XXE

September 25, 2023

Snoopy – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec ClamAV, CVE-2023-20052, CVE-2023-23946, dns zone transfer, Git, git apply, HackTheBox, HTB, LFI, Mail Server, Man in The Middle, nsupdate, Patch File, SMTP, ssh-mitm, symlink, Update DNS Record, XXE 0

Machine Name: Snoopy
IP: 10.10.11.212
Difficulty: Hard

Summary

Snoopy is a hard machine that starts with discovering subdomains through DNS zone transfer, and exploiting an LFI to obtain site configuration files that revealed mailserver secret key. The key was used to update the mail server’s DNS records to receive mails on my local SMTP server. The mattermost subdomain discovered had an “email password reset link” page. The password was received on the SMTP server for user cbrown. Authenticated session of mattermost provided an option to interact with the server through SSH which was intercepted to perform a man-in-the-middle attack to fetch the SSH credentials of cbrown. The user cbrown could run “git apply” command as user sbrown which was exploited by using a known vulnerability that uses symbolic links to access files of the user running Git. This was used to write the SSH public key into sbrown and gain a SSH shell. Privilege escalation involved exploiting ClamAV’s XXE vulnerability to fetch the private key of root.

April 30, 2023

MetaTwo – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec Blind XXE, Bookingpress, CVE-2021-29447, CVE-2022-0739, FTP, GnuPG, GPG, gpg2john, HackTheBox, HTB, Infosec, JohnTheRipper, Linux Box, PassPie, Password Cracking, PGP, Private Key, SQLi, sqlmap, WAVE, Wordpress, Writeup, XXE 0

Machine Name: MetaTwo
IP: 10.10.11.186
Difficulty: Easy

Summary

MetaTwo is an easy machine that needs exploiting a SQLi that leads us to hashes that need to be cracked. The cracked hash credentials provide access to a WordPress dashboard. This WordPress version is vulnerable to Blind XXE via a WAVE file format metadata. The XXE gives us access to the “wp-config.php” file which contains cleartext password for FTP. Enumerating the FTP server, SSH credentials are found for user. Privilege Escalation requires understanding of private and public keys and different methods that are used to encrypt them. Passpie is the application that was used to encrypt private keys found. We can crack the GPG format keys using John and gain the credentials for root.

February 4, 2023

Red Panda – HackTheBox Writeup

Thoviti Siddharth HackTheBox, Infosec code-review, exiftool, HackTheBox, HTB, Infosec, jd-gui, LinPeas, Linux Box, pspy, SpringBoot, SSTI, XXE 0

Machine Name: Red Panda
IP: 10.10.11.170
Difficulty: Easy

Summary

Red Panda is an easy machine (not really) that exploits SSTI in Java Spring Boot to get an RCE. To escalate privileges to root, enumeration of directories, permissions, identities, groups, processes, and files need to be chained together to exploit a file that runs as a cronjob as root. The main attack involves performing an XXE attack to gain access to the private key of root.