🧧Environment

https://app.hackthebox.com/machines/Environment

Used htbscan script for Recon and checking result of dir/dns/vhost

Recon

Website

Login-Page

Our recon script shows us a login page

User

Laravel

Our feroxbuster-scan shows us a upload page:

  • Laravel Version Identified: Laravel 11.30.0

  • PHP Version: 8.2.28

  • APP_DEBUG=True since we can see the stracktrace

detecting environment=preprod

We can bypass the Login-Page by adding /login?--env=preprod to the url while intercepting the login POST-Request. https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h

Reverse-Shell

We are getting redirected to the dashboad:

Now we gonna upload a webshell as userpicture but we need to bypass some detection.

Starting a listener and getting a reverse shell:

And we get our userflag:

Root

Continuing in our shell we download the gpg file

Ctrl-C on Attacker-Side if you think the file has been transfered, it is quite small should only be some seconds.

Same for the keys

move you gnupg-folder back afterwards:

Login in using that credentials

Checking what we can do and checking the scripts

The script /usr/bin/systeminfo is a bash script run as root, and it uses unsanitized system commands like dmesg, ss, mount, and column.

This means you can do a PATH hijack attack, because sudo will preserve env_keep+="ENV BASH_ENV"

Hijacking Path with BASH_ENV

Here’s how:

  1. /tmp/root.sh Hijack: The echo 'echo "BASH_ENV sourced as root!"; id; /bin/bash -p' > /tmp/root.sh command creates a new script at /tmp/root.sh. The contents of this file:

  • The first line will print a message indicating that BASH_ENV has been sourced.

  • The second line (id) will show the user ID, which should show root when executed with elevated privileges.

  • The third line (/bin/bash -p) will start a new interactive root shell with the -p flag, which preserves the environment and avoids resetting some environment variables that may give you additional access.

  1. Exploiting with env -i and sudo:

The command:

  • env -i runs a command with a clean environment (i.e., clears all environment variables except those explicitly passed).

  • BASH_ENV=/tmp/root.sh sets the BASH_ENV variable to point to the malicious script /tmp/root.sh.

  • The PATH variable is set to the default system PATH, which is fine for running standard commands, including sudo and /usr/bin/systeminfo.

  • sudo runs the systeminfo script with root privileges, but now the BASH_ENV is set to /tmp/root.sh, so the malicious script is sourced, and the root shell is spawned.

Why This Works

  • sudo does not reset BASH_ENV: When you run sudo, it typically does not reset the BASH_ENV variable unless explicitly configured to do so in the sudoers file. This allows you to control the environment in which systeminfo is executed, giving you the ability to inject your own commands as root.

  • Bypass Restrictions: The use of env -i to clear the environment variables except for BASH_ENV and PATH is crucial here. It prevents any other environment variables that might be present from interfering with your exploit.

Last updated