search

Skyfall

hashtag
Recon

chevron-rightnmap_scan.loghashtag
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com

[~] The config file is expected to be at "/home/rustscan/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.254:22
Open 10.10.11.254:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -vvv -sV -sC -Pn" on ip 10.10.11.254
Depending on the complexity of the script, results may take some time to appear.
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
[~] Starting Nmap 7.93 ( https://nmap.org ) at 2024-06-19 17:32 UTC
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 17:32
Completed Parallel DNS resolution of 1 host. at 17:32, 0.04s elapsed
DNS resolution of 1 IPs took 0.05s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 17:32
Scanning 10.10.11.254 [2 ports]
Discovered open port 22/tcp on 10.10.11.254
Discovered open port 80/tcp on 10.10.11.254
Completed Connect Scan at 17:32, 0.16s elapsed (2 total ports)
Initiating Service scan at 17:32
Scanning 2 services on 10.10.11.254
Completed Service scan at 17:32, 6.26s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.11.254.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 5.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 0.52s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 0.00s elapsed
Nmap scan report for 10.10.11.254
Host is up, received user-set (0.091s latency).
Scanned at 2024-06-19 17:32:36 UTC for 12s

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 6570f71247073a888e27e9cb445d10fb (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVqvI8vGs8EIUAAUiRze8kfKmYh9ETTUei3zRd1wWWLRBjSm+soBLfclIUP69cNtQOa961nyt2/BOwuR35cLR4=
|   256 74483307b7889d320e3bec16aab4c8fe (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINk0VgEkDNZoIJwcG5LEVZDZkEeSRHLBmAOtd/pduzRW
80/tcp open  http    syn-ack nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-favicon: Unknown favicon MD5: FED84E16B6CCFE88EE7FFAAE5DFEFD34
|_http-title: Skyfall - Introducing Sky Storage!
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:32
Completed NSE at 17:32, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.10 seconds
└─$ grep sky /etc/hosts
10.10.11.254    skyfall.htb demo.skyfall.htb

hashtag
HTTP (80)

Application has demo version and it's on demo subdomain.

Writeup.png

hashtag
Demo

Demo creds: guest:guest

Writeup-1.png

On login we are given a cookie which looks like a Flask cookie:

Writeup-2.png

hashtag
XSS

We have an Escalate page which says that admins will check it out. Possible XSS to hijack the session cookie. After doing submit the request was not submitted, so I guess the form is just placeholder!

hashtag
SSRF

Possible SSRF via fetch:

Writeup-3.png

The only valid port seems to be 5005 up to 42600 ports.

The port seems to be current app port, which is both good and bad. We have few pages with restricted access and we could view them using ssrf.

Trying to get internal page gives error:

Writeup-6.png

hashtag
Files

In the Files tab we have Welcome.pdf which contains project description and possible username:

Download file takes filename of file to download it.

Writeup-4.png

Filename like ./Welcome.pdf is invalid, so the application sanitizes and returns only matching filename not path.

After messing around with Rename File I got an error:

Writeup-5.png

hashtag
Metrics (403 Bypass)

/metrics gives 403, bypass via SSRF didn't work. There's many ways of bypassing 403, if we are lucky the authentication might not be based on session cookies.

Tool to bypass 403/40X response codes. devploit/nomore403arrow-up-right

circle-info

Note: 403 lines removed from output, there was a lot D:

Welp, newline injection in url is new, but it gives us 200 response!

Writeup-7.png

On last line we see interesting domain, update /etc/hosts

CVE-2023-28432arrow-up-right Minio - Information Disclosurearrow-up-right

GET request didn't work, but the post request worked.

hashtag
MinIO (Cloud)

MinIO CLI tool can be used to use the cloud via terminal: https://github.com/minio/mcarrow-up-rightalias set docs: https://min.io/docs/minio/linux/reference/minio-mc/mc-alias-set.htmlarrow-up-right

List buckets

Download the backup

The contents of backup has nothing, all file are empty or defaults.

In lsarrow-up-right docs: --versions: Directs mc lsarrow-up-right to operate on all object versions that exist in the bucket.

cp allows using version number:

It has more files. It includes project https://github.com/ahzhezhe/terraform-generatorarrow-up-right

Current project version is 6.4.2, so backup is really old. Anyway it has nothing since it's an opensource project and no external commits were made.

We can see differences between versions via diff command:

Nice, another credentials.

Now we need vault program,https://min.io/docs/kes/integrations/hashicorp-vault-keystore/arrow-up-righthttps://developer.hashicorp.com/vault/installarrow-up-right

Environment variables was not enough, needed to issue loginarrow-up-right command.

Most commands from docs were blocked due to access https://developer.hashicorp.com/vault/docs/commands/listarrow-up-right Since token is part of developers we should be able to do something.

SSH was interesting, but in needs a role. List all roles related to ssh:

circle-info

Note: sudo apt intall sshpass

hashtag
User.txt

hashtag
Privilege Escalation (root)

We don't have permissions to access docker binary.

Going back to sudo binary we can use help to see what it's doing. We don't have access to any files in command.

The program creates/overwrites debug.log, but we can't read it because root creates it.

hashtag
Race Condition

Since the file is created no matter what and accessed to write contents we can use race condition to get the desired output, specifically Symlink Race! Symlink Race - Blog post: https://hackmd.io/@bachtam2001/BkZkudoLq#Examplearrow-up-right

race.py:

race.sh:

  1. Create race.py

  2. Create race.sh

  3. Create target file (e.g.: test.log)

  4. Run race.sh

After running it for few minutes we get a hit!

hashtag
Root.txt

PreviousOfficeNextTwoMillion

Last updated