Academy
#Linux #Enumeration #Laravel #UserPivoting
Academy is an easy-rated Linux machine from HackTheBox, created by egre55 and mrb3n. In the current post, my IP is 10.10.14.44, and the target IP is 10.129.167.56
This machine features an apache server hosting a PHP website. The website doesn't look special until you intercept the registration process, where you can change a obvious parameter to change your privileges to that account, then when you fuzz the website, you find an admin login url. In that URL there is an sub-domain with error logs from Laravel, revealing in the process the API_KEY used for an exploit for RCE. Inside the machine, there are a lot of techniques used to pivot between users and the change your user to root.
Recon
The first steps are about getting basic information about the target, by using nmap and searching information from the website.
$ ping -c 1 10.129.167.56
Pinging 10.129.167.56 with 32 bytes of data:
Reply from 10.129.167.56: bytes=32 time=141ms TTL=63
Reply from 10.129.167.56: bytes=32 time=173ms TTL=63
Reply from 10.129.167.56: bytes=32 time=142ms TTL=63
Reply from 10.129.167.56: bytes=32 time=144ms TTL=63
Ping statistics for 10.129.167.56:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 141ms, Maximum = 173ms, Average = 150msBy the TTL, we can assume that is a Linux Machine.
$ nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.167.56 -oN Ports
Nmap scan report for 10.129.167.56
Host is up, received reset ttl 63 (0.16s latency).
Scanned at 2023-06-06 10:37:16 Pacific SA Standard Time for 16s
Not shown: 65283 closed tcp ports (reset), 249 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63
33060/tcp open mysqlx syn-ack ttl 63
Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 16.10 seconds
Raw packets sent: 76803 (3.379MB) | Rcvd: 74737 (2.990MB)If you search for "OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 launchpad", you can find the specific machine type, in this case the result was: "Ubuntu Focal". It could be useful to find an vulnerability for a certain version.
Information that we have now: It's a website (port 80) that use Apache/2.4.41, with an open mysqlx (port 33060), there is no response for now.
Because of the following message "Did not follow redirect to http://academy.htb/" we have to add the IP to /etc/hosts/
Browser: http://academy.htb/
If you go to Login, the URL is "http://academy.htb/login.php", this is a good opportunity to fuzz with php termination.
Index.php: Nothing
login.php: useful after registration.
admin.php: Admin login panel, it could be useful.
home.php: Redirect to login.php
register.php: Registration form.
config.php: 403, Empty
Our alternatives now is to intercept the registration panel with burpsuite.
Exploitation
At the response, we can see that between the parameters, there is a "roleid", before we found an admin.php.
So, our best action is to change the roleid to 1 and create a new account.
Then, go to http://academy.htb/admin.php and login with the new user... after this, you will see the following thing:
Hey! There is a subdomain, add it to /etc/hosts.
Reverse Shell [www-data]
The website shows a Laravel error, maybe it could be vulnerable to something, search it at exploit-db.com. I tried the CVE-2021-3129 but it doesn't work. And the CVE-2018-15133 requieres metasploit, but there are alternatives at github.
The structure of the command is the following:
Now, open a new local terminal
And you are in! Close the CVE Interactive Terminal and do a Bash Upgrade at the other terminal
User Pivoting [cry0l1t3]
There is an interesting hidden file called .env, type cat .env
Now we can test that password with other users, we can enumerate them at /home
After testing with each { $user : mySup3rP4s5w0rd!! } the correct one is cry0l1t3
User Pivoting [mrb3n]
The user is from the group adm, maybe we can use an specific command or read some logs.
Usually the logs located at /var/log/audit/ are important, but they have a LOT of information, a good alternative is to use "grep" to find relevant data.
From here, we want a hash like "2F7573722F62696E2F656469746F72202D2D202F" between cmd= and Terminal=, to apply xxd -ps -r
Nothing here, now we will tesst with uid=1000
But there is another interesting rows, the ones that contain "TYPE=tty" and "data="
Privileges Escalation
At GTFOBin there is a way to escalate privileges with sudo using composer
Last updated