search

Academy

#Linux #Enumeration #Laravel #UserPivoting

Academy is an easy-rated Linux machine from HackTheBoxarrow-up-right, created by egre55 and mrb3n. In the current post, my IP is 10.10.14.44, and the target IP is 10.129.167.56

This machine features an apache server hosting a PHP website. The website doesn't look special until you intercept the registration process, where you can change a obvious parameter to change your privileges to that account, then when you fuzz the website, you find an admin login url. In that URL there is an sub-domain with error logs from Laravel, revealing in the process the API_KEY used for an exploit for RCE. Inside the machine, there are a lot of techniques used to pivot between users and the change your user to root.

hashtag
Recon

The first steps are about getting basic information about the target, by using nmap and searching information from the website.

Local Terminal
$ ping -c 1 10.129.167.56

Pinging 10.129.167.56 with 32 bytes of data:
Reply from 10.129.167.56: bytes=32 time=141ms TTL=63
Reply from 10.129.167.56: bytes=32 time=173ms TTL=63
Reply from 10.129.167.56: bytes=32 time=142ms TTL=63
Reply from 10.129.167.56: bytes=32 time=144ms TTL=63

Ping statistics for 10.129.167.56:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 141ms, Maximum = 173ms, Average = 150ms

By the TTL, we can assume that is a Linux Machine.

Local Terminal
$ nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.167.56 -oN Ports

Nmap scan report for 10.129.167.56
Host is up, received reset ttl 63 (0.16s latency).
Scanned at 2023-06-06 10:37:16 Pacific SA Standard Time for 16s
Not shown: 65283 closed tcp ports (reset), 249 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE REASON
22/tcp    open  ssh     syn-ack ttl 63
80/tcp    open  http    syn-ack ttl 63
33060/tcp open  mysqlx  syn-ack ttl 63

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 16.10 seconds
           Raw packets sent: 76803 (3.379MB) | Rcvd: 74737 (2.990MB)

If you search for "OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 launchpad", you can find the specific machine type, in this case the result was: "Ubuntu Focal". It could be useful to find an vulnerability for a certain version.

Information that we have now: It's a website (port 80) that use Apache/2.4.41, with an open mysqlx (port 33060), there is no response for now.

Because of the following message "Did not follow redirect to http://academy.htb/" we have to add the IP to /etc/hosts/

If you go to Login, the URL is "http://academy.htb/login.phparrow-up-right", this is a good opportunity to fuzz with php termination.

  • Index.php: Nothing

  • login.php: useful after registration.

  • admin.php: Admin login panel, it could be useful.

  • home.php: Redirect to login.php

  • register.php: Registration form.

  • config.php: 403, Empty

Our alternatives now is to intercept the registration panel with burpsuite.

Interception result

hashtag
Exploitation

At the response, we can see that between the parameters, there is a "roleid", before we found an admin.php.

So, our best action is to change the roleid to 1 and create a new account.

Send this

Then, go to http://academy.htb/admin.php and login with the new user... after this, you will see the following thing:

Hey! There is a subdomain, add it to /etc/hosts.

hashtag
Reverse Shell [www-data]

The website shows a Laravel error, maybe it could be vulnerable to something, search it at exploit-db.com. I tried the CVE-2021-3129arrow-up-right but it doesn't work. And the CVE-2018-15133arrow-up-right requieres metasploit, but there are alternatives at github.

LogoGitHub - aljavier/exploit_laravel_cve-2018-15133: Exploit for Laravel Remote Code Execution with API_KEY (CVE-2018-15133)GitHubchevron-right

The structure of the command is the following:

API_key location

Now, open a new local terminal

And you are in! Close the CVE Interactive Terminal and do a Bash Upgrade at the other terminal

hashtag
User Pivoting [cry0l1t3]

There is an interesting hidden file called .env, type cat .env

Now we can test that password with other users, we can enumerate them at /home

After testing with each { $user : mySup3rP4s5w0rd!! } the correct one is cry0l1t3

hashtag
User Pivoting [mrb3n]

The user is from the group adm, maybe we can use an specific command or read some logs.

Usually the logs located at /var/log/audit/ are important, but they have a LOT of information, a good alternative is to use "grep" to find relevant data.

From here, we want a hash like "2F7573722F62696E2F656469746F72202D2D202F" between cmd= and Terminal=, to apply xxd -ps -r

Nothing here, now we will tesst with uid=1000

But there is another interesting rows, the ones that contain "TYPE=tty" and "data="

hashtag
Privileges Escalation

At GTFOBin there is a way to escalate privileges with sudo using composer

Logocomposer | GTFOBinsgtfobins.github.iochevron-right
PreviousEasy MachineNextBashed

Last updated