Linux

Overview This note documents what an attacker can see and abuse from an interactive mysql> prompt, using the Altered box as a training ground. It moves from enumeration, through file read/write, to remote code execution via user-defined functions (UDF). Context for Altered: the application database account holds the FILE privilege (which is why INTO OUTFILE succeeds), and the mysql process runs as its own dedicated user rather than root. That makes it an ideal environment for practising UDF and general_log tricks. ...

Active machine — write-up published after retirement.

Active machine — write-up published after retirement.

Overview Machine author: TheHermit. Host: Ubuntu, with Docker containers (Debian 8 Jessie). Theme: Star Trek: The Next Generation. Chain: recon, SQL injection in a custom WordPress plugin, credentials in a draft post, Joomla admin, PHP shell upload via eXtplorer, a www-data shell on the host (outside Docker), a SUID stack buffer overflow in /bin/lcars, root. The key trap: there are two different www-data shells. One is in a Docker container (WordPress/Joomla), the other is on the real host (via Apache on 443). Root only comes from the second one. ...

Overview Machine author: NoobHacker9999. IP: 10.10.10.x. Technique categories: SSRF, SSRF filter bypass, redirect-based SSRF, data exfiltration, Python pdb privesc. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 enumeration (nmap, gobuster dir + vhost) v "Upload from URL" on forge.htb -> SSRF v localhost blacklist -> bypass via a 301 redirect from your own server v access to admin.forge.htb (localhost only) -> exfil /announcements (FTP creds user:heightofsecurity123!, /upload supports ftp://) v SSRF + ftp:// scheme -> read /home/user/.ssh/id_rsa v SSH as user -> user.txt v sudo python3 /opt/remote-manage.py -> force an exception -> pdb.post_mortem -> root shell v root.txt Three concepts to take away: ...

Overview Machine author: TheCyberGeek. IP: 10.10.10.x. Recon: only port 80 is open (Werkzeug/Python 3.9.2, a Flask application). SQL injection in the login form: authentication bypass plus a dump of the main database. The admin’s MD5 hash cracks to superadministrator. Subdomain internal-administration.goodgames.htb: a Flask panel, password reuse. SSTI in the profile field: RCE, a reverse shell, root inside a Docker container. Docker escape via a shared bind-mount plus the SUID bit: root on the host. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV -sC -Pn 10.10.10.x Port 80: Werkzeug/2.0.2 Python/3.9.2, title GoodGames | Community and Store. The footer reveals the domain goodgames.htb. ...

Active machine — write-up published after retirement.

Overview Machine author: rastating. Focus: privilege escalation (misconfiguration / service abuse, and a ret2libc BOF). 1 2 3 4 5 6 7 8 9 10 recon +- leaky API /api/users/ -> crack hashes -> login as web admin v download myplace.backup (base64 -> zip) +- crack the zip password (john) -> application source -> Mongo creds v SSH as mark (password reuse) +- privesc #1 (mark -> tom): a Mongo-driven scheduler runs exec() as tom v privesc #2 (tom -> root): SUID /usr/local/bin/backup -> ret2libc BOF (plus unintended methods) Skills: API enumeration, credential reuse, service abuse through a database, SUID binary analysis (ltrace/Ghidra), ret2libc, NX + ASLR bypass, blacklist filter bypass. ...

Active machine — write-up published after retirement.

Overview Chamilo LMS 1.11.24, Ubuntu 22.04. Release: 2024-07-06. Retire: 2024-11-02. IP: 10.10.10.x. Chain: unauthenticated file upload to RCE (CVE-2023-4220), a reused Chamilo database password for the mtz system account, then a symlink-following sudo ACL script for root. Reconnaissance Port scan 1 2 nmap -p- --min-rate 10000 10.10.10.x nmap -p 22,80 -sCV 10.10.10.x Open ports: 22/tcp: OpenSSH 8.9p1 (Ubuntu 22.04 jammy) 80/tcp: Apache 2.4.52, redirects to http://permx.htb Subdomain fuzzing The server routes HTTP requests by the Host header, so fuzz subdomains: ...