SQLi

October 21, 2023

Jupiter – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec ffuf, file permission misconfiguration, Grafana, GraphQL, HackTheBox, HTB, Jupyter, LFI, LinPeas, Port Forwarding, postgresql, pspy, SQLi, SSH, strings, sub-domain-enumeration 0

Machine Name: Jupiter
IP: 10.10.11.216
Difficulty: Medium

Summary

Jupiter is a medium machine that starts with discovering a subdomain that retrieves data from the database using queries sent through the request, making it vulnerable to SQLi. The SQL injection is leveraged to gain a shell as user Postgres. A configuration script writable by Postgres, and run by Juno is used to gain a shell as Juno. Juno is a part of “science” group which uses Jupyter Notebook. The Jupyter service is run by Jovian. The logs of Jupyter can be read by Juno, which are used obtain tokens to login to the Jupyter Hub. The notebook is used to execute commands and gain a shell as Jovian. To escalate privileges as root, a binary which can be run using sudo, uses a configuration file which can be written by Jovian. This misconfiguration is leveraged to gain a shell as root.

July 15, 2023

Socket – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec .pyc, code-review, decompilation, Flask, HackTheBox, HTB, Infosec, john, JohnTheRipper, pycdc, PyInstaller, SQLi, sudo -l, UNION Injection, WebSocket 0

Machine Name: Socket
IP: 10.10.11.206
Difficulty: Medium

Summary

Socket is a medium machine that starts with decompiling and obtaining the python source code for an executable. The source code reveals how one can communicate with the WebSocket server that is hosted. The WebSocket server is vulnerable to SQLi which is leveraged to obtain password hashes for the user. The privilege escalation involves exploiting a script that the user can run as root. This script uses PyInstaller to build files. A python file that sets the suid bit was executed using this script to gain root privileges.

April 30, 2023

MetaTwo – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Blind XXE, Bookingpress, CVE-2021-29447, CVE-2022-0739, FTP, GnuPG, GPG, gpg2john, HackTheBox, HTB, Infosec, JohnTheRipper, Linux Box, PassPie, Password Cracking, PGP, Private Key, SQLi, sqlmap, WAVE, Wordpress, Writeup, XXE 0

Machine Name: MetaTwo
IP: 10.10.11.186
Difficulty: Easy

Summary

MetaTwo is an easy machine that needs exploiting a SQLi that leads us to hashes that need to be cracked. The cracked hash credentials provide access to a WordPress dashboard. This WordPress version is vulnerable to Blind XXE via a WAVE file format metadata. The XXE gives us access to the “wp-config.php” file which contains cleartext password for FTP. Enumerating the FTP server, SSH credentials are found for user. Privilege Escalation requires understanding of private and public keys and different methods that are used to encrypt them. Passpie is the application that was used to encrypt private keys found. We can crack the GPG format keys using John and gain the credentials for root.

June 27, 2022

Trick – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec DNS, dns zone transfer, fail2ban, HackTheBox, HTB, hydra, Infosec, LFI, Linux Box, nginx, SMTP, SQLi, sqlmap, sub-domain-enumeration 0

Machine Name: Trick
IP: 10.10.11.166
Difficulty: Easy

Summary

Trick is a moderately easy machine that demands a lot of enumeration skills. It involves finding two sub-domains that can be found through DNS zone transfer and sub-domain fuzzing. One of the sub-domains has a SQLi that can be leveraged to gather information on the server and the other sub-domain has a LFI that exposes SSH private key. This key is used to gain SSH access to the user. Since the user can restart fail2ban as root, one of fail2ban’s configuration files needed to be modified to gain a reverse shell as root.