Node Writeup
Node is about enumerating a Express NodeJS application to find an API endpoint that shares too much data including user password hashes ...
Vulnerability Exploited: Broken Access Control (CWE-284)
System Vulnerable: 10.10.10.58
Vulnerability Explanation: The /users API endpoint was exposed and that allowed us to get a list of credentials without having any access rights. Although access control is being done on other endpoints, the developers must have forgotten to restrict access to this endpoint.
Vulnerability Fix: Proper access control should be applied on all sensitive API endpoints
Privilege Escalation Vulnerability: Linux Kernel Outdated - Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation (CVE-2017-16995). The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.
Vulnerability Fix: Update the Linux Kernel.
Severity: Critical
An initial nmap scan revealed the Hadoop-datanoe Apache Hadoop running on port 3000/tcp.
The MYPLACE website initial page
Check tom account while intercepting the traffic using burpsuite to get the following request.
Change the directory from /api/users/tom to /api/users and resend the request. All the user's credentials are displayed as the following:
Crack the password as sha256 using hashtoolkit.com to get the following credentials
Login as admin and download the Backup
The backup file needs to be decoded and cracked to get its content, to do this follow the next steps:
Check the content of app.js file
The user mark used to connect on mongodb, using the following credentials: mark:5AYRft73VtFpc84k. Using the some credentials to establish an ssh connection
Privilege Escalation:
Check the Linux kernel version using uname -a command
Search for public exploit using searchsploit tool
https://www.exploit-db.com/exploits/44298
Download the exploit on the local machine using wget and compile it
Give the file the execution permission and run it to elevate the privilege to root permission.
user.txt
root.txt
Lessons Learned
To gain an initial foothold on the box we exploited three vulnerabilities.
Broken access control. The /users API endpoint was exposed and that allowed us to get a list of credentials without having any access rights. Although access control is being done on other endpoints, the developers must have forgotten to restrict access to this endpoint. Proper access control should be applied on all sensitive API endpoints.
Weak login credentials and insecure hashing implementation. We were able to crack the passwords we found in the users file in a matter of seconds. That was due to two reasons: (1) the users had chosen easy passwords that were easily crackable, and (2) the passwords were not salted and therefore they can be easily looked up in a pre-computed table (rainbow tables) to see if the given password hash matches any of the hashes in the table. Therefore, to avoid this, the application developers should enforce strong password policies on users and use a salt when hashing users’ passwords.
Weak encryption credentials. The backup file we found was zipped and encrypted with a weak password. The administrators should have used a sufficiently long password that is not easily crackable.
Hard coded credentials and password reuse. After cracking the password on the zipped file we found an app.js file that contains hard coded credentials. Although the credentials were for mongodb, a service that was not publicly exposed, the user used the same credentials for his SSH account. This final vulnerability chained with the above listed vulnerabilities allowed us to gain initial access to the box. When possible, developers should not embed credentials in files and security awareness should be given to users on password management best practices.
To escalate privileges we exploited two vulnerability.
Security misconfiguration of app.js. The app.js file was being run as a scheduled task by the ‘tom’ user, although the file was executing code from mongodb using a less privileged user’s credentials (mark). This allowed us to escalate our privileges to ‘tom’. To avoid that, mark should have been the owner of the scheduled task.
Insufficient user input validation in backup binary. The user ‘tom’ was configured to be in the admin group and therefore had execute rights on the backup binary. However, this binary file had the suid bit set and was owned by root. Since command line arguments were not properly validated, we were able to exploit a command injection to get root level access on the system. This could have been avoided if user input was properly validated — whitelisting instead of blacklisting, use of safe functions, etc.
Or You can use:
Linux kernel exploit to escalate your privilege
Last updated