BountyHunter - Easy
Introduction@BountyHunter:~$
Enumeration
Nmap
Only 2 ports are opened, 22 for ssh and 80 for http.
Web
Web page is not CMS , it's simple bootstrap site.
Directory Scan
db.php is just a blank page and portal.php is underdevelopment.
When we click that link, we will redirect to log_submit.php page.
Now submit some data and intercept with burp.
Data sent as base64 encode over POST request. When we decode it,we will get xml data
So, the first thing we should try is XXE injection,
XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.
Reference: Port Swigger
You can find XXE payload in payloadallthetings. Let try with this.
Our payload:
Encode that payload and paste it in request.
Now we got Base64 encoded data. When we decode it,
We got some credentials from db.php, Let's look at /etc/passwd.
/etc/password
In /etc/passwd , we found development user, let login ssh with that account.
Getting User
Privilege Escalation
Always try sudo first
ticketValidator.py
This code check for a file with .md extension, so create .md file and if the condition is true that code open the file search for the next condition, when we wrote the code as given conditions in the code ,we will get a ticket file like below. we can add os.system() in the last condition to pop up a root shell.
Now our exploit .md file will look like this.
Run ticketValidator.py as root and enter our file name, now we got a shell as root.
Author Account : https://app.hackthebox.com/profile/237587
Reference
Last updated