Linux Box

June 8, 2022

Late – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec extended-attributes, Flask, HackTheBox, HTB, htb-late, Infosec, jinja2, Linux Box, lsattr, Path-Hijacking, pspy, SSTI, Writeup 0

Machine Name: Late
IP: 10.10.11.156
Difficulty: Easy

Summary

Late has an interesting way of exploiting Server Side Template Injection (SSTI) through image to text conversion. Once an image payload that is recognized well by the application is executed, we obtain a user level shell. To escalate privileges, simple enumeration leads to an interesting file run by root. With some understanding of file attributes, it is easy enough to run code as root to get root privileges.

June 8, 2022

Paper – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec CVE-2021-3560, Directory-Traversal, Gobuster, HackTheBox, HTB, htb-paper, Infosec, LinPeas, Linux Box, paper-hackthebox, Pwnkit, Rocket-Chat, Writeup 0

Machine Name: Paper
IP: 10.10.11.143
Difficulty: Easy

Summary

Paper is a relatively easy box and teaches enumeration and a bit of reading API documentations. It forces the attacker to keep looking for sensitive information that can be utilized to run commands and eventually get a shell. To get a user shell, we find credentials on the system through a chat bot. They can be used for logging in through SSH. Another way was to find a command hidden from the ones listed by the bot by reading the API documentation or finding a scripts directory to run commands as user and get a shell. Escalating privileges as root was simple as it was vulnerable to a popular vulnerability with a simple PoC.

June 6, 2022

RouterSpace – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Android, CVE-2021-3156, HackTheBox, HTB, htb-routerspace, LinPeas, Linux Box, Node, sudo 0

Machine Name: RouterSpace
IP: 10.10.11.148
Difficulty: Easy

Summary

An APK file is to be inspected to understand a feature’s inner workings. To get the user shell, the traffic was to be redirected to burp, and an RCE vulnerability through injection is to be exploited. To escalate privileges, simple enumeration leads us to a exploit POC that gives a root shell.

December 8, 2020

Doctor – HackTheBox Writeup

Thoviti Siddharth Infosec CSRF, HackTheBox, HTB, htb-doctor, Infosec, LinPeas, Linux Box, PySplunkWhisper2, Splunk, SSTI, Writeup 0

IP: 10.10.10.209
Difficulty: Easy

Summary: Doctor is a Linux Box that can be exploited using Server Site Template Injection (SSTI) or Cross Site Request Forgery (CSRF). The escalated Splunk service is exploited to escalate privileges to root by using Splunk 8.0.5 exploit.