HipFlask

Prompts and answers

• Is the network portion internal or external? external
  **Common Vulnerability Scoring System CVSS**
• └─$ theHarvester -d tryhackme.com -l 500 -b google
  *****************************************************************
• *******************************************************************
  _ _ _
• * _ _ _ *
  | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __
• * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ *
  | __| _ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__|
• * | __| _ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
  | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ |
• * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | *
  \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_|
• * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| *
• * *
  theHarvester 4.0.3
• * theHarvester 4.0.3 *
  Coded by Christian Martorella
• * Coded by Christian Martorella *
  Edge-Security Research
• * Edge-Security Research *
  cmartorella@edge-security.com
• * cmartorella@edge-security.com *
• * *
  *****************************************************************
• Fortunately we only have one target, so getting an initial idea of what we're dealing with technically speaking should be fairly simple. We'll start with a few port scans against the target to see what we're up against, then move on to some more probing vulnerability scans, followed by enumerating the available services in-depth.
  *port scanning*
• We will move on from here; however, as a matter of good practice you should run a full port scan on a slower mode (e.g. -T2) against the TCP ports, and maybe a slightly wider UDP scan in the background. Be warned: these will not return anything new for this box.
  *vulnerability scan*
• Weak encryption method (Cipher Block Chaining -- CBC) in use for SSH encryption. Disable the CBC mode cipher encryption on the OpenSSH server and replace it with the CTR or GCM encryption methods.
  *webapp initial thoughts*
• Disclose the source code for the main.py file and note down the secret key.
  *understanding the vuln*
• There are a million-and-one different ways to accomplish the same objective with Nginx configuration files -- many of them will have vulnerabilities like this, many will not. It all depends on the experience of the sysadmin. As such, searching for .py files with feroxbuster is still an effective strategy when we know that there is a reverse proxy in front of our Python webapp -- even with a routed application.
  *full source code disclosure*
• Move the database outside of the webroot. Vulnerability can also be mitigated against as a side-effect of remediating HF-WEB-3
  *implications of the vuln*
• 2. "Flashing" is Flask's way of persisting messages between requests. For example, if you try to log into an application and fail then the request endpoint may redirect you back to the login page with an error message. This error message would be "flashed" -- meaning it's stored in your session temporarily where it can be read by code in the login page and displayed to you.
  *cookie forgery*
• The final program should look like this, albeit with your own key substituted in:
  *poc.py*
• eyJhdXRoIjoiVHJ1ZSIsInVzZXJuYW1lIjoiUGVudGVzdGVyIn0.Yuxpmg.tQk-QZg5URo0BusUkZ3IR9x0e6s
  *change the cookie (eyJhdXRoIjoiVHJ1ZSIsInVzZXJuYW1lIjoiUGVudGVzdGVyIn0.Yuxpmg.tQk-QZg5URo0BusUkZ3IR9x0e6s) -> admin for me in inspect/storage/cookies*
• There have been 25698 unique visitors to the site!
  *server side template injection (SSTI)*
• Overwrite your cookie one last time and get a shell!
  *RCE completed*
• www-data
  *Shell Stabilisation and Local Enumeration *
• Note: these numbers depend on your screen and terminal size and will likely be different for everyone
  *
• www-data@websrv1:/opt/site$
  *
• Stabilise your shell and have a poke around the machine.
  **privilege scalation (polkit)*
• What is the root user's password hash? $6$./Fh3mWMsk8X29kq$6CvaDzV7zlXKn1MMQjXtO.abB4/7ecNKBFkQvEWsLkgM8raAZeuSHZurnXG01pqZ4BY2ubk/WgIbo4ee.wnaP0
  *me*
• root@websrv1:/opt/site#
  *wrapping up*