Headless (Easy)

Easy difficulty Linux box.....

Enumeration

Let's start with usual nmap scan:

Not shown: 998 closed tcp ports (reset)
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
|   256 90:02:94:28:3d:ab:22:74:df:0e:a3:b2:0f:2b:c6:17 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJXBmWeZYo1LR50JTs8iKyICHT76i7+fBPoeiKDXRhzjsfMWruwHrosHoSwRxiqUdaJYLwJgWOv+jFAB45nRQHw=
|   256 2e:b9:08:24:02:1b:60:94:60:b3:84:a9:9e:1a:60:ca (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkBEMKoic0Bx5yLYG4DIT5G797lraNQsG5dtyZUl9nW
5000/tcp open  upnp?   syn-ack ttl 63
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 200 OK
|     Server: Werkzeug/2.2.2 Python/3.11.2
|     Date: Sat, 20 Jul 2024 14:19:29 GMT
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 2799
|     Set-Cookie: is_admin=InVzZXIi.uAlmXlTvm8vyihjNaPDWnvB_Zfs; Path=/
|     Connection: close

So we see ssh and a web server running on port 5000, let's start a directory fuzzing before we go check it, to have some sort of recon running in the background to save time.

Now let's check the website, which has only one button that leads us to /support and seeing it:

Support page in the website

Let's check /dashboard

Showing dashboard in the website

Nothing in here.... let's get back to the support page.

So we have a contact form, I tried some XSS payload in the "Message" field as "<b>Hello</b>", and I got this:

Flagging our XSS payload

Exploitation

So we see all headers get displayed in here, and sent for admin, so let's try doing an XSS but in headers.

Will do it in Burp repeater:

Trying to send this request to which I added "My-Header" and had an alert in to see if it will be processed, after sending it i did this:

Getting the URL from there and checking it in the browser:

Alert worked!

We have a valid XSS, now let's do a payload to steal a cookie, i will modify the value of the header to be:

And I will start a server in my machine and send our request:

Couple of seconds later we get a hit:

We have a valid admin cookie, let's try it in the dashboard page:

Report generating in the dashboard

Let's intercept it in Burp and see what we can do.

The date is being sent like this date=2023-09-15 let's try for basic command injection.

Like:

And we get this in the response:

So perfect! Let's get a shell by sending:

Don't forget to URL encode your payload.

Now we have a shell as "dvir".

First i will just stabilize the shell doing:

Now root time.

Privilege Escalation

I will start with checking sudo privileges and i get this:

Let's see what is this "syscheck" file.

A Bash script, let's check our rights over it.

We can read it, so let's do that.

In the last if condition we see it will run "initdb.sh" from the current working directory, which might be a bit dangerous, we can make a custom one and make it give us a reverse shell.

So here is what i did:

Now just executing the sudo rule, and don't forget to start your listener:

We got a root shell.

And that's it for the box!

Happy Hacking :) 🧛

PreviousHTB BoxesNextCodify (Easy)

Last updated