Transcription
Hi everybody, good morning. I'm doing this new room. Uh, these three machines. I'm doing the first one, Basecamp. The only information they tell you, um, uh, this company have Dom K to try me secure system. Are you able to make your way through the mountain? Okay, basically, as always, we start with enumeration. I just use, uh, R, um, R scan it because they already give you the domain, so you know, uh, eight. They also tell you that. So the first thing to do is edit. So we need to add that, um, uh, TR no TR me k2. THM. So we know that's host. Uh, sorry, I was playing now, but let's not stop playing. So you get, uh, you have a website like that. Page source does show anything. It's just a normal HTML website. There's nothing special about it. Um, going to the rest of the pages also the same. You have the contact form. Also, if you go to the contact form, you say, uh, send a message. It's a, uh, not allowed. So, so basic. Also, you can say, okay, what happens if I go with the, I just did go bust. Now let's do it. I can just a normal, uh, normal, um, list it. Pick up, uh, home point. So if you switch to home, you get the same website. So nothing really different. So we can kill that. So, but because they give us a subdomain, so the first thing that comes is we is to to think about fuzzing. So maybe there's a subdomain in this company. That's what we need to get. So it's K2 try HCK me minus. Swit is the host. Host had a, uh, sorry, f. k2. triac me minus word list. We can use the same word list. We we also saw shared word list, uh, the, what's the the bust directory to medium. Well, let's stop that one. Minus FS, the size that because they're all the same. So we can remove this size. Says, click is not the correct answer. So you have admin. When you have it, you can stop the scan now, but you, if you don't need to continue, but it's K2 do try Haack me or admin. k2. track me. So we're done with this, um, bust. So this one we can just stop it. So we have two endpoints, so we can play with them. So we have admin dot, and we have it. K2 do try hack me. So let me zoom in. Now, of course, you think the admin is more interesting. That's common sense. But of course, it's a straight login form. You might think about brute forcing or something, but let's not jump to conclusions. The first thing when you see a form that is said sign up, when either they sign up, you must sign up. It's so you can see what you can see. If I log in, what happens, um, uh, if I'm I log in the system, so of course, of course, it's better to check the page source in case it's a login endpoint, and that's it. So we don't have too much info here to play with. So if I log in now, um, hello, please submit your ticket. So nothing. Also, if I go page source again, uh, nothing special here. It says submit the ticket. So basically, of course, whatever application like that, you keep testing it. So, um, login issue, for example, please save, for example, please reset my password. So the first thing you notice is we can't see what we're submitting. So we don't know is there a filter or something. Of course, um, the next thing you do, inspect the storage. You go to the session, and you think, okay, what I can do with this? If I copy this and go for example to offline chef and [Music] then if I go there, it's nothing. But I can see there's a three, three parts in this. It, you think it's a JWT. JW T token. What's that one? Not if you go now to JWT token, uh, accept all. If I put there, it detects the first one. We can see there's something in the header, but then the rest is situated here. So it's not a JWT token. You can guess here, it's not. So we know that the first part, we can decode and it tells me that authentication, that's my, I'm the first in ID. So you can, you don't need to crack this because it's clearly there is no admin or whatever because it starts from one. So our goal is to access this. So you can say maybe there, that's what happened. Maybe the admin, if we submit, we can't see our, uh, our ticket. But if the admin logs in and clicks on a link or something, we can steal the cookies. And, uh, it means it's XSS. What is XSS stealing cookie? But what is this? So follow my process. So this one is not, uh, it's a Flask token, uh, Flask token, uh, exploit. Let's try where is that, uh, Hack tricks. That's what I did first. I thought to maybe we can, uh, do these tricks. I'm following you. My process, what what I did. You can see is, uh, what is this? So we can install this. I'm showing you how this does. This is not that's not a solution, but, um, just to show you what we did. I did. If I, you do that, and then you come back here. So if I want to decode, they just say Flask can sign decode cookie. Uh, let's try that. After I finish installing, I can say there and I can get my cookie. Uh, where is my cookie? What's going on here? Copy and then oops, you can't decode the first part. That's cool. Then how can we get, uh, because you think you can crack the secret. To crack the secret, how to use the secret, decode the cookie, brute force, uh, you get the word list, and then end sign, and then you give a cookie, and then, uh, at the end, you put this, this, uh, let's get this one. So if I do, uh, let's say, uh, one on side, and then we can put our cookie here. Let's get our cookie. Of course, this one doesn't work because, uh, you can't crack it. It's, it's very strong, uh, secrets. I'm just showing you the process. Uh, so you can see it's fine, but we'll let him for a moment, and we'll come back to this. So we don't have that. The next one is, you know, you can't crack it. So the next thing to do is, as I said, you assume that if I put a steal cookies through XSS, so hopefully it will work. Then when the admin logs in, I can steal the cookies on login. That's part of stealing cookie. So one thing we can say, let's start my Python, Python 3.9 minus M HTTP. Do server, uh, server. Let's get that one. So we have our server running. No, the classic ones, where is? So I don't need to type too much. The classic one is this one. This is my IP address, my port. So if I put this, the classic one, I'm just detecting. No, this one, uh, now this one, clear. So there's no in on it. So we can just a normal one. If I put there payload, so basically we just do normal payload and just say test one. If I submit now, it tells me what filter activated. So there's a filter detecting the keyword in this payload. So we can't use really this payload. The next one we can do two of them. We can use, uh, base 64. So we can take this one. Let me show you what exactly is that. So if I put that one there, what's going on? So you just, this is my IP machine. So you can just do the same. You take that one, you change your IP. So we hide in our payload in base 64 structure. So let's try this one, uh, and I just make sure that, uh, I call it cap 64. So we can distinguish them when they come. Uh, hold on. So I can take, for example, now this base 64 one and say, let's see if it passes the filter. So if I copy it there and say ticket one, now I can see it passes the filter. Filter. I can see it. So let's wait and see if it does work. If it does work, we should have, um, um, uh, what, what's his name? Uh, we have a cookie. If the admin now logs in and opens the ticket, and because the application doesn't protect through, uh, uh, prevention through XSS, now we got it. So you can see we got exactly what we're looking for. You get four of them. I think that's part of the room for whatever reason. We'll check later on. Now the question is, can we, this is the hex. If we convert things to hex, so you just need to put your IP address. I put them, called it admin hex. So you can see it when it comes. So if we take this one, so this one came, and it's a cap 64, as we said, you can see 64 is exactly what we have here. So if I do another one and call it now using the hex, now ticket number two, now where submit number to, uh, ticket submit. Let's see if that one comes. So we got the first one. So the first one, uh, now we got the second one. So we, both of them working. So you can use either this and that, uh, and then we have, we can just take the last one. So we can take this one and then we can go to admin and then we can do inspect. We go to the storage, admin. We can add session here. Uh, we assume it's the same app, so it will use the same, uh, process because this one used the, so it uses the same storage session. So we can just call it session and then we put that. So if we refresh the page, you're stuck there, but that's not really the session. It's still there. So it doesn't mean you are there. But remember this application, let's assume it has the dashboard. So let's say admin dashboard because that's what we we're trying to go. Dashboard, and you, if you have the dashboard, you're cool. We, we are in as admin. You can see our cookies is there and everything is fine. So we can close that, and then we are in our cookie. It seems the application deletes, like for example, if I put another another ticket and let's say system test, the way the application works, I think it's after a minute or something it will delete it. It only keeps this. I think it's doing it there. So it doesn't keep sending, uh, this. So what it does, it deletes after, after I think after 10 minutes, 1 minute or something, this will be removed. Okay, he said select a ticket title. The title, for example, here is help, and then if you click there, it shows you the name and the thing. Uh, for example, the title here, I got it. So now the question will be, what next? Uh, no, there's no, no, I got it without spaces. So the part, I got it. So basically, there's nothing information we can get special from this now because, sorry, all the information is in front of us. This is not useful information for we can say name of people has a P is J. I don't know, but is this information? Let me show you that we did. I think after, okay, let's wait for the delete. The next best thing to think about it is SQL injection to the title because that's the common thing to start with SQL injection. You can say if I go with the classic, uh, or 1 equal 1 and submit it, it says attack detected. Then you go out. When you, when you see this, don't get worried. Just go back. Just go back to dashboard. This application doesn't kick you out. It just, uh, redirects. So now we know we can't use OR. So we can say, how about like the room we did last time, Break Me or Cheesy Room. The Cheesy Room server turn on error. Okay, so let's go back. Let's do the some classic, uh, order by one and server error. Okay, why you keep server error? All by one internal server error. He, this is when you do video, when you do video live, suddenly internal server error. I didn't have internal server error before. It should work. Why now is internal server error? I assume there are three. One, two, three. So three should work. Why is doing internal server error? This doesn't give me anything. Sorry. This is try Union select. I tried that SQL map because of the firewall. Just a nightmare. Maybe let's try different comment and no server error. What's wrong with you? Another null. Today is not a good day for making, uh, a video. If you assume it's MySQL, so we can ask for the version. Really, even, uh, MySQL version, you complain about it. Null Union select null version version. I think they updated this room. This is not like the same box I did the last time. Okay, null. Really, nothing will internal server error. How come this one did work for me? What, why is not working now? Did I type it wrong? For whatever reason, let's copy from here. Either the server is overloaded or there is an error in the application. Good for you. What, let's see what happens. I know it did work when I do the room. What, what, because there are three, and then you can detect the version, and then you can, uh, get the database. So, so why now is not working? Oh, no, something wrong in the application. I don't want to start the machine because this did work before. Maybe what we did that, let's look out. This even this application doesn't log you out for whatever reason. I'm back or not, and internal server error. Did they update the room? What version is this? Version 1.5. Huh? Otherwise, there's some script running or something. They're killing it. He keeps sending it. This one, maybe that's the problem. Kill our process. This log, even log out is, uh, let's kill our session storage cookie. I don't think a session is a, is a problem. The database works, so we got the data. It's there. So why the doesn't work anymore? Oh, now he's working. No, no, no, it's not working. Order by three and turn seven. Either the server is overloaded or there is an error in the application logic. So I need to make another video. Let's get, uh, our friend, the Ross XSS. This one did work. Now suddenly nothing is working. So part are working and part not working. Why? So this one, Union select admin, admin password, email from admin. Or worked, but in Union select no column name name from information schema where table. This one is getting server error. Um, this one supposed to work also and give me my SQL version. Damn it. Didn't know why, why he's doing this. Uh, let's kill the session. Get another session. I don't know what's going on with this, um, storage. Let's kill this session. Okay, dashboard. There, let's, uh, let me get another, uh, for whatever reason, I don't know what's going on here. Okay, we have, uh, there. Let me get, uh, just the base 64 we used. He sometimes I don't get it why when I make videos, things go south. Uh, there's just put test submit one two three in the same time. Let's go to the triple Swiss. I assume it's, uh, it's MySQL, uh, injection. The best guess you can do for this is SQLi to MySQL itself. So we can use this for comment. Okay, yeah, which I use this one. Suppose this Union should work. Or did we get? Let's see if we got session again. Oh, we got the session. Yeah, we can use the last one. I don't know why, uh, uh, let's go back now to our session cookie session, the session, and then we can go to dashboard, and we are cool. Let's see that order by three to ignore server error. Why isn't it? Cuz it said it's server issue. It's not going with the three. Sub to work because we have three values here. So, but that one is not interested for me. So it doesn't make sense to me. So the dot dash [Music] dash order by three. But if you do that, doesn't make sense. Who is the tun? Uh, I don't know, guys. This one supposed to work. In whatever reason, it's not working for now. Is there the comment or something? I'm doing it wrong. We can use this one, dash dash dash. Let's try that one. DH dash dash. Okay, that one works. So we got, uh, the MySQL version. Let's go back to the order by three and then add another [Music] one. Okay, so it's a comment. So if I put one and then add another one, four should give me a because four doesn't exist. So that's correct. Three should work. So we know there's a three column. So we know now it's a three column. Okay, now I understand. Now is the the dash. So these three columns. So we know it's three columns. So we can use, uh, clearly we can use the. So we need to add, oh, sorry. So we need to add that another another tou here, the, uh, see if I go now, I can get MySQL version. So we know the title is the one that has an injection on it. Is the middle. So one, two, three. So it's the second one. So we can, because it's the second one, so we can put a table name in the second and the other one, relate by null. And then we can get the structure of the table. Hold on a minute. We can add do dash. I forgot. Give me server error. So s. So it, we can use this one. Okay, so it's cool. Then where is it? And then you can submit. Then we have authentication, admin authentication. We don't interested on this. The ticket, we know what's on it. We more, because that's our ticket. User is ours, but this one we don't know about it. So we can get that one with, uh, now to to do that one, I need to get, um, same things we did, uh, in the middle, because it's the second position of the title. Null, null. And then we need to get a structure of this table. And is we need to add that dash again. So if I put there, so the table has an ID, admin username, password, email. We can just, because we only can make three, we can take these three, 31 look for this 31 wants. So admin username, admin password, and email. So we can get, I need to add that that one there. So if we add there, we got, we got this password. So now the question is, what we can do with them? Uh, the first thing is, you think is, can we just SSH to this? On, so let's take James. You can see we couldn't crack it. So just stop it. We can't crack it. So we can't go with the cracking. Uh, the cracking. So that one is a dead end. So SSH James at k2. track me. So if I use that password we just got, now, of course, you can test the rest. They're not, they're not passwords working for us. So, um, clear. So I'm James. What I have here now, we have the user. So it's head minus [Music] C 6 user.txt. So we have the flag there. Uh, the next question is, they ask us for for password for root, for password for for the user that access to the machine. Um, uh, uh, first of all, uh, now the first of all, bash history isn't null. We don't have a local MySQL history. It's James. So you can see what's inside my SQL history. There's nothing. Uh, admin site. We can go to now to see what's inside that one. And, uh, sorry, Vim, the app. That's why we couldn't crack it. You can see the password of that, the Flask secret key. That's why we couldn't get it because it's, it's too complex. And then we have database. That's a database login. Database, it's the name is ticket site, right? And then that's where is our problem. That's the password. Dashboard, select ticket. And then, and that's the filtering. We can't use sleep here. Remove this here. Remove this. Oh, and this if these after eight numbers. So why it wasn't doing me server errors? Okay, so, so and or it's also filtered. And then message is attack detected. Okay, so we know that. And then, uh, so now if you go to LS home, we get another person there. CD home. Rose is clear. L LA. We can't see the history. And it's not empty. So there are things you think about it. We have the K2 site, the profile. So if you go to K2 site, this LS. That's the static. No, that's not the static. That's the route we found before, the home and the HTML site. So it's running. And the, and the Rose, uh, the question is, the people that they said, the people that have, uh, access to the machine. Of course, if you, that question, it can get from this pass, pass WD. Um, for someone to access the machine, you need to have a bash binary. So grab, um, um, minus I, you can just grab bash from ITC pass WD. Let me clear it so it doesn't look too. So these three people that they can look to the machine. The question number, I think number two, you have root, we have Rose, and we have James. We have James's password because we logged in with that. So James has a password. The names of the user, remember they said, uh, uh, two people, they have their names clear text. That's is Rose. The full name is Rose Bal. And James is James Bald. So this is the last, uh, question three answer. So we need the root password. We need Rose's password. So this what, so we have now, uh, only one question left. This is the three users that can access the machine: root, Rose, in alphabetic order. So we have, um, James, root, Rose. So we have James. We have James's password. We got it. Then we have Rose. We still need to look for it. And then we have, uh, uh, root. Root with password wherever. And then we need Rose with password wherever. So where to find L? First of all, this is my, the mistake I was correct somewhere else yesterday. It's good to work with a team. That's why I start enjoying it. The first thing you need to do in a machine before you get line pie or something and waste your time, just check first what you have. You have James in the group ADM. When you are in ADM, it means you can access VAR log folder. You have the right to access all of them because you are part of the ADM, uh, ADM, um, part of the ADM. So because I'm looking for root in Rose, so one thing you can say, uh, grab minus I run, Rose from VAR log. Let's see what anything happening. R, it says binary. That let's come in journal. Are binaries? But there's one interesting thing, permission denied. Some file. Yeah, you look here. What we found there, Rose's password wherever. We have a new password here. It's, uh, login in the admin. But this password, we didn't see it here. It's not part of this list. So also you can do grab minus add a for binary to to read the binaries. But still, it's a journal. We can see it's trying to read the the journal. For that, we can go journal, uh, journal CTL. I can just pipe it, grab row. What row was doing? Let's see what row was playing around. Uh, where is it? Grab rows, new group, rows. So Rose was in a new group, new user, new Rose to shell binary. Okay, then change user Rose to bash. Accepted password for Rose. Session opened. And then we have, uh, oh, root to root. She did ask you here. Use a root row. So Rose has power of root. If you look, sudo from user root by Rose, it should be nice. You do some password change. [Music] For why don't detect sudo? You do accept password. So Rose knows the root password. For whatever reason, Rose from this IP in, uh, SSH. It's an SSH row session. Rows to group sudo. So user has the root password. And then add themselves in sudo group. You can see, see now, close connection. Bash history session opened. And then we have this Python site. That's Rose doing the the piping things. So we're cool. So we know what exactly Rose was doing. But most of this, the nice one we got is this one. This new password that we got. So because it's a part password, you can think about it. Is it user row or is it root password? We can guess here. If I say sudo Rose and put the password, no. But if I sudo to root, because you assume it's a mistake typing the password, no, you are root directly. I'm already root. So you can just have CD root, LS, and then we get, uh, head minus C6 root.txt. So we got the flag now. Uh, the question is, what's the the the? So we have a root password. We have James, but we don't have Rose. Of course, you can see I go to ITC Shadow. Oops. Shadow and grip rows. And you can say, oh, I can take this one and crack it with Johan. I think you can crack this with J. But remember when we did the Rose directory, L LA, there is a history file. Can bash history file? And that's a mistake of root password. This is the, uh, Rose password because this password is different. This is not the password we got from, uh, it's not the password we we got from admin. I, uh, Rose var log log. Remember this password we got here. This is the root password. And then, of course, this one is Rose's password. So we got the password. Well, so, so yeah, interesting room. What else? Yeah, if you go to opt folder, there's some interesting file. So if I get to the XPY selenium, selenium is for related to Chrome running in headless. You can see what it's doing. This is how we got our, uh, how we get this the cookies. The cookies I get from here. So this is the one that logs automatically as James. And then we can steal his, uh, his cookie. I think so. He logs to the replace with the target website username, username James, password again, submit button, find and find the submit by button and then click the submit button and sleep one drive quit. Where is the one that delete? And then we have, um, set db.py. This is the ticket we have. SMY hle Paco that we got before. That's the database. Where is the one that delete the database? Execute truncate. Oh, truncate ticket. So that's how we deleted the data and then insert a new one. Then you have the Google Chrome is there. I thought before the Google is the entry point. Okay, guys, that's the whole walkthrough of this room. Thank you very much. And if you have questions, just make sure that the mistake I did is I forgot to add this server error. I don't know why you should add it, but in any case, that's the one that worked for me. Have questions, please let me know. Please like and share the video. Thank you very much and have a good day.