Nov 26, 2022

7 min read

HackTheBox — RedPanda

Red panda, an easy rated linux machine, involved a spring boot application vulnerable Server Side Template Injection (SSTI) which was blocking few characters to not allow remote code execution, using any encoder for generating payload for java runtime exec, we get the shell as woodenk user, running pspy a jar file was being executed as root user which was dealing with XML and abusing XXE by performing directory traversal we can read any file as the root user.

NMAP

Nmap scan report for 10.10.11.170
Host is up (0.089s latency).   
Not shown: 65533 closed ports      
PORT     STATE SERVICE    VERSION     
22/tcp   open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)        
8080/tcp open  http-proxy
| fingerprint-strings:                  
|   GetRequest:            
|     HTTP/1.1 200                     
|     Content-Type: text/html;charset=UTF-8
|     Content-Language: en-US
|     Date: Sat, 09 Jul 2022 19:01:58 GMT     
|     Connection: close     
|     <!DOCTYPE html>              
snip..
|_    Request</h1></body></html>       
| http-methods:                    
|_  Supported Methods: GET HEAD OPTIONS
|_http-title: Red Panda Search | Made with Spring Boot

PORT 8080 (HTTP)

On port 8080 we see an animation of a fox having a search bar and the title bar tells us that it’s made on Spring Boot which is a java web framework

I tried some stuff like putting a single quote ' to see if there's sqli or some command injection

Fuzzing for files with gobuster we find an endpoint /stats

This shows two potential usernames damian and woodenk, clicking on either one of them will show us an option to export table and a GET parameter author

I tried fuzzing for LFI through a payload list which failed as well

On clicking Export table it downloads an xml file

Foothold

But we can’t really change the contents of xml so there’s no chance ofXXE, testing for SSTI it was vulnerable to Thymeleaf which is a template engine for spring boot, testing it with @{7*7]

So we know that it’s vulnerable to SSTI, let’s try to get RCE and look for any payloads if there are

But this payload didn’t worked and gave an error that there are banned characters

I tried different fragment expressions

And * this one worked with our payload

For getting a reverse shell I tried bunch of things, encoding the reverse shell with base64 and sending it off but I didn't get a connection back

I searched around for ways to generate java runtime exec payloads and found an encoder for that

Stabilizing the shell with python3

Since we are in logs group, I checked if this group has access anywhere

The reason we are in this group is because the panda search is application is being ran as woodenk as user and with logs group

Checked for sudo -l which was asking for a password

I transferred linpeas to enumerate the machine

It didn't found anything but pspy we can see something running in background as root user

Privilege Escalation

In /opt , we can see a clean up script removing every jpg and xml files from every publicly writable directory

We can check the source code of panda search MainController.java

In the source code we can see that it's looking for either damian_creds.xml or woodenk_creds.xml in /credits and reading the contents

We can find the password of woodenk user here

But it was useless as we wouldn't be in the logs group also this file isn't important as the one which is running as root through cronjob is credit score /opt/credit-score/LogParser/final/src/main/java/com/logparser/App.java

First it's going to set arguments from the log file from which it can parse the values and separate them with ||

In IsImage function it's going to check for a jpg image extension file , will come back to it later

From getArtist function it's going to read the meta data of the image specifically the name of Artist of the image

Lastly the main function from which the code will start from which wiil read the uri part from the log file separated by ||, it will check if there's a jpg image file in the uri, if there is , it's going to fetch the artist name of the image file and it's going to send the value to addviewto function which will check if the uri of the image is the similar the one present in the xml file

So to perform the XXE, first we need to make jpg image file point to an artist name and it could be any name so I’ll be setting it to uwu but we don't have write permissions in the directory where the source code is running so we'll need to perform directory traversal to /home/woodenk

For the xml file we need to name it artist + creds.xml, so it's going to be uwu_creds.xml also we need to add the location of the image in uri and this needs to be the same as the one in the log file

Method 1

Transfer both the image and xml file in woodenk’s home directory

Now to add the uri of this image file we’ll perform a directory traversal from /clients as the path is hard coded /opt/panda_search/src/main/resources/static + uri , here uri is our input where we'll perform directory traversal to our image file location /home/wendook/smooch.jpg

echo "200||10.10.14.36||Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0||/../../../../../../../../../../home/woodenk/smooch.jpg" > ./redpanda.log

After waiting for some time we’ll see the root ssh key being reflected in uwu xml attribute which we set

Method 2

The second way is also with XXE but it’s with blind SSRF which is also known as out of band XXE, through which we’ll get the root flag by transferring an xml file having an entity to make a request to our server with the entity having the flag contents as a parameter being passed on to our hosted xml having the entities to load the contents