Easy

Active machine — write-up published after retirement.

Overview Chamilo LMS 1.11.24, Ubuntu 22.04. Release: 2024-07-06. Retire: 2024-11-02. IP: 10.10.10.x. Chain: unauthenticated file upload to RCE (CVE-2023-4220), a reused Chamilo database password for the mtz system account, then a symlink-following sudo ACL script for root. Reconnaissance Port scan 1 2 nmap -p- --min-rate 10000 10.10.10.x nmap -p 22,80 -sCV 10.10.10.x Open ports: 22/tcp: OpenSSH 8.9p1 (Ubuntu 22.04 jammy) 80/tcp: Apache 2.4.52, redirects to http://permx.htb Subdomain fuzzing The server routes HTTP requests by the Host header, so fuzz subdomains: ...

Overview Ubuntu 20.04. IP: 10.10.10.x. Topics: SSTI (Spring Boot), log poisoning, path traversal, XXE, source code review. Chain: SSTI in the search box, shell as woodenk, credentials in the source, SSH, analysis of a root cron job (a Java jar), a four-vulnerability chain (log poisoning + path traversal + metadata-driven path injection + XXE), the root SSH key, root. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV 10.10.10.x 22/tcp: OpenSSH 8.2p1 (Ubuntu) 8080/tcp: HTTP (http-proxy) HTTP (port 8080): ...

Overview Machine author: TheCyberGeek. IP: 10.10.10.x. Recon: only port 80 is open (Werkzeug/Python 3.9.2, a Flask application). SQL injection in the login form: authentication bypass plus a dump of the main database. The admin’s MD5 hash cracks to superadministrator. Subdomain internal-administration.goodgames.htb: a Flask panel, password reuse. SSTI in the profile field: RCE, a reverse shell, root inside a Docker container. Docker escape via a shared bind-mount plus the SUID bit: root on the host. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV -sC -Pn 10.10.10.x Port 80: Werkzeug/2.0.2 Python/3.9.2, title GoodGames | Community and Store. The footer reveals the domain goodgames.htb. ...

Overview Machine author: TheCyberGeek. OS: Ubuntu 18.04.3 LTS (Bionic). 1 2 3 Redis 6379 (no auth) --SAVE authorized_keys to .ssh/--> shell as redis --crack /opt/id_rsa.bak (ssh2john + john) -> computer2008--> su Matt (password reuse) --Webmin 10000, CVE-2019-12840 command injection in `u`--> root Foothold: Redis listens without authentication; abuse SAVE to write an SSH public key to /var/lib/redis/.ssh/authorized_keys, shell as redis. Lateral movement: the encrypted private key /opt/id_rsa.bak is cracked by john (password computer2008); Matt reuses that as his system password; su Matt. Privilege escalation: log into Webmin with Matt’s credentials; CVE-2019-12840 (command injection in the Package Updates module, parameter u); Webmin runs as root, so RCE as root. Reconnaissance 1 2 nmap -p- --min-rate 10000 -oA scans/nmap-alltcp 10.10.10.x nmap -p 22,80,6379,10000 -sC -sV -oA scans/nmap-tcpscripts 10.10.10.x Port Service Version Notes 22 SSH OpenSSH 7.6p1 Ubuntu standard 80 HTTP Apache 2.4.29 (Ubuntu) “under construction” page 6379 Redis Redis 4.0.9 no authentication 10000 HTTP MiniServ 1.910 (Webmin httpd) HTTPS, admin panel Port 6379 (Redis) is the obvious foothold: open to the world, no password. Port 10000 (Webmin 1.910): a specific old version, worth keeping for privesc. Webmin runs as root, so any RCE there is root. Port 80 is a dead end. Gobuster: /images /upload /css /js /fonts, nothing useful. Initial Access Redis, shell as redis Redis 4.0-5.0 with a default, open configuration allows arbitrary disk writes with the privileges of the redis process: ...