dns zone transfer

September 25, 2023

Snoopy – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec ClamAV, CVE-2023-20052, CVE-2023-23946, dns zone transfer, Git, git apply, HackTheBox, HTB, LFI, Mail Server, Man in The Middle, nsupdate, Patch File, SMTP, ssh-mitm, symlink, Update DNS Record, XXE 0

Machine Name: Snoopy
IP: 10.10.11.212
Difficulty: Hard

Summary

Snoopy is a hard machine that starts with discovering subdomains through DNS zone transfer, and exploiting an LFI to obtain site configuration files that revealed mailserver secret key. The key was used to update the mail server’s DNS records to receive mails on my local SMTP server. The mattermost subdomain discovered had an “email password reset link” page. The password was received on the SMTP server for user cbrown. Authenticated session of mattermost provided an option to interact with the server through SSH which was intercepted to perform a man-in-the-middle attack to fetch the SSH credentials of cbrown. The user cbrown could run “git apply” command as user sbrown which was exploited by using a known vulnerability that uses symbolic links to access files of the user running Git. This was used to write the SSH public key into sbrown and gain a SSH shell. Privilege escalation involved exploiting ClamAV’s XXE vulnerability to fetch the private key of root.

June 27, 2022

Trick – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec DNS, dns zone transfer, fail2ban, HackTheBox, HTB, hydra, Infosec, LFI, Linux Box, nginx, SMTP, SQLi, sqlmap, sub-domain-enumeration 0

Machine Name: Trick
IP: 10.10.11.166
Difficulty: Easy

Summary

Trick is a moderately easy machine that demands a lot of enumeration skills. It involves finding two sub-domains that can be found through DNS zone transfer and sub-domain fuzzing. One of the sub-domains has a SQLi that can be leveraged to gather information on the server and the other sub-domain has a LFI that exposes SSH private key. This key is used to gain SSH access to the user. Since the user can restart fail2ban as root, one of fail2ban’s configuration files needed to be modified to gain a reverse shell as root.