Skyfall
Reconnaissance
Port scan
Subdomain
You can Ctrl+u to view the web page source code and see we have 2 sub-domains.
Web Attack
Nginx ACL + Flask strip()
We were able to login with default creds given:
guest:guest
I tried for LFI with remaining filename, or upload .php and trying to access it from somewhere. Although I didn't find anything, we can further move on for other approach.
The only interesting thing was this 403, WHY?
Well if we try to access /beta the flask app restricts us, but for /metrics nginx doesn't allow us to go forward, so that means....there's a website which flask can serve us if we bypass nginx 403.
Googling Nginx 403 bypass hacktricks gives us this beautiful resource
Third title worked for me, Unsafe path restriction which leads us to the following page
Our nginx version is nginx/1.18.0 (Ubuntu)
We will add 0c in our request
And VoiLA!!, we got in.
Info
Why this attack worked?
It's because nginx was set to return 403 on /metrics request, but we were sending /metrics\x0c request which was considered as different request and it was forwarded later to Flask.
Flask usually strips URLs before parsing them, so our /metrics\x0c became /metrics and the data of the webpage was returned back to us.
Anyway, back to web attack.
If we scroll down a bit, we can see it's using minIO with:
It also gives us minIO endpoint URL
Let's add this subdomain in our /etc/hosts file.
MinIO
MinIO is a High Performance Object Storage API compatible with Amazon S3 cloud storage service.
It's like aws cli, with few other features.
MinIO bug
If we search the version number on google we find this article
Lets try curl the endpoint with the above URL.
YESSSSSS.... we got secret username and password.....
Install
mcto interact with the minIO instance
User shell
Minio client
Help menu of mc will tell us how to list files,
What's version? It's basically like git commit, new version will have different data than previous version.
Let's download askyy/home_backup (all version)
We'll use mc cp for this
Great we download all imp files, lets check what's the difference in all of these files...
I decide to remove all similar and non-intersting files,
Reading ./v2/.ssh/id_rsa.pub reveals the username askyy (askyy@skyfall)
./v2/.ssh/id_rsa has ssh private key
I tried ssh'ing the server with this private key, it doesn't work for some reason.
Let's remove those files from our search as well.
Hmm interesting........
Hashcorp
It's a hashicorp token, what's the token for? (Answer straight from google)
What is HashiCorp Vault used for? It is used to secure, store and protect secrets and other sensitive data using a UI, CLI, or HTTP API. A secret is anything that you want to tightly control access to, such as tokens, API keys, passwords, encryption keys or certificates.
It's basically like a password management tool, which gives you one time sign in password and rotates it everytime. Perhaps that why signing in with private key didn't work bcuz hashicorp changed the password and keys and that was the key valid only for a single login session. (this is just a guess)
Hashicorp client
You can download it from here
We can login and check if everything is working fine
We are having developers role.
Ssh creds
Since the ssh didn't worked last time, because hashicorp changes password everytime, I decided to move on and get the creds working.
The above resource will guide us how to get password from the server.
Inputing all values, we can now have user shell (FINALLY)
Contents of payload.json file
Root shell
Master token is basically root token, which can do anything, our end goal is to get master token and get root ssh creds. Read more about tokens here:
We can't read the file contents, this might has our master token key.
Since we can decide what directory to put the file in (debug.log), we can play with the filesystem.
We can see user_allow_other option enables in /etc/fuse.conf ..... I found a good resource
This tutorial explains security flaws of having user_other_allow
In this case, any user making use of the filesystem has root privileges on that filesystem! If the process has access to the actual filesystem, this could easily be used to gain pretty much unlimited access.
Since user is making a file where we specify, and we have user_other_allow option enabled, we can try for race conditions. Basically we will create a mount that will intake all data from current folder.
So i.e. our_mount -> original_folder So whatever data comes to original folder (even if as root), we can get that data in our_mount.
Honestly, this was my first time exploiting FUSE, I couldn't find good resource, so here's one from 0xdf/ippsec: https://github.com/hanwen/go-fuse
We can compile memfs from examples/ folder.
And done....... we now have admin token.
Edit our payload.json file
Edit our curl command
NOW let's ssh.
FINALLY done.......superb box tbh. Learned a lot since this is my first Insane box.
_____________________heapbytes' still pwning.
Last updated