HackTheBox Writeup: Ghoul

Ghoul was a hard rated box and man did it deserve that rating! It was a devious machine with lots of layers, false leads and trolling. Despite it being very frustrating at times, I found it to be extremely rewarding and I learned a ton from it. Zip slip, a vulnerability in Gogs, git histories, ssh-agent - there's not much that Ghoul didn't have! Let's dig in.

Nmap scan:

HTTP shows a cool looking site:

Port 8080 is password protected:

I clicked around the site on port 80 but didn't find anything interesting so I fired up Gobuster:

secret.php appears to have some juicy details:

Troll #1: the user flag does not work.

Running Gobuster again on the /users directory revealed a login.php file:

I got nowhere with the login.php so I turned my attention to port 8080. I compiled a list of potential users:

Then I used Hydra:

Logging on shows page with an upload function:

There is also an option to upload zip files:

With the hint in secret.php about RCE somewhere on the site, I tried uploading a PHP reverse shell with a jpg extension first. That failed as the site inspects the contents of the file:

That only leaves a zip file. A bit of googling around and I found this article talking about the zip slip vulnerability - it's basically taking advantage of directory traversal with zip files. First I created a small php reverse shell:

Next I copied it to /var/www/html on my machine and zipped it up using a relative path from the current folder:

If you take a look at the contents of the newly created zip file, you'll see the directory traversal:

I uploaded this zip file through the web interface, then hit http://ghoul.htb/rs-small.php to get a reverse shell:

While enumerating the system, I find /var/www/html/users/login.php that shows credentials in plain text:

All of these creds work at http://ghoul.htb/users/login.php but they all end up with the same page:

That was Troll #2.

While enumerating some more, I found /var/backups/backups which had some files in it:

In the 'keys' folder, there were what appeared to be private RSA keys for each user so I saved those. Continuing to enumerate, I found some interesting files in /var/tmp including my php/zip files:

The NSA Report was interesting, dealing with spear phishing and election rigging but ultimately useless:

The 'txt' file was what looked to be obfuscated Powershell malware:

Ok, time to try those private keys out. They all work:

Kaneki's key has a passphrase on it. After some guessing, I figured out it was 'ILoveTouka' from the secret.php:

The user flag is found in Kaneki's home directory:

ifconfig shows that we are not in 10.10.10.101 but likely in a docker container or something:

Other files in Kaneki's home directory:

While enumerating, I found /usr/share/tomcat7/conf/tomcat-users.xml which has some creds in plaintext:

I couldn't do anything with those creds so filed them away for the time being and continued to enumerate. A look at Kaneki's 'authorized_keys' file reveals another one of his usernames 'kaneki_pub':

It stands to reason that if we are currently in a container, there may be another container that is reachable. I used a simple for loop to run a ping sweep and found 172.20.0.150:

On a hunch, I tried ssh'ing to 172.20.0.150 as kaneki_pub with Kaneki's id_rsa key. It had a passphrase and he re-used 'ILoveTouka' so I got in:

There's a to-do.txt file in his home dir:

I filed away 'AogiriTest' as a potential user somewhere and moved on.

'ifconfig' shows that this is a dual homed machine:

I transferred 'pspy64' to the machine and ran it. There's an interesting thing being run every so often:

A peek at /etc/group shows that UID 1001 belongs to kaneki_adm:

I couldn't do anything with that yet so just filed it in my notes. Time to enumerate more then. I transferred nmap to the machine and ran a ping scan on the newly accessible 172.18.0.0 subnet:

Let's take a closer look at 172.18.0.2:

Hmm, a web server of some kind eh? Time to do some tunneling by ssh'ing to my machine from kaneki-pc:

Now we have GUI access to Gogs:

Version number:

The notes I took came in handy here. I logged in with 'aogiritest/test@aogiri123' that I found while enumerating:

Some googling around lead me to a RCE vulnerability which took me quite a while to get working. First I figured out that you need to comment out the below lines:

That let the script complete but I still had issues getting a reverse shell. It was somewhere during this process that I discovered that the RCE stops working after every run unless you change the repo name. That is done at this line in the script:

It took a few tries but I finally found a reverse shell that worked:

'ps -aux' revealed this:

Using that breadcrumb, I find /app/gogs/docker/s6/openssh/run:

That seems pretty ripe for abuse so I created a shell script, made it executable and ran it as root:

With a netcat listener:

Alternatively, you can just do this:

There's a /root/session.sh file with creds:

There is also an interesting file aogiri-app.7z so I downloaded netcat to the machine and transferred it to mine:

I extracted the file and looking through it shows some creds:

Unfortunately these creds did not work anywhere. I was stuck here for a while until I learned a bit more about how to use 'git'. git log shows a list of commits:

I wrote these commit numbers to a text file with: git log | grep commit | cut -d " " -f2 > commits.txt then tried another simple for loop: for i in $(cat commits.txt); do git show $i ; done but couldn't find a password in that.

After poking around some more, .git/logs/HEAD had more commits so I used that instead:

I was only interested in the first block of numbers and wrote them to head.txt with cat HEAD | cut -d " " -f1 > ../../head.txt

Next another for loop:

With some trial and error, ' 7^Grc%C\7xEQ?tb4' works to become root on kaneki-pc:

Here we have Troll #3:

Back to enumerating. I find some interesting commands in kaneki_adm's .bash_history:

I try these commands as root and kaneki_adm but struck out. I got stuck here for quite a while. After a break to clear my head, I started the enumeration process again and noticed funny looking folders in /tmp that I had skimmed past before:

A bit of googling reveals that these folders contain sockets used by programs to communicate with ssh-agent:

In short order I find this article explaining how to hijack that. Basically, a file will appear in one of those /tmp/ssh-* directories as part of some script/cron. When it does, we need to set the environment variable SSH_AUTH_SOCK to that file. This happens pretty quickly so scripting is the way to go. I created the below script:

I was a bit anxious to try it and got all kinds of annoying errors when I first ran it:

I ran it again piping errors to /dev/null and after a short while, I got a root shell:

At long last, the root flag: