HTB Yummy update

Author: bytebl33d

_posts/2025-02-21-htb-yummy.md

@@ -9,10 +9,10 @@ toc: true
 header:
     teaser: "/assets/images/headers/Yummy.png"
 ---
-"Yummy" is a hard Linux machine that starts off by finding a Local File Inclusion (LFI) vulnerability in order to find several cron job scripts. These scripts lead to a database backup script of the website's source code that leaks a secret JWT key to forge a token for the admin account on the site. The backend is vulnerable to SQL injection that gives us initial access to the machine. Further enumeration reveals the password for another user that can run a command as another user to move laterally to a developer account. This account can run `rsync` as root, which allows us to copy the root user's SSH key.
+Yummy is a hard box that starts with a Restaurant web app using Caddy web service, on port 80, where an attacker finds an arbitrary file read HTTP Location header, which is not handled and sanitized properly by the default Caddy configuration. This allows an attacker to find several `cronjob` scripts that allow downloading the web app source code. Reading the source code, the web app uses JWT RSA keypairs to forge an admin token and escalate privileges on the web app. The admin panel has an SQL injection, allowing arbitrary file write over a file running periodically (`cronjob`). Improper directory permissions allow the attacker to move laterally to `www-data` and eventually a `dev` user. The `dev` user can execute `rsync` binary as root, which helps escalate privileges to root.
 
 # Reconnaissance
-Our initial port scan only shows two standard ports open, 22 and 80.
+Our initial port scan only shows two ports open: SSH on port 22 and a web server on port 80. By looking at the `http-server-header`, we identify that the server is running Caddy as a reverse proxy.
 
 ```
 # Nmap 7.94SVN scan initiated Sun Oct  6 14:04:12 2024 as: nmap -p- -sCV -v -oN yummy.nmap 10.129.74.97
@@ -32,15 +32,17 @@ PORT   STATE SERVICE VERSION
 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 ```
 
-Navigating to the website redirects us to `yummy.htb` and also displays that the version in use is **Caddy**. We add this domain to the `/etc/hosts` file and continue to explore the webpages. After creating an account and logging in, we can make a reservation.
+Navigating to the website redirects us to `yummy.htb`. We add this domain to the `/etc/hosts` file and continue to explore the webpages. The website is hosting a restaurant application to manage appointments and reservations. After creating an account and logging in, we can make a new reservation.
 
 ![](../assets/images/writeups/yummy/booking.png)
 
 From our dashboard, it is possible to save our reservation to a calendar file (ics) via the `save iCalendar` option.
 
 ![](../assets/images/writeups/yummy/save-icalendar.png)
 
-The request makes a call to the `/export/Yummy_reservation_YYYYMMDD_hhmmss` endpoint where the date is the current timestamp of the export. This endpoint is vulnerable to LFI and we can alter the request to read arbitrary files as the `www-data` user.
+The request makes a call to the `/export/Yummy_reservation_YYYYMMDD_hhmmss` endpoint where the date is the current timestamp of the export. This endpoint is vulnerable to LFI and we can alter the request to read arbitrary files as the `www-data` user. Another thing to notice is that the cookie uses a JWT token which can be decoded with tools like [CyberChef](https://gchq.github.io/CyberChef/) or [jwt.io](https://jwt.io/). Decoding the token, there's a role `customer` and fields `e` and `n` are specified, which are essential encryption exponent and modulus respectively.
+
+Manipulating the GET request to `/export/../../etc/passwd` gives us Arbitrary File Read.
 
 ![](../assets/images/writeups/yummy/LFI.png)
 
@@ -75,11 +77,12 @@ cd /var/www
 /usr/bin/zip -r backupapp.zip /opt/app
 ```
 
-This zip file is a backup of the original source code located in `/opt/app`. After downloading the zip and extracting it, we have the application's source code.
+We can download the backed-up file from `/var/www/backupapp.zip`. This zip file is a backup of the original source code located in `/opt/app`. Once unzipped, we can view the content of `app.py`.
 
 ![](../assets/images/writeups/yummy/backup.png)
 
-We can proceed to do some code analysis and see if we can spot additional vulnerabilities or credentials. The login method in `app.py` looks interesting.
+We can proceed to do some code analysis and see if we can spot additional vulnerabilities or credentials. The login method in `app.py` looks interesting. The pair of RSA keys are generated in the `config/signature.py`. The validation is done in the
+`middleware/verification.py`.
 
 ```python
 if user:
@@ -154,7 +157,7 @@ Let's perform a search query on the admin dashboard and intercept the request wi
 
 By using SQLMap we can check our user privileges:
 
-```bash
+```console
 $ sqlmap -r request --privileges
 
 [15:27:11] [INFO] retrieved: 'FILE'
@@ -214,7 +217,7 @@ write_file "" "/data/scripts/dbstatus.json"
 
 We start a netcat listener on port 9001, run the above script and after a minute we should have received a connection back to our machine.
 
-```bash
+```console
 $ nc -nvlp 9001
 mysql@yummy:/var/spool/cron$
 ```
@@ -247,8 +250,8 @@ www-data@yummy:~/app-qatesting/.hg/store/data$ strings app.py.i
 
 We can now SSH as `qa`.
 
-```bash
-ssh qa@yummy.htb
+```console
+$ ssh qa@yummy.htb
 qa@yummy:~$ cat user.txt
 ```
 
@@ -306,7 +309,7 @@ The key element is the `--chmod` flag of the rsync binary. This additional param
 
 ```console
 $ chmod 600 id_rsa
-$ shh -i id_rsa root@yummy.htb
+$ ssh -i id_rsa root@yummy.htb
 root@yummy:~# id
 uid=0(root) gid=0(root) groups=0(root)
 root@yummy:~# cat root.txt