Docker » THOVITI SIDDHARTH

September 2, 2023

MonitorsTwo- HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Cacti Group, capsh, CVE-2022-46169, Docker, JohnTheRipper, LinPeas, MySQL, overlay2, RCE 0

Machine Name: MonitorsTwo
IP: 10.10.11.211
Difficulty: Easy

Summary

MonitorsTwo is an easy machine that starts with exploiting the Cacti monitoring software to gain a shell. The shell obtained is a container host where we find hashes of user in a database file. After cracking the hashes, we obtain the user shell through SSH. Privilege escalation consists of leveraging insufficient permissions on the Docker overlay2 filesystem which allows host users to run privileged binaries on the container. To create a setuid bash binary on the docker container, capsh’s capabilities were misused to gain privileges as root. Finally, the binary was executed on the host machine to obtain a root shell.

August 13, 2023

Busqueda – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Code Injection, Docker, eval(), Gitea, HackTheBox, HTB, Infosec, Injection, Linux Box, MySQL, Path Hijacking, Privilege Escalation, Relative Path Hijacking, Searchor, sudo, Writeup 0

Machine Name: Busqueda
IP: 10.10.11.208
Difficulty: Easy

Summary

Busqueda is an easy machine that challenges you to read code, find the vulnerability, and craft syntactically correct payloads that suit the code when injected. The privilege escalation is straight forward and explores relative path hijacking through SUID scripts to get root.

June 12, 2022

OpenSource – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Container Escape, Docker, Flask, Git, git-hook, Gitea, HackTheBox, HTB, htb-opensource, Infosec, LFI, Linux Box, pspy, Werkzeug, Writeup 0

Machine Name: OpenSource
IP: 10.10.11.164
Difficulty: Easy

Summary

OpenSource like it’s name is all about exploiting information that is openly available. It demands knowledge about LFI, Docker, Flask, understanding source code, and ofcourse, Git. To get the user shell, LFI vulnerability was exploited to get RCE. Then, a docker container needed to be escaped in order to gain the user shell. Knowledge of tunneling helps to connect to the host machine and enumerate further. Ability to access the host machine lets us enumerate further and gain access to user via leaked credentials. Escalating privileges requires understanding the concept of Git hooks to exploit a process running as root. This box is great for someone who is new to programming and learning code/version management tools like Git.