Hackthebox - Poison
FreeBsd (Unix)
Nmap
Port 80
If we go on the website we have this page
The listfiles.php seems interesting
Let's have a look at the password backup
It says the password has been encoded at list 13 times. Let's go to cyberchef and try to add the recipe "frombase64" 13 times or more until it gets decrypted. And it works!!
On the website using the form we can show /etc/passwd
Initial foothold
We can use the password to connect with ssh. and the user charix because it is less likely to work with root.
And it works
We can get the user flag now
cat user.txtwhen we list the files we have a secret.zip we can take in our machine and try to unzip it with the password
The file is not readable using cat
Privesc
With
ps -auxwe see a vnc processroot 529 0.0 0.9 23620 8868 v0- I 00:08 0:00.02 Xvnc :1 -desktop X -httpd /usr/local/share/tightvnc/classes -auth /root/.Xauthority -geometry 1280x800 -depth 24 -rfbwait 120000 -rfbauth /root/.With
ps -auxwwwe get more information we see that it is running on port 5901.We need to use ssh port forwarding to interact more easily with this process
ssh -L 5901:127.0.0.1:5901 charix@10.10.10.84I should be able to access vnc with my port 5901With some research on vnc it seems like the password file we found in the zip can be used to access the process
vncviewer 127.0.0.1:5901 -passwd secretWe get a root shell and can have the flag
Resources
Rana's writeup is very detailed because she shows 3 different way to gain initial foothold
Last updated