Mango

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.162 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, a few ports are open.

Let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,443 10.10.10.162 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's start with the basics. First, I see there is an HTTPS service running on port 443. Let's inspect the SSL certificate with the following command:

ssl s_client -connect 10.10.10.162:443

  • s_client implements a generic SSL/TLS client.

  • -connect tests connectivity to an HTTPS service..

At some point we should see this:

Now we know that the common name (CN) is staging-order.mango.htb and the Domain Name is mango .htb. Let's add both to the /etc/hosts file and see if there is Virtual Hosting.

Virtual hosting is a method for hosting multiple domain names (with separate handling of each name) on a single server.

If we take a look at http://mango.htb we will get a Forbidden message.

And if we take a look at https://mango.htb or https://staging-order.mango.htb we will see a Mango search engine, based on the Google search engine.

And if we take a look at http://staging-order.mango.htb we'll see a login page.

Exploitation

Let's try some random credentials on the login page, intercept the request with BurpSuite, and send it to the repeater.

username=admin&password=admin&login=login

At this point, I tried to inject various types of payloads from the PayloadAllTheThings github repository, and I got something interesting by doing NoSQL injection. If I enter some invalid credentials I get a response with a 200 OK status code, but if I use the NoSQL Authentication Bypass I get a 302 Found status code, and if I forward the petition I see the home.php file basically saying that the website is not functional.

username[$ne]=admin&password[$ne]=admin&login=login

Now that we can do NoSQL Injection, we can try to dump the current database. We used before the not equal [$ne], but we can also use regular expressions with [$regex]. If we send something like username[$regex]=^a and we get a 302 Found status code, we know that there is a user that starts with the letter a, if we get a 200 OK status code, we know the users doesn't start with a.

The idea here is to keep trying letters until we get the 302 Found status code, then we can append that letter at the end of the username value.

username[$regex]=^a&password[$ne]=admin&login=login

If we append the letter b at the end, we'll get a 200 OK status code, which means that there is no user that starts with ab.

username[$regex]=^ab&password[$ne]=admin&login=login

But, if I append the letter d, I get a 302 Found status code, which means that there is a user which starts with ad.

username[$regex]=^ad&password[$ne]=admin&login=login

Here is a python script I coded which basically automates this whole process. It finds valid users and their password, by exploiting the vulnerability explained before.

If we execute the script, we should get the users admin and mango with their passwords.

python3 exploit.py

If we try to log in via SSH with these credentials, we'll see that we can have a shell as the mango user.

ssh mango@10.10.10.162

From here we can become the admin user with the password that we obtained before, and then we could grab the user flag.

su admin

Privilege Escalation

Now we could try to list SUID binaries, and see if we can escalate privileges with one of them.

find / -perm /4000 2>/dev/null

We get a bunch of SUID binaries. If we search for the jjs binary on GTFOBins we'll see there is a way of getting a shell as the root user.

GTFOBins is a great list of binaries that can be used to escalate privileges if you have the right permissions:

https://gtfobins.github.io/

The following command will set the /bin/bash binary with the SUID permission, so we could get a shell as root.

echo "Java.type('java.lang.Runtime').getRuntime().exec('chmod +s /bin/bash').waitFor()" | jjs

Then all we have to do is execute bash with privileged mode and reap the harvest and take the root flag.

bash -p

Last updated

Was this helpful?