Medium

Overview StreamIO is a Windows Active Directory box (domain streamIO.htb, hostname DC) running IIS + PHP with MSSQL as the backend database. The foothold chains a UNION-based SQL injection on a streaming subdomain into credential recovery, a hidden debug parameter that exposes a local file include, and finally a remote file include that reaches a raw eval() for code execution. From there the path is pure credential reuse and Active Directory ACL abuse: database credentials pulled from the web root unlock a backup database with fresh hashes, saved Firefox logins hand over a domain user, and a WriteOwner/Owns edge over a group with ReadLAPSPassword lets us read the LAPS-managed local administrator password and log in as administrator. ...

Overview Machine author: irogir. Main skills: side-channel enumeration (timing attack), mass assignment, LFI + PHP wrappers, arbitrary file upload (timestamp brute force), git history leak, Axel .axelrc misconfiguration for arbitrary file write as root. Chain: timing attack, user enumeration, password guess, mass assignment (role=1), LFI (image.php), php://filter (source disclosure), arbitrary upload + MD5(time()) brute force, RCE, git log in a backup, password reuse, SSH as aaron, sudo netutils (axel), .axelrc default_filename, overwrite /root/.ssh/authorized_keys, SSH as root. ...

Overview Machine author: NoobHacker9999. IP: 10.10.10.x. Technique categories: SSRF, SSRF filter bypass, redirect-based SSRF, data exfiltration, Python pdb privesc. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 enumeration (nmap, gobuster dir + vhost) v "Upload from URL" on forge.htb -> SSRF v localhost blacklist -> bypass via a 301 redirect from your own server v access to admin.forge.htb (localhost only) -> exfil /announcements (FTP creds user:heightofsecurity123!, /upload supports ftp://) v SSRF + ftp:// scheme -> read /home/user/.ssh/id_rsa v SSH as user -> user.txt v sudo python3 /opt/remote-manage.py -> force an exception -> pdb.post_mortem -> root shell v root.txt Three concepts to take away: ...

Overview Windows Server 2019 (Build 10.0.17763). Attacker IP (tun0): 10.10.14.x. Key techniques: LFI/RFI, PHP session poisoning, blacklist bypass, PSCredential lateral movement, malicious CHM, Net-NTLMv2 capture and crack. 1 2 3 4 5 6 7 8 9 10 11 12 nmap -> IIS + PHP +- LFI in ?lang= (blog) +- read the PHP session file (C:\Windows\TEMP\sess_<PHPSESSID>) +- PHP session poisoning: PHP code in the "username" field +- RCE as NT AUTHORITY\IUSR +- download nc64.exe -> reverse shell (IUSR) +- db.php -> MySQL password 36mEAhz/B8xQ~2VM +- password reuse -> PSCredential -> shell as SNIPER\chris (user flag) +- malicious .chm in C:\Docs (opened by the admin) +- Responder captures the admin Net-NTLMv2 +- hashcat -m 5600 -> butterfly!#1 +- PSCredential -> shell as Administrator (root flag) Reconnaissance 1 2 3 4 5 # 1) fast sweep of all ports ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) # 2) service/script scan on open ports only nmap -p$ports -sC -sV 10.10.10.x Result: Windows, IIS, a PHP server. The “Sniper Co.” site has a login page and a blog. ...

Overview Craft is a medium-difficulty Linux box built around a beer-catalog REST API. The intended path is almost entirely source-review driven: a self-hosted Gogs instance leaks API credentials and the API source, the source reveals a Python eval() injection in the brew endpoint, and code execution drops us into the API container as root. From there the database yields reusable credentials, one of which unlocks a private Gogs repo holding an SSH key. Finally, the box uses HashiCorp Vault’s SSH secrets engine to broker root logins, and a leftover root-capable Vault token lets us mint a one-time password and SSH straight in as root. ...

Overview Machine author: ompamo. Debian. A maze box with multiple paths at every stage. Key concepts: cookie reuse between subdomains, NSS + PostgreSQL as the backend for system accounts, command injection in a setuid wrapper, and a x64 ROP buffer overflow. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 +- XSS (contact form) --------------+ admin.redcross.htb +- SQLi -> crack charles -----------+-> reuse PHPSESSID +- guest account -> cookie ---------+ | v +- Haraka SMTP RCE ---------------+ shell as penelope + +-> user.txt +- cmd injection (iptctl) -> www-data -> PostgreSQL creds -> add a user gid=1000 | v +- gid=27 (sudo) -> sudo su ------+ (unintended) root +- unixnssroot -> uid=0 -> su ----+ (intended) +- BOF in iptctl (setuid) -> ROP -+ (BOF path) | v root.txt Reconnaissance 1 2 3 22/tcp ssh OpenSSH 7.4p1 Debian 10+deb9u3 (Debian 9 Stretch) 80/tcp http Apache 2.4.25 443/tcp ssl/http Apache 2.4.25 Script scans (-sC) hang, so there is a WAF. Run only -sV. HTTP GET / redirects (301) to https://intra.redcross.htb. Add it to /etc/hosts. Domain and directory enumeration: ...

Overview Machine author: rastating. Focus: privilege escalation (misconfiguration / service abuse, and a ret2libc BOF). 1 2 3 4 5 6 7 8 9 10 recon +- leaky API /api/users/ -> crack hashes -> login as web admin v download myplace.backup (base64 -> zip) +- crack the zip password (john) -> application source -> Mongo creds v SSH as mark (password reuse) +- privesc #1 (mark -> tom): a Mongo-driven scheduler runs exec() as tom v privesc #2 (tom -> root): SUID /usr/local/bin/backup -> ret2libc BOF (plus unintended methods) Skills: API enumeration, credential reuse, service abuse through a database, SUID binary analysis (ltrace/Ghidra), ret2libc, NX + ASLR bypass, blacklist filter bypass. ...