GoodGames
Intro
Recon
Start Reconnaissance
Browse to http://10.10.11.130:80
Python webserver
Login page found
Footer says
GoodGames.htb
Add the found values to the /etc/hosts file
Directory Brute Force
Start BurpSuite and intercept traffic from browser via FoxyProxy.
Create an account at
http://10.10.11.130/signup
Try to login - Successful - it redirect to
/profile
Exploitation
SQL Injection - sqlmap
Edit Detailsform does not work - always returnsHTTP 500Check the login form for SQL injection using the intercepted request in BurpSuite (with a valid email), since the client-side JavaScript requires a valid email address to submit.
It redirects to the
admin's profile pages
Save the request with correct email login and run
sqlmapon it
Enumerate the database and tables, checking for sensitive information
Extract all the data from the
usertables
SQL injection - manual
This can be done manually too - check HTB: GoodGames | 0xdf writeup
Dump the full DB with
UNIONinjection
Get
maindatabase's tables
Get
users
Dumped users are
Crack the hash
Try to crack admin's hash 2b22337f218b2d82dfc3b6f77e7cb8ec with https://crackstation.net/ or search Google
📌 Login with [email protected]:superadministrator
As admin, there is an extra gear icon at the top right of the page, that links to
http://internal-administration.goodgames.htb/login
SSTI
Visit the page http://internal-administration.goodgames.htb/login and try to login with admin:superadministrator
Test for SSTI (Server Side Template Injection) in the Python Flask application
Open user's Settings and try the following payload in the Full Name input field
It changed the username to the result of
49
Find which template engine it is using
The template engine is
JinjaCheck system commands execution via the following SSTI
It works, and is
roottooGet a reverse shell with the same payload, encoding the payload to base64 first
Get a better shell
By checking the IP, it can be found out the reverse shell is inside a Docker container
Foothold
The
1000UID hints that the user's home is mounted inside the Docker container from the main system, since there is noaugustususer or1000UID in the container's/etc/passwdconfirm it with
mount
Shell as user augustus
Knowing the container's IP is 172.19.0.2 and the host machine is the gateway with IP 172.19.0.1, let's try to enumerate host's ports, from inside the container using a bash one-liner TCP port scanner:
SSHis listening internally. Attempt a password reuse for bothrootandaugustusaccounts📌
augustus:superadministratorworks!
The shell is the GoodGames host itself
Privilege Escalation
Docker Escape
Docker is in the process list, confirming the app is hosted within a Docker container
Shell as root
The
augustushome contains the same files as inside the containerFiles can be written in the host and change their permissions to root within the container, reflecting the permissions on the host system as well
Copy host's bash binary to the user's directory and exit the SSH session
The
bashbinary must be the one from the host, not from the container (which uses an older library)
Apply SUID permissions and change the ownership of the bash executable to root:root from within the Docker container
SSH back into the host
changes to
bashfile are reflected
Spawn a shell with the effective UID (
euid) of root
Summary
Nmap scan showed only port 80 open.
Login page vulnerable to time-based SQL injection; dumped database with
sqlmap.Cracked admin hash and logged into the main site.
Found Flask app login and accessed it via password reuse.
Exploited Flask SSTI vulnerability to get a reverse shell in a Docker container.
Container had the host’s
/home/augustusdirectory mounted.Reused the same password to SSH into the host as
augustus, from the container.Used the mounted home directory to drop a SUID
bashbinary and escalate to root.
Extra
Last updated