SSH » THOVITI SIDDHARTH

SSH

March 12, 2024

CozyHosting – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec GTFObins, HackTheBox, HTB, JAR Decompilation, john, Linux Box, Password Cracking, postgres, RCE, Session Hijacking, SpringActuators, SpringBoot, SSH, sudo -l 0

Machine Name: CozyHosting
IP: 10.10.11.230
Difficulty: Easy

Summary

CozyHosting, an easy machine, initially involves understanding its SpringBoot application, discovered through a generic error page uncovered during directory enumeration. Further exploration revealed sensitive SpringActuator endpoints, leading to the acquisition of a session token belonging to user KAnderson. Leveraging this token facilitated the theft of the user’s session, providing access to the admin’s dashboard featuring an exploitable SSH configuration. Exploiting the SSH configuration vulnerability allowed for remote code execution (RCE) and subsequent acquisition of a shell. The next step involved decompiling a JAR file, uncovering plain-text database credentials that enabled access to the Postgres database. Within the database, user hashes were uncovered and subsequently cracked to unveil the user password, granting entry as Josh. Finally, privilege escalation was achieved through an SSH sudo misconfiguration, facilitating the acquisition of an interactive shell as root via SSH.

October 21, 2023

Jupiter – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec ffuf, file permission misconfiguration, Grafana, GraphQL, HackTheBox, HTB, Jupyter, LFI, LinPeas, Port Forwarding, postgresql, pspy, SQLi, SSH, strings, sub-domain-enumeration 0

Machine Name: Jupiter
IP: 10.10.11.216
Difficulty: Medium

Summary

Jupiter is a medium machine that starts with discovering a subdomain that retrieves data from the database using queries sent through the request, making it vulnerable to SQLi. The SQL injection is leveraged to gain a shell as user Postgres. A configuration script writable by Postgres, and run by Juno is used to gain a shell as Juno. Juno is a part of “science” group which uses Jupyter Notebook. The Jupyter service is run by Jovian. The logs of Jupyter can be read by Juno, which are used obtain tokens to login to the Jupyter Hub. The notebook is used to execute commands and gain a shell as Jovian. To escalate privileges as root, a binary which can be run using sudo, uses a configuration file which can be written by Jovian. This misconfiguration is leveraged to gain a shell as root.