sábado, 9 de julio de 2022

RouterSpace HackTheBox Writeup

logo

Scanning

We run nmap on 22 and 80 ports with scripts and software versions.

Enumeration

We access port 80, we see the website of a router.

We can see a button where we download a file "RouterSpace.apk".

Download and extract the contents of the apk. I looked in case it stored some credentials that I could use for the SSH service, but it did not.

We check the apk with MobaSF, we find the domain "routerspace.htb":

We access the web service through the domain, but it goes to the same site.

Exploitation

We proceed to virtualize the apk (I used Anbox) and I configured my Burp on port 9000. (Yes, the picture is wrong, sorry)

adb shell settings put global http_proxy 192.168.174.130:9000
adb install RouterSpace.apk

We check that it has been installed correctly, double click and run them.

View RouterSpace application

We intercept the request by pressing the button on the mobile application, we see that it appears to be executing an action such as a ping on the remote device activity check.

It was easy, as it is a typical vulnerability in IoT/IIoT devices, we evidenced that it is possible to inject commands.

We abuse vulnerability for read "user.txt" file:

I saw that it did not reach the id_rsa, but it does have the authorized_keys file

So I will insert my public key in the file and I should get access to the machine via SSH.

We connect to SSH service:

Privilege Escalation

We can use linpeas tool and we enumerate the SUDO version 1.8.31:

I downloaded the checker and PoC from Bl4sty and my friend Lockedbyte.

Exploit: CVE-2021-3156

We upload the files, compile and run the checker... It is vulnerable! We run the exploit with option "1", become root and read the flag.


About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton