Precious

Personal Rating: Medium

Enumeration

sudo nmap -sV <IP>

  • Only ssh and port 80 open

  • There is a page where you are supposed to enter an URL and get it converted to PDF

  • nginx and Phusion Passenger 6.0.15

  • Subdomain Scan, dirscan and Vhost scan revealed nothing at all

On the web page, when I fetch a html page that I created and host on my machine, I get a PDF file as output. I will try to include files with Javascript.

I created a test js file. A PDF with this content to check the injection: 

<!DOCTYPE html>
<html>
  <body>
    <div id="main">The JS was not executed</div>
  </body>
  <script>
    div = document.getElementById('main');
    div.innerHTML = "The JS was executed";
  </script>
</html>

Server Side XSS?

The vulnerability is a Server Side XSS, as you can make a web handler execute code, but not in the browser of a user that accesses the website for instance, but on the server itself. I found a list of LFI payloads to test:

I am loading this with http://10.10.16.7:8000/test.html

This seems to make the server not output a PDF anymore, so I removed it:

The script collection above actually returned nothing when sending it to the server.

Exifdata pdfkit Exploit Reveal

I checked the result PDF with exiftool and found out that it uses a vulnerable pdfkit version. This is not the way that I expected. I saw that it is important to test and enumerate broadly before trying for too long on an exploit path that does not work.

The version of exiftool is vulnerable to a ruby code injection. https://www.ctfiot.com/84447.html

This was the command that did the exploit:

I got a shell with that actually.

With this I could upgrade it to a real tty:

There is the user “henry”. I cannot read the user.txt yet as I am the ruby user.

Internal Enumeration

I ran linPEASS:

I got the creds henry:Q3c1AqGHtoI0aXAYFH from /home/ruby/.bundle/config

With that I could ssh on to the host

Ruby SUID Dependency Update Exploit

With sudo -l I found an suid binary: (root) NOPASSWD: /usr/bin/ruby /opt/update_dependencies.rb

After changing the PATH to include /home/henry and creating a file called dependencies.yml in it, I looked at the update deps file. It uses YAML.load(File.read... This is apparently vulnerable to a deserialization, which can lead to code execution. I had to peek at the writeup for this as I got stuck.

LogoUniversal RCE with Ruby YAML.loadStaaldraad

I put this in the dependencies.yml:

I wanted a shell as root, so I researched further

LogoPayloadsAllTheThings/Insecure Deserialization/Ruby.md at master · swisskyrepo/PayloadsAllTheThingsGitHub

In the end, this payload worked to get a root shell:

PreviousPhotobombNextRedPanda

Last updated