Code

https://app.hackthebox.com/machines/Code

Port scan

Running initial fast Nmap scan on 10.129.33.86...
Open ports: 22,5000
Running detailed Nmap scan on ports: 22,5000...
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-23 18:21 IST
Nmap scan report for 10.129.33.86 (10.129.33.86)
Host is up (0.40s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 b5:b9:7c:c4:50:32:95:bc:c2:65:17:df:51:a2:7a:bd (RSA)
|   256 94:b5:25:54:9b:68:af:be:40:e1:1d:a8:6b:85:0d:01 (ECDSA)
|_  256 12:8c:dc:97:ad:86:00:b4:88:e2:29:cf:69:b5:65:96 (ED25519)
5000/tcp open  http    Gunicorn 20.0.4
|_http-title: Python Code Editor
|_http-server-header: gunicorn/20.0.4
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.02 seconds
Scan complete. Results saved in 10.129.33.86.ports.scan

There's a web page running on port 5000, the title suggests it's a python code editor. seems FUN.

Web attack (sandbox bypass?)

Homeage

It's a simple python code editor, let's try catching this in burp suite and get RCE.

After I captured the request, I changed the body encoding. I like using WebkitFormBoundary because it takes care of all the encoding stuff for me.

I try to read the curren file, but a simple payload doesn't work.

Hmm, that means the program has some bad characters/words blacklist & ignore executing the code if one of the words is included in the program.

LogoJinja2 SSTI - HackTricksbook.hacktricks.wiki

I followed the RCE section, and got a successfull RCE.

This is the cyberchef URL, we can see that subprocess.Popen is on line 318,

AND WE GOT SUCESSFULL RCE.

Payload:

User shell

Payload:

User (app-production -> martin)

There's a database file in instance/directory. Let's take that to our local machine. I'll use nc & cat command for it.

There are 2 tables in the current database. The usertable has hashes.

If we gave hash on crackstation.netit will crack the hash for us.

Let's ssh. & done

Root shell.

Script

Script Flow

  1. We have to give the progm a .json file

  2. It'll check if the filetype is file (-f $json_file)

  3. in updated_jsonvariable, the directories to be archived variable will be updated removing all the ../using gsub. [ HERE EXSIT THE CODE MISTAKE ]

  4. directories_to_archivevariable stores the directory name that we'll need to archive.

  5. is_allowed_path()function will check if the path we mentioned in the directories_to_archive starts with either /homeor /var [ CODE MISTAKE 2 ]

  6. If the function returns 0, backy binary will be executed.

Attack

So coming back to point 3,

it's removing ../and replacing it with '' . But what if I have ....//It will replace ../out from the 4 dots and the slash, eventually after removal, i have ../

Also talking about point 5,

if [[ "$path" == $allowed_path* ]]; then

The leading * includes all directories inside /home or /var (intended) but due to that, we can misuse file path. (yeah linux is funny)

This is my task.jsonfile.

And done, we successfully backed up the /rootfolder.

I moved the file to my localhost since the server has some cleanup script running which deletes all the files after certain amount of time.

Root shell

Since we have the root folder with us, we can see it has the private key for ssh too, after changing the permission to 400, we can ssh into the box.

________________heapbytes' still pwning

PreviousEasyNextPermX

Last updated