RF converter and let's zip it up so we'll do zip Dev shm converter then we'll just do star I think we do d r for recursive we don't have zip s z Oh man oh we can t t ctvf um converter do is it bz2 home Neil converter oh we probably should have done Dev shm uh we probably don't have right access to this directory and that's why it AED Dev shm there we go man since we used zip before my mind was just on zip and I was like I can't use zip then how can I get this file um so let's SCP again we have to go cat this to grab the password because it's probably not my clipboard anymore SCP let's do Dev shm converter dot.

HackTheBox - Bookworm


bz2 don't need the dashr anymore it is still going with that wonder how big this is maybe I shouldn't have grabbed the npm directory I hope I don't like fill up the disc which could have just happened or maybe that lib QT web engine core 6 thing is big I don't know srank Bookworm htb when doing this box I didn't actually copy the application to my box I just looked at it from the command line but I really wanted to to like use sneak to analyze this so let's see duhs Dev shm um what is it converter 171 Megs no things are so big Goan gets a lot of flack but man node um I'm just going to pause the video let this finish it'll be a few seconds okay the file has finished so I'm going to make the source we'll go in there then turx jvf converter tur bz2 and it's going to extract this and then once it's done extracting we will be able to open this

HackTheBox - Bookworm


up with sneak and see what it says or open up with Visual Studio code which then we use sneak to tell me if there's vulnerabilities I'm kind of curious if it detects this right um so let's do code Dot and visual studio code should be opening there it is update later go over to sneak and which is going to scan the application so open source security found a few things uh crosslite scripting arbitrary file upload these are cves in this which I don't think is relevant to us but we have Whoa man quite a few vulnerabilities cross-site scripting a path traversal I think this is what we want unsanitized input from upload file Flows In I want to say this is what we want not positive Let's see server.js we make a post to upload that may be it what is index okay this is looking more what I expected so we have a past travs of

HackTheBox - Bookworm


vulnerability in here so it looks like it does find it a regular expression Den service is also there we could crash the web service if we wanted to um so there is somewhat of a path reversal let's see HP body 33 so we're just grabbing request. body and output type and down the line we will spawn convert ebook on the file path and destination path path let's just try this application out and see what it does um starting with the code without seeing what it does is somewhat tough to explain at least JavaScript where I'm not that great with to begin with so let's go to um htb Bookworm and I'm going to put a text file so let's do test. jpeg this was just please subscribe right yeah let's move this to test. text so we want to be able to write this file because if we can write this file then um we may be able to do something like a lot of exploits go with file

HackTheBox - Bookworm


right or maybe we can read files I don't know um so let's do all files test. text output type we can do ePub docx um Amazon Kindle or p PDF so if I do the UB format let's see let's make sure we intercept so we have Please Subscribe UB and this is output type and we know there was a um path traversal vulnerability here so I'm just going to try like Dev shm Pub whoops I have caps lock on there we go let's for this request and then on this box I want to look at Dev shm to see if we wrote a file we have converter T bz2 but we did not write the file so let's go back to history put this in repeater and we will put a bunch of dot dot slashes save this cannot post did we go to High let's see dot dot slash do three not found oh it's writing so we got a 404 but it does write okay so we do LS a there's no false a small file I'm going to graet for please on these files and we do get

HackTheBox - Bookworm


index.html so I'm assuming um this application is running as Neil because it's in his directory not positive by that but that is my guess um and if I could get a line break in here we could write a SSH key and potentially write to to authorize keys so let's try a br since this is HTML um wonder if we're going to have to change the file name no we don't hit over rot so it did not work we have any encoding what if we put a bunch of braks send that it puts some on separate lines so that is not helping us um it is using let's see convert ebook let's look at this function it is using Cali which is a binary um I bet we had it on our box we probably could look at it here Cali bin so it's using this binary to um write the ebook so let's Google actually before we Google I just had an idea um what if we gave it

HackTheBox - Bookworm


HTML so if we said um let's see can we do HTML injection so it would be image source is equal to file ety passwd I think that's all we need send this do a less and that did not look like it worked um wonder if we gave it the HTML mime type real quick let's try this real quick um move test. text to test.html Let's copy this and then we will we'll just go upload it again uh let's do upload all files test HTML are we still intercepting we are convert send the repeater Tab and I'm going to grab this it's text HTML now I wasn't a 100% sure on the MIM type right so we sent that now now let's do a less and it still did not include it so I'm thinking maybe we can't include this um thought there was a way to do it but maybe not let's just look in the UB file again oh wait um 417 image SES past WD that was

HackTheBox - Bookworm


new see grab Frank out of all this not there let's do UB 2 CD UB two so I think it's supposed to be in this file we get image source.

HackTheBox - Bookworm


passwd we included that so I'm going to try one last thing um nodejs really does love having root directory set which you can't go out of so if we do home Neil um let's see what is Dev did we see Dev oh that was us writing let's try profile we'll do home neil.

HackTheBox - Bookworm


profile so we can say home neil.

HackTheBox - Bookworm


profile okay CD Dev shm CD UB 2 whoops EB I at two oh got pass WD it did write it um it just for some reason makes everything hidden I guess I should have known that from this 29f that image source was passwd it's weird that it did that um we have aore profile as well which is that so we could try getting the SSH key so we could do like SSH ID RSA like that we do lsla let's just do go out of his directory UB 2 we don't have a SSH key which probably means it doesn't exist there is one possibility also if we do this we see these people like using um whatever that key is so we can try this I'm also going to add a pub to it to see if he has a public key there if we look at UB 2 we can cat or cdub 2 cat.

HackTheBox - Bookworm


ided oh we do have a key and we have a public key as well so we should be able to try this so chod 600.

HackTheBox - Bookworm


ID uh let's just copy this to our box so V this is neil. key paste chod 600 s-i neil. key Neil at we did Bookworm htb and we get a password so just because the private key is there doesn't mean it's in the authorized Keys file we can try X filling that as well and let's see I don't see it so I'm guessing that means it's not here right we tried to include it but there's no files that would have it so authorized key doesn't exist so we have to um go in um file right probably so we can write that authorized key file so let's see if we went back to the source we can go um calib ebook convert let's Google this uh Google uh my intercept is on okay Cali ebook invert um I'm going to do extensions or let's just search this so this piece is really useful to know right so calibri supports multiple formats and if we have a extension it'll use that if there is no extension it

HackTheBox - Bookworm


uses the open ebook format which is HTML files so when we're writing this uh where's our burp we're not giving it a extension so that's why it's um doing that one format so I bet if we did Dev shm um let's just call it out.txt and we say Please Subscribe we save this now let's go in Dev shm there's out. text that is just please subscribe so that works now the issue is authorized Keys doesn't have an extension so if we try to write it then it's going to write as that open ebook format right however we can abuse Sim links so we could Create a Sim link to home Neil SSH authorized keys and we're going to say um we're going to call it p. text right so if I look at p. text inside of Dev shm it's pointed at this file um and since we can't read that file right away let's do something different we can say Dev

HackTheBox - Bookworm


shm um we'll call this please sub and we'll call it ip. text okay so this one we'll be able to more easily read so we don't have a please sub file if I try to cat ic. text it's going to go no file right so if I change this to be ip.

HackTheBox - Bookworm


text we write it we do it LS I thought we'd have a please sub file we did that I wonder if we have to make a directory that's readable and writable by everyone m test chod 777 test let's see let's go back to Ln let's write to test Please sub so that is empty hip. text exist here so when we write to it please work it did not I was hoping we'd have a file called please sub. text owned by Frank or um Neil but we don't which is odd let's see what is going on I don't make that symbolic can we still do it no file if it's not symbolic okay let's try putting the Sim link inside of our test directory as well so we can now do a ln- S what do we call the Sim link was it ic. text yep so we'll call it um ped and ic. tex okay so if we write to ic. text it'll go to pwned so let's now put this in our test directory which was test run it again and we get it saying Please

HackTheBox - Bookworm


Subscribe and we have the file here so what happened this is a um let's see if we do protected Sim links the behavior I think is from Linux right so if we look at Sim links there is a odd behavior so when set to one sim links are PR to be followed only when the outside of a sticky World writable directory or when the uid of a Sim link and follower match so what was happening before is um I don't think Dev shm is that world writable uh let's grap shm maybe it is maybe this is a weird directory because that is 777 but it was protected right um when I made this test directory then that's what enabled it I wonder if temp is the same way this is just a a weird directory um if you have trouble with Sim links make sure they're in a directory that CH moded 777 and not in Dev shm or like the Sim link or follower match

HackTheBox - Bookworm


right I wonder yeah we don't have any permission over like we in groups do we have same group no I was wonder if maybe a group ID was the same putting in the test directory did that but no um so we want to have it in the test directory and let's see we want to I want to try something real quick um let's delete both of these files oh we can't delete pwned okay so let's do that Ln again so we're going to create home Neil please subscribe so when we write to ic. Tex now it should go into Neil's directory it does so if I was not in the sticky directory or the word writable directory let's see what happens um let's remove ic.

HackTheBox - Bookworm


text ln- S I will do please subscribe to that there we go so remove this right La home Neil please subscribe to did not work if we did this in well temps are bad directory because we have all these system D privates um we never know if I guess we could kind of guess login D resolve time sync up power so I don't think the web service or npm service is running in a private directory because I don't see anything labeled it so let's try this real quick let's do Ln home Neil and temp would it work in temp so let's do LS La Neil does not work so let's go in Neil's directory can we write files as Frank we can so I think we're pretty much stuck having to use this Dev shm test directory that we CH mod to 777 um there may be another way but that's just the things I do when I'm solving to kind of test my knowledge

HackTheBox - Bookworm


right so let's remove ic. text let's now um point it Tosh authorized keys so now when we write to ic. text it goes to this authorized key file um so let's see what key do we want to put well we can go to EPUB 2 ePub 2 cat id. Pub let's just put this key because we already saved it to our box so we're going to write this key here and we do Dev shm test and we try to sh with a key before we sent it it does not work send this and we get in so we save that key from his SSH directory if we didn't have his key there we could also generate our own SSH key and use that um I just used it because we could right so now we are both Neil and Frank and Bookworm so if we go in Dev oh that's our directory that we accidentally wrote to okay we do a pseudo- l we can see we can execute this gen label binary as root so we should poke at this binary if

HackTheBox - Bookworm


I try to um do pseudo gen label let's see what happens it wants an order ID so we'll do 11 and it's made a PDF in temp whatever this is so output dot it's got a postcript file and then it's also got a PDF so I bet if we copied this so scpi neil. key Neil Bookworm htb slash this directory let's open output.pdf and it's going to print this awesome so we want to see exactly what gen label is now and the easiest way to do that is just run a file command against it right so we want to see what type of file this is and it looks like it is a python script so if we open this up in Vim we can see what it does so it's going to connect to the database then we have a query and then we execute so there SQL injection right here right because we're just passing our query straight into the MySQL um the issue is it doesn't really

HackTheBox - Bookworm


buy us anything because we could just go into the mySQL database of this user anyways and do load file so that piece isn't that interesting even though we have SQL injection it's not giving us any additional privilege right now so then we're going to um create this postcript file output. PS um create the PDF location or this is just um defining where we write to and then we're going to open it we're going to read it we're going to write the data and then we're going to generate a PDF with this PS2 PDF um the paper size this just going to make like the PDF to be the A4 paper size D no safer um let's see PS2 PDF this means we can like write or delete files like it's disabling all the safety things in the PDF generator um let's see do we have it no safer it disables the safety mode so we have

HackTheBox - Bookworm


access to read write delete files Etc so this piece is interesting so we got like a double injection going on right so we have this MySQL injection and it's feeding data to this postcript file which then gets ran with um the converter as root so if we do some postcript injection it will run as root um and we can write arbitrary things through SQL right so let's look at the um output so it's CD temp is it gone already yeah pseudo gen label 13 let's go to this directory let's cat output. PS and see what type of data we have let's see um what is the first field actually did I open that in less or Vim I did Vim uh let's do that again so what is the first field we write probably address line one so let's look at that I don't know what address line one is but we can open 62 West Lane so if I search for 62 there we

HackTheBox - Bookworm


go so we're writing right here and we can control whatever we want here so we could put a postcript operation to write a file for instance right so I'm going to um let's see Google postcript WR file um I'm going to search ha tricks first to see if they have anything file system access this is not postcript right looks like maybe okay so it looks like we have something here we do I think percent is comments so this is listing files reading files writing files so let's just try writing a file so what we're going to want to do is close that parentheses then we can let's see we will want to close the parentheses Vim payload so we want to definitely close it then we want to say slash Al wonder if can we do line breaks like this let's see let's try this let's do slout file um we'll do Dev shm p. text we'll do p root. text I guess I'm

HackTheBox - Bookworm


not sure if p. text already exist right um w+ so that's probably aend so file def why do we do two I wonder if these two um brackets are bad let's try this out file hello world right string like that and we just do out file close file then I'm going to leave a open parentheses because that's where where this is going to come in because it's going to append that close parency and show so I think that's what I want so we can probably test this so let's do that pseudo again generate a label I'm going to go in that temp directory I'm going to copy output. PS to be in Dev shm and then let's um go here PS2 PDF let's see postcript output PDF output so we should be able just to write this so right now I'm not being root so um it should be fine because I'm just doing everything in a world rable directory

HackTheBox - Bookworm


right so let's do output. PS and we'll call it output.pdf LS La output.pdf it created it so I think we are good there so let's try our injection so let's do output PS and what was that street let's see do I still have the PDF open 62 Westlane okay okay 62 62 West Lane so we want to test this injection so I'm going to cap the payload we're going to pretend we have the union already and we're just going to paste our payload in so we closed that we put the out file and we write hello World um P test so now if I run this again we do have a Pon test that is good and it's just the string we wanted so that is very very promising so what we want to do now is V payload we want to write the SSH key here so let's grab the SSH key we had used before just because it's easy we could also like write to the

HackTheBox - Bookworm


Chron file or do a bunch of other things right doesn't have to be an SSH key whoops we want to write there and we want to write to slash root slash uh Sate authorized Keys okay so we should be writing there and let's do a base 64 incode okay so now we want to do the union injection um let's see we do a Vim how many lines or entries do we have so there's one two three four five six seven we have seven entries we have to inject so let's do whoops pseudo like this and then oh man was it a double quote or single quote order ID is equal to oh there are no quotes I know the whole string is quoted but there's no quote here like I was kind of half expecting it to be order ID and then quoted like that but it is not quoted that makes life easy so pseudo let's just say this order ID hopefully doesn't

HackTheBox - Bookworm


exist Union Select 1 two 3 4 five six 7even like that and let's go in temp TM whatever uh we should grab this file actually SCP output.pdf and I'm expecting this to be pretty much a blank PDF at least where all the entries are right so we have 1 2 3 4 five seven so we have confirmed the SQL injection right so now we want to inject our payload here so we can say select from base 64 and then put in our payload right and I think this is going to work question is does it work first try so let's look at this temp file real quick temp temp 4 then output PS um we wrote out file somewhere so you can see what it is this is where the address line would be and then we do slout file the SSH key we wrote the string closed it and then we keep the post script valid by putting that open parthy so it looks like we wrote the key so all that's left to do is attempt to SSH with Neil's key

HackTheBox - Bookworm


to root at Bookworm htb and Moment of Truth we are root so that is going to be the Box hope you guys enjoyed it take care and I'll see you all next time

HackTheBox - Bookworm