exiftool

November 25, 2023

Pilgrimage – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Arbitrary File Read, code review, exiftool, ffuf, Git, git-dumper, HackTheBox, Hex, HTB, Image Magick, Infosec, LFI, LinPeas, Linux Box, Rust, Source Code Review, Writeup 0

Machine Name: Pilgrimage
IP: 10.10.11.219
Difficulty: Easy

Summary

Pilgrimage is an easy machine which starts with identifying the ImageMagick tool that the target web application uses to shrink images. The tool is vulnerable to Arbitrary File Reads which enable us to fetch the credentials from a database file. These credentials were used to SSH and gain a user shell. The privilege escalation consists of exploiting Binwalk that runs inside a cron script.

June 25, 2023

Stocker – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Burp, exiftool, express, ffuf, HackTheBox, HTB, Infosec, Linux Box, Node, nodejs, NoSQL, NoSQL Injection, PDF, Server Side XSS, subdomain, sudo -l, Writeup, XSS 1

Machine Name: Stocker
IP: 10.10.11.196
Difficulty: Easy

Summary

Stocker is an easy machine which starts with a subdomain enumeration, and leads to NoSQL injection to bypass a login page. Then, it challenges us to understand the flow of API calls that generate a PDF, which can be exploited to read local files on the server using a Server Side XSS exploit. We find credentials of a user by exploiting the Server Side XSS to read the source code of the application. The privilege escalation involves abusing sudo rights that allow the user to run javascript files as root.

May 15, 2023

Interface – HackTheBox Writeup

Thoviti Siddharth Uncategorized API, Arithmetic Expression Injection, code review, Curl, CVE-2022-28368, Directory Fuzzing, DomPDF, exiftool, ffuf, HackTheBox, HTB, Infosec, Linux Box, Parameter Fuzzing, pspy, Writeup 0

Machine Name: Interface
IP: 10.10.11.200
Difficulty: Medium

Summary

Interface is a medium machine that requires some “curling” skills to form request and demystify their respective response codes. The machine has a lot of fuzzing for API endpoints and parameters which lead to an exploit for DomPDF. The vulnerability deals with how DomPDF caches the font file and allows remote files to be read. The privilege escalation teaches a new technique that abuses Arithmetic Expression Injection in bash scripts.

April 22, 2023

Investigation – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec binary analysis, code review, command injection, exiftool, Ghidra, HackTheBox, HTB, Infosec, LinPeas, Linux Box, Privilege Escalation, sudo -l, Windows Event Logs, Writeup 0

Machine Name: Investigation
IP: 10.10.10.197
Difficulty: Medium

Summary

Investigation is a medium machine that has a web server vulnerable to command injection vulnerability. With enough enumeration, it is easy to exploit command injection. However, it only leads to a shell as www-data. Getting a user shell requires some log file analysis and common sense. Privilege escalation deals with binary analysis and code review.

February 4, 2023

Red Panda – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec code-review, exiftool, HackTheBox, HTB, Infosec, jd-gui, LinPeas, Linux Box, pspy, SpringBoot, SSTI, XXE 0

Machine Name: Red Panda
IP: 10.10.11.170
Difficulty: Easy

Summary

Red Panda is an easy machine (not really) that exploits SSTI in Java Spring Boot to get an RCE. To escalate privileges to root, enumeration of directories, permissions, identities, groups, processes, and files need to be chained together to exploit a file that runs as a cronjob as root. The main attack involves performing an XXE attack to gain access to the private key of root.

June 11, 2022

Meta – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec CVE-2021-22204, exiftool, Gobuster, GTFObins, HackTheBox, HTB, htb-meta, ImageMagick, Infosec, Linux Box, mogrify, pspy, vhost, Writeup 0

Machine Name: Meta
IP: 10.10.11.140
Difficulty: Medium

Summary

Meta is a machine that involves finding a virtual host and then exploiting a vulnerability in the web application. Once exploited, it gives us a limited shell as www-data. To obtain user, we enumerate further into background processes and how they’re being run. Exploiting another vulnerability in the application, we gain access to files that would otherwise be unreadble. With that sensitive information, we gain access to the user shell and process to escalate privileges through a SUDO misconfiguration. It involves understand how the SUDO allowed binary runs and how an environment variable could be used to leverage the binary’s functionality to gain root privileges.