HaskHell
Teach your CS professor that his PhD isn't in security.
Scanning
Nmap
scan open ports and scan services
nmap -sV -sC 10.10.245.91
Starting Nmap 7.60 ( https://nmap.org ) at 2021-10-04 03:05 BST
Nmap scan report for ip-10-10-245-91.eu-west-1.compute.internal (10.10.245.91)
Host is up (0.00080s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 1d:f3:53:f7:6d:5b:a1:d4:84:51:0d:dd:66:40:4d:90 (RSA)
| 256 26:7c:bd:33:8f:bf:09:ac:9e:e3:d3:0a:c3:34:bc:14 (ECDSA)
|_ 256 d5:fb:55:a0:fd:e8:e1:ab:9e:46:af:b8:71:90:00:26 (EdDSA)
5001/tcp open http Gunicorn 19.7.1
|_http-server-header: gunicorn/19.7.1
|_http-title: Homepage
MAC Address: 02:A6:36:7C:DC:6D (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.24 seconds22 SSH 5001 HTTP
Enumeration
go for web server take a look on available pages
only Haskell files are Accepted to upload
Brute Forcing
dive into upload page lets create our malicious code rev.sh "Reverse Shell"
setup listener
Initial Access
upload rev.hs to submit directory
Privilege Escalation
Horizontal Escalation
we can access SSH private key of prof account
copy it to attack box named as prof.key
connect to target with more stable shell
Vertical Escalation
Sudo
check sudo list for prof account
we can run /usr/bin/flask with sudo privilege
let's check what this binary do
search for this error You did not provide the FLASK_APP environment variable
The FLASK_APP environment variable is used to specify how to load the application. While FLASK_APP supports a variety of options for specifying your application, most use cases should be simple.
Last updated