{"uuid": "1c9d598d-b6d0-4938-9a66-afc6050a07af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-20052", "type": "seen", "source": "https://t.me/timcore_hacking/2828", "content": "#hackthebox\n#htb\n#hacking\n\nHackTheBox - Snoopy\n\n00:00 - Introduction\n01:00 - Start of nmap, discovering ssh/dns/http\n02:30 - Taking a look at the website\n04:00 - Discovering a message about DNS, taking a look at the DNS and discovering zone transfers are enabled\n09:40 - Identifying the website is running with PHP Enabled, then running gobuster\n13:00 - Attacking the file download and discovering File Disclosure\n15:35 - We got lucky discovering the File Disclosure filter bypass, using FFUF which would be make catching this more consistent\n19:30 - Automating the File Disclosure by creating a python script\n24:30 - Looking at files on the target, discovering the DNS Configuration which has the RNDC Key to update DNS\n30:40 - Looking at the NSUPDATE Man page and then adding a the DNS Record mail.snoopy.htb and pointing it to us\n34:24 - Using python to run a SMTP Server and then having Mattermost's forgot password email us the password reset\n39:50 - Using the Mattermost bot to provision a server via SSH which causes it to SSH back to us\n42:30 - Backdooring PAM with pam_exec and a bash script to log passwords of users logging into our box, and grabbing CBROWN's password\n50:40 - cbrown can run Git apply as sbrown, looking for exploits around it and discovering CVE-2023-23946. \n1:08:50 - sbrown can run clamscan in debug mode as root\n1:11:45 - Looking at CVE's in clamav and discovering an XXE in the DMG Parser (CVE-2023-20052)\n1:23:30 - Downloading a DMG File (sublime), then modifying the XML to put an XXE in, scanning, then exfiltrating the root ssh key\n\nhttps://www.youtube.com/watch?v=6tn30O0SjVQ", "creation_timestamp": "2023-10-04T10:52:03.000000Z"}