OpenKeyS

10.10.10.199

by SixPraxis

Write-Up

Two open ports were available at the time of scanning. One ssh port, one http port. The http port displayed a simple login page. Fuzzing found the /includes/ which contained auth.php and auth.php.swp. VIM swap files contain changes that have been made to a file, but not yet saved. Downloading auth.php.swp and using strings to open the file revealed a potential username “jennifer” and another file at ../auth_helpers/check_auth. The file was downloaded from http://openkeys.htb/auth_helpers/check_auth and investigated using strings.

By web searching “libc.so.95.1 cve”, a library referenced in the check_auth binary, CVE-2019-19521 is found, it details a vulnerability in the library that allows authentication to succeed by supplying -schallenge or -schallenge:passwd as a username. Article about CVE-2019-19521. The login form on port 80 accepted -schallenge:passwd, but showed a message saying no keys are stored for user “-schallenge:passwd”.

Looking at the auth.php.swp code shows that php is searching the $_REQUEST variable for the username field. From the php docs for $_REQUEST, that variable contains the of GET, POST, and COOKIE. Using that knowledge, the attacker used Burp Suite to capture the login request and modify it by appending ;username=jennifer to the cookie field. Hitting send and then follow redirection in Burp Suite successfully retrieved the SSH key stored for the jennifer user. Right clicking and choosing show response in browser provided an easy way to copy the key without having to remove the html tags.

The key was copied into a new file in our .ssh folder and permissions were set to 600 in accordance with the rules for ssh key files, chmod 600 id_rsa. ssh jennifer@openkeys.htb successfully used the key to log in as jennifer and allowed retrieval of the user flag.

The same report that contained information about the -schallenge vulnerabliity also contained CVEs for privilege escalation. Following commands from https://www.qualys.com/2019/12/04/cve-2019-19521/authentication-vulnerabilities-openbsd.txt?_ga=2.75852181.122675264.1575541632-949691503.1575541632 for CVE-2019-19520 and CVE-2019-19522 escalated us to the root user.

CVE-2019-19522

Root Flag

Recon

NMAP

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.1 (protocol 2.0)
80/tcp open  http    OpenBSD httpd

Port 80

Http port, contained a nondescript login page.

WFuzz

000020693:   200        22 L     57 W     697 Ch      "css - /"                               
000030353:   200        25 L     72 W     1066 Ch     "fonts - /"                             
000037409:   200        21 L     52 W     589 Ch      "images - /"                            
000037689:   200        22 L     57 W     711 Ch      "includes - /"                          
000037784:   200        6 L      9 W      96 Ch       "index - .html"                         
000037792:   200        101 L    195 W    4837 Ch     "index - .php"                          
000041245:   200        21 L     52 W     582 Ch      "js - /" 
http://10.10.10.199:80/vendor

Credentials

User flag: 36ab21239a15c537bde90626891d2b10

Root flag: f3a553b1697050ae885e7c02dbfc6efa

Jennifer SSH key:

SixPraxis

HTB - OpenKeyS