Node » THOVITI SIDDHARTH

Node

June 25, 2023

Stocker – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Burp, exiftool, express, ffuf, HackTheBox, HTB, Infosec, Linux Box, Node, nodejs, NoSQL, NoSQL Injection, PDF, Server Side XSS, subdomain, sudo -l, Writeup, XSS 1

Machine Name: Stocker
IP: 10.10.11.196
Difficulty: Easy

Summary

Stocker is an easy machine which starts with a subdomain enumeration, and leads to NoSQL injection to bypass a login page. Then, it challenges us to understand the flow of API calls that generate a PDF, which can be exploited to read local files on the server using a Server Side XSS exploit. We find credentials of a user by exploiting the Server Side XSS to read the source code of the application. The privilege escalation involves abusing sudo rights that allow the user to run javascript files as root.

June 6, 2022

RouterSpace – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Android, CVE-2021-3156, HackTheBox, HTB, htb-routerspace, LinPeas, Linux Box, Node, sudo 0

Machine Name: RouterSpace
IP: 10.10.11.148
Difficulty: Easy

Summary

An APK file is to be inspected to understand a feature’s inner workings. To get the user shell, the traffic was to be redirected to burp, and an RCE vulnerability through injection is to be exploited. To escalate privileges, simple enumeration leads us to a exploit POC that gives a root shell.