« back

Backend Writeup/Walkthrough - HackTheBox

HackTheBox, CTF, Writeups, Linux, Pentesting

Backend #

[]

Initial Recon #

Let’s start with the basic Nmap scan

Nmap #

Content Discovery #

Dirbuster #

I used old-fashioned dirbuster because my machine was newly downloaded Kali VM and I haven’t installed the lovely gobuster or wfuzz.

[]
From dirbuster, we know that we have:

/api/
/docs/
/api/v1/

Trying to access documentation #

Going to /docs will tell us that there is some kind of authentication in this API.
[]
This means, in the API itself there’s a user management system that involves authentication and possibly also a registration system.

Trying to access the API itself #

[]
From this response, we can see that there are two possible endpoints which are /user and /admin
[]
Fuzzing it deeper give us:

/admin/file

and
# every valid number returns 200
/user/{valid number}

We can assume that the /user endpoint will return user based on id which is represented by a number. We can find a valid user id by filtering out a small-sized and repetitive response (in this case it’s 4 and 104) from gobuster.

[]
As expected, the valid user returns with size 141 and we have found another endpoint which is /cgi-bin. We can validate this finding by accessing each user data (apparently it does not require authentication)
[]
We still havent found anything related to authentication so we will try fuzzin once again with POST request instead of GET
[]
Finally, We found /login and /signup accessible through POST request.

Signing Up New User #

Assuming that the signup will require email and password. We can register a new user.
curl -XPOST http://10.10.11.161/api/v1/user/signup -H "Content-Type: application/json" -d '{"email":"ejak@ejak.ejak","password":"ejak"}'
[]

Login as Our User #

[]
For no absolute reason, we can’t login using a json request but we can login using normal POST url form format. Now, using this token, we can access the documentation and most probably find a way to exploit the API.

Authenticated Enum #

Using Modify Header Value extension in firefox, I was able to use the token and freely browse the API from browser. The API is a FastAPI instance, a Python-based API.

[]

From the docs, there is this one endpoint called /api/v1/user/SecretFlagEndpoint which is accessible with PUT request.
[]
Surprisingly, this returns our user.txt :).

Interesting Endpoint #

[]
The next interesting endpoint is the updatepass functionality. This endpoint requires user to be authenticated and provide guid value. If there is no validation done to verify the authenticated user and the given guid, we can easily update admin password by providing admin user’s guid.

Updating Admin Pass #

With the exploitation idea explained above, we can change admin password and get access to the admin functionality.
[]

Exploitation (Initial Foothold) #

After successfully authenticated as admin, we can use the token to execute arbitrary code using the /exec endpoint accessible only for admin.
[]
Apparently, we need a ‘debug’ value inside our JWT to be able to execute this functionality. To do this we need to find the JWT secret to modify our JWT using the /file functionality to read files.

Finding JWT Secret #

We can find the root directory of the API by accessing the environment variable stored in /proc/self/environ.
[]
From this, we can see the root directory is /home/htb/uhc and the main function is inside app/main.py.
[]
From main.py we know that it is importing app/deps.py to do deps.parse_token . Inside /deps.py, we can see that the JWT secret is imported from settings (/app/core/config.py)
[]
And here it is, The Secret
[]
So, let PyJWT do the magic.
[]
With this new token we will be able to execute command!
[]

Getting a Shell #

Well its the basic, you can either insert your public key to .ssh/authorized_keys or execute a reverse shell command. In my case, I just do echo {base64 of reverse shell payload}|base64 -d|bash. Make sure it’s url encoded!
[]
[]

Enum & PrivEsc #

This one is the easiest part of this machine. The app is on “Debug” mode with auth.log logging every authentication attempt. Reading it will give us the password for root. []

Conclusion #

[]
Well yeah, thats it for this box. We played around with FastAPI and JWT to get the foothold and simply use a reused password to get root shell. The main learning point from this machine is the absent of validation in /updatepass functionality, allowing attacker to update any user’s password easily. I personally was expecting more for the root part but not reusing your password is still a good advice I guess.

External Resources #

PyJWT
Modify Header Value
JWT.IO