pspy

November 4, 2023

Topology – HackTheBox -Writeup

Thoviti Siddharth HackTheBox, Infosec GNUplot, HackTheBox, HTB, Infosec, JohnTheRipper, LaTeX Injection, LFI, LinPeas, Linux Box, OCR, pspy 0

Machine Name: Topology
IP: 10.10.11.217
Difficulty: Easy

Summary

Topology is an easy machine which starts by exploiting LaTeX injection to read files on the server that contain password hashes. After cracking the password hash, it was possible to login via SSH and obtain the user flag. The privilege escalation consisted of enumerating for processes that are run by root. One of the processes being run by root executed “.plt” files in a particular folder to which the user had write permissions. Finally, it was a simple matter of looking up the documentation on running OS commands for that particular extension and use it to gain a shell as root.

October 21, 2023

Jupiter – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec ffuf, file permission misconfiguration, Grafana, GraphQL, HackTheBox, HTB, Jupyter, LFI, LinPeas, Port Forwarding, postgresql, pspy, SQLi, SSH, strings, sub-domain-enumeration 0

Machine Name: Jupiter
IP: 10.10.11.216
Difficulty: Medium

Summary

Jupiter is a medium machine that starts with discovering a subdomain that retrieves data from the database using queries sent through the request, making it vulnerable to SQLi. The SQL injection is leveraged to gain a shell as user Postgres. A configuration script writable by Postgres, and run by Juno is used to gain a shell as Juno. Juno is a part of “science” group which uses Jupyter Notebook. The Jupyter service is run by Jovian. The logs of Jupyter can be read by Juno, which are used obtain tokens to login to the Jupyter Hub. The notebook is used to execute commands and gain a shell as Jovian. To escalate privileges as root, a binary which can be run using sudo, uses a configuration file which can be written by Jovian. This misconfiguration is leveraged to gain a shell as root.

August 5, 2023

Agile – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Chromium, CVE-2023-22809, Flask, HackTheBox, HTB, Infosec, Lateral Movement, LFI, Linux Box, MySQL, Port Forwarding, pspy, Remote Debugging Port, Stealing Cookies, Sudo 1.9.9, sudoedit, Werkzeug 0

Machine Name: Agile
IP: 10.10.11.203
Difficulty: Medium

Summary

Agile is a medium machine that starts with discovering a LFI which was leveraged to gain information required to crack the Werkzeug pin. The werkzeug pin allowed console access which allowed us to gain a shell as www-data. A config file revealed MySQL database credentials. The credentials for user corum were found which were used to SSH into the box. Enumerating further, it was found that chrome was running a remote-debugging-port at 41829 which was port forwarded to attacker machine which allowed us access to an existing session of the application. The credentials for user edwards was found here and were used to SSH into the box. Privilege escalation to root involved exploiting the sudo version 1.9.9 which was used to execute a writeable script running as root.

July 8, 2023

Inject- HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Ansible Playbook, Curl, CVE-2022-22963, HackTheBox, HTB, Infosec, LFI, LinPeas, Linux Box, pspy, Spring Cloud, Spring Framework, SpringBoot 0

Machine Name: Inject
IP: 10.10.11.204
Difficulty: Easy

Summary

Inject is an easy machine which starts with exploiting an LFI to gain information on the application being built on Spring Framework. Through the LFI, we discover one of the configuration files which reveals that the framework version is vulnerable to RCE. The RCE in Spring Cloud is exploited to gain a shell as user Frank. However, only user Phil can read the user flag. The credentials of Phil were found in another configuration file which was used to switch user to Phil. Privilege Escalation consisted of checking for cronjobs and looking for vulnerabilities in the jobs running as root. Ansible was being run on all the “.yml” files, which was exploited to gain access as root.

May 15, 2023

Interface – HackTheBox Writeup

Thoviti Siddharth Uncategorized API, Arithmetic Expression Injection, code review, Curl, CVE-2022-28368, Directory Fuzzing, DomPDF, exiftool, ffuf, HackTheBox, HTB, Infosec, Linux Box, Parameter Fuzzing, pspy, Writeup 0

Machine Name: Interface
IP: 10.10.11.200
Difficulty: Medium

Summary

Interface is a medium machine that requires some “curling” skills to form request and demystify their respective response codes. The machine has a lot of fuzzing for API endpoints and parameters which lead to an exploit for DomPDF. The vulnerability deals with how DomPDF caches the font file and allows remote files to be read. The privilege escalation teaches a new technique that abuses Arithmetic Expression Injection in bash scripts.

February 4, 2023

Red Panda – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec code-review, exiftool, HackTheBox, HTB, Infosec, jd-gui, LinPeas, Linux Box, pspy, SpringBoot, SSTI, XXE 0

Machine Name: Red Panda
IP: 10.10.11.170
Difficulty: Easy

Summary

Red Panda is an easy machine (not really) that exploits SSTI in Java Spring Boot to get an RCE. To escalate privileges to root, enumeration of directories, permissions, identities, groups, processes, and files need to be chained together to exploit a file that runs as a cronjob as root. The main attack involves performing an XXE attack to gain access to the private key of root.

June 18, 2022

Catch – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Android, API, apktool, Cachet, CVE-2021-39174, Gitea, HackTheBox, HTB, htb-catch, Infosec, Lets-Chat, Linux Box, MobSF, pspy, Writeup 0

Machine Name: Catch
IP: 10.10.11.150
Difficulty: Medium

Summary

Catch is a machine that requires reverse engineering an APK, enumerating for information in the APK file and finding API tokens. Using the tokens, we login to a dashboard which is vulnerable to injection that leads to leaking SSH credentials. These credentials are used to get the user shell. Escalating Privileges involves monitoring processes and finding a script that allows the user to inject payloads and execute them as root.

June 12, 2022

OpenSource – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Container Escape, Docker, Flask, Git, git-hook, Gitea, HackTheBox, HTB, htb-opensource, Infosec, LFI, Linux Box, pspy, Werkzeug, Writeup 0

Machine Name: OpenSource
IP: 10.10.11.164
Difficulty: Easy

Summary

OpenSource like it’s name is all about exploiting information that is openly available. It demands knowledge about LFI, Docker, Flask, understanding source code, and ofcourse, Git. To get the user shell, LFI vulnerability was exploited to get RCE. Then, a docker container needed to be escaped in order to gain the user shell. Knowledge of tunneling helps to connect to the host machine and enumerate further. Ability to access the host machine lets us enumerate further and gain access to user via leaked credentials. Escalating privileges requires understanding the concept of Git hooks to exploit a process running as root. This box is great for someone who is new to programming and learning code/version management tools like Git.

June 11, 2022

Meta – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec CVE-2021-22204, exiftool, Gobuster, GTFObins, HackTheBox, HTB, htb-meta, ImageMagick, Infosec, Linux Box, mogrify, pspy, vhost, Writeup 0

Machine Name: Meta
IP: 10.10.11.140
Difficulty: Medium

Summary

Meta is a machine that involves finding a virtual host and then exploiting a vulnerability in the web application. Once exploited, it gives us a limited shell as www-data. To obtain user, we enumerate further into background processes and how they’re being run. Exploiting another vulnerability in the application, we gain access to files that would otherwise be unreadble. With that sensitive information, we gain access to the user shell and process to escalate privileges through a SUDO misconfiguration. It involves understand how the SUDO allowed binary runs and how an environment variable could be used to leverage the binary’s functionality to gain root privileges.

June 8, 2022

Late – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec extended-attributes, Flask, HackTheBox, HTB, htb-late, Infosec, jinja2, Linux Box, lsattr, Path-Hijacking, pspy, SSTI, Writeup 0

Machine Name: Late
IP: 10.10.11.156
Difficulty: Easy

Summary

Late has an interesting way of exploiting Server Side Template Injection (SSTI) through image to text conversion. Once an image payload that is recognized well by the application is executed, we obtain a user level shell. To escalate privileges, simple enumeration leads to an interesting file run by root. With some understanding of file attributes, it is easy enough to run code as root to get root privileges.