Flask

August 26, 2023

OnlyForYou – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec chisel, Cipher Injection, code review, dig, ffuf, Flask, Gogs, HackTheBox, HTB, Lateral Movement, LFI, LinPeas, Linux Box, Neo4j, pip3 download, Port Forwarding, Source Code Review, sub-domain-enumeration 0

Machine Name: OnlyForYou
IP: 10.10.11.210
Difficulty: Medium

Summary

OnlyForYou is a medium machine that starts with discovering a subdomain that is vulnerable to LFI. The LFI is used to read the source code of the application. Improper sanitization of user data in the a part of code that executes shell commands was leveraged to gain a shell as www-data. From this shell, two active ports were found, one of which hosted a login page that used default credentials. The dashboard revealed that the application uses Neo4j database. This information was used to test for Cipher injection. The cipher injection was successful and was used to gain password hashes from the database. The cracked hashes were used to login as user John. Privilege escalation involved abusing the “pip3 download” command that could be run as root by the user.

August 5, 2023

Agile – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Chromium, CVE-2023-22809, Flask, HackTheBox, HTB, Infosec, Lateral Movement, LFI, Linux Box, MySQL, Port Forwarding, pspy, Remote Debugging Port, Stealing Cookies, Sudo 1.9.9, sudoedit, Werkzeug 0

Machine Name: Agile
IP: 10.10.11.203
Difficulty: Medium

Summary

Agile is a medium machine that starts with discovering a LFI which was leveraged to gain information required to crack the Werkzeug pin. The werkzeug pin allowed console access which allowed us to gain a shell as www-data. A config file revealed MySQL database credentials. The credentials for user corum were found which were used to SSH into the box. Enumerating further, it was found that chrome was running a remote-debugging-port at 41829 which was port forwarded to attacker machine which allowed us access to an existing session of the application. The credentials for user edwards was found here and were used to SSH into the box. Privilege escalation to root involved exploiting the sudo version 1.9.9 which was used to execute a writeable script running as root.

July 15, 2023

Socket – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec .pyc, code-review, decompilation, Flask, HackTheBox, HTB, Infosec, john, JohnTheRipper, pycdc, PyInstaller, SQLi, sudo -l, UNION Injection, WebSocket 0

Machine Name: Socket
IP: 10.10.11.206
Difficulty: Medium

Summary

Socket is a medium machine that starts with decompiling and obtaining the python source code for an executable. The source code reveals how one can communicate with the WebSocket server that is hosted. The WebSocket server is vulnerable to SQLi which is leveraged to obtain password hashes for the user. The privilege escalation involves exploiting a script that the user can run as root. This script uses PyInstaller to build files. A python file that sets the suid bit was executed using this script to gain root privileges.

June 12, 2022

OpenSource – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Container Escape, Docker, Flask, Git, git-hook, Gitea, HackTheBox, HTB, htb-opensource, Infosec, LFI, Linux Box, pspy, Werkzeug, Writeup 0

Machine Name: OpenSource
IP: 10.10.11.164
Difficulty: Easy

Summary

OpenSource like it’s name is all about exploiting information that is openly available. It demands knowledge about LFI, Docker, Flask, understanding source code, and ofcourse, Git. To get the user shell, LFI vulnerability was exploited to get RCE. Then, a docker container needed to be escaped in order to gain the user shell. Knowledge of tunneling helps to connect to the host machine and enumerate further. Ability to access the host machine lets us enumerate further and gain access to user via leaked credentials. Escalating privileges requires understanding the concept of Git hooks to exploit a process running as root. This box is great for someone who is new to programming and learning code/version management tools like Git.

June 9, 2022

Noter – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec burp-intruder, Flask, FTP, HackTheBox, HTB, htb-noter, Infosec, JWT, Linux Box, MySQL, user-enumeration, Writeup 0

Machine Name: Noter
IP: 10.10.11.140
Difficulty: Medium

Summary

Noter is a machine that expects basic enumeration to lead to session cookies, JWT secrets, and credentials to servers. It teaches code review, and identification of code injections. Privilege Escalation was fairly simple as it was achieved with a public exploit that required credentials obtained during enumeration. The exploit allowed command execution as root through MySQL to gain a root shell.

June 8, 2022

Late – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec extended-attributes, Flask, HackTheBox, HTB, htb-late, Infosec, jinja2, Linux Box, lsattr, Path-Hijacking, pspy, SSTI, Writeup 0

Machine Name: Late
IP: 10.10.11.156
Difficulty: Easy

Summary

Late has an interesting way of exploiting Server Side Template Injection (SSTI) through image to text conversion. Once an image payload that is recognized well by the application is executed, we obtain a user level shell. To escalate privileges, simple enumeration leads to an interesting file run by root. With some understanding of file attributes, it is easy enough to run code as root to get root privileges.