Friendzone

Tags: #Linux #Enumeration #LFI #SMB #DNS #CronAbuse #PathHijacking

Friendzone is an easy-rated Linux machine from HackTheBox, created by Creator askar. In the current post, my IP is 10.10.14.24, and the target IP is 10.129.191.183.

Friendzone is like those easy boxes that are challenging. At the start, it has a lot of noise and rabbit holes, wasting your time. The good thing about this machine, is it's a mix of many techniques and stuff, checking SMB, doing an LFI, inject a php file, etc. It's a funny machine.

Gathering Information

The first steps are about getting basic information about the target, by using nmap and searching information from the website.

Local Terminal
$ ping -c 1 10.129.191.183

Pinging 10.129.191.183 with 32 bytes of data:
Reply from 10.129.191.183: bytes=32 time=176ms TTL=63
Reply from 10.129.191.183: bytes=32 time=188ms TTL=63
Reply from 10.129.191.183: bytes=32 time=233ms TTL=63
Reply from 10.129.191.183: bytes=32 time=168ms TTL=63

Ping statistics for 10.129.191.183:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 168ms, Maximum = 233ms, Average = 191ms

By the TTL, we can assume that is a Linux Machine.

Local Terminal
$nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.191.183 --oG Ports

Nmap scan report for 10.129.191.183
Host is up, received echo-reply ttl 63 (0.79s latency).
Scanned at 2023-05-24 09:42:09 Pacific SA Standard Time for 25s
Not shown: 39993 closed tcp ports (reset), 25535 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT    STATE SERVICE      REASON
21/tcp  open  ftp          syn-ack ttl 63
22/tcp  open  ssh          syn-ack ttl 63
53/tcp  open  domain       syn-ack ttl 63
80/tcp  open  http         syn-ack ttl 63
139/tcp open  netbios-ssn  syn-ack ttl 63
443/tcp open  https        syn-ack ttl 63
445/tcp open  microsoft-ds syn-ack ttl 63

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 25.41 seconds
           Raw packets sent: 106042 (4.666MB) | Rcvd: 42746 (1.710MB)

It has the FTP port 21 service working, we are going to check if has the user anonymous

It doesn't work, and the services https at the port 443, can provide information by using the command openSSL

There is an email (haha@friendzone.red) and a domain (CN = friendzone.red), to avoid public IPs, we need to add it to /etc/hosts

Now, we are going to get information using whatweb to view the Content Manager

New email added {info@friendzoneportal.red} and thanks to it, another domain {friendzoneportal.red}, remember to add it in /etc/hosts. If you are using Windows, use vi C:\Windows\System32\drivers\etc\hosts

  • Browser: http://10.129.191.183

At first sight, there is nothing, let's check with CTLR+U

  • Browser: https://10.129.181.183

It looks like a dead end, but still, we have two domains to test,

  • Browser: https://friendzone.red

There is a hint in this image, let's go to https://friendzone.red/js/js

It changes always, uses base64, but if you decode that you will get nothing.

So, we got nothing, let's check the nmap information again and test with other channels.

The important information comes from the disk with permissions.

Go where you downloaded the creds.txt files and read the document

Valid, but nothing change

Now, we are going to abuse to the service at the port 53, to make a Zone Transference Attack.

Login with the credentials admin:WORKWORKHhallelujah@#

We can see that the website respond to the parameter timestamp, by adding a .php at the end. Thanks to SMB we find a folder called Development that we can read and write, this sounds weird but there is a chance that by creating a file and test something will happen.

  • Browser: https://administrator1.friendzone.red/dashboard.php?image_id=a.jpg&pagename=../../../../../../etc/Development/test

It works!

Ok, with this information at our hand, we know that we can create a reverse shell

Now to work better, you need to do a Bash Upgrade.

Always, configuration files like "mysql_data.conf" are worth to check

Credentials in plain text!

And it works.

[Friend]

Privileges Escalation

While looking around the target, I found an interesting file in /opt/server_admin/

As you can see, the package "os" is executed from python and by root and we have write permission.

And now wait until the task reporter.py runs again.

PreviousForestNextHaystack

Last updated