search

Topology

#Linux #Enumeration #

This is a easy difficulty Linux machine from HackTheBox arrow-up-rightcreated by gedsic. In this scenario, my IP is 10.10.14.71 and the target’s IP is 10.129.151.145

hashtag
Recon

The first steps are about getting basic information about the target, by using nmap and searching information from the website.

Local Terminal
$ ping -c 1 10.129.151.145

PING 10.129.151.145 (10.129.151.145) 56(84) bytes of data.
64 bytes from 10.129.151.145: icmp_seq=1 ttl=62 time=174 ms

--- 10.129.151.145 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 174.093/174.093/174.093/0.000 ms

The machine is alive, and by the TTL (close to 64) we can assume and confirm that is definitely a Linux Machine

Local Terminal
nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.151.145 -oG AllPorts
Completed SYN Stealth Scan at 16:03, 26.39s elapsed (65535 total ports)
Nmap scan report for 10.129.151.145
Host is up, received reset ttl 62 (0.0029s latency).
Scanned at 2023-07-05 16:03:03 UTC for 26s
Not shown: 65532 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT    STATE SERVICE REASON
22/tcp  open  ssh     syn-ack ttl 62
80/tcp  open  http    syn-ack ttl 62
443/tcp open  https   syn-ack ttl 62

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 26.63 seconds
           Raw packets sent: 131091 (5.768MB) | Rcvd: 5122 (204.880KB)

By searching "OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 launchpad" you can conclude that is a Ubuntu-Focal machine, this is good to know in some targets just in case that there is an specific Linux exploit.

There is an email, save that information. { lklein@topology.htb }

By hovering, there is just one interesting link at "LaTeX Equation Generatorarrow-up-right"

Not found, the new domain to /etc/hosts as "10.129.151.145 latex.topology.htb topology.htb" before going again.

Looks like a perfect place for LaTeX injection

But first, check if you can explore more from latex.topology.htb

We can explore the whole site, but there is nothing interesting.

hashtag
Exploit

Search for "LaTeX Injection Exploit" and return to http://latex.topology.htb/equation.phparrow-up-right

LogoPayloadsAllTheThings/LaTeX Injection at master · swisskyrepo/PayloadsAllTheThingsGitHubchevron-right
LogoPage not found - HackTricksbook.hacktricks.xyzchevron-right
Inject the basic payload
But it does not work

Maybe it has some validation... let's search for different way to execute commands.

  • \include{password} Fail

  • \lstinputlisting{/etc/passwd} Fail

  • $\include{password}$ Fail

  • $\lstinputlisting{/etc/passwd}$

It works, now we need a way to execute commands

hashtag
Reverse Shell [vdaisley]

All right, we can read files, but we can't execute commands, at this point the best option is to search for information about the target and see if you can read some files that store passwords.

For "Apache/2.4.41" it's htpasswd located at /var/www/html/, try $\lstinputlisting{/var/www/html/.htpasswd}$ it fails... what about dev? try: $\lstinputlisting{/var/www/dev/.htpasswd}$

It works! {vdaisley : $apr1$1ONUB/S2$58eeNVirnRDB5zAIbIxTY0}

Let's use John to crack the password

Now with the password, we can try login through ssh {vdaisley : calculus20}

hashtag
Privilege Escalation [vdaisley > root]

We are inside the machine, now we want to change to root.

Scouting process:

Nothing suspicious, an alternative here is to search using pspy.

LogoGitHub - DominicBreuker/pspy: Monitor linux processes without root permissionsGitHubchevron-right

Open an http.server and then download pspy from the target. Then execute the file.

That fragment looks pretty interesting... let's check what's inside.

We can't see anything inside, but from pspy we know that is executing something, search for exploits.

https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/gnuplot-privilege-escalation/exploit-notes.hdks.orgchevron-right

After creating our payload, we are going to move it to /opt/gnuplot, why? because of the following line from pspy64.

And now we wait...

PreviousSauNextMedium Machine

Last updated