TryHackMe Contrabando Walk Through

TryHackMe Contrabado

Never tell me the odds.

Scenario:

Our company was excited to release our new product, but a recent attack has forced us to go down for maintenance. They have asked you to conduct a vulnerability assessment to help identify how the attack occurred.

Are you up for it?

Great kid! Don’t get cocky.

Room Link: https://tryhackme.com/room/contrabando

YouTube Video Walk Through: https://youtu.be/5-izLhcaD6M

Enumeration:

Coming Soon page after you click on Checkout our beta page it take you to page/home.html:

TryHackMe Contrabando — Our password generator is currently down page

the URL page/home.html give strong indication of LFI, we can use Burp to try to access /etc/passwd

YouTube Video Walk Through: https://youtu.be/5-izLhcaD6M

TryHckMe Contrabando — Burp /etc/passwd

with double URL encoding we can get access to /etc/passwd which confirm LFI

checking /etc/apache2/sites-available/000-default.conf /etc/apache2/sites-available/000-default.conf give us another clue of app running on port 8080

YouTube Video Walk Through: https://youtu.be/5-izLhcaD6M

<VirtualHost *:8080>
 # The ServerName directive sets the request scheme, hostname and port that
 # the server uses to identify itself. This is used when creating
 # redirection URLs. In the context of virtual hosts, the ServerName
 # specifies what hostname must appear in the request's Host: header to
 # match this virtual host. For the default virtual host (this file) this
 # value is not decisive as it is used as a last resort host regardless.
 # However, you must set it for any further virtual host explicitly.
 #ServerName www.example.com

 ServerAdmin webmaster@localhost
 DocumentRoot /var/www/html

 # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
 # error, crit, alert, emerg.
 # It is also possible to configure the loglevel for particular
 # modules, e.g.
 #LogLevel info ssl:warn

 ErrorLog ${APACHE_LOG_DIR}/error.log
 CustomLog ${APACHE_LOG_DIR}/access.log combined

 # For most configuration files from conf-available/, which are
 # enabled or disabled at a global level, it is possible to
 # include a line for only one particular virtual host. For example the
 # following line enables the CGI configuration for this host only
 # after it has been globally disabled with "a2disconf".
 #Include conf-available/serve-cgi-bin.conf
</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Next step is to look for other files, we can use ffuf for this

YouTube Video Walk Through: https://youtu.be/5-izLhcaD6M

root@ip-10-10-199-180:~# ffuf -u http://10.10.87.45/page/FUZZ.php -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt  -fs 100-200

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.3.1
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.87.45/page/FUZZ.php
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405
 :: Filter           : Response size: 100-200
________________________________________________

gen                     [Status: 200, Size: 392, Words: 65, Lines: 15]

we find new file gen.php, we also can get its source code:

<?php
function generateRandomPassword($length) {
    $password = exec("tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c " . $length);
    return $password;
}

if(isset($_POST['length'])){
        $length = $_POST['length'];
        $randomPassword = generateRandomPassword($length);
        echo $randomPassword;
}else{
    echo "Please insert the length parameter in the URL";
}
?>

We can notice Apache version Apache/2.4.54 (Debian), with some research online we find out there is CVE 2023 25690 Request splitting/smuggling https://github.com/dhmosfunk/CVE-2023-25690-POC and also a Python script that can help us to smuggle our post request to gen.php script: https://github.com/thanhlam-attt/CVE-2023-25690/tree/main

We can use that to get reverse shell

YouTube Video Walk Through: https://youtu.be/5-izLhcaD6M

pre.txt file created using Burp

Enumeration after first shell

after getting the first shell, there is not much to find, no regular user, we can then start scanning the network if there is any open ports or other application running:

www-data@124a042cc76c:/var/www/html$ for p in 22 80 443 3000 5000 6379 8000 8080 8081 9000 27017 3306 5432; do
  (echo > /dev/tcp/172.18.0.1/$p) >/dev/null 2>&1 && echo "host 172.18.0.1 has $p open"
<0 5000 6379 8000 8080 8081 9000 27017 3306 5432; do
<dev/null 2>&1 && echo "host 172.18.0.1 has $p open"
> 
done
host 172.18.0.1 has 22 open
host 172.18.0.1 has 80 open
host 172.18.0.1 has 5000 open

We find out there is an app running on port 5000:

Fetch Website Content app

This is SSTI

Full YouTube Video Walk Through:

YouTube Video Walk Through: https://youtu.be/5-izLhcaD6M

Contrabando | TryHackMe | LFI | SSTI Request Smuggling