Writeups

Overview Timelapse is an Easy Active Directory box built around a single domain controller (DC01, domain timelapse.htb). The entry point is an anonymously readable SMB share that stores a backup zip containing a PFX certificate bundle. The zip and the PFX inside it are both password protected, but both fall quickly to john against rockyou.txt. Once the certificate and private key are extracted, they authenticate to WinRM over TLS as legacyy, which owns the user flag. ...

Overview Machine author: TheCyberGeek. IP: 10.10.10.x. Recon: only port 80 is open (Werkzeug/Python 3.9.2, a Flask application). SQL injection in the login form: authentication bypass plus a dump of the main database. The admin’s MD5 hash cracks to superadministrator. Subdomain internal-administration.goodgames.htb: a Flask panel, password reuse. SSTI in the profile field: RCE, a reverse shell, root inside a Docker container. Docker escape via a shared bind-mount plus the SUID bit: root on the host. Reconnaissance 1 2 ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sV -sC -Pn 10.10.10.x Port 80: Werkzeug/2.0.2 Python/3.9.2, title GoodGames | Community and Store. The footer reveals the domain goodgames.htb. ...

Overview Machine author: irogir. Main skills: side-channel enumeration (timing attack), mass assignment, LFI + PHP wrappers, arbitrary file upload (timestamp brute force), git history leak, Axel .axelrc misconfiguration for arbitrary file write as root. Chain: timing attack, user enumeration, password guess, mass assignment (role=1), LFI (image.php), php://filter (source disclosure), arbitrary upload + MD5(time()) brute force, RCE, git log in a backup, password reuse, SSH as aaron, sudo netutils (axel), .axelrc default_filename, overwrite /root/.ssh/authorized_keys, SSH as root. ...

Overview Machine author: NoobHacker9999. IP: 10.10.10.x. Technique categories: SSRF, SSRF filter bypass, redirect-based SSRF, data exfiltration, Python pdb privesc. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 enumeration (nmap, gobuster dir + vhost) v "Upload from URL" on forge.htb -> SSRF v localhost blacklist -> bypass via a 301 redirect from your own server v access to admin.forge.htb (localhost only) -> exfil /announcements (FTP creds user:heightofsecurity123!, /upload supports ftp://) v SSRF + ftp:// scheme -> read /home/user/.ssh/id_rsa v SSH as user -> user.txt v sudo python3 /opt/remote-manage.py -> force an exception -> pdb.post_mortem -> root shell v root.txt Three concepts to take away: ...

Overview Machine author: TheCyberGeek. OS: Ubuntu 18.04.3 LTS (Bionic). 1 2 3 Redis 6379 (no auth) --SAVE authorized_keys to .ssh/--> shell as redis --crack /opt/id_rsa.bak (ssh2john + john) -> computer2008--> su Matt (password reuse) --Webmin 10000, CVE-2019-12840 command injection in `u`--> root Foothold: Redis listens without authentication; abuse SAVE to write an SSH public key to /var/lib/redis/.ssh/authorized_keys, shell as redis. Lateral movement: the encrypted private key /opt/id_rsa.bak is cracked by john (password computer2008); Matt reuses that as his system password; su Matt. Privilege escalation: log into Webmin with Matt’s credentials; CVE-2019-12840 (command injection in the Package Updates module, parameter u); Webmin runs as root, so RCE as root. Reconnaissance 1 2 nmap -p- --min-rate 10000 -oA scans/nmap-alltcp 10.10.10.x nmap -p 22,80,6379,10000 -sC -sV -oA scans/nmap-tcpscripts 10.10.10.x Port Service Version Notes 22 SSH OpenSSH 7.6p1 Ubuntu standard 80 HTTP Apache 2.4.29 (Ubuntu) “under construction” page 6379 Redis Redis 4.0.9 no authentication 10000 HTTP MiniServ 1.910 (Webmin httpd) HTTPS, admin panel Port 6379 (Redis) is the obvious foothold: open to the world, no password. Port 10000 (Webmin 1.910): a specific old version, worth keeping for privesc. Webmin runs as root, so any RCE there is root. Port 80 is a dead end. Gobuster: /images /upload /css /js /fonts, nothing useful. Initial Access Redis, shell as redis Redis 4.0-5.0 with a default, open configuration allows arbitrary disk writes with the privileges of the redis process: ...

Overview Windows Server 2019 (Build 10.0.17763). Attacker IP (tun0): 10.10.14.x. Key techniques: LFI/RFI, PHP session poisoning, blacklist bypass, PSCredential lateral movement, malicious CHM, Net-NTLMv2 capture and crack. 1 2 3 4 5 6 7 8 9 10 11 12 nmap -> IIS + PHP +- LFI in ?lang= (blog) +- read the PHP session file (C:\Windows\TEMP\sess_<PHPSESSID>) +- PHP session poisoning: PHP code in the "username" field +- RCE as NT AUTHORITY\IUSR +- download nc64.exe -> reverse shell (IUSR) +- db.php -> MySQL password 36mEAhz/B8xQ~2VM +- password reuse -> PSCredential -> shell as SNIPER\chris (user flag) +- malicious .chm in C:\Docs (opened by the admin) +- Responder captures the admin Net-NTLMv2 +- hashcat -m 5600 -> butterfly!#1 +- PSCredential -> shell as Administrator (root flag) Reconnaissance 1 2 3 4 5 # 1) fast sweep of all ports ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) # 2) service/script scan on open ports only nmap -p$ports -sC -sV 10.10.10.x Result: Windows, IIS, a PHP server. The “Sniper Co.” site has a login page and a blog. ...

Overview Craft is a medium-difficulty Linux box built around a beer-catalog REST API. The intended path is almost entirely source-review driven: a self-hosted Gogs instance leaks API credentials and the API source, the source reveals a Python eval() injection in the brew endpoint, and code execution drops us into the API container as root. From there the database yields reusable credentials, one of which unlocks a private Gogs repo holding an SSH key. Finally, the box uses HashiCorp Vault’s SSH secrets engine to broker root logins, and a leftover root-capable Vault token lets us mint a one-time password and SSH straight in as root. ...

Overview Machine author: ompamo. Debian. A maze box with multiple paths at every stage. Key concepts: cookie reuse between subdomains, NSS + PostgreSQL as the backend for system accounts, command injection in a setuid wrapper, and a x64 ROP buffer overflow. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 +- XSS (contact form) --------------+ admin.redcross.htb +- SQLi -> crack charles -----------+-> reuse PHPSESSID +- guest account -> cookie ---------+ | v +- Haraka SMTP RCE ---------------+ shell as penelope + +-> user.txt +- cmd injection (iptctl) -> www-data -> PostgreSQL creds -> add a user gid=1000 | v +- gid=27 (sudo) -> sudo su ------+ (unintended) root +- unixnssroot -> uid=0 -> su ----+ (intended) +- BOF in iptctl (setuid) -> ROP -+ (BOF path) | v root.txt Reconnaissance 1 2 3 22/tcp ssh OpenSSH 7.4p1 Debian 10+deb9u3 (Debian 9 Stretch) 80/tcp http Apache 2.4.25 443/tcp ssl/http Apache 2.4.25 Script scans (-sC) hang, so there is a WAF. Run only -sV. HTTP GET / redirects (301) to https://intra.redcross.htb. Add it to /etc/hosts. Domain and directory enumeration: ...

Overview Machine author: TheHermit. Host: Ubuntu, with Docker containers (Debian 8 Jessie). Theme: Star Trek: The Next Generation. Chain: recon, SQL injection in a custom WordPress plugin, credentials in a draft post, Joomla admin, PHP shell upload via eXtplorer, a www-data shell on the host (outside Docker), a SUID stack buffer overflow in /bin/lcars, root. The key trap: there are two different www-data shells. One is in a Docker container (WordPress/Joomla), the other is on the real host (via Apache on 443). Root only comes from the second one. ...

Overview Machine author: rastating. Focus: privilege escalation (misconfiguration / service abuse, and a ret2libc BOF). 1 2 3 4 5 6 7 8 9 10 recon +- leaky API /api/users/ -> crack hashes -> login as web admin v download myplace.backup (base64 -> zip) +- crack the zip password (john) -> application source -> Mongo creds v SSH as mark (password reuse) +- privesc #1 (mark -> tom): a Mongo-driven scheduler runs exec() as tom v privesc #2 (tom -> root): SUID /usr/local/bin/backup -> ret2libc BOF (plus unintended methods) Skills: API enumeration, credential reuse, service abuse through a database, SUID binary analysis (ltrace/Ghidra), ret2libc, NX + ASLR bypass, blacklist filter bypass. ...