sub-domain-enumeration

October 21, 2023

Jupiter – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec ffuf, file permission misconfiguration, Grafana, GraphQL, HackTheBox, HTB, Jupyter, LFI, LinPeas, Port Forwarding, postgresql, pspy, SQLi, SSH, strings, sub-domain-enumeration 0

Machine Name: Jupiter
IP: 10.10.11.216
Difficulty: Medium

Summary

Jupiter is a medium machine that starts with discovering a subdomain that retrieves data from the database using queries sent through the request, making it vulnerable to SQLi. The SQL injection is leveraged to gain a shell as user Postgres. A configuration script writable by Postgres, and run by Juno is used to gain a shell as Juno. Juno is a part of “science” group which uses Jupyter Notebook. The Jupyter service is run by Jovian. The logs of Jupyter can be read by Juno, which are used obtain tokens to login to the Jupyter Hub. The notebook is used to execute commands and gain a shell as Jovian. To escalate privileges as root, a binary which can be run using sudo, uses a configuration file which can be written by Jovian. This misconfiguration is leveraged to gain a shell as root.

August 26, 2023

OnlyForYou – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec chisel, Cipher Injection, code review, dig, ffuf, Flask, Gogs, HackTheBox, HTB, Lateral Movement, LFI, LinPeas, Linux Box, Neo4j, pip3 download, Port Forwarding, Source Code Review, sub-domain-enumeration 0

Machine Name: OnlyForYou
IP: 10.10.11.210
Difficulty: Medium

Summary

OnlyForYou is a medium machine that starts with discovering a subdomain that is vulnerable to LFI. The LFI is used to read the source code of the application. Improper sanitization of user data in the a part of code that executes shell commands was leveraged to gain a shell as www-data. From this shell, two active ports were found, one of which hosted a login page that used default credentials. The dashboard revealed that the application uses Neo4j database. This information was used to test for Cipher injection. The cipher injection was successful and was used to gain password hashes from the database. The cracked hashes were used to login as user John. Privilege escalation involved abusing the “pip3 download” command that could be run as root by the user.

June 27, 2022

Trick – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec DNS, dns zone transfer, fail2ban, HackTheBox, HTB, hydra, Infosec, LFI, Linux Box, nginx, SMTP, SQLi, sqlmap, sub-domain-enumeration 0

Machine Name: Trick
IP: 10.10.11.166
Difficulty: Easy

Summary

Trick is a moderately easy machine that demands a lot of enumeration skills. It involves finding two sub-domains that can be found through DNS zone transfer and sub-domain fuzzing. One of the sub-domains has a SQLi that can be leveraged to gather information on the server and the other sub-domain has a LFI that exposes SSH private key. This key is used to gain SSH access to the user. Since the user can restart fail2ban as root, one of fail2ban’s configuration files needed to be modified to gain a reverse shell as root.