CozyHosting
A Linux machine with a twist.
Enumeration
┌──(kali㉿kali)-[~/Desktop/CTF/Boxes/CozyHosting]
└─$ nmap -sC -sV -Pn 10.10.11.230
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-06 11:40 EDT
Nmap scan report for cozyhosting.htb (10.10.11.230)
Host is up (0.0048s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 43:56:bc:a7:f2:ec:46:dd:c1:0f:83:30:4c:2c:aa:a8 (ECDSA)
|_ 256 6f:7a:6c:3f:a6:8d:e2:75:95:d4:7b:71:ac:4f:7e:42 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Cozy Hosting - Home
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.23 seconds
Nothing interesting here besides HTTP.
HTTP Enumeration
Upon visiting the webpage, we discover a boostrap template website with a login page.
We do not find much functionality on the site besides the login so we attempt to perform directory fuzzing with gobuster.
Nothing interesting as well.
If we try to visit any non-existent directories, we are presented with a Whitelabel error page, which is specific to the SpringBoot Framework.
Looking at hacktricks, it states that one of the common misconfigurations of SpringBoot is the use of actuators.
With reference to this article, it states the following :
The Spring Boot Framework includes a number of features called actuators to help you monitor and manage your web application when you push it to production. Intended to be used for auditing, health, and metrics gathering, they can also open a hidden door to your server when misconfigured.
The article also provides a wordlist for directory/file fuzzing at SecList's spring-boot.txt
We can use this wordlist to fuzz all the possible actuator endpoints.
The /actuator/sessions endpoint looks particularly interesting as the official SpringBoot Documentation states the following.
The
sessionsendpoint provides information about the application’s HTTP sessions that are managed by Spring Session.
Visiting the endpoint, we get presented with a bunch of random strings with the username kanderson.
If we try to login with any invalid credentials, we notice a JSESSION id being created with a similar value to the random strings at /actuator/sessions.
Thus, we can come up with the assumption that the random strings are actually session cookies which we can use to login as kanderson.
Immediately we see an interesting function at the bottom where it seems to be running some sort of ssh authentication in the backend.
This is further confirmed upon intercepting the request with burp, it is revealed to be making a POST request to the endpoint/executessh with a error message Host Key Verification Failed, a common ssh error.
If we put a ; in the username parameter, we get a ssh usage output, suggesting that this parameter is vulnerable to some form of command injection.
We can thus try to execute our reverse shell payload, using base64 to reduce the number of spaces and substituting spaces with the IFS trick.
Initial Access
Running whoami we discover that we are the user app and there is a .jar file named cloudhosting-0.0.1.jar.
We can then extract it out and use the zipgrep functionality to grep for any strings containing the word password.
Opening the file BOOT-INF/classes/application.properties, we notice credentials for the user postgres which seems to be running locally on port 5432.
This is confirmed as using the command ps aux, we notice a postgres process running in the background.
We can thus try to access the cozyhosting database via psql which reveals the user administrator's hash.
We can then crack it using hashcat which reveals the password manchesterunited.
Looking at the available users in /etc/passwd, we see a user named josh.
We can then test for password reuse via ssh for the user josh using the cracked password, obtaining the user flag.
Privilege Escalation
Using the command sudo -l, we discover that josh has the ability to run ssh as root, probbaly due to the insecure feature on the web application earlier.
We can thus reference GTFOBins to obtain a root shell.
Last updated