Secret

image

Basic Scans

NMAP

Manual Enumeration

Just Visting websites on ports 80,3000 both looked same. Just gazing through website 2 features looks intresting.

Live Demo

![[Pasted image 20211031095429.png]] which redirets to /api endpoint ![[Pasted image 20211031095516.png]] Nothing intresting for now so let's move on to the seond feature.

Source Code

![[Pasted image 20211031095602.png]] The website seeming gives out it source code on website just like any other opensource projects. So let's download it and inspects for something good. Looking at the directory listing of source code it looks like it a git repository. It was all confirmed by ohmyzsh in my case.

I used git extractor tools to extract everything from the git archives. Link to the GitTools I Used https://github.com/internetwache/GitTools

and it will take time as it is a big repository so give it some time to complete. While that's running I did some manual enumeration. Looking at index.js we can see that the is an /api/user endpoint on auth route and auth route and it logic is defined in /route/auth. so let's check /routes/auth.js we can see there is the /register endpoint to register user so let's confirm this by sending a post request as get requests are not allowed.

looks like we have a valid endpoint so let's see what data it is expecting us to send in order to register a user. Looks like it expects us to give name,email,password in order to register the user. Looks like this schema is also defined in validation.js

so now we know that what we know how we can register and login as a user. And we can see that login endpoint creates a JWT token upon loggin in.

and now we know the location where secret is stored so we can just see it.

but no luck I guess it redacted or used a dummy word but it can we in the previous commits so let's check in that dump folder.

Git Dump Enumeration

Now we have extracted everything from Git repo we can see there is a total of 6 commit.

one thing that we know from above manual enumeration is that it used secret to sign JWT tokens so let's hunt for it. Looking through all the commit I found token in first 2 commits.

So now we have the secret let's go into details of how the token is signed. you can check that on /routes/verifytoken.js

let's just create a sample token using the secret found.

Registering User

So let's register the user from our above knowledge.

We registered a user oopsie. Now let's try and login. For login we know we need to send email and password.(from validation.js)

looks like we are logged in and we have our token. now let's see if we can do something intresting with but let's first see how it validates a JWT token.

looks like we just have to pass it as header in request with header name auth-token. so let's confirm it by sending it to /api/priv endpoint which just tells you if you are admin or not.

Looks like we are not admin but we have the secret we can forge the token. Let's Understand what we need to satisfy in order to be an admin it is declared in /routes/private.js so it basically checks that if name == 'theadmin' if so then it will give us the admin capabilities. Let's decode our token and find how its made. I will use jwttool for it you can use any tool of your liking you can also use their online website jwt.io which easy and pretty convinient. website: https://jwt.io/ tool: https://github.com/ticarpi/jwt_tool

Forging token

Now we have the forged token let's verify it at /api/priv endpoint

Now we are admin. Now let's try to look at logs as we can see it in /routes/private.js We have to specify the file name as the get parameter with the name file.

Looks like it's a comand injection.

Exploitation

Command Injection

Yeah so now let's to get the rev shell. Now create a shell.sh file with contents

and then host it on python server.

and call the file using curl and pipe it out to bash

And boom we have the revshell

PrivESC

SUID Binaries

Gives you an intresting file with setuid at /opt/count. looking for the files in opt directory we are given the code for the binary too.

So let's go through the code.

Looking at the source code the write functionality looks intresting but the problem is that we cannot write in privilleged mode and not the content of file so there is no possible way we can write something to high-privileged file or see the content of higher privileged file. The catch over here is that what if we crash the code in between the execution of the code. Most of the time if we crash the process in between the report is most of the time saved in /var/crash in linux distro. Normally this won't be possible but with this perm set prctl(PR_SET_DUMPABLE, 1); it could be possible. I am still not sure about what it does exactly but here is the man page for this function if you are intrested. https://man7.org/linux/man-pages/man2/prctl.2.html As far as I understand this determines whether core dumps are produced or not and by default it is always 1 so not sure why he manually did probably as a hint. As it is set to 1 we can produce core dump so let's test this thoery practically. For this we need 2 shells so first make sure you have 2 shells. 1 -> To run the count binary 2 -> To create crash

Shell 1

Now let's go to shell 2 to crash the binary

Shell 2

Now kill the process with the PID corresponding to ./count -p

Now you can check the shell1 if the process is been crashed.

Shell 1

Indeed we have crashed the process so lets check the /var/crash for the report.

We have the coredump file so let's check it out using strings or else it will give out gibberish output.

  • box pwned

PreviousSoccerNextShoppy

Last updated