Exploiting Local File Inclusion at Ruby on Rails API, Remote Code Execution on LimeSurvey and Consul by HashiCorp
Reconnaisance & Information Gathering
scan open port / running service using nmap. there are 2 open ports ssh and http.
we know that there is port 80 (http) open. that means there is a web service running. visit the website heal.htb or machine_ip:80. this website can be used to create a resume. there is a form to login. we can try to sign up, but it's better to enumerate it first to get more information about the target.
enumerate directories and subdomains on the website to obtain more information about targets and expand the attack surface.
we don't get any interesting info from directory enumeration, but we found a subdomain (api.heal.htb). from the index page at the api subdomain, we can see that the web service is Ruby on Rails version 7.1.4.
analyze how the website works and operates to gain more insight about target. we can try various features in it and maybe we can find vulnerabilities. try to sign up on the main website.
we automatically log in after signing up and we are directed to the resume page. On this page there is a resume builder feature. There are profile, survey and logout buttons at the top. At the very bottom of the page there is an export as pdf button which functions to download the resume you have built.
if we do further enumeration on the api.heal.htb subdomain, we can find several api endpoints that match with the features in the main domain (heal.htb). for example, on the heal.htb page there are features for creating a resume, viewing profiles, and downloading resume. and in the api.heal.htb subdomain there are resume, profile, and download endpoints. so we can conclude that the domain heal.htb is the frontend and api.heal.htb is the backend.
there is other interesting findings. we found other subdomain on the survey page (take-survey.heal.htb). we can access it by pressing the survey button then press take the survey button at survey page.
if we go to the index.php page we can find out that there is an admin user ([email protected]). we also know that the subdo using LimeSurvey.
we also found login page if we do directory enumeration using dirsearch.
after we carried out information gathering and reconnaisance, we got quite a lot of information about the target. with this information we know how the service or target works and the attack surface of the target. with sufficient information about the target, we can carry out analysis and look for vulnerabilities in the target.
Recon Results :
there are 3 domain on target (heal.htb, api.heal.htb, take-survey.heal.htb)
heal.htb is the frontend, api.heal.htb is the backend (Ruby on Rails 7.1.4)
web feature and api endpoint (resume, download, profile)
take-surver.heal.htb using LimeSurvey
there is an admin named ralph ([email protected])
Initial Access & Foothold
download the resume and intercept the traffic using burpsuite. forward the request until we get request at download endpoint.
pay attention to the following request. at the request line (the first line of the http request) we make a get request to the /download endpoint with the ?filename= parameter. We can assume that this request aims to retrieve a file in a directory.
we can abuse this feature to retrieve any file in the server (example: /etc/passwd). we managed to get a response of 200 (ok) and data from /etc/passwd. that means the /download endpoint has a local file inclusion vulnerability.
Local File Inclusion [LFI]
The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a “dynamic file inclusion” mechanisms implemented in the target application.
Local file inclusion (also known as LFI) is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application. This vulnerability occurs, for example, when a page receives, as input, the path to the file that has to be included and this input is not properly sanitized, allowing directory traversal characters (such as dot-dot-slash) to be injected.
source : owasp.org
we can ask AI for directory structure of Ruby on Rails and sesitive info inside it. by knowing the directory structure and sensitive files in it, we can look for files that most likely contain credentials in them to gain initial access.
database.yml file contain information about the database that being used. we can see there are two databases at /storage directory (test.sqlite3, and development.sqlite3).
based on the database.yml file development.sqlite3 is the database used by the target in production. open the file to obtain the credentials. development.sqlite3 seems to contain the credentials for web heal.htb. There is a user that we use when registering and user ralph (web administrator).
crack ralph password hash to get the password for ralph account. we must identify the type of hashing algorithm used in the hash. to identify hash type we can use hash identifier (hashes.com.
crack the hash using hashcat.
based on our finding earlier while doing reconnaisance (at subdo / LimeSurvey) and while we testing LFI vulnerability (get /etc/passwd), we knew that user ralph is exist. try to login via ssh using cracked password.
we can't log in as ralph via ssh, maybe the password is wrong or maybe ralph dones't have access to ssh. since ralph is the web admin, we try logging in as ralph on the heal.htb web maybe we can find an additional feature that the admin has. but we didn't find additional feature that admin usually has (example: dashboard).
try logging in elsewhere. during recon we find the subdo take-survey.heal.htb. maybe we can try to log in there. and we are logged in.
search for information about limesurvey vulnerabilities or exploits on google.
CVE-2021-44967 allows us to achieve remote code execution via the plugin's upload and install functions. source : nvd.nist.gov
even though based on information from the nvd.nist.gov website that the vulnerability exists in limesurvey version 5.2.4 and limesurvey at our target using version 6.6.4, we can still exploit this feature because until now there has been no solution for this vulnerability since this vulnerability was disclosed. source : pentest-tools.com
we can exploit this vulnerability using exploit from https://github.com/Y1LD1R1M-1337/Limesurvey-RCE
download the exploit, adjust ip address and port at php-rev.php file with listener. add compatibility configuration for version 6 in config.xml.
zip config.xml and php-rev.php into one zip file. the zip file name must be the same as the zip file name on github. save the zip file in the same directory as exploit.py.
set up netcat listener and run the exploit. we got shell as www-data :3
Privilege Escalation to User
we got shell access to the server as www-data. user flag is usually located in the user home directory. we need to perform privilege escalation to the user to get user flag. we can use linpeas to look for loopholes that can be exploited for privilege escalation.
LinPEAS LinPEAS is a script that search for possible paths to escalate privileges on Linux/Unix*/MacOS hosts.
move linpeas from host to target via python http server. set the http server at linpeas directory and download linpeas from target server using wget.
run linpeas.
we found a password on a php file.
access the php file and it turns out that the password used for the database.
even if it turns out that the password is a database password, there is a possibility that another user will use the same password. try logging in as ralph with that password. login failed. if you look in the home directory, there is a home directory for another user, ron. try logging in as ron with that password. login successful.
don't forget to grab user's flag.
Privilege Escalation to Root
first, we need to log in as ron via ssh to get more stable and better shell.
check for listening port to discover running service using netstat.
there is port 8500 listening. use curl to retrieve data from the listening port. we get a response in the form of html file that says moved permanently but there is a href that goes to the /ui/ directory. use curl to retrieve data from /ui/ directory, we got response again with html title consul by hashicorp.
because port 8500 can only be accessed locally, we need to do port forwarding using ssh so we can access that resources.
we can access that resources from our host.
look for information about vulnerabilities in Consul on the internet.
Consul by Hashicorp RCE
in a certain configuration of Hashicorp Consul, an unauthentication attacker may be able to archive remote command execution on the server. the necessary conditions that make an agent vulnerable to this attack are:
- the API is available on an interface that can be accessed over the network.
- script checks are enabled.
- ACLs are disabled or an ACL token is compromised.
given the above conditions, an attacker can register a check on a remote agent with a malicious payload. By design, script checks allow arbitrary code execution, so allowing service registration with checks enabled via an exposed API presents an RCE (remote code execution) threat.
source: hashicorp blog
we can check whether the configuration in the consul on the target are vulnerable and allows us to obtain RCE by visiting the endpoint /v1/check/self. because we access the consul directly from local (not over network, direct access from the server as a user via SSH port forwarding so we can access it from our host) and we can access the consul website, which means we are authorized. so we don't need to fulfill all the requirements above to obtain RCE. the only configuration we need is script checks enabled which is true in this case.
we can use this exploit to obtain RCE. source: exploit-db
set a listener and run the exploit. we got root, machine pwned :3