There is a page where you are supposed to enter an URL and get it converted to PDF
nginx and Phusion Passenger 6.0.15
Subdomain Scan, dirscan and Vhost scan revealed nothing at all
On the web page, when I fetch a html page that I created and host on my machine, I get a PDF file as output. I will try to include files with Javascript.
I created a test js file. A PDF with this content to check the injection:
<!DOCTYPE html>
<html>
<body>
<div id="main">The JS was not executed</div>
</body>
<script>
div = document.getElementById('main');
div.innerHTML = "The JS was executed";
</script>
</html>
Server Side XSS?
The vulnerability is a Server Side XSS, as you can make a web handler execute code, but not in the browser of a user that accesses the website for instance, but on the server itself. I found a list of LFI payloads to test:
The script collection above actually returned nothing when sending it to the server.
Exifdata pdfkit Exploit Reveal
I checked the result PDF with exiftool and found out that it uses a vulnerable pdfkit version. This is not the way that I expected. I saw that it is important to test and enumerate broadly before trying for too long on an exploit path that does not work.
I got the creds henry:Q3c1AqGHtoI0aXAYFH from /home/ruby/.bundle/config
With that I could ssh on to the host
Ruby SUID Dependency Update Exploit
With sudo -l I found an suid binary:
(root) NOPASSWD: /usr/bin/ruby /opt/update_dependencies.rb
After changing the PATH to include /home/henry and creating a file called dependencies.yml in it, I looked at the update deps file. It uses YAML.load(File.read... This is apparently vulnerable to a deserialization, which can lead to code execution. I had to peek at the writeup for this as I got stuck.
