Linux Box

March 12, 2024

CozyHosting – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec GTFObins, HackTheBox, HTB, JAR Decompilation, john, Linux Box, Password Cracking, postgres, RCE, Session Hijacking, SpringActuators, SpringBoot, SSH, sudo -l 0

Machine Name: CozyHosting
IP: 10.10.11.230
Difficulty: Easy

Summary

CozyHosting, an easy machine, initially involves understanding its SpringBoot application, discovered through a generic error page uncovered during directory enumeration. Further exploration revealed sensitive SpringActuator endpoints, leading to the acquisition of a session token belonging to user KAnderson. Leveraging this token facilitated the theft of the user’s session, providing access to the admin’s dashboard featuring an exploitable SSH configuration. Exploiting the SSH configuration vulnerability allowed for remote code execution (RCE) and subsequent acquisition of a shell. The next step involved decompiling a JAR file, uncovering plain-text database credentials that enabled access to the Postgres database. Within the database, user hashes were uncovered and subsequently cracked to unveil the user password, granting entry as Josh. Finally, privilege escalation was achieved through an SSH sudo misconfiguration, facilitating the acquisition of an interactive shell as root via SSH.

January 6, 2024

Sau – HackTheBox

Thoviti Siddharth HackTheBox, Infosec CVE-2023-27163, GTFObins, HackTheBox, HTB, Linux Box, Mailtrail, Request Basket, SSRF, sudo -l, systemctl 0

Machine Name: Sau
IP: 10.10.11.224
Difficulty: Easy

Summary

Sau is an easy machine that starts with discovering a port that runs Request Basket. The application is vulnerable to an SSRF which led to discovering the Mailtrail application running on port 8338 was being forwarded. The Mailtrail application was vulnerable to an unauthenticated command injection. The RCE was obtained by chaining the SSRF to redirect us to the vulnerable “/login” page where the payload was injected. Privilege Escalation involved abusing sudo right to run systemctl as root.

November 25, 2023

Pilgrimage – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Arbitrary File Read, code review, exiftool, ffuf, Git, git-dumper, HackTheBox, Hex, HTB, Image Magick, Infosec, LFI, LinPeas, Linux Box, Rust, Source Code Review, Writeup 0

Machine Name: Pilgrimage
IP: 10.10.11.219
Difficulty: Easy

Summary

Pilgrimage is an easy machine which starts with identifying the ImageMagick tool that the target web application uses to shrink images. The tool is vulnerable to Arbitrary File Reads which enable us to fetch the credentials from a database file. These credentials were used to SSH and gain a user shell. The privilege escalation consists of exploiting Binwalk that runs inside a cron script.

November 4, 2023

Topology – HackTheBox -Writeup

Thoviti Siddharth HackTheBox, Infosec GNUplot, HackTheBox, HTB, Infosec, JohnTheRipper, LaTeX Injection, LFI, LinPeas, Linux Box, OCR, pspy 0

Machine Name: Topology
IP: 10.10.11.217
Difficulty: Easy

Summary

Topology is an easy machine which starts by exploiting LaTeX injection to read files on the server that contain password hashes. After cracking the password hash, it was possible to login via SSH and obtain the user flag. The privilege escalation consisted of enumerating for processes that are run by root. One of the processes being run by root executed “.plt” files in a particular folder to which the user had write permissions. Finally, it was a simple matter of looking up the documentation on running OS commands for that particular extension and use it to gain a shell as root.

September 30, 2023

Format – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec code review, Format String Vulnerability, Gitea, HackTheBox, HTB, LFI, LinPeas, Linux Box, Nginx Reverse Proxy Misconfiguration, redis, socket, Source Code Review, sudo -l 0

Machine Name: Format
IP: 10.10.11.213
Difficulty: Medium

Summary

Format is a medium machine that starts with discovering two ports that run Gitea and a Microblog respectively. First, an LFI is discovered on the Microblog after reviewing the source code. Further analysing the source code, one could bypass the mechanism to become Pro user and upload image files. One of the parameters that causes LFI creates a new if it doesn’t already exist. This allowed writing a PHP shell through which a shell was obtained as www-data. A redis server running on a socket was discovered and used to obtain credentials for the user “cooper”. Privilege escalation involved exploiting a python format string vulnerability for a script that could be run using sudo.

August 26, 2023

OnlyForYou – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec chisel, Cipher Injection, code review, dig, ffuf, Flask, Gogs, HackTheBox, HTB, Lateral Movement, LFI, LinPeas, Linux Box, Neo4j, pip3 download, Port Forwarding, Source Code Review, sub-domain-enumeration 0

Machine Name: OnlyForYou
IP: 10.10.11.210
Difficulty: Medium

Summary

OnlyForYou is a medium machine that starts with discovering a subdomain that is vulnerable to LFI. The LFI is used to read the source code of the application. Improper sanitization of user data in the a part of code that executes shell commands was leveraged to gain a shell as www-data. From this shell, two active ports were found, one of which hosted a login page that used default credentials. The dashboard revealed that the application uses Neo4j database. This information was used to test for Cipher injection. The cipher injection was successful and was used to gain password hashes from the database. The cracked hashes were used to login as user John. Privilege escalation involved abusing the “pip3 download” command that could be run as root by the user.

August 13, 2023

Busqueda – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Code Injection, Docker, eval(), Gitea, HackTheBox, HTB, Infosec, Injection, Linux Box, MySQL, Path Hijacking, Privilege Escalation, Relative Path Hijacking, Searchor, sudo, Writeup 0

Machine Name: Busqueda
IP: 10.10.11.208
Difficulty: Easy

Summary

Busqueda is an easy machine that challenges you to read code, find the vulnerability, and craft syntactically correct payloads that suit the code when injected. The privilege escalation is straight forward and explores relative path hijacking through SUID scripts to get root.

August 5, 2023

Agile – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Chromium, CVE-2023-22809, Flask, HackTheBox, HTB, Infosec, Lateral Movement, LFI, Linux Box, MySQL, Port Forwarding, pspy, Remote Debugging Port, Stealing Cookies, Sudo 1.9.9, sudoedit, Werkzeug 0

Machine Name: Agile
IP: 10.10.11.203
Difficulty: Medium

Summary

Agile is a medium machine that starts with discovering a LFI which was leveraged to gain information required to crack the Werkzeug pin. The werkzeug pin allowed console access which allowed us to gain a shell as www-data. A config file revealed MySQL database credentials. The credentials for user corum were found which were used to SSH into the box. Enumerating further, it was found that chrome was running a remote-debugging-port at 41829 which was port forwarded to attacker machine which allowed us access to an existing session of the application. The credentials for user edwards was found here and were used to SSH into the box. Privilege escalation to root involved exploiting the sudo version 1.9.9 which was used to execute a writeable script running as root.

July 8, 2023

Inject- HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Ansible Playbook, Curl, CVE-2022-22963, HackTheBox, HTB, Infosec, LFI, LinPeas, Linux Box, pspy, Spring Cloud, Spring Framework, SpringBoot 0

Machine Name: Inject
IP: 10.10.11.204
Difficulty: Easy

Summary

Inject is an easy machine which starts with exploiting an LFI to gain information on the application being built on Spring Framework. Through the LFI, we discover one of the configuration files which reveals that the framework version is vulnerable to RCE. The RCE in Spring Cloud is exploited to gain a shell as user Frank. However, only user Phil can read the user flag. The credentials of Phil were found in another configuration file which was used to switch user to Phil. Privilege Escalation consisted of checking for cronjobs and looking for vulnerabilities in the jobs running as root. Ansible was being run on all the “.yml” files, which was exploited to gain access as root.

June 25, 2023

Stocker – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Burp, exiftool, express, ffuf, HackTheBox, HTB, Infosec, Linux Box, Node, nodejs, NoSQL, NoSQL Injection, PDF, Server Side XSS, subdomain, sudo -l, Writeup, XSS 1

Machine Name: Stocker
IP: 10.10.11.196
Difficulty: Easy

Summary

Stocker is an easy machine which starts with a subdomain enumeration, and leads to NoSQL injection to bypass a login page. Then, it challenges us to understand the flow of API calls that generate a PDF, which can be exploited to read local files on the server using a Server Side XSS exploit. We find credentials of a user by exploiting the Server Side XSS to read the source code of the application. The privilege escalation involves abusing sudo rights that allow the user to run javascript files as root.