Gobuster » THOVITI SIDDHARTH

Gobuster

June 11, 2022

Meta – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec CVE-2021-22204, exiftool, Gobuster, GTFObins, HackTheBox, HTB, htb-meta, ImageMagick, Infosec, Linux Box, mogrify, pspy, vhost, Writeup 0

Machine Name: Meta
IP: 10.10.11.140
Difficulty: Medium

Summary

Meta is a machine that involves finding a virtual host and then exploiting a vulnerability in the web application. Once exploited, it gives us a limited shell as www-data. To obtain user, we enumerate further into background processes and how they’re being run. Exploiting another vulnerability in the application, we gain access to files that would otherwise be unreadble. With that sensitive information, we gain access to the user shell and process to escalate privileges through a SUDO misconfiguration. It involves understand how the SUDO allowed binary runs and how an environment variable could be used to leverage the binary’s functionality to gain root privileges.

June 8, 2022

Paper – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec CVE-2021-3560, Directory-Traversal, Gobuster, HackTheBox, HTB, htb-paper, Infosec, LinPeas, Linux Box, paper-hackthebox, Pwnkit, Rocket-Chat, Writeup 0

Machine Name: Paper
IP: 10.10.11.143
Difficulty: Easy

Summary

Paper is a relatively easy box and teaches enumeration and a bit of reading API documentations. It forces the attacker to keep looking for sensitive information that can be utilized to run commands and eventually get a shell. To get a user shell, we find credentials on the system through a chat bot. They can be used for logging in through SSH. Another way was to find a command hidden from the ones listed by the bot by reading the API documentation or finding a scripts directory to run commands as user and get a shell. Escalating privileges as root was simple as it was vulnerable to a popular vulnerability with a simple PoC.