sudo -l

March 12, 2024

CozyHosting – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec GTFObins, HackTheBox, HTB, JAR Decompilation, john, Linux Box, Password Cracking, postgres, RCE, Session Hijacking, SpringActuators, SpringBoot, SSH, sudo -l 0

Machine Name: CozyHosting
IP: 10.10.11.230
Difficulty: Easy

Summary

CozyHosting, an easy machine, initially involves understanding its SpringBoot application, discovered through a generic error page uncovered during directory enumeration. Further exploration revealed sensitive SpringActuator endpoints, leading to the acquisition of a session token belonging to user KAnderson. Leveraging this token facilitated the theft of the user’s session, providing access to the admin’s dashboard featuring an exploitable SSH configuration. Exploiting the SSH configuration vulnerability allowed for remote code execution (RCE) and subsequent acquisition of a shell. The next step involved decompiling a JAR file, uncovering plain-text database credentials that enabled access to the Postgres database. Within the database, user hashes were uncovered and subsequently cracked to unveil the user password, granting entry as Josh. Finally, privilege escalation was achieved through an SSH sudo misconfiguration, facilitating the acquisition of an interactive shell as root via SSH.

January 6, 2024

Sau – HackTheBox

Thoviti Siddharth HackTheBox, Infosec CVE-2023-27163, GTFObins, HackTheBox, HTB, Linux Box, Mailtrail, Request Basket, SSRF, sudo -l, systemctl 0

Machine Name: Sau
IP: 10.10.11.224
Difficulty: Easy

Summary

Sau is an easy machine that starts with discovering a port that runs Request Basket. The application is vulnerable to an SSRF which led to discovering the Mailtrail application running on port 8338 was being forwarded. The Mailtrail application was vulnerable to an unauthenticated command injection. The RCE was obtained by chaining the SSRF to redirect us to the vulnerable “/login” page where the payload was injected. Privilege Escalation involved abusing sudo right to run systemctl as root.

September 30, 2023

Format – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec code review, Format String Vulnerability, Gitea, HackTheBox, HTB, LFI, LinPeas, Linux Box, Nginx Reverse Proxy Misconfiguration, redis, socket, Source Code Review, sudo -l 0

Machine Name: Format
IP: 10.10.11.213
Difficulty: Medium

Summary

Format is a medium machine that starts with discovering two ports that run Gitea and a Microblog respectively. First, an LFI is discovered on the Microblog after reviewing the source code. Further analysing the source code, one could bypass the mechanism to become Pro user and upload image files. One of the parameters that causes LFI creates a new if it doesn’t already exist. This allowed writing a PHP shell through which a shell was obtained as www-data. A redis server running on a socket was discovered and used to obtain credentials for the user “cooper”. Privilege escalation involved exploiting a python format string vulnerability for a script that could be run using sudo.

July 15, 2023

Socket – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec .pyc, code-review, decompilation, Flask, HackTheBox, HTB, Infosec, john, JohnTheRipper, pycdc, PyInstaller, SQLi, sudo -l, UNION Injection, WebSocket 0

Machine Name: Socket
IP: 10.10.11.206
Difficulty: Medium

Summary

Socket is a medium machine that starts with decompiling and obtaining the python source code for an executable. The source code reveals how one can communicate with the WebSocket server that is hosted. The WebSocket server is vulnerable to SQLi which is leveraged to obtain password hashes for the user. The privilege escalation involves exploiting a script that the user can run as root. This script uses PyInstaller to build files. A python file that sets the suid bit was executed using this script to gain root privileges.

June 25, 2023

Stocker – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Burp, exiftool, express, ffuf, HackTheBox, HTB, Infosec, Linux Box, Node, nodejs, NoSQL, NoSQL Injection, PDF, Server Side XSS, subdomain, sudo -l, Writeup, XSS 1

Machine Name: Stocker
IP: 10.10.11.196
Difficulty: Easy

Summary

Stocker is an easy machine which starts with a subdomain enumeration, and leads to NoSQL injection to bypass a login page. Then, it challenges us to understand the flow of API calls that generate a PDF, which can be exploited to read local files on the server using a Server Side XSS exploit. We find credentials of a user by exploiting the Server Side XSS to read the source code of the application. The privilege escalation involves abusing sudo rights that allow the user to run javascript files as root.

April 22, 2023

Investigation – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec binary analysis, code review, command injection, exiftool, Ghidra, HackTheBox, HTB, Infosec, LinPeas, Linux Box, Privilege Escalation, sudo -l, Windows Event Logs, Writeup 0

Machine Name: Investigation
IP: 10.10.10.197
Difficulty: Medium

Summary

Investigation is a medium machine that has a web server vulnerable to command injection vulnerability. With enough enumeration, it is easy to exploit command injection. However, it only leads to a shell as www-data. Getting a user shell requires some log file analysis and common sense. Privilege escalation deals with binary analysis and code review.