search
Page cover

Jason (Node.js Deserialization, npm)

First, we need to enumerate using nmap.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/jason  
╰─➤  nmap -A 10.10.101.131 | tee nmap.log
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-28 09:08 +0630
Nmap scan report for 10.10.101.131
Host is up (0.28s latency).
Not shown: 987 closed ports
PORT     STATE    SERVICE        VERSION
22/tcp   open     ssh            OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
80/tcp   open     http
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 OK
|     Content-Type: text/html
|     Date: Thu, 28 Apr 2022 02:38:45 GMT
|     Connection: close
|     <html><head>
|     <title>Horror LLC</title>
|     <style>
|     body {
|     background: linear-gradient(253deg, #4a040d, #3b0b54, #3a343b);
|     background-size: 300% 300%;
|     -webkit-animation: Background 10s ease infinite;
|     -moz-animation: Background 10s ease infinite;
|     animation: Background 10s ease infinite;
|     @-webkit-keyframes Background {
|     background-position: 0% 50%
|     background-position: 100% 50%
|     100% {
|     background-position: 0% 50%
|     @-moz-keyframes Background {
|     background-position: 0% 50%
|     background-position: 100% 50%
|     100% {
|     background-position: 0% 50%
|     @keyframes Background {
|     background-position: 0% 50%
|     background-posi
|   HTTPOptions: 
|     HTTP/1.1 200 OK
|     Content-Type: text/html
|     Date: Thu, 28 Apr 2022 02:38:46 GMT
|     Connection: close
|     <html><head>
|     <title>Horror LLC</title>
|     <style>
|     body {
|     background: linear-gradient(253deg, #4a040d, #3b0b54, #3a343b);
|     background-size: 300% 300%;
|     -webkit-animation: Background 10s ease infinite;
|     -moz-animation: Background 10s ease infinite;
|     animation: Background 10s ease infinite;
|     @-webkit-keyframes Background {
|     background-position: 0% 50%
|     background-position: 100% 50%
|     100% {
|     background-position: 0% 50%
|     @-moz-keyframes Background {
|     background-position: 0% 50%
|     background-position: 100% 50%
|     100% {
|     background-position: 0% 50%
|     @keyframes Background {
|     background-position: 0% 50%
|_    background-posi
|_http-title: Horror LLC
912/tcp  filtered apex-mesh
1039/tcp filtered sbl
2170/tcp filtered eyetv
2393/tcp filtered ms-olap1
2607/tcp filtered connection
3390/tcp filtered dsc
4125/tcp filtered rww
5298/tcp filtered presence
7443/tcp filtered oracleas-https
7938/tcp filtered lgtomapper
9594/tcp filtered msgsys

hashtag
Port 80

When you browse to http://10.10.101.131/, you will see nodejs webpage.

Insert mail to Email Address field, but no response. Let's use burp to intercept the data. You can see session cookie on response when i request with an email.

Let's decode the cookie value.

This Vulnerability come with Node.js deserialization (CVE-2017-5941). Here is Poc https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/. Generate rce using https://github.com/ajinabraham/Node.Js-Security-Course/blob/master/nodejsshell.py.

Here is the complete exploit.

Encode it to base64.

And request using this cookie vaule.

In netcat session, we got a reverse shell.

hashtag
User

Spawning a TTY Shell

Read the user flag.

hashtag
Root

Check privileges. You can run npm command using root privileges.

Here is a ref to privilege escalation https://gtfobins.github.io/gtfobins/npm/.

Finally, we got root shell.

PreviousMagician (ImageTragick, Port Forwarding)NextBiblioteca (SQLI, Python Library Hijacking)

Last updated