Dyplesher HTB writeup
Dyplesher was my very first Insane Hack The Box machine. Drove me nuts to find an initial foothold and root wasn't much harder than a medium/hard box.
Enum
Enumeration was the part where I spend most of the time, was overlooking into the wrong places and ignored the correct.
NMAP results
Below results of NMAP, we can see SSH, HTTP, RabbitMQ, EPMD Memcached and minecraft-server services running, also an unknown service running on port 3000.
Result of common nmap scripts against open ports.
Web fuzz results
I first started fuzzing GOGS service, but nothing found so far with with low privileges on it.
After many ours of enumerating all web services with different wordlist, finally got a hit using dirb's common.txt on test.dyplesher.htb
Foothold
Knowing we have a .git on test.dyplesher.htb proceeded to dump all info I can with gogitdumper. This tool will download all the git objects and create a new repository in our local machine.
Once we have the files locally, we can proceed to see its contents, first checking what files are on stage.
As we can see, the repo have two removed files, we can undo them using git checkout --
README.md haven't had any useful information, but index.php showed us an auth connection for memcached on port 11211
Also we can see the repository pointing to a remote server, this part give us a clue what could be inside Gogs git server.
Memcached enumeration
Now that we have memcached credentials, is time to enumerate and find something useful. As the server is using SASL auth, we cannot use netcat nor telnet. So I installed memcached tools and check the status of the server.
This confirmed credentials worked, now proceed to check slabs
Next is to check how many items are stored in the cache, was 4 items in my case.
Then tried to list the keys, but wasn't able to see then in any way.
At this point tried to guess how the keys would be, tried things like email, user, password.
username key worked and gave us 3 users.
As username worked, tried password and it worked, giving us 3 bcrypt hashes.
John the ripper gave us 1 password out of the 3 hashes we got.
Gogs
Working password was for felamos user on http://10.10.10.190:3000 Gogs service.
Once logged in, we can see there was 2 repositories: memcached with same contents as we downloaded previously in the other web service and a gitlab repository.
We couldn't see anything useful on the repository itself, but there was a release package with a zip file ready to download. http://10.10.10.190:3000/attachments/a1b0e8bb-5843-4d5a-aff4-c7ee283e95f2
At this point, once the zip file downloaded and unzipped. We can locally clone the contents of an existing @hashed directory.
So far, there were 4 repositories. After reviewing them we observed that only 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce had things usefull for us.
Checking over the contents of this repository I've found that there was a DB file with users credentials.
After opening the file with an sqlite browser, decrypted the password with john the ripper.
Bukkit java plugin
The new credential allowed us to login into http://dyplesher.htb/home/console
At first tried to upload a jar plugin created by msfvenom, it failed due name too large while loading and also because the plugin requires an specific design for the tool consuming it.
Then looked at bukkit.yml in the same repo as users.db file which results is a plugin management for minecraft https://bukkit.gamepedia.com/Main_Page
Main site leads us into a how to write plugins guide https://bukkit.gamepedia.com/Plugin_Tutorial
Next step is to create a new maven project.
Once the project had a proper design, followed the guide to write plugins and adapted the required parts for bukkit plugins.
First was pom.xml file. Below is an example of my configuration.
Second is src/main/resources/plugin.yml file which is where bukkit will read plugin name and what java class will load as main.
Last file is src/main/java/htb/dyplesher.Xnaaro.java. This is the file where the actual java code with our RCE commands will be.
It requires to load JavaPlugin and extends its main class with it.
Our RCE code will be executed while loading/enabling the plugin.
At first tried to get a reverse shell, but it didn't work as expected because there was a firewall in the box blocking outgoing connections.
After enumerating sometime the box, saw the commands were running as MinatoTW user.
So, just added my SSH key into his authorized_keys file.
Finally, create a .jar package with maven
In order to raise the RCE, first we need to upload the plugin package and then enable it in the GUI. In the plugin list the name was a long hash, but using plugin name xnaaro in my case, properly executed it.
And we have ssh access to minatotw user.
Felamos user
After enumerating a couple of things, saw minato user was in wireshark group.
As there is rabbitmq and memcached running, we may be able to intercept something useful from it.
Downloaded the .pcap file to my local.
And looked at the contents, we where able to find some auth strings.
Credentials worked for felamos and yuntao users.
Cuberite
Once inside felamos $HOME directory we can see a file with some information on what to focus and how to do it.
It refers to some service that read on the rabbitmq queues and open an URL.
Checking running processes we can observe an interesting one executing something called Cuberite.
Investigated a bit what the services was doing and what languages uses it, found out that the plugins were written with lua programming language. https://book.cuberite.org/#0.1
At first tried to read queues, but auth was required. Looking at the previous captured .pcap file, I was able to see another credential for AMQP.
Then wrote a python script to connect rabbitmq and send a message into the queue. Used this guide to write the code https://www.rabbitmq.com/tutorials/tutorial-one-python.html
Cuberite was expecting an URL in the message and outgoing connections was blocked by the firewall.
Our only option was to use a hosted service inside the box and point the URL to localhost.
Contents of the lua exploit inside the box.
Method was the same as for the low privileged shell, copy our SSH key into root's authorized_keys
I had to execute the exploit a couple of times until it worked as expected.
We can see the lua exploit was getting retrieved by the service.
Root
And we got root user.
This box took me 25 hours of work, most of the time was in the enumeration part, once you know the behaviour of the services is easily accomplished after some research and development guides.
Hope you liked it, happy hacking!
Last updated
Was this helpful?