Linux

Overview Machine author: Tr1s0n. IP: 10.10.10.x. Chain: forum token, escalation to admin, XXE (file / source read), Redis (session replacement), access to developers., LFI + PHP filter chain (RCE as www-data), PHP-FPM / FastCGI (pivot to victor), prototype pollution in a Node.js API (RCE as root). Reconnaissance 1 nmap -sV -sC -p- 10.10.10.x Open: 22 (SSH), 80 (HTTP). Redis (6379) is local only / password protected. 1 10.10.10.x collect.htb developers.collect.htb The vhost developers.collect.htb is protected by Basic Auth. ...

Overview Machine author: TheCyberGeek. OS: Ubuntu 18.04.3 LTS (Bionic). 1 2 3 Redis 6379 (no auth) --SAVE authorized_keys to .ssh/--> shell as redis --crack /opt/id_rsa.bak (ssh2john + john) -> computer2008--> su Matt (password reuse) --Webmin 10000, CVE-2019-12840 command injection in `u`--> root Foothold: Redis listens without authentication; abuse SAVE to write an SSH public key to /var/lib/redis/.ssh/authorized_keys, shell as redis. Lateral movement: the encrypted private key /opt/id_rsa.bak is cracked by john (password computer2008); Matt reuses that as his system password; su Matt. Privilege escalation: log into Webmin with Matt’s credentials; CVE-2019-12840 (command injection in the Package Updates module, parameter u); Webmin runs as root, so RCE as root. Reconnaissance 1 2 nmap -p- --min-rate 10000 -oA scans/nmap-alltcp 10.10.10.x nmap -p 22,80,6379,10000 -sC -sV -oA scans/nmap-tcpscripts 10.10.10.x Port Service Version Notes 22 SSH OpenSSH 7.6p1 Ubuntu standard 80 HTTP Apache 2.4.29 (Ubuntu) “under construction” page 6379 Redis Redis 4.0.9 no authentication 10000 HTTP MiniServ 1.910 (Webmin httpd) HTTPS, admin panel Port 6379 (Redis) is the obvious foothold: open to the world, no password. Port 10000 (Webmin 1.910): a specific old version, worth keeping for privesc. Webmin runs as root, so any RCE there is root. Port 80 is a dead end. Gobuster: /images /upload /css /js /fonts, nothing useful. Initial Access Redis, shell as redis Redis 4.0-5.0 with a default, open configuration allows arbitrary disk writes with the privileges of the redis process: ...

Overview Machine author: ompamo. Debian. A maze box with multiple paths at every stage. Key concepts: cookie reuse between subdomains, NSS + PostgreSQL as the backend for system accounts, command injection in a setuid wrapper, and a x64 ROP buffer overflow. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 +- XSS (contact form) --------------+ admin.redcross.htb +- SQLi -> crack charles -----------+-> reuse PHPSESSID +- guest account -> cookie ---------+ | v +- Haraka SMTP RCE ---------------+ shell as penelope + +-> user.txt +- cmd injection (iptctl) -> www-data -> PostgreSQL creds -> add a user gid=1000 | v +- gid=27 (sudo) -> sudo su ------+ (unintended) root +- unixnssroot -> uid=0 -> su ----+ (intended) +- BOF in iptctl (setuid) -> ROP -+ (BOF path) | v root.txt Reconnaissance 1 2 3 22/tcp ssh OpenSSH 7.4p1 Debian 10+deb9u3 (Debian 9 Stretch) 80/tcp http Apache 2.4.25 443/tcp ssl/http Apache 2.4.25 Script scans (-sC) hang, so there is a WAF. Run only -sV. HTTP GET / redirects (301) to https://intra.redcross.htb. Add it to /etc/hosts. Domain and directory enumeration: ...

Overview Ubuntu 20.04. IP: 10.10.10.x. Topics: SSTI (Spring Boot), log poisoning, path traversal, XXE, source code review. Chain: SSTI in the search box, shell as woodenk, credentials in the source, SSH, analysis of a root cron job (a Java jar), a four-vulnerability chain (log poisoning + path traversal + metadata-driven path injection + XXE), the root SSH key, root. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV 10.10.10.x 22/tcp: OpenSSH 8.2p1 (Ubuntu) 8080/tcp: HTTP (http-proxy) HTTP (port 8080): ...

Overview Machine author: irogir. Main skills: side-channel enumeration (timing attack), mass assignment, LFI + PHP wrappers, arbitrary file upload (timestamp brute force), git history leak, Axel .axelrc misconfiguration for arbitrary file write as root. Chain: timing attack, user enumeration, password guess, mass assignment (role=1), LFI (image.php), php://filter (source disclosure), arbitrary upload + MD5(time()) brute force, RCE, git log in a backup, password reuse, SSH as aaron, sudo netutils (axel), .axelrc default_filename, overwrite /root/.ssh/authorized_keys, SSH as root. ...