# Lessons Learned - Javascript files with `.min.js` are minified or obfuscated - Deobfuscate with an LLM or other tool - `/api/v1` may show all available endpoints --- # After-Action Attack Sequence - BLUF: minified/obfuscated javascript; API endpoints; json payloads; CVE-2023-0386 - Notice that `/invite` is very inviting as it states to "hack your way in" - Deobfuscated js file sends POST request to an API endpoint with a json payload - Get an invite code that works on `/register` by targeting different API endpoints and ROT13+base64 decoding - Once we have access to the dashboard, we notice that we can generate `.ovpn` files - Performing this action hits another API endpoint - We can also see all API endpoints at `/api/v1` now --- # Discover Ports & Services - `ping` test ![[images/Pasted image 20260611181242.png]] - `nmap` scan - light ![[images/Pasted image 20260611181259.png]] - `nmap` scan - detailed ![[images/Pasted image 20260611181338.png]] --- # Service Enum ## Port 80 (http): nginx ### Initial Enum - visit site ![[images/Pasted image 20260612190914.png]] - `request:response` in burp ![[images/Pasted image 20260612183649.png]] - source code - `hall of fame` is interesting; maybe an IDOR? ### Secondary Enum - garbage page > redirects to `/404` ![[images/Pasted image 20260612193319.png]] - `robots.txt` and `sitemap.xml` > both redirect to `/404` - `index.html` and `index.php` > both redirect to `/404` - tech stack fingerprint - `whatweb` scan ![[images/Pasted image 20260612193521.png]] ### Fuzzing - directory ![[images/Pasted image 20260612193805.png]] - `/api` recursive - had issues with `feroxbuster` > maybe because it's using GET method by default - subdomain ![[images/Pasted image 20260612194518.png]] - vhost ![[images/Pasted image 20260612194454.png]] ### Individual Pages #### `/login` - Visit page ![[images/Pasted image 20260612191028.png]] - `request:response` in burp ![[images/Pasted image 20260612191103.png]] - forgot password appears broken #### `/api` - initial visit to home page had api indications > both 301 redirects ![[images/Pasted image 20260612191232.png]] #### `/invite` - looks very inviting > based on text: "hack your way in :)" ![[images/Pasted image 20260612191939.png]] - `request:response` in burp ![[images/Pasted image 20260612192043.png]] - view source ![[images/Pasted image 20260612192232.png]] - looks like it sends a POST to `/api/v1/invite/verify` with json payload to verify ![[images/Pasted image 20260612192927.png]] #### `/register` - visit page ![[images/Pasted image 20260612192345.png]] - looks like this may need a valid invite code ![[images/Pasted image 20260612192451.png]] - NOTE: interesting that the `invite code` field is blanked out > input readonly type ![[images/Pasted image 20260612193137.png]] - send a POST to `/api/v1/user/register` ![[images/Pasted image 20260612192544.png]] - also, the error page correspond to a GET request with the `error` parameter ![[images/Pasted image 20260612192650.png]] --- # Things to try later - default creds against `/login` - SQLi against `/login` - test API endpoints --- # Revisit `/invite` - View js files in dev tools - De-obfuscate `htb-frontend.min.js` and `inviteapi.min.js` > `.min` indicates that the code is minified or obfuscated ## Inspect `inviteapi.min.js` - Deobfuscated version reveals a `verifyinvitecode` and `makeinvitecode` functions ![[images/Pasted image 20260612201706.png]] - Obviously we need to generate ourselves an invite code ## Interact with `/api/v1/invite/how/to/generate ` - send a request with a blank json payload ![[images/Pasted image 20260612202157.png]] - this gives us ROT13 encrypted data - try to decrypt the ROT13 encrypted data ![[images/Pasted image 20260612202344.png]] ## Interact with `/api/v1/invite/generate` - let's send a POST request to `/api/v1/invite/generate` ![[images/Pasted image 20260612202439.png]] - base64 decode the code ![[images/Pasted image 20260612205718.png]] - after base64 decoding and entering into `/invite`, we are redirected to `/register` where the readonly invite code field is now populated ![[images/Pasted image 20260612202635.png]] --- # Foothold ## Authenticated Dashboard - After using the invite code to register an account, we are in a dashboard ![[images/Pasted image 20260612204856.png]] - Looks like there's a security bug at play ![[images/Pasted image 20260612205201.png]] - Maybe it's in `/home/access` ![[images/Pasted image 20260612205314.png]] - Connection pack hits `/api/v1/user/vpn/generate` ![[images/Pasted image 20260613152305.png]] ## API endpoints - visit `/api/v1` ![[images/Pasted image 20260613152543.png]] - try `/api/v1/admin/auth` ![[images/Pasted image 20260613152714.png]] - try `/api/v1/admin/settings/update` ![[images/Pasted image 20260613153703.png]] - try again > looks like we need to swap username for email ![[images/Pasted image 20260613155730.png]] - missing `is_admin` parameter ![[images/Pasted image 20260613155945.png]] - try again with parameter ![[images/Pasted image 20260613160122.png]] - remove quotes from non-string boolean integer value ![[images/Pasted image 20260613160151.png]] - confirm with `/api/v1/admin/auth` ![[images/Pasted image 20260613160332.png]] - now try to hit `/api/v1/admin/vpn/generate` >that works ![[images/Pasted image 20260613160507.png]] - now try command injection on `username` input string - include # at the end to comment out garbage ![[images/Pasted image 20260613160749.png]] - insert a revshell in place of `id` - it hangs ![[images/Pasted image 20260613160919.png]] - and we have a callback ![[images/Pasted image 20260613161013.png]] - `.env` includes db creds ![[images/Pasted image 20260613161127.png]] - there is a mysql server on localhost > we cannot use admin to access locally? ![[images/Pasted image 20260613161314.png]] - check users with login shells ![[images/Pasted image 20260613161510.png]] --- # Privesc ## Enum - try to `su admin` > we have access to `admin` ![[images/Pasted image 20260613161719.png]] - drop in a pubkey for ssh access > now we have a proper shell ![[images/Pasted image 20260613161855.png]] - grab `linpeas.sh` from kali and run ![[images/Pasted image 20260613163145.png]] - `sudo` version 1.9.9 may be exploitable - `/var/spool/mail` has a telling note ![[images/Pasted image 20260613164336.png]] - maybe this is CVE-2023-0386 ![[images/Pasted image 20260613164355.png]] ## GameOverLay - grab `gameoverlay.sh` from kali and run ![[images/Pasted image 20260613164943.png]] - getting an error - check kernel and os versions ![[images/Pasted image 20260613165658.png]] - looks like gameoverlay is not applicable to this kernel+os version combo ![[images/Pasted image 20260613191745.png]] - need to do further research on CVE-2023-0386 ## CVE-2023-0386 - Use poc at: [security-labs-pocs/proof-of-concept-exploits/overlayfs-cve-2023-0386/poc.c at main · DataDog/security-labs-pocs · GitHub](https://github.com/DataDog/security-labs-pocs/blob/main/proof-of-concept-exploits/overlayfs-cve-2023-0386/poc.c) - create `poc.c` on target and compile there, then make executable - run ![[images/Pasted image 20260613193144.png]] - rooted!