GTFObins

March 12, 2024

CozyHosting – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec GTFObins, HackTheBox, HTB, JAR Decompilation, john, Linux Box, Password Cracking, postgres, RCE, Session Hijacking, SpringActuators, SpringBoot, SSH, sudo -l 0

Machine Name: CozyHosting
IP: 10.10.11.230
Difficulty: Easy

Summary

CozyHosting, an easy machine, initially involves understanding its SpringBoot application, discovered through a generic error page uncovered during directory enumeration. Further exploration revealed sensitive SpringActuator endpoints, leading to the acquisition of a session token belonging to user KAnderson. Leveraging this token facilitated the theft of the user’s session, providing access to the admin’s dashboard featuring an exploitable SSH configuration. Exploiting the SSH configuration vulnerability allowed for remote code execution (RCE) and subsequent acquisition of a shell. The next step involved decompiling a JAR file, uncovering plain-text database credentials that enabled access to the Postgres database. Within the database, user hashes were uncovered and subsequently cracked to unveil the user password, granting entry as Josh. Finally, privilege escalation was achieved through an SSH sudo misconfiguration, facilitating the acquisition of an interactive shell as root via SSH.

January 6, 2024

Sau – HackTheBox

Thoviti Siddharth HackTheBox, Infosec CVE-2023-27163, GTFObins, HackTheBox, HTB, Linux Box, Mailtrail, Request Basket, SSRF, sudo -l, systemctl 0

Machine Name: Sau
IP: 10.10.11.224
Difficulty: Easy

Summary

Sau is an easy machine that starts with discovering a port that runs Request Basket. The application is vulnerable to an SSRF which led to discovering the Mailtrail application running on port 8338 was being forwarded. The Mailtrail application was vulnerable to an unauthenticated command injection. The RCE was obtained by chaining the SSRF to redirect us to the vulnerable “/login” page where the payload was injected. Privilege Escalation involved abusing sudo right to run systemctl as root.

June 11, 2022

Meta – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec CVE-2021-22204, exiftool, Gobuster, GTFObins, HackTheBox, HTB, htb-meta, ImageMagick, Infosec, Linux Box, mogrify, pspy, vhost, Writeup 0

Machine Name: Meta
IP: 10.10.11.140
Difficulty: Medium

Summary

Meta is a machine that involves finding a virtual host and then exploiting a vulnerability in the web application. Once exploited, it gives us a limited shell as www-data. To obtain user, we enumerate further into background processes and how they’re being run. Exploiting another vulnerability in the application, we gain access to files that would otherwise be unreadble. With that sensitive information, we gain access to the user shell and process to escalate privileges through a SUDO misconfiguration. It involves understand how the SUDO allowed binary runs and how an environment variable could be used to leverage the binary’s functionality to gain root privileges.