Home Clicker Report
Post
Cancel

Clicker Report

Posted 2023-10-25 1 min read

Information gathering

Scope: 10.10.11.232/32 (Linux)

TCP Nmap scan: 65,535 ports

  • Open ports:
    • 22/ssh:
    • 80/http:
      • Banner grabbing
        • Server: Apache/2.4.52 (Ubuntu)
      • Follow redirect: http://clicker.htb/
        • Services:
          • The clicker game
        • Technologies
          • Bootstrap v4.3.1
          • PHP
        • Headers
          • None
        • Cookies
          • PHPSESSID=q790rl9f70uasg0i39ib7pgth4 (dynamic)
        • Emails
          • None
        • Users
          • None
      • Directory Fuzzing
        • file: content/dir_fuzzing
        • register.php && login.php:
          • Acccount created: marss:marss
      • Subdomains
        • None
      • Code analysis (clicker.htb)
        • save_game.php
        • db_utils.php
        • authenticate.php
        • index.php
    • 111/rpcbind,2049/nfs:
      • Data available to mount: /tmp/backups (Webpage content)
        • clicker.htb
    • Unknown
      • 32791,43287,43905,46507,56687
  • Filtered ports:
    • None

Vulnerability Assesment

  • CRLF (Carriage Return && Line Feed)
    • Bypass $_GET request input data
      • Local testing (index.php)
        • Valid injections: %0d%0a…,%0a…,…%0d%0a,…%0a
  • Remote Code Execution
    • Code injection on “nickname” variable (save_game.php)
    • Exporting file (no extension check)

Exploitation

  • CRLF (Carriage Return && Line Feed)
    • Change User rol to Admin role
    • Login again to load profile (authenticate.php)
  • PHP code injection to RCE
  • www-data enumeration
    • SUID binary (Jack user)
      • Code analysis
        • With an invalid option we can insert any file to save in “sql_file” variable and then read it
          • sql_file = create.sql
          • /usr/bin/mysql -u clicker_db_user –password=’clicker_db_password’ clicker -v < /home/jack/queries/”sql_file”
        • Read private id_rsa key (jack)

Post-exploitation

  • Jack enumeration
    • SUID binary (monitor.sh)
      • SETENV: set own enviroment variables
    • /opt/monitor.sh
      • Perl script
        • ENVIRONMENT: (perlrun)
          • PERL5OPT: environment variable allows specifying command-line options (-[CDIMTUWdmtw])
          • PERL5DB: load debug code

Lateral movement

Proof of concept

HTB
HTB Linux Medium Python Scripting CRLF Command Injection RCE
This post is licensed under CC BY 4.0 by the author.
Recently Updated
Contents