HackTheBox | Sau

HackTheBox | Sau

- 6 mins
HackTheBox Pentesting Sau Linux Easy MailTrail SSRF Request Baskets

Overview

Sau is an easy HackTheBox machine that runs Request Baskets service in one of its ports, which is vulnerable to SSRF, exploiting that will give us the access to a hidden MailTrail platform which is vulnerable to RCE. The privilege escalation is about using systemctl and trail service to spawn a root shell.

Nmap

nmap -A -T4 10.10.11.224
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-03 22:16 +01
Nmap scan report for 10.10.11.224
Host is up (0.16s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT      STATE    SERVICE VERSION
22/tcp    open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 aa:88:67:d7:13:3d:08:3a:8a:ce:9d:c4:dd:f3:e1:ed (RSA)
|   256 ec:2e:b1:05:87:2a:0c:7d:b1:49:87:64:95:dc:8a:21 (ECDSA)
|_  256 b3:0c:47:fb:a2:f2:12:cc:ce:0b:58:82:0e:50:43:36 (ED25519)
80/tcp    filtered http
55555/tcp open     unknown
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Wed, 03 Jan 2024 21:17:47 GMT
|     Content-Length: 75
|     invalid basket name; the name does not match pattern: ^[wd-_\.]{1,250}$
|   GenericLines, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 302 Found
|     Content-Type: text/html; charset=utf-8
|     Location: /web
|     Date: Wed, 03 Jan 2024 21:17:13 GMT
|     Content-Length: 27
|     href="/web">Found</a>.
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Allow: GET, OPTIONS
|     Date: Wed, 03 Jan 2024 21:17:15 GMT
|_    Content-Length: 0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port55555-TCP:V=7.94SVN%I=7%D=1/3%Time=6595CED7%P=x86_64-pc-linux-gnu%r
SF:(GetRequest,A2,"HTTP/1\.0\x20302\x20Found\r\nContent-Type:\x20text/html
SF:;\x20charset=utf-8\r\nLocation:\x20/web\r\nDate:\x20Wed,\x2003\x20Jan\x
SF:202024\x2021:17:13\x20GMT\r\nContent-Length:\x2027\r\n\r\n<a\x20href=\"
SF:/web\">Found</a>\.\n\n")%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20
SF:Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:
SF:\x20close\r\n\r\n400\x20Bad\x20Request")%r(HTTPOptions,60,"HTTP/1\.0\x2
SF:0200\x20OK\r\nAllow:\x20GET,\x20OPTIONS\r\nDate:\x20Wed,\x2003\x20Jan\x
SF:202024\x2021:17:15\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPReque
SF:st,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plai
SF:n;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Reques
SF:t")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20t
SF:ext/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x
SF:20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nC
SF:ontent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\
SF:n\r\n400\x20Bad\x20Request")%r(TerminalServerCookie,67,"HTTP/1\.1\x2040
SF:0\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\
SF:nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(TLSSessionReq,67
SF:,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x2
SF:0charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r
SF:(Kerberos,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20te
SF:xt/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x2
SF:0Request")%r(FourOhFourRequest,EA,"HTTP/1\.0\x20400\x20Bad\x20Request\r
SF:\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nX-Content-Type-Optio
SF:ns:\x20nosniff\r\nDate:\x20Wed,\x2003\x20Jan\x202024\x2021:17:47\x20GMT
SF:\r\nContent-Length:\x2075\r\n\r\ninvalid\x20basket\x20name;\x20the\x20n
SF:ame\x20does\x20not\x20match\x20pattern:\x20\^\[\\w\\d\\-_\\\.\]{1,250}\
SF:$\n")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Typ
SF:e:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x
SF:20Bad\x20Request")%r(LDAPSearchReq,67,"HTTP/1\.1\x20400\x20Bad\x20Reque
SF:st\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20c
SF:lose\r\n\r\n400\x20Bad\x20Request");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We can see from the nmap output that we have two open ports (22 & 55555). Firstly, I checked the content of the port 5555 :

Alt text

It is a Request Baskets service, which is a web service designed to capture HTTP requests and facilitate their inspection through either a RESTful API or a web user interface.

Actually a critical SSRF vulnerability was identified in Request-Baskets, affecting all versions up to and including 1.2.1, known as CVE-2023–27163.

We can exploit this vulnerability in three ways :

1st Method

Using an existing exploit :

https://github.com/entr0pie/CVE-2023-27163

Alt text

Alt text

2nd Method

Using a web user interface :

Alt text

Alt text

3rd Method

Using cURL :

https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3

curl -X POST http://10.10.11.224:55555/api/baskets/temp -d '{"forward_url": "http://127.0.0.1", "proxy_response": true, "insecure_tls": false, "expand_path": true,"capacity": 200}'

Alt text

Alt text

In all the three ways above we can see the returned web page is a Mailtrail v0.53 platform, that is vulnerable to Unauthenticated OS Command Injection (RCE).

MailTrail is a cloud-based email delivery platform for delivering transactional and marketing emails.

Exploit Mailtrail

https://github.com/spookier/Maltrail-v0.53-Exploit

Alt text

Using the exploit above we can easily get a reverse shell as the puma user :

Alt text

User flag

Alt text

PE

Checking the permissions of our user, we can see that he can run systemctl status trail.service as root.

Alt text

We can easily exploit that to privesc just by resizing the size of our terminal and make it smaller, which will give us the possibility to press enter each time to see more details, here we will enter !sh command which will trigger a root shell!

https://gtfobins.github.io/gtfobins/systemctl

Alt text

Alt text


MACHINE PWNED!


And that was it, I hope you enjoyed the writeup. If you have any questions you can Contact Me.

Happy Hacking!

Related Posts

Hicham Ouardi

Hicham Ouardi

Cybersecurity Engineer | Offensive Security Intern